CLSA-2026-1781004077
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1781004077.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1781004077
- Upstream
- Published
- 2026-06-09T11:23:12Z
- Modified
- 2026-10-26T09:31:06Z
- Summary
- osbuild-composer: Fix of 5 CVEs
- Details
-
- rebuild with newer golang 1.25.7-1.el9_6.tuxcare.els5 to fix the following CVEs
- CVE-2026-32280: fix denial-of-service in crypto/x509 certificate chain building with a large number of intermediate certificates
- CVE-2026-32282: fix TOCTOU symlink race in os.Root.Chmod on Linux
- CVE-2026-32283: fix TLS 1.3 connection deadlock when multiple key update messages arrive in a single record
- CVE-2026-32286: fix panic on negative DataRow field length in vendored jackc/pgproto3
- CVE-2026-34986: fix panic on JWE decryption with key-wrapping algorithms in vendored go-jose
- rebuild with newer golang 1.25.7-1.el9_6.tuxcare.els5 to fix the following CVEs
- References
-
- https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1781004077.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-32280
- https://nvd.nist.gov/vuln/detail/CVE-2026-32282
- https://nvd.nist.gov/vuln/detail/CVE-2026-32283
- https://nvd.nist.gov/vuln/detail/CVE-2026-32286
- https://nvd.nist.gov/vuln/detail/CVE-2026-34986
Affected packages
TuxCare:AlmaLinux:9.6 / osbuild-composer
Package
- Name
- osbuild-composer
- Purl
- pkg:rpm/tuxcare/osbuild-composer?distro=almalinux-9.6
TuxCare:AlmaLinux:9.6 / osbuild-composer-core
Package
- Name
- osbuild-composer-core
- Purl
- pkg:rpm/tuxcare/osbuild-composer-core?distro=almalinux-9.6
TuxCare:AlmaLinux:9.6 / osbuild-composer-tests
Package
- Name
- osbuild-composer-tests
- Purl
- pkg:rpm/tuxcare/osbuild-composer-tests?distro=almalinux-9.6