[CLSA-2026:1789486639] osbuild-composer: Fix of CVE-2026-27136
Type:
security
Severity:
Important
Release date:
2026-09-15 15:37:28 UTC
Description:
- CVE-2026-27136: fix XSS via duplicate attributes mis-parsed by the vendored golang.org/x/net/html tokenizer, which could be leveraged to bypass HTML sanitization
CVEs fixed:
Updated packages:
  • osbuild-composer-76-2.el9_2.2.alma.tuxcare.els8.x86_64.rpm
    sha:2e2d60dfbffa617c3055c42a755451f37f2cba94ce66ea6ada4c07d8f8470fa3
  • osbuild-composer-core-76-2.el9_2.2.alma.tuxcare.els8.x86_64.rpm
    sha:9fda5c696612b974045853f221523271e300a845311ffb62020e0ca6a11b3822
  • osbuild-composer-dnf-json-76-2.el9_2.2.alma.tuxcare.els8.x86_64.rpm
    sha:d59ecb447ca63c8dc710b22c117fc6efa3427c48108b2e0ab69a4cde4a28fcbc
  • osbuild-composer-tests-76-2.el9_2.2.alma.tuxcare.els8.x86_64.rpm
    sha:753031a4ad378d614d8164399e8ef433303560a1f2320eb001c6484a9698f257
  • osbuild-composer-worker-76-2.el9_2.2.alma.tuxcare.els8.x86_64.rpm
    sha:6291595f733c0b34a86e0feb3575cf42ee8212e7220fea4365faf1b2054e6c9a
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.