Release osbuild-composer-165.1-3.el10_2.2 ALSA-2026:65895

osbuild-composer security update
Severity: Important
Description
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)
* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)
* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)
* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
* net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
* net/[http:](http:) golang: Go net/[http:](http:) Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
* html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
* encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected packages:
osbuild-composer-165.1-3.el10_2.2.x86_64
osbuild-composer-core-165.1-3.el10_2.2.x86_64
osbuild-composer-worker-165.1-3.el10_2.2.x86_64
osbuild-composer-165.1-3.el10_2.2.s390x
osbuild-composer-core-165.1-3.el10_2.2.s390x
osbuild-composer-worker-165.1-3.el10_2.2.s390x
osbuild-composer-165.1-3.el10_2.2.ppc64le
osbuild-composer-core-165.1-3.el10_2.2.ppc64le
osbuild-composer-worker-165.1-3.el10_2.2.ppc64le
osbuild-composer-165.1-3.el10_2.2.aarch64
osbuild-composer-core-165.1-3.el10_2.2.aarch64
osbuild-composer-worker-165.1-3.el10_2.2.aarch64
osbuild-composer-165.1-3.el10_2.2.x86_64_v2
osbuild-composer-core-165.1-3.el10_2.2.x86_64_v2
osbuild-composer-worker-165.1-3.el10_2.2.x86_64_v2