THREATIST.IORead the docs osbuild-composer security update
Released 2026-05-20 · Red Hat rating Important · View on Red Hat →
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources.
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service.
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.