osbuild-composer security update

101.5-3.0.1 - go.mod: update github.com/labstack/echo/v4 to v4.15.3 Resolves: RHEL-213908 - go.mod: update go.opentelemetry.io/otel to v1.44.0 Resolves: RHEL-239503 - Rebuild against updated golang Resolves: RHEL-177172, RHEL-234031, RHEL-251840, RHEL-251061 - Fix CVE-2025-22866 CVE-2026-32281...

ROOT-APP-GOBINARY-CVE-2026-55677 CVE-2026-55677 in github.com/labstack/echo/v4 - Patched by Root

Root has patched CVE-2026-55677 in the github.com/labstack/echo/v4 package for Root:Go. Multiple fixed versions available...

CLEANSTART-2026-VM28699 Security fixes in temporal 1.8.2-r1

Package temporal version 1.8.2-r1 fixes 1 vulnerabilities: CVE-2026-55677...

RHEL 9 : osbuild-composer (RHSA-2026:57541)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57541 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...

CVE-2026-55677

creationtimestamp| type| source ---|---|--- 2026-06-26 18:24:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7kwlsngg2x...

CVE-2026-55677

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path preserving %2F as-is, while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an...