EUVD-2026-71774

A flaw was found in Flatpak. A Time-of-check to time-of-use TOCTOU race condition exists in the org.freedesktop.Flatpak.SystemHelper component. This vulnerability occurs because a privileged chmod operation executes before the OSTree repository validation within the Deploy function. An attacker c...

CVE-2026-76925

A flaw was found in Flatpak. A Time-of-check to time-of-use TOCTOU race condition exists in the org.freedesktop.Flatpak.SystemHelper component. This vulnerability occurs because a privileged chmod operation executes before the OSTree repository validation within the Deploy function. An attacker c...

RHSA-2026:55435 Red Hat Security Advisory: gstreamer1-plugins-ugly-free security update

Bulletin has no description...

AZL-95625 CVE-2026-70622 affecting package rpm-ostree 2024.4-11

tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::appenddirall function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrust...

OESA-2026-3013 rpm-ostree security update

rpm-ostree is a hybrid image/package system. It supports "composing" packages on a build server into an OSTree repository, which can then be replicated by client systems with atomic upgrades. Additionally, unlike many "pure" image systems, with rpm-ostree each client system can layer on additiona...

OESA-2026-2944 rpm-ostree security update

rpm-ostree is a hybrid image/package system. It supports "composing" packages on a build server into an OSTree repository, which can then be replicated by client systems with atomic upgrades. Additionally, unlike many "pure" image systems, with rpm-ostree each client system can layer on additiona...

OESA-2026-2945 rpm-ostree security update

rpm-ostree is a hybrid image/package system. It supports "composing" packages on a build server into an OSTree repository, which can then be replicated by client systems with atomic upgrades. Additionally, unlike many "pure" image systems, with rpm-ostree each client system can layer on additiona...

RLSA-2026:1838 Moderate: image-builder security update

A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fixes: golang: archive/tar: Unbounded allocation when parsing GNU sparse map CVE-2025-58183 For more details about the security issues, including the impact, a CVSS scor...

CVE-2026-33055 affecting package rpm-ostree for versions less than 2024.4-10

CVE-2026-33055 affecting package rpm-ostree for versions less than 2024.4-10. A patched version of the package is available...

CVE-2026-33056 affecting package rpm-ostree for versions less than 2024.4-10

CVE-2026-33056 affecting package rpm-ostree for versions less than 2024.4-10. A patched version of the package is available...

ALSA-2026:13642 Important: image-builder security update

A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 For more details about the security issues, including the impact, a CVSS score,...

CVE-2025-58160 affecting package rpm-ostree for versions less than 2024.4-8

CVE-2025-58160 affecting package rpm-ostree for versions less than 2024.4-8. A patched version of the package is available...

CVE-2026-25541 affecting package rpm-ostree for versions less than 2024.4-8

CVE-2026-25541 affecting package rpm-ostree for versions less than 2024.4-8. A patched version of the package is available...

CVE-2025-58160 affecting package rpm-ostree for versions less than 2022.1-8

CVE-2025-58160 affecting package rpm-ostree for versions less than 2022.1-8. A patched version of the package is available...

ALSA-2026:2124 Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fixes: crypto/x50...

AZL-76715 CVE-2026-25541 affecting package rpm-ostree for versions less than 2024.4-8

Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "vcapacity = newcap + offset" uses an unchecked addition. When newcap + offset...

Azure Linux 3.0 Security Update: rpm-ostree (CVE-2021-45707)

The version of rpm-ostree installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-45707 advisory. - An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22....

Azure Linux 3.0 Security Update: rpm-ostree (CVE-2021-32714)

The version of rpm-ostree installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-32714 advisory. - hyper is an HTTP library for Rust. In versions prior to 0.14.10, hyper's HTTP server and client code had...

Azure Linux 3.0 Security Update: rpm-ostree (CVE-2021-32715)

The version of rpm-ostree installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-32715 advisory. - hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and...

Azure Linux 3.0 Security Update: rpm-ostree (CVE-2024-2905)

The version of rpm-ostree installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-2905 advisory. - A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in...