RHSA-2026:98613: Critical: cockpit-image-builder security update
The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as a frontend for osbuild.Security Fix(es): source-map-js: source-map-js: Denial of Service via malformed indexed source maps (CVE-2026-93749) brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278) brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276) zod: zod: Denial of service via unbounded array validation (CVE-2023-54404) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/cockpit-image-builderto a version that resolves this vulnerability.Fixed in 110.3-1.el10_3
Event History
Frequently Asked Questions
Which kinds of issues are addressed by this update?
The update addresses denial-of-service issues in source-map-js, brace-expansion, and zod. The brace-expansion issues involve uncontrolled recursion and stack exhaustion from crafted nested brace patterns, while zod is affected by unbounded array validation.
Is exploit access or an affected default configuration described?
No. The provided advisory does not specify the required attacker access, whether any default configuration is affected, or the exposure conditions for Cockpit Image Builder deployments.
What mitigation is documented if the update cannot be applied immediately?
No temporary mitigation or workaround is provided in the advisory data.