RLSA-2026:98613: Critical: cockpit-image-builder security update
The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as a frontend for osbuild.
Security Fix(es):
source-map-js: source-map-js: Denial of Service via malformed indexed source maps (CVE-2026-93749)
brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
zod: zod: Denial of service via unbounded array validation (CVE-2023-54404)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/cockpit-image-builderto a version that resolves this vulnerability.Fixed in 0:110.3-1.el10_3
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What does an attacker need to exploit the issues addressed by this update?
The advisory rates the issue as network-accessible with low attack complexity, requiring no privileges and no user interaction. An attacker could therefore attempt exploitation remotely without an authenticated Cockpit account, where the vulnerable functionality is reachable.
What is the expected security impact?
The listed fixes address denial-of-service conditions in source-map-js, brace-expansion, and zod. The stated CVSS vector indicates an availability impact, with no confidentiality or integrity impact.