OSTree Files

Security fixes

This release fixes two security vulnerabilities in static delta processing, both rated Moderate (CVSS 4.9):

• GHSA-7cgc-gp99-6jmm (https://github.com/ostreedev/ostree/security/advisories/GHSA-7cgc-gp99-6jmm): Unbounded LZMA decompression in static delta processing allows denial of service via decompression bomb. A crafted static delta can exhaust client memory and disk during ostree pull before checksum validation completes. The LZMA decoder memory is now capped to 100 MiB and decompressed output is bounded to the declared part size with a 512 MiB hard cap. Affected since v2014.5.
• GHSA-xppc-j946-vcj7 (https://github.com/ostreedev/ostree/security/advisories/GHSA-xppc-j946-vcj7): Heap buffer overflow via integer truncation in static delta bspatch on 32-bit systems. A crafted content_size value can overflow the 32-bit gsize allocation while bspatch() writes using the full 64-bit value, causing an out-of-bounds heap write. 64-bit systems are not affected. Affected since v2015.4.

It is important to note that both vulnerabilities require the attacker to control the content served by the repository. On systems without signature verification, this means compromising the publishing path (mirror, CDN, or build pipeline). On systems with GPG or ed25519 signature verification -- which is the standard configuration for production deployments -- the attacker would need to compromise both the signing keys and the publishing path, making exploitation significantly harder in practice. Credits: AISLE and Red Hat Product Security.

What's Changed

• Release 2026.2 by @jmarrero in https://github.com/ostreedev/ostree/pull/3606
• Revert "sysroot: Merge bootconfig-extra from previously staged deployment" by @cgwalters in https://github.com/ostreedev/ostree/pull/3610
• repo-commit: preserve existing .file object inode on consume commit by @electricface in https://github.com/ostreedev/ostree/pull/3603
• lib/commit: Fix min-free-space accounting for duplicate content objects by @jlebon in https://github.com/ostreedev/ostree/pull/3614
• lib/commit: Fix min-free-space accounting for reflinked content objects by @jlebon in https://github.com/ostreedev/ostree/pull/3615
• ci: revert removing coreos-ci Jenkins CI job by @jmarrero in https://github.com/ostreedev/ostree/pull/3607
• Ignore typedef-redefinition warnings with Clang and Fix enum type mismatch in copy flags by @bbhtt in https://github.com/ostreedev/ostree/pull/3592
• docs: update link to VServer reference by @miabbott in https://github.com/ostreedev/ostree/pull/3589
• prepare-root: Properly check return value of snprintf() by @cgwalters in https://github.com/ostreedev/ostree/pull/3617
• README.md: Link to top-level Atomic Desktops page by @jeckersb in https://github.com/ostreedev/ostree/pull/3566
• prepare-root: create /run/systemd/volatile-root for composefs by @ricardosalveti in https://github.com/ostreedev/ostree/pull/3608
• static-delta: Account for the full part payload consistently by @cgwalters in https://github.com/ostreedev/ostree/pull/3618
• ostree-sign-ed25519: Fix overwriting already-set GErrors by @pwithnall in https://github.com/ostreedev/ostree/pull/3620
• man: Document how to select subkeys with --gpg-sign by @pwithnall in https://github.com/ostreedev/ostree/pull/3625
• clang-format: fix files failing check. by @jmarrero in https://github.com/ostreedev/ostree/pull/3629
• find-remotes: Don't require write access unless pulling by @lzwind in https://github.com/ostreedev/ostree/pull/3627
• build: Remove G_GNUC_CONST from *_get_type declarations by @lzwind in https://github.com/ostreedev/ostree/pull/3626
• ot-builtin-summary: Verify signature when viewing a summary file by @pwithnall in https://github.com/ostreedev/ostree/pull/3624

New Contributors

• @electricface made their first contribution in https://github.com/ostreedev/ostree/pull/3603
• @bbhtt made their first contribution in https://github.com/ostreedev/ostree/pull/3592
• @jeckersb made their first contribution in https://github.com/ostreedev/ostree/pull/3566
• @lzwind made their first contribution in https://github.com/ostreedev/ostree/pull/3627

Full Changelog: https://github.com/ostreedev/ostree/compare/v2026.2...v2026.3