v2026.3

Security fixes

This release fixes two security vulnerabilities in static delta processing, both rated Moderate (CVSS 4.9):

• GHSA-7cgc-gp99-6jmm (GHSA-7cgc-gp99-6jmm): Unbounded LZMA decompression in static delta processing allows denial of service via decompression bomb. A crafted static delta can exhaust client memory and disk during ostree pull before checksum validation completes. The LZMA decoder memory is now capped to 100 MiB and decompressed output is bounded to the declared part size with a 512 MiB hard cap. Affected since v2014.5.
• GHSA-xppc-j946-vcj7 (GHSA-xppc-j946-vcj7): Heap buffer overflow via integer truncation in static delta bspatch on 32-bit systems. A crafted content_size value can overflow the 32-bit gsize allocation while bspatch() writes using the full 64-bit value, causing an out-of-bounds heap write. 64-bit systems are not affected. Affected since v2015.4.

It is important to note that both vulnerabilities require the attacker to control the content served by the repository. On systems without signature verification, this means compromising the publishing path (mirror, CDN, or build pipeline). On systems with GPG or ed25519 signature verification -- which is the standard configuration for production deployments -- the attacker would need to compromise both the signing keys and the publishing path, making exploitation significantly harder in practice.
Credits: AISLE and Red Hat Product Security.

What's Changed

• Release 2026.2 by @jmarrero in #3606
• Revert "sysroot: Merge bootconfig-extra from previously staged deployment" by @cgwalters in #3610
• repo-commit: preserve existing .file object inode on consume commit by @electricface in #3603
• lib/commit: Fix min-free-space accounting for duplicate content objects by @jlebon in #3614
• lib/commit: Fix min-free-space accounting for reflinked content objects by @jlebon in #3615
• ci: revert removing coreos-ci Jenkins CI job by @jmarrero in #3607
• Ignore typedef-redefinition warnings with Clang and Fix enum type mismatch in copy flags by @bbhtt in #3592
• docs: update link to VServer reference by @miabbott in #3589
• prepare-root: Properly check return value of snprintf() by @cgwalters in #3617
• README.md: Link to top-level Atomic Desktops page by @jeckersb in #3566
• prepare-root: create /run/systemd/volatile-root for composefs by @ricardosalveti in #3608
• static-delta: Account for the full part payload consistently by @cgwalters in #3618
• ostree-sign-ed25519: Fix overwriting already-set GErrors by @pwithnall in #3620
• man: Document how to select subkeys with --gpg-sign by @pwithnall in #3625
• clang-format: fix files failing check. by @jmarrero in #3629
• find-remotes: Don't require write access unless pulling by @lzwind in #3627
• build: Remove G_GNUC_CONST from *_get_type declarations by @lzwind in #3626
• ot-builtin-summary: Verify signature when viewing a summary file by @pwithnall in #3624

New Contributors

• @electricface made their first contribution in #3603
• @bbhtt made their first contribution in #3592
• @jeckersb made their first contribution in #3566
• @lzwind made their first contribution in #3627

Full Changelog: v2026.2...v2026.3