Critical Security Flaw in Image-Builder Package: IPv6 Parsing Issue
Summary
ALSA-2026:13671: Important: image-builder security update. Affects image-builder versions < 31-4.el9_7. Fixed in 31-4.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The image-builder package is a local binary designed for creating customized operating system artifacts, including virtual machine images and OSTree commits. It operates using osbuild as its underlying technology. This package is crucial for developers and system administrators who need to generate tailored OS images efficiently. However, it has been identified to have a significant security vulnerability that affects its functionality and security posture.
Vulnerability Detail
The vulnerability stems from an incorrect parsing of IPv6 host literals within the net/url package, identified as CVE-2026-25679. This flaw can lead to potential security risks, including the possibility of unauthorized access or manipulation of network requests. The technical implications of this vulnerability could allow attackers to exploit the incorrect parsing behavior, potentially leading to data breaches or system compromises.
How To Fix
Minimum fixed version
31-4.el9_7
This is the first release that contains the fix.
sudo dnf update image-builderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider restricting access to the image-builder functionality or implementing network-level controls to mitigate the risk of exploitation until the package is updated.
Conclusion
The image-builder package has a critical vulnerability due to incorrect IPv6 parsing, which poses significant security risks. Users are strongly advised to update to the patched version to safeguard their systems. Utilizing tools like Vulert can help monitor and identify vulnerabilities in your applications effectively.
See every vulnerability recorded for image-builder →
FAQ
CVE-2026-25679 is a security vulnerability related to incorrect parsing of IPv6 host literals in the net/url package, which can lead to security risks.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities in real-time.
The consequences may include unauthorized access, data breaches, or manipulation of network requests, which can compromise the security of the system.
Yes, a patch is available. Users should update the image-builder package to version 31-4.el9_7 or later to address the vulnerability.
If immediate updates are not possible, consider implementing network-level controls or restricting access to the image-builder functionality as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for image-builder.
