Critical Security Update for Buildah: Addressing Container Escape and Denial of Service Vulnerabilities
Summary
ALSA-2025:22011: Important: buildah security update. Affects buildah versions < 2:1.41.6-1.el9_7. Fixed in 2:1.41.6-1.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Buildah is a powerful tool designed for building Open Container Initiative (OCI) container images. It allows users to create working containers from scratch or based on existing images, and to build images using Dockerfile instructions. This flexibility makes Buildah a crucial component in containerized application development. However, recent vulnerabilities have been identified that could compromise the security of applications using Buildah.
Vulnerability Detail
The vulnerabilities stem from issues in the underlying components used by Buildah. Specifically, CVE-2025-52881 highlights a container escape and denial of service risk due to arbitrary write gadgets and procfs write redirects. This could allow an attacker to escape the container's isolation and potentially gain access to the host system. Additionally, CVE-2025-58183 involves an unbounded allocation when parsing GNU sparse maps in the golang archive/tar package, which could lead to resource exhaustion and denial of service.
How To Fix
Minimum fixed version
2:1.41.6-1.el9_7
This is the first release that contains the fix.
sudo dnf update buildahTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the permissions of the containers or avoid using features that rely on the vulnerable components until the update is applied. However, the best course of action is to apply the security update as soon as possible.
Conclusion
In summary, the recent vulnerabilities in Buildah pose significant risks to container security. It is crucial to update to the patched version to mitigate these risks. Users are encouraged to stay informed about vulnerabilities and utilize tools like Vulert to monitor their applications for potential threats.
See every vulnerability recorded for buildah →
FAQ
Buildah is a tool for building OCI container images, allowing users to create and manage container images efficiently.
The main vulnerabilities include a container escape and denial of service risk (CVE-2025-52881) and an unbounded allocation issue in the golang archive/tar package (CVE-2025-58183).
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file. Visit Vulert Scanner to check your application without any signup.
If an immediate update is not possible, consider limiting container permissions or avoiding the use of vulnerable features until the update can be applied.
For detailed information about the vulnerabilities, including their impact and CVSS scores, refer to the CVE pages for CVE-2025-52881 and CVE-2025-58183.
Related vulnerabilities
Recent vulnerabilities recorded for buildah.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
