Critical Security Update for Buildah: Addressing Denial of Service and Memory Exhaustion Vulnerabilities
Summary
ALSA-2026:3298: Important: buildah security update. Affects buildah versions < 2:1.41.8-2.el9_7. Fixed in 2:1.41.8-2.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Buildah is a powerful tool designed for building Open Container Initiative (OCI) container images. It allows users to create working containers from scratch or based on existing images, and to build images using Dockerfile instructions. Its flexibility and efficiency make it a popular choice among developers for container image management. However, recent vulnerabilities have been identified that could compromise the security and stability of systems utilizing Buildah.
Vulnerability Detail
The vulnerabilities in Buildah stem from issues in its underlying libraries, specifically in the Go programming language. These include a Denial of Service (DoS) vulnerability due to excessive resource consumption when processing crafted certificates (CVE-2025-61729), memory exhaustion during query parameter parsing (CVE-2025-61726), and unexpected session resumption in TLS connections (CVE-2025-68121). Exploiting these vulnerabilities could lead to service disruptions and potential data exposure.
How To Fix
Minimum fixed version
2:1.41.8-2.el9_7
This is the first release that contains the fix.
sudo dnf update buildahTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the resources allocated to the Buildah process to mitigate the impact of the vulnerabilities until a full update can be applied. This can be done by configuring resource limits in your container orchestration settings.
Conclusion
The vulnerabilities identified in Buildah pose significant risks to systems utilizing this tool for container image management. It is crucial to apply the recommended updates to mitigate these risks and ensure the security and stability of your applications. Regular monitoring and updates are essential practices in maintaining a secure environment.
See every vulnerability recorded for buildah →
FAQ
Buildah is a tool for building OCI container images, allowing users to create and manage container images efficiently.
The main vulnerabilities include Denial of Service due to excessive resource consumption, memory exhaustion in query parameter parsing, and unexpected session resumption in TLS.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Update the Buildah and Buildah-tests packages to the latest patched version using 'sudo dnf update buildah buildah-tests'.
Yes, you can limit the resources allocated to the Buildah process as a temporary workaround until the packages are updated.
Related vulnerabilities
Recent vulnerabilities recorded for buildah.
