Critical Security Update for Buildah: Addressing SSH Client Panic Vulnerability
Summary
ALSA-2026:0436: Important: buildah security update. Affects buildah versions < 2:1.41.8-1.el10_1. Fixed in 2:1.41.8-1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Buildah is a powerful tool designed for building Open Container Initiative (OCI) container images. It allows users to create working containers from scratch or from existing images, and to build both Docker and OCI images using Dockerfile instructions. This flexibility makes Buildah a vital component in containerized application development. However, a recent security vulnerability has been identified that affects its SSH client functionality, potentially leading to application crashes.
Vulnerability Detail
The vulnerability, identified as CVE-2025-47913, originates from the golang.org/x/crypto/ssh/agent package, which is utilized by Buildah. The issue arises when the SSH client encounters an unexpected SSH_AGENT_SUCCESS response, leading to a panic state. This could result in application instability and unexpected behavior, posing risks to systems relying on Buildah for container image management.
How To Fix
Minimum fixed version
2:1.41.8-1.el10_1
This is the first release that contains the fix.
sudo dnf update buildahTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the SSH agent functionality within Buildah until the package is updated. This can be done by configuring Buildah to operate without SSH agent access, thereby preventing the panic from occurring.
Conclusion
In summary, the Buildah package has a critical vulnerability that requires immediate attention. Users are advised to update to the latest patched version to ensure the stability and security of their systems. By following the outlined steps, you can effectively mitigate the risks associated with CVE-2025-47913.
See every vulnerability recorded for buildah →
FAQ
CVE-2025-47913 is a security vulnerability in the Buildah package that causes the SSH client to panic due to an unexpected SSH_AGENT_SUCCESS response.
This vulnerability can lead to application crashes and instability in systems that utilize Buildah for container image management.
If an immediate update is not possible, consider disabling SSH agent functionality in Buildah as a temporary workaround.
For more details, refer to the CVE page associated with CVE-2025-47913 and the advisory provided by AlmaLinux.
Vulert provides real-time monitoring and alerts for open-source vulnerabilities using a manifest file like package-lock.json, allowing you to stay informed about potential risks in your software.
Related vulnerabilities
Recent vulnerabilities recorded for buildah.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
