Critical Security Update for Buildah: Addressing SSH Client Panic Vulnerability
Summary
ALSA-2026:0437: Important: buildah security update. Affects buildah versions < 2:1.41.8-1.el9_7. Fixed in 2:1.41.8-1.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Buildah is a powerful tool designed for building Open Container Initiative (OCI) container images. It allows users to create working containers from scratch or based on existing images, and to build images using Dockerfile instructions. The package is widely used in containerized environments for its flexibility and efficiency in image management. However, it has been found to have a security vulnerability that could lead to unexpected behavior in SSH client operations.
Vulnerability Detail
The vulnerability identified as CVE-2025-47913 affects the SSH client functionality within the golang.org/x/crypto/ssh/agent package used by Buildah. This issue can cause a panic in the SSH client when it encounters an unexpected SSH_AGENT_SUCCESS response. The ramifications of this vulnerability include potential denial of service and instability in applications relying on SSH for secure communications. It is crucial for users of Buildah to address this vulnerability promptly to maintain the integrity and reliability of their containerized applications.
How To Fix
Minimum fixed version
2:1.41.8-1.el9_7
This is the first release that contains the fix.
sudo dnf update buildahTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider avoiding the use of SSH agent features in Buildah until the package is updated. This can help mitigate the risk of encountering the panic issue while a permanent fix is being implemented.
Conclusion
In summary, the Buildah package has a critical vulnerability that can lead to SSH client panic. Users are advised to update to the latest patched version to mitigate risks associated with this issue. Regular updates and monitoring for vulnerabilities are essential for maintaining secure software environments.
See every vulnerability recorded for buildah →
FAQ
Buildah is a tool for building OCI container images, allowing users to create and manage container images efficiently.
CVE-2025-47913 refers to a vulnerability in the SSH client functionality of Buildah that can cause a panic due to unexpected responses.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability can lead to denial of service and instability in applications that rely on SSH for secure communications.
It is recommended to regularly check for updates and apply them promptly to ensure that your software is secure and up-to-date.
Related vulnerabilities
Recent vulnerabilities recorded for buildah.
