Critical Security Update for Image-Builder Package: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:3839: Important: image-builder security update. Affects image-builder versions < 31-3.el9_7. Fixed in 31-3.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The image-builder package is a local binary designed for creating customized operating system artifacts, including virtual machine images and OSTree commits. It utilizes osbuild as its underlying technology, enabling users to efficiently generate tailored OS images. However, recent vulnerabilities have been identified that could compromise the security and stability of systems utilizing this package.
Vulnerability Detail
The vulnerabilities stem from issues in the underlying libraries used by the image-builder package. Specifically, there are three critical security flaws: 1) A Denial of Service vulnerability due to excessive resource consumption when processing crafted certificates (CVE-2025-61729). 2) Memory exhaustion caused by improper handling of query parameters in the net/url package (CVE-2025-61726). 3) An unexpected session resumption issue in the crypto/tls library (CVE-2025-68121). These vulnerabilities could lead to service interruptions, application crashes, or unauthorized access to sensitive data.
How To Fix
Minimum fixed version
31-3.el9_7
This is the first release that contains the fix.
sudo dnf update image-builderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the resources allocated to the image-builder process to reduce the impact of the Denial of Service vulnerability. Additionally, avoid processing untrusted certificates and sanitize input parameters to prevent memory exhaustion.
Conclusion
In summary, the image-builder package has been identified with critical vulnerabilities that could impact system security and stability. It is crucial for users to update to the latest patched version to mitigate these risks. Additionally, temporary workarounds can help reduce the immediate impact while a full update is performed.
See every vulnerability recorded for image-builder →
FAQ
The image-builder package is a tool used for creating customized OS artifacts, such as VM images and OSTree commits, leveraging osbuild technology.
The vulnerabilities include Denial of Service due to excessive resource consumption, memory exhaustion in query parameter parsing, and unexpected session resumption in TLS.
You can update the package by running 'sudo dnf update image-builder' in your terminal, ensuring you have the latest version installed.
Yes, you can limit resource allocation for the image-builder process and avoid processing untrusted certificates as a temporary workaround.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for image-builder.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
