Critical Security Update for Image-Builder Package: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:3840: Important: image-builder security update. Affects image-builder versions < 31-4.el10_1. Fixed in 31-4.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The image-builder package is a local binary tool designed for creating customized operating system artifacts, including virtual machine images and OSTree commits. It leverages osbuild technology to facilitate the building process. This package is crucial for developers and system administrators who need to create tailored OS environments efficiently. However, it has been identified to contain several security vulnerabilities that could potentially compromise system integrity and availability.
Vulnerability Detail
The image-builder package has been found to have multiple vulnerabilities that can lead to severe security issues. These include a Denial of Service (DoS) due to excessive resource consumption from crafted certificates (CVE-2025-61729), memory exhaustion during query parameter parsing (CVE-2025-61726), and unexpected session resumption in TLS (CVE-2025-68121). These vulnerabilities can be exploited by malicious actors to disrupt service availability, exhaust system resources, or compromise secure communications.
How To Fix
Minimum fixed version
31-4.el10_1
This is the first release that contains the fix.
sudo dnf update image-builderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the use of the image-builder package until the update is applied. Additionally, consider implementing network-level protections to mitigate the risk of exploitation while the vulnerabilities remain unaddressed.
Conclusion
The image-builder package has critical vulnerabilities that require immediate attention. Updating to the latest patched version is essential to safeguard your systems against potential exploits. Utilize tools like Vulert to stay informed about vulnerabilities in your open-source software.
See every vulnerability recorded for image-builder →
FAQ
The vulnerabilities include Denial of Service due to excessive resource consumption, memory exhaustion in query parameter parsing, and unexpected session resumption in TLS.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, consider limiting the use of the image-builder package and implementing network-level protections to reduce the risk of exploitation.
While specific exploits may not be publicly disclosed, the nature of the vulnerabilities suggests that they could be leveraged for Denial of Service attacks and resource exhaustion.
It is recommended to regularly check for updates to your packages, ideally on a weekly basis, to ensure that you are protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for image-builder.
