Critical Denial of Service Vulnerabilities in Image-Builder Package
Summary
RLSA-2026:65886: Important: image-builder security update. Affects image-builder versions < 0:52.1-1.el9_8.2. Fixed in 0:52.1-1.el9_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The image-builder package is a local binary designed for creating customized operating system artifacts, such as virtual machine images and OSTree commits. It leverages the osbuild tool under the hood, enabling users to build and manage OS images efficiently. However, this package has been found to contain multiple vulnerabilities that could lead to denial of service attacks, affecting its reliability and security.
Vulnerability Detail
The vulnerabilities stem from various components within the Go programming language libraries utilized by the image-builder package. These include denial of service issues related to inefficient certificate chain validation, pathological email address parsing, and excessive recursion in XML decoding. Attackers could exploit these vulnerabilities to disrupt service availability, leading to potential downtime and loss of functionality for users relying on the image-builder for OS image creation.
How To Fix
Minimum fixed version
0:52.1-1.el9_8.2
This is the first release that contains the fix.
sudo dnf update image-builderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of the image-builder service to untrusted networks and implement strict input validation to mitigate the risk of denial of service attacks until the package is updated.
Conclusion
The image-builder package has critical vulnerabilities that could lead to denial of service attacks. Users are strongly advised to update to the latest patched version to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities in open-source software effectively.
See every vulnerability recorded for image-builder →
FAQ
The vulnerabilities have a CVSS score of 8.2, indicating a critical level of severity.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
Exploitation of these vulnerabilities could lead to denial of service, causing disruptions and downtime for applications relying on the image-builder package.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If an immediate update is not possible, consider implementing network restrictions and input validation to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for image-builder.
