Critical Security Flaw in Image-Builder Package: Important Update Required
Summary
RLSA-2026:67139: Important: image-builder security update. Affects image-builder versions < 0:52.1-2.el10_2.rocky.0.1. Fixed in 0:52.1-2.el10_2.rocky.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The image-builder package is a local binary designed for creating customized operating system artifacts, including VM images and OSTree commits. It operates using osbuild as its underlying technology. This package is essential for developers and system administrators who require tailored OS images for various environments. However, it has been found to contain multiple security vulnerabilities that could lead to severe consequences if not addressed promptly.
Vulnerability Detail
The vulnerabilities in the image-builder package stem from issues in the golang.org/x/net/html library, which is responsible for HTML parsing. These include Cross-Site Scripting (XSS) vulnerabilities that can be exploited through HTML parsing bypass, unexpected HTML tree rendering, and arbitrary code execution. Additionally, the OpenTelemetry-Go library has a Denial of Service vulnerability due to oversized baggage headers. The ramifications of these vulnerabilities can range from unauthorized access to sensitive data to complete system compromise, making it critical for users to apply the necessary updates.
How To Fix
Minimum fixed version
0:52.1-2.el10_2.rocky.0.1
This is the first release that contains the fix.
sudo dnf update image-builderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of the application by implementing strict input validation and sanitization to prevent XSS attacks. However, this is not a substitute for applying the official patch.
Conclusion
The image-builder package has critical vulnerabilities that need to be addressed promptly through an update to the latest version. Users are encouraged to follow the provided steps to ensure their systems remain secure and protected against potential threats.
See every vulnerability recorded for image-builder →
FAQ
The vulnerabilities have a CVSS score of 8.1, indicating a critical level of severity that requires immediate attention.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to address these vulnerabilities can lead to unauthorized access, data breaches, and potential system compromise, posing significant risks to your environment.
Yes, Vulert provides a service that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If immediate updates are not possible, implement input validation and sanitization as a temporary workaround to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for image-builder.
