Critical Security Flaw in Image-Builder Package: IPv6 Host Literal Parsing Issue
Summary
RLSA-2026:13642: Important: image-builder security update. Affects image-builder versions < 0:31-5.el10_1.rocky.0.2. Fixed in 0:31-5.el10_1.rocky.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The image-builder package is a local binary tool designed for creating customized operating system artifacts, such as virtual machine images and OSTree commits. It operates using osbuild as its underlying engine, providing users with a streamlined method to generate and manage OS images. However, this package has been identified to have a security vulnerability that affects its ability to correctly parse IPv6 host literals, potentially leading to security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2026-25679, stems from an incorrect parsing mechanism within the net/url package used by image-builder. This flaw can allow attackers to exploit the system by manipulating IPv6 host literals, which may lead to unauthorized access or other malicious activities. The impact of this vulnerability is significant, as it can compromise the integrity and security of the OS artifacts being built, making it crucial for users to address this issue promptly.
How To Fix
Minimum fixed version
0:31-5.el10_1.rocky.0.2
This is the first release that contains the fix.
sudo dnf update image-builderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the image-builder package until the update is applied. Additionally, ensuring that any input involving IPv6 addresses is validated before processing can help mitigate potential exploitation of this vulnerability.
Conclusion
The image-builder package has a critical vulnerability related to IPv6 host literal parsing, which can pose significant security risks. Users are strongly advised to update to the patched version to ensure their systems remain secure. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for image-builder →
FAQ
CVE-2026-25679 is a security vulnerability in the image-builder package that involves incorrect parsing of IPv6 host literals.
This vulnerability can lead to unauthorized access or manipulation of OS artifacts, compromising system security.
If an immediate update is not possible, consider avoiding the use of the image-builder package and validating IPv6 inputs.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for image-builder.
