Critical Security Flaw in Image-Builder Package: IPv6 Host Literal Parsing Issue
Summary
RLSA-2026:13671: Important: image-builder security update. Affects image-builder versions < 0:31-4.el9_7.rocky.0.2. Fixed in 0:31-4.el9_7.rocky.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The image-builder package is a local binary designed for creating customized operating system artifacts, including virtual machine images and OSTree commits. It operates using osbuild as its underlying framework. This package is essential for developers and system administrators who need to generate tailored OS deployments efficiently. However, it has been found to have a significant security vulnerability that could potentially expose systems to various threats.
Vulnerability Detail
The vulnerability identified as CVE-2026-25679 pertains to incorrect parsing of IPv6 host literals in the net/url module. This flaw can lead to improper handling of network requests, which may allow an attacker to exploit the system by crafting malicious URLs that bypass security measures. The ramifications of this vulnerability could include unauthorized access to sensitive data or system resources, making it critical for users of the image-builder package to address this issue promptly.
How To Fix
Minimum fixed version
0:31-4.el9_7.rocky.0.2
This is the first release that contains the fix.
sudo dnf update image-builderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is highly recommended to apply the patch as soon as it is available to mitigate any risks associated with the flaw.
Conclusion
The image-builder package has a critical vulnerability (CVE-2026-25679) that affects its handling of IPv6 host literals, posing significant security risks. Users are strongly advised to update to the patched version to protect their systems. Utilizing tools like Vulert can help monitor and identify vulnerabilities in your applications effectively.
See every vulnerability recorded for image-builder →
FAQ
CVE-2026-25679 is a security vulnerability related to incorrect parsing of IPv6 host literals in the net/url module of the image-builder package.
The vulnerability could allow attackers to exploit network requests, potentially leading to unauthorized access to sensitive data or system resources.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
While there are no specific workarounds, it is crucial to prioritize updating the package to mitigate risks associated with the vulnerability.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for image-builder.
