Critical Security Update for Image-Builder Package: Addressing Denial of Service Vulnerabilities
Summary
RLSA-2026:3840: Important: image-builder security update. Affects image-builder versions < 0:31-4.el10_1.rocky.0.2. Fixed in 0:31-4.el10_1.rocky.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The image-builder package is a local binary tool designed for creating customized operating system artifacts, including virtual machine images and OSTree commits. It operates using osbuild under the hood, providing users with a streamlined method to generate and manage OS images. However, recent vulnerabilities have been identified that could compromise the security and stability of systems utilizing this package.
Vulnerability Detail
The vulnerabilities stem from issues in the underlying libraries used by the image-builder package. Specifically, CVE-2025-61729 presents a Denial of Service (DoS) risk due to excessive resource consumption when processing crafted certificates. CVE-2025-61726 highlights a memory exhaustion issue in the net/url package during query parameter parsing, which can lead to application crashes. Additionally, CVE-2025-68121 involves unexpected session resumption in the crypto/tls library, potentially allowing unauthorized access to secure sessions. These vulnerabilities can severely impact system performance and availability.
How To Fix
Minimum fixed version
0:31-4.el10_1.rocky.0.2
This is the first release that contains the fix.
sudo dnf update image-builderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the use of the image-builder package until the update is applied. Additionally, monitoring resource consumption and implementing rate limiting on certificate processing can help mitigate the impact of the vulnerabilities until a patch is installed.
Conclusion
The image-builder package has critical vulnerabilities that can lead to Denial of Service and memory exhaustion issues. It is crucial for users to update to the latest patched version to ensure system security and stability. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for image-builder →
FAQ
The image-builder package is a tool for creating customized OS artifacts, such as VM images and OSTree commits, utilizing osbuild.
Three vulnerabilities have been identified: CVE-2025-61729 (DoS via crafted certificates), CVE-2025-61726 (memory exhaustion in query parsing), and CVE-2025-68121 (unexpected session resumption).
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
The CVSS score for the vulnerabilities is 7.5, indicating a high severity level.
If an immediate update is not possible, consider implementing resource monitoring and limiting the use of the image-builder package until the vulnerabilities are addressed.
References
Related vulnerabilities
Recent vulnerabilities recorded for image-builder.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
