Critical Security Flaw in Image-Builder Package: Important Update Required
Summary
RLSA-2026:22937: Important: image-builder security update. Affects image-builder versions < 0:52.1-1.el10_2.rocky.0.1. Fixed in 0:52.1-1.el10_2.rocky.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The image-builder package is a local binary designed for creating customized operating system artifacts, such as virtual machine images and OSTree commits. It operates using osbuild as its underlying technology. This package is essential for developers and system administrators who need to generate tailored OS images efficiently. However, it has been identified as vulnerable to several security issues that could potentially compromise system integrity and security.
Vulnerability Detail
The vulnerabilities in the image-builder package stem from various components, including the Go programming language's libraries. Notable issues include memory exhaustion during query parameter parsing, improper session resumption in TLS, and denial of service through crafted JSON Web Encryption objects. These vulnerabilities could allow attackers to exploit the system, leading to unauthorized access, service disruptions, or data breaches. The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
How To Fix
Minimum fixed version
0:52.1-1.el10_2.rocky.0.1
This is the first release that contains the fix.
sudo dnf update image-builderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the affected systems and monitoring for unusual activity. Implementing network-level controls to limit exposure can also serve as a temporary measure until the package is updated.
Conclusion
The image-builder package has been identified with critical vulnerabilities that require immediate attention. Updating to the latest patched version is essential to protect your systems from potential exploitation. Regular monitoring and updates are vital for maintaining security.
See every vulnerability recorded for image-builder →
FAQ
The image-builder package is a tool used for creating customized OS artifacts, such as VM images and OSTree commits, utilizing osbuild technology.
The vulnerabilities can lead to unauthorized access, denial of service, and potential data breaches, posing significant risks to system security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check your application without any signup.
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
It is recommended to regularly check for updates and apply them promptly to mitigate the risk of vulnerabilities in your software.
References
Related vulnerabilities
Recent vulnerabilities recorded for image-builder.
