Critical Security Flaw in Image-Builder Package: Memory Exhaustion and Denial of Service Vulnerabilities
Summary
RLSA-2026:23228: Important: image-builder security update. Affects image-builder versions < 0:52.1-1.el9_8. Fixed in 0:52.1-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The image-builder package is a local binary tool designed for creating customized operating system artifacts, such as virtual machine images and OSTree commits. It utilizes osbuild as its underlying technology. This package is crucial for developers and system administrators who need to automate the creation of OS images efficiently. However, recent vulnerabilities have been identified that could severely impact its functionality and security.
Vulnerability Detail
The vulnerabilities stem from various components within the image-builder package, including memory exhaustion in query parameter parsing, unexpected session resumption in TLS, and improper email constraint enforcement. These issues can lead to denial of service attacks, authorization bypass, and potential exploitation of crafted JSON Web Encryption objects. The vulnerabilities are linked to several CVEs, including CVE-2025-61726, CVE-2025-68121, CVE-2026-25679, and others, with a CVSS score of 9.1 indicating a critical severity level.
How To Fix
Minimum fixed version
0:52.1-1.el9_8
This is the first release that contains the fix.
sudo dnf update image-builderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing network-level controls to restrict access to the affected services and monitor for unusual activity. Additionally, avoid using features that rely on the vulnerable components until a patch is applied.
Conclusion
The vulnerabilities identified in the image-builder package pose significant risks, including potential denial of service and unauthorized access. It is crucial for users to update to the latest patched version to mitigate these risks. Regular monitoring and vulnerability assessment using tools like Vulert can help maintain security in open-source software.
See every vulnerability recorded for image-builder →
FAQ
Image-builder is a tool for creating customized OS artifacts, such as VM images and OSTree commits, using osbuild.
The vulnerabilities include memory exhaustion, denial of service, and authorization bypass, affecting various components of the package.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of the vulnerabilities is 9.1, indicating a critical severity level.
You can update the package by running 'sudo dnf update image-builder' in your terminal.
References
Related vulnerabilities
Recent vulnerabilities recorded for image-builder.
