Moderate Security Vulnerability in Image-Builder Package: Unbounded Allocation in GNU Sparse Map
Summary
ALSA-2026:1377: Moderate: image-builder security update. Affects image-builder versions < 31-2.el9_7. Fixed in 31-2.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The image-builder package is a local binary tool designed for creating customized operating system artifacts, such as virtual machine images and OSTree commits. It operates using osbuild as its underlying framework, allowing users to efficiently build and manage OS images. However, it has been identified to have a security vulnerability that could potentially lead to resource exhaustion.
Vulnerability Detail
The vulnerability stems from an unbounded allocation issue when parsing GNU sparse maps in the golang archive/tar package, identified as CVE-2025-58183. This flaw can lead to excessive memory consumption, which may result in denial of service conditions, affecting the stability and availability of systems utilizing the image-builder package. Attackers could exploit this vulnerability by crafting malicious input that triggers the unbounded allocation, leading to potential system crashes or slowdowns.
How To Fix
Minimum fixed version
31-2.el9_7
This is the first release that contains the fix.
sudo dnf update image-builderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the input size or validate the input data before processing it with the image-builder package to prevent triggering the unbounded allocation issue. However, this is not a permanent solution and updating the package is strongly advised.
Conclusion
The image-builder package has a moderate security vulnerability due to unbounded allocation when parsing GNU sparse maps. Users are advised to update to the patched version to mitigate risks associated with this vulnerability. Temporary workarounds can be employed, but updating is the most effective solution.
See every vulnerability recorded for image-builder →
FAQ
CVE-2025-58183 is a security vulnerability in the golang archive/tar package that allows for unbounded memory allocation when parsing GNU sparse maps.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to denial of service conditions, causing system crashes or slowdowns due to excessive memory consumption.
Yes, a patch is available in version 31-2.el9_7 of the image-builder package. Updating to this version will fix the vulnerability.
If immediate updating is not possible, consider implementing input validation or limiting input sizes as a temporary workaround until the package can be updated.
Related vulnerabilities
Recent vulnerabilities recorded for image-builder.
