Moderate Vulnerability in Image-Builder Package: Unbounded Allocation in Tar Parsing
Summary
ALSA-2026:1838: Moderate: image-builder security update. Affects image-builder versions < 31-3.el10_1. Fixed in 31-3.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The image-builder package is a local binary tool designed for creating customized operating system artifacts, such as virtual machine images and OSTree commits. It operates using osbuild under the hood, providing users with a streamlined way to build and manage OS images. However, this package is susceptible to a security vulnerability that can lead to unbounded memory allocation, potentially affecting system stability and security.
Vulnerability Detail
The vulnerability identified as CVE-2025-58183 arises from an unbounded allocation issue when parsing GNU sparse maps in the golang archive/tar library. This flaw allows an attacker to exploit the image-builder package, leading to excessive memory consumption and potentially causing denial-of-service conditions. The vulnerability is particularly concerning as it can be triggered by specially crafted input, making it a vector for malicious attacks.
How To Fix
Minimum fixed version
31-3.el10_1
This is the first release that contains the fix.
sudo dnf update image-builderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the input size or validate the input before processing it with the image-builder package to avoid triggering the vulnerability. However, the best course of action is to apply the patch as soon as possible.
Conclusion
In summary, the image-builder package has a moderate vulnerability (CVE-2025-58183) that can lead to unbounded memory allocation when processing certain inputs. Users are strongly advised to update to the patched version to ensure system security and stability. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for image-builder →
FAQ
CVE-2025-58183 is a security vulnerability in the golang archive/tar library that can lead to unbounded memory allocation when parsing GNU sparse maps.
This vulnerability can cause excessive memory consumption, potentially leading to denial-of-service conditions when the image-builder package processes maliciously crafted input.
You should update the image-builder package to version 31-3.el10_1 or later to mitigate the vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
Failure to address this vulnerability could lead to system instability, denial-of-service attacks, and exploitation by malicious actors.
Related vulnerabilities
Recent vulnerabilities recorded for image-builder.
