Moderate Security Update for Image-Builder: Addressing CVE-2025-58183
Summary
RLSA-2026:1838: Moderate: image-builder security update. Affects image-builder versions < 0:31-3.el10_1.rocky.0.2. Fixed in 0:31-3.el10_1.rocky.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Image-builder is a local binary tool designed for creating customized operating system artifacts, such as virtual machine images and OSTree commits. It operates using osbuild as its underlying framework. The tool is essential for developers and system administrators who need to generate tailored OS images for various environments. However, it has recently been identified to have a vulnerability that could potentially impact its security.
Vulnerability Detail
The vulnerability, identified as CVE-2025-58183, arises from an unbounded allocation issue when parsing GNU sparse maps in the golang archive/tar package. This flaw can lead to excessive memory allocation, which may result in denial of service or other unintended behaviors, particularly when processing maliciously crafted tar files. The severity of this vulnerability is rated with a CVSS score of 7.5, indicating a moderate risk to systems utilizing the affected package.
How To Fix
Minimum fixed version
0:31-3.el10_1.rocky.0.2
This is the first release that contains the fix.
sudo dnf update image-builderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted tar files with the image-builder tool until the package has been updated to the patched version.
Conclusion
The image-builder tool has a moderate security vulnerability (CVE-2025-58183) that can lead to excessive memory allocation. It is crucial to update to the fixed version of the package to mitigate potential risks. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for image-builder →
FAQ
CVE-2025-58183 is a vulnerability in the golang archive/tar package that allows for unbounded memory allocation when parsing GNU sparse maps, potentially leading to denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a moderate level of risk.
If you cannot update the package immediately, avoid processing untrusted tar files as a temporary workaround.
The security update is provided by the Rocky Enterprise Software Foundation and Red Hat, who maintain the image-builder package.
Related vulnerabilities
Recent vulnerabilities recorded for image-builder.
