Security Vulnerability in osbuild-composer: Unbounded Allocation in GNU Sparse Map Parsing
Summary
ALSA-2026:1380: Moderate: osbuild-composer security update. Affects osbuild-composer versions < 101.4-2.el8_10.alma.1. Fixed in 101.4-2.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
osbuild-composer is a service designed for building customized OS artifacts, such as virtual machine images and OSTree commits. It leverages osbuild to facilitate the creation of these images, which can be used locally or uploaded directly to cloud environments. The service is compatible with composer-cli and cockpit-composer clients, making it a versatile tool for developers and system administrators.
Vulnerability Detail
The vulnerability identified as CVE-2025-58183 pertains to an unbounded allocation issue when parsing GNU sparse maps within the golang archive/tar package. This flaw can lead to excessive memory consumption, potentially resulting in denial of service (DoS) conditions. Attackers could exploit this vulnerability by crafting malicious tar files that, when processed by osbuild-composer, could cause the service to consume an excessive amount of memory, leading to system instability or crashes.
How To Fix
Minimum fixed version
101.4-2.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update osbuild-composerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can avoid processing untrusted or potentially malicious tar files until the update is applied. This can help mitigate the risk of exploitation while you work on updating the affected packages.
Conclusion
The osbuild-composer package has a moderate security vulnerability that can lead to significant memory issues if exploited. It is crucial to update to the latest patched version to ensure the security and stability of your systems. Additionally, using tools like Vulert can help monitor for such vulnerabilities in your applications.
See every vulnerability recorded for osbuild-composer →
FAQ
CVE-2025-58183 is a security vulnerability in the golang archive/tar package that allows for unbounded memory allocation when parsing GNU sparse maps.
This vulnerability can lead to excessive memory consumption in osbuild-composer, potentially causing denial of service conditions if exploited.
You should update your osbuild-composer package to version 101.4-2.el8_10.alma.1 or later to mitigate the vulnerability.
Yes, avoid processing untrusted tar files until you can update the affected packages.
You can use Vulert, which monitors and alerts for open-source vulnerabilities. Visit Vulert Scanner to check your application without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for osbuild-composer.
