Security Update for osbuild-composer: Mitigating Unbounded Allocation Vulnerability
Summary
ALSA-2026:1837: Moderate: osbuild-composer security update. Affects osbuild-composer versions < 149-4.el10_1.alma.3. Fixed in 149-4.el10_1.alma.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
osbuild-composer is a service designed for building customized OS artifacts, such as virtual machine images and OSTree commits. It operates using osbuild and supports direct uploads to cloud environments. This package is compatible with composer-cli and cockpit-composer clients, making it a versatile tool for developers and system administrators. However, it has been identified to have a security vulnerability that could potentially impact its functionality and security.
Vulnerability Detail
The vulnerability stems from an unbounded allocation issue in the golang archive/tar package, specifically when parsing GNU sparse maps (CVE-2025-58183). This flaw can lead to excessive memory consumption, which may result in denial of service or other unintended behaviors. The vulnerability is particularly concerning as it can be exploited during the image building process, affecting the stability and security of the system.
How To Fix
Minimum fixed version
149-4.el10_1.alma.3
This is the first release that contains the fix.
sudo dnf update osbuild-composerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if you cannot update the packages immediately, consider limiting the resources allocated to the osbuild-composer service to mitigate the impact of potential exploitation. This can be done by configuring resource limits in your service manager (e.g., systemd).
Conclusion
The osbuild-composer package has a moderate security vulnerability that requires immediate attention. By updating to the latest patched version, users can protect their systems from potential exploitation. It is crucial to stay informed about such vulnerabilities and utilize tools like Vulert to monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for osbuild-composer →
FAQ
osbuild-composer is a service for building customized OS artifacts, such as VM images and OSTree commits, utilizing osbuild.
The vulnerability involves unbounded allocation when parsing GNU sparse maps, which can lead to excessive memory usage.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Consider implementing resource limits on the osbuild-composer service to reduce the risk of exploitation until you can apply the update.
For more details, refer to the CVE page for CVE-2025-58183, which provides insights into the impact and technical specifics of the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for osbuild-composer.
