Moderate Vulnerability in osbuild-composer: Unbounded Allocation in GNU Sparse Map
Summary
RLSA-2026:1837: Moderate: osbuild-composer security update. Affects osbuild-composer versions < 0:149-4.el10_1.rocky.0.8. Fixed in 0:149-4.el10_1.rocky.0.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
osbuild-composer is a service designed for building customized operating system artifacts, such as virtual machine images and OSTree commits. It leverages osbuild to facilitate the creation of these images, which can be used locally or uploaded directly to cloud environments. The service is compatible with composer-cli and cockpit-composer clients, making it a versatile tool for developers and system administrators.
Vulnerability Detail
The vulnerability identified as CVE-2025-58183 pertains to an unbounded allocation issue when parsing GNU sparse maps within the golang archive/tar package. This flaw can lead to excessive memory consumption, potentially resulting in denial of service conditions. Attackers could exploit this vulnerability by crafting malicious tar files that, when processed by osbuild-composer, could cause the service to allocate an excessive amount of memory, leading to application crashes or degraded performance.
How To Fix
Minimum fixed version
0:149-4.el10_1.rocky.0.8
This is the first release that contains the fix.
sudo dnf update osbuild-composerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available security update as soon as possible.
Conclusion
In summary, the osbuild-composer package has a moderate vulnerability (CVE-2025-58183) related to unbounded memory allocation when processing GNU sparse maps. It is essential to update to the patched version to protect against potential denial of service attacks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for osbuild-composer →
FAQ
CVE-2025-58183 is a vulnerability in the golang archive/tar package that allows for unbounded memory allocation when parsing GNU sparse maps.
This vulnerability can lead to excessive memory consumption, potentially causing denial of service conditions in osbuild-composer when processing malicious tar files.
The CVSS score for this vulnerability is 7.5, indicating a moderate severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup at Vulert Scanner.
While there are no specific workarounds, it is crucial to prioritize applying the security update as soon as possible to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for osbuild-composer.
