Issued:: 2026-02-03
Updated:: 2026-02-05

RHSA-2026:1838 - Security Advisory

Overview
Updated Packages

Synopsis

Moderate: image-builder security update

Type/Severity

Security Advisory: Moderate

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for image-builder is now available for Red Hat Enterprise Linux 10.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.

Security Fix(es):

golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

Red Hat Enterprise Linux for x86_64 10 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64
Red Hat Enterprise Linux for IBM z Systems 10 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x
Red Hat Enterprise Linux for Power, little endian 10 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le
Red Hat Enterprise Linux for ARM 64 10 aarch64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64
Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64
Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x
Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le
Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64
Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64
Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le
Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x

Fixes

BZ - 2407258 - CVE-2025-58183 golang: archive/tar: Unbounded allocation when parsing GNU sparse map
RHEL-137212 - Update image-builder to fix pqc keys on RHEL 10.1

CVEs

CVE-2025-58183

References

https://access.redhat.com/security/updates/classification/#moderate

Note: More recent versions of these packages may be available. Click a package name for more details.

Red Hat Enterprise Linux for x86_64 10

SRPM
image-builder-31-3.el10_1.src.rpm	SHA-256: 6b7cb74fe8fd5c52ef783d3e02516772b2f92ee6c695e7ad65d2cd8c6f919b7a
x86_64
image-builder-31-3.el10_1.x86_64.rpm	SHA-256: a122930c4537529dc1cf5241f96ba1569712f94409d240449822bcd54b0d960f
image-builder-debuginfo-31-3.el10_1.x86_64.rpm	SHA-256: 26aa76763dc5ecf4bd22cce19b8d5dbdf0c0d20415d4449f135931ebeb76afb1
image-builder-debugsource-31-3.el10_1.x86_64.rpm	SHA-256: 7062119bd7aff8aa6bfb7f7334530753e82db7e1f0f455bb945ee94dd81961c6

Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2

SRPM
image-builder-31-3.el10_1.src.rpm	SHA-256: 6b7cb74fe8fd5c52ef783d3e02516772b2f92ee6c695e7ad65d2cd8c6f919b7a
x86_64
image-builder-31-3.el10_1.x86_64.rpm	SHA-256: a122930c4537529dc1cf5241f96ba1569712f94409d240449822bcd54b0d960f
image-builder-debuginfo-31-3.el10_1.x86_64.rpm	SHA-256: 26aa76763dc5ecf4bd22cce19b8d5dbdf0c0d20415d4449f135931ebeb76afb1
image-builder-debugsource-31-3.el10_1.x86_64.rpm	SHA-256: 7062119bd7aff8aa6bfb7f7334530753e82db7e1f0f455bb945ee94dd81961c6

Red Hat Enterprise Linux for IBM z Systems 10

SRPM
image-builder-31-3.el10_1.src.rpm	SHA-256: 6b7cb74fe8fd5c52ef783d3e02516772b2f92ee6c695e7ad65d2cd8c6f919b7a
s390x
image-builder-31-3.el10_1.s390x.rpm	SHA-256: f81f30372bf46ca4d81954edb860560676e8af9cbc2c8d7be83c99467b305898
image-builder-debuginfo-31-3.el10_1.s390x.rpm	SHA-256: 6d7f24e16c4eee7f03806b5186c18e449c8a26160178905ffccfb50d71b1a13e
image-builder-debugsource-31-3.el10_1.s390x.rpm	SHA-256: d89c6446091d0729be76f3277865403da84e7b6e20973106c464c8a67474325d

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2

SRPM
image-builder-31-3.el10_1.src.rpm	SHA-256: 6b7cb74fe8fd5c52ef783d3e02516772b2f92ee6c695e7ad65d2cd8c6f919b7a
s390x
image-builder-31-3.el10_1.s390x.rpm	SHA-256: f81f30372bf46ca4d81954edb860560676e8af9cbc2c8d7be83c99467b305898
image-builder-debuginfo-31-3.el10_1.s390x.rpm	SHA-256: 6d7f24e16c4eee7f03806b5186c18e449c8a26160178905ffccfb50d71b1a13e
image-builder-debugsource-31-3.el10_1.s390x.rpm	SHA-256: d89c6446091d0729be76f3277865403da84e7b6e20973106c464c8a67474325d

Red Hat Enterprise Linux for Power, little endian 10

SRPM
image-builder-31-3.el10_1.src.rpm	SHA-256: 6b7cb74fe8fd5c52ef783d3e02516772b2f92ee6c695e7ad65d2cd8c6f919b7a
ppc64le
image-builder-31-3.el10_1.ppc64le.rpm	SHA-256: 5daa0e1ded189c6677cd012d9390d9858b125881f3d7f1ab4b362d42ec74c383
image-builder-debuginfo-31-3.el10_1.ppc64le.rpm	SHA-256: 1a7735e89b71b8c4c9ec8f825df02a6c4fbca1706e026f3507bf0a19e716cf79
image-builder-debugsource-31-3.el10_1.ppc64le.rpm	SHA-256: 73f6e9cd7617d64ca114fc640479dd6318ef9f2241dbd0c1a06d2e7f46181ef3

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2

SRPM
image-builder-31-3.el10_1.src.rpm	SHA-256: 6b7cb74fe8fd5c52ef783d3e02516772b2f92ee6c695e7ad65d2cd8c6f919b7a
ppc64le
image-builder-31-3.el10_1.ppc64le.rpm	SHA-256: 5daa0e1ded189c6677cd012d9390d9858b125881f3d7f1ab4b362d42ec74c383
image-builder-debuginfo-31-3.el10_1.ppc64le.rpm	SHA-256: 1a7735e89b71b8c4c9ec8f825df02a6c4fbca1706e026f3507bf0a19e716cf79
image-builder-debugsource-31-3.el10_1.ppc64le.rpm	SHA-256: 73f6e9cd7617d64ca114fc640479dd6318ef9f2241dbd0c1a06d2e7f46181ef3

Red Hat Enterprise Linux for ARM 64 10

SRPM
image-builder-31-3.el10_1.src.rpm	SHA-256: 6b7cb74fe8fd5c52ef783d3e02516772b2f92ee6c695e7ad65d2cd8c6f919b7a
aarch64
image-builder-31-3.el10_1.aarch64.rpm	SHA-256: 7634138d4b834879c85997522d0f5447cacc6af583491c466bf033928f8b13b5
image-builder-debuginfo-31-3.el10_1.aarch64.rpm	SHA-256: 1440c375ede34ef95530a86a8e8436518c811efb723b7bd9015415d3db20f49e
image-builder-debugsource-31-3.el10_1.aarch64.rpm	SHA-256: 2b7e2c0ecbb4938626b85df437b03b1e287dc8e737200409a475e659f1c1c4d3

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2

SRPM
image-builder-31-3.el10_1.src.rpm	SHA-256: 6b7cb74fe8fd5c52ef783d3e02516772b2f92ee6c695e7ad65d2cd8c6f919b7a
aarch64
image-builder-31-3.el10_1.aarch64.rpm	SHA-256: 7634138d4b834879c85997522d0f5447cacc6af583491c466bf033928f8b13b5
image-builder-debuginfo-31-3.el10_1.aarch64.rpm	SHA-256: 1440c375ede34ef95530a86a8e8436518c811efb723b7bd9015415d3db20f49e
image-builder-debugsource-31-3.el10_1.aarch64.rpm	SHA-256: 2b7e2c0ecbb4938626b85df437b03b1e287dc8e737200409a475e659f1c1c4d3

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2

SRPM
image-builder-31-3.el10_1.src.rpm	SHA-256: 6b7cb74fe8fd5c52ef783d3e02516772b2f92ee6c695e7ad65d2cd8c6f919b7a
aarch64
image-builder-31-3.el10_1.aarch64.rpm	SHA-256: 7634138d4b834879c85997522d0f5447cacc6af583491c466bf033928f8b13b5
image-builder-debuginfo-31-3.el10_1.aarch64.rpm	SHA-256: 1440c375ede34ef95530a86a8e8436518c811efb723b7bd9015415d3db20f49e
image-builder-debugsource-31-3.el10_1.aarch64.rpm	SHA-256: 2b7e2c0ecbb4938626b85df437b03b1e287dc8e737200409a475e659f1c1c4d3

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2

SRPM
image-builder-31-3.el10_1.src.rpm	SHA-256: 6b7cb74fe8fd5c52ef783d3e02516772b2f92ee6c695e7ad65d2cd8c6f919b7a
s390x
image-builder-31-3.el10_1.s390x.rpm	SHA-256: f81f30372bf46ca4d81954edb860560676e8af9cbc2c8d7be83c99467b305898
image-builder-debuginfo-31-3.el10_1.s390x.rpm	SHA-256: 6d7f24e16c4eee7f03806b5186c18e449c8a26160178905ffccfb50d71b1a13e
image-builder-debugsource-31-3.el10_1.s390x.rpm	SHA-256: d89c6446091d0729be76f3277865403da84e7b6e20973106c464c8a67474325d

Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2

SRPM
image-builder-31-3.el10_1.src.rpm	SHA-256: 6b7cb74fe8fd5c52ef783d3e02516772b2f92ee6c695e7ad65d2cd8c6f919b7a
ppc64le
image-builder-31-3.el10_1.ppc64le.rpm	SHA-256: 5daa0e1ded189c6677cd012d9390d9858b125881f3d7f1ab4b362d42ec74c383
image-builder-debuginfo-31-3.el10_1.ppc64le.rpm	SHA-256: 1a7735e89b71b8c4c9ec8f825df02a6c4fbca1706e026f3507bf0a19e716cf79
image-builder-debugsource-31-3.el10_1.ppc64le.rpm	SHA-256: 73f6e9cd7617d64ca114fc640479dd6318ef9f2241dbd0c1a06d2e7f46181ef3

Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2

SRPM
image-builder-31-3.el10_1.src.rpm	SHA-256: 6b7cb74fe8fd5c52ef783d3e02516772b2f92ee6c695e7ad65d2cd8c6f919b7a
x86_64
image-builder-31-3.el10_1.x86_64.rpm	SHA-256: a122930c4537529dc1cf5241f96ba1569712f94409d240449822bcd54b0d960f
image-builder-debuginfo-31-3.el10_1.x86_64.rpm	SHA-256: 26aa76763dc5ecf4bd22cce19b8d5dbdf0c0d20415d4449f135931ebeb76afb1
image-builder-debugsource-31-3.el10_1.x86_64.rpm	SHA-256: 7062119bd7aff8aa6bfb7f7334530753e82db7e1f0f455bb945ee94dd81961c6

Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2

SRPM
image-builder-31-3.el10_1.src.rpm	SHA-256: 6b7cb74fe8fd5c52ef783d3e02516772b2f92ee6c695e7ad65d2cd8c6f919b7a
x86_64
image-builder-31-3.el10_1.x86_64.rpm	SHA-256: a122930c4537529dc1cf5241f96ba1569712f94409d240449822bcd54b0d960f
image-builder-debuginfo-31-3.el10_1.x86_64.rpm	SHA-256: 26aa76763dc5ecf4bd22cce19b8d5dbdf0c0d20415d4449f135931ebeb76afb1
image-builder-debugsource-31-3.el10_1.x86_64.rpm	SHA-256: 7062119bd7aff8aa6bfb7f7334530753e82db7e1f0f455bb945ee94dd81961c6

Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2

SRPM
image-builder-31-3.el10_1.src.rpm	SHA-256: 6b7cb74fe8fd5c52ef783d3e02516772b2f92ee6c695e7ad65d2cd8c6f919b7a
aarch64
image-builder-31-3.el10_1.aarch64.rpm	SHA-256: 7634138d4b834879c85997522d0f5447cacc6af583491c466bf033928f8b13b5
image-builder-debuginfo-31-3.el10_1.aarch64.rpm	SHA-256: 1440c375ede34ef95530a86a8e8436518c811efb723b7bd9015415d3db20f49e
image-builder-debugsource-31-3.el10_1.aarch64.rpm	SHA-256: 2b7e2c0ecbb4938626b85df437b03b1e287dc8e737200409a475e659f1c1c4d3

Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2

SRPM
image-builder-31-3.el10_1.src.rpm	SHA-256: 6b7cb74fe8fd5c52ef783d3e02516772b2f92ee6c695e7ad65d2cd8c6f919b7a
ppc64le
image-builder-31-3.el10_1.ppc64le.rpm	SHA-256: 5daa0e1ded189c6677cd012d9390d9858b125881f3d7f1ab4b362d42ec74c383
image-builder-debuginfo-31-3.el10_1.ppc64le.rpm	SHA-256: 1a7735e89b71b8c4c9ec8f825df02a6c4fbca1706e026f3507bf0a19e716cf79
image-builder-debugsource-31-3.el10_1.ppc64le.rpm	SHA-256: 73f6e9cd7617d64ca114fc640479dd6318ef9f2241dbd0c1a06d2e7f46181ef3

Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2

SRPM
image-builder-31-3.el10_1.src.rpm	SHA-256: 6b7cb74fe8fd5c52ef783d3e02516772b2f92ee6c695e7ad65d2cd8c6f919b7a
s390x
image-builder-31-3.el10_1.s390x.rpm	SHA-256: f81f30372bf46ca4d81954edb860560676e8af9cbc2c8d7be83c99467b305898
image-builder-debuginfo-31-3.el10_1.s390x.rpm	SHA-256: 6d7f24e16c4eee7f03806b5186c18e449c8a26160178905ffccfb50d71b1a13e
image-builder-debugsource-31-3.el10_1.s390x.rpm	SHA-256: d89c6446091d0729be76f3277865403da84e7b6e20973106c464c8a67474325d

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.

Select Your Language

Infrastructure and Management

Cloud Computing

Storage

Runtimes

Integration and Automation