Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
AlmaLinux image-builder may misinterpret IPv6 addresses
published 6 months ago
Summary
The image-building tool used to create custom virtual machine images can incorrectly read IPv6 network addresses. This mistake could cause the tool to connect to the wrong host or expose the system to network‑related risks. Update the software to the latest version to fix the parsing error.
What to do
- Update almalinux image-builder to version 31-5.el10_1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:10 | almalinux | image-builder |
< 31-5.el10_1 Fix: upgrade to 31-5.el10_1
|
Original advisory text
Important: image-builder security update
A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.
Security Fix(es):
* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:13642 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-25679 Third Party Advisory
- https://bugzilla.redhat.com/2445356 Third Party Advisory
- https://errata.almalinux.org/10/ALSA-2026-13642.html Vendor Advisory
Timeline
Published5 May 2026
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2026:13642 · OSV
Track software like this
Free during beta