The Red Hat image-builder tool, which builds customized OS artifacts using osbuild, contains three security vulnerabilities: CVE-2025-61729 (denial of service via excessive resource consumption from crafted certificates in crypto/x509), CVE-2025-61726 (memory exhaustion in net/url query parameter parsing), and CVE-2025-68121 (unexpected session resumption in crypto/tls). These vulnerabilities can cause denial of service or unexpected behavior when processing crafted inputs. Red Hat has issued security updates for image-builder in Red Hat Enterprise Linux 10 to address these issues.

Successful exploitation of these vulnerabilities could lead to denial of service conditions due to excessive resource consumption or memory exhaustion, and unexpected TLS session resumption behavior. The impact is rated as Important by Red Hat Product Security, indicating a significant security concern but not necessarily remote code execution or data breach. No known exploits in the wild have been reported.

Red Hat has released updated image-builder packages for Red Hat Enterprise Linux 10 that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:3840 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are required beyond applying the official update.