Red Hat image-builder, a local binary for building customized OS artifacts such as VM images and OSTree commits, contains three security vulnerabilities: CVE-2025-61729 (denial of service via excessive resource consumption from crafted certificates in crypto/x509), CVE-2025-61726 (memory exhaustion in net/url query parameter parsing), and CVE-2025-68121 (unexpected session resumption in crypto/tls). These vulnerabilities can lead to denial of service or unexpected TLS behavior. The issues affect multiple architectures and versions of Red Hat Enterprise Linux 10. Red Hat has issued an important security update (RHSA-2026:3840) that addresses these vulnerabilities.

The vulnerabilities can cause denial of service conditions due to excessive resource consumption or memory exhaustion, potentially disrupting the image-building process. The unexpected session resumption in TLS could lead to unexpected behavior in TLS sessions, which may affect security properties of connections established by the image-builder tool. No known exploits in the wild have been reported at this time.

Red Hat has released an important security update for image-builder in Red Hat Enterprise Linux 10 that addresses these vulnerabilities. Users should apply the update as per the instructions in the Red Hat advisory RHSA-2026:3840 (https://access.redhat.com/errata/RHSA-2026:3840) and the related article https://access.redhat.com/articles/11258. Applying this update will remediate the issues. No additional mitigation steps are indicated by the vendor.