The Red Hat image-builder utility, which leverages osbuild to create customized operating system artifacts, contains three security vulnerabilities: CVE-2025-61729 (a denial of service caused by excessive resource consumption via crafted certificates in crypto/x509), CVE-2025-61726 (memory exhaustion in query parameter parsing within the golang net/url package), and CVE-2025-68121 (unexpected session resumption in crypto/tls). These vulnerabilities can lead to resource exhaustion or unexpected TLS behavior. Red Hat has issued an important security advisory (RHSA-2026:3839) with updated packages for Red Hat Enterprise Linux 9 on multiple architectures to address these issues.

The vulnerabilities can cause denial of service conditions through excessive resource consumption or memory exhaustion, potentially impacting the availability of systems using the image-builder tool. The unexpected session resumption in TLS could affect the security of TLS sessions, though specific impact details are not provided. No known exploits in the wild have been reported. The overall security impact is rated as Important by Red Hat.

Red Hat has released updated image-builder packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply these official updates as described in Red Hat advisory RHSA-2026:3839 and the linked update article (https://access.redhat.com/articles/11258). Since this is an on-premises product, patching is required by the user or administrator. Patch status is confirmed as available via the vendor advisory.