CVE-2026-25679 is a security vulnerability in the image-builder tool used for creating customized OS artifacts such as VM images and OSTree commits. The issue involves incorrect parsing of IPv6 host literals in the net/url package. This vulnerability affects versions of image-builder prior to 31-4.el9_7. A security update fixing this issue is available.