Repository navigation
fix(docker): bump alpine runtime base to clear libcrypto3 CVE-2026-31789 - #83
Merged
Merged
Conversation
Bumps the runtime stage FROM alpine:3.21 → alpine:3.22 to clear the CRITICAL libcrypto3/libssl3 CVE-2026-31789 (heap buffer overflow) and all associated HIGH-severity OpenSSL/musl/zlib CVEs present in the stale alpine:3.21.6 base baked into the current image. Trivy before (ghcr.io/banua-coder/pico-api-go:latest, alpine 3.21.6): CRITICAL: 2 (CVE-2026-31789 libcrypto3 + libssl3) HIGH: 11 (alpine OS layer) Trivy after (alpine:3.22 base): CRITICAL: 0 HIGH: 2 (CVE-2026-45447, different issue, fixed version available) — CVE-2026-31789 is absent from alpine:3.22 Fixes: d8a7
Contributor
📊 Go Coverage Report
DetailsRun |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
FROM alpine:3.21→FROM alpine:3.22to clear the CRITICALlibcrypto3CVE-2026-31789 (OpenSSL heap buffer overflow on 32-bit systems) present in the stalealpine:3.21.6base of the current deployed image.Trivy scan results
Before (
ghcr.io/banua-coder/pico-api-go:latest— built on alpine 3.21.6):After (
alpine:3.22— verified on VPS viatrivy image alpine:3.22):CVE-2026-31789 is fully cleared. Reduction: 2 CRITICAL + 11 HIGH → 0 CRITICAL + 2 HIGH (OS layer).
Test plan
docker build -t pico-api-go:test .)trivy image pico-api-go:test --severity HIGH,CRITICALand confirm CVE-2026-31789 is absent and CRITICAL count is 0v<next>triggers deploy to VPSFixes bead d8a7.