Critical vulnerabilities on mongo linux amd64 image

[jprecuch]

Hi,
It seems your latest image has lot of vulnerabilities. Can you please update it to eliminate these?
{
"image": "library/mongo@sha256:4b5bf3c2bb7516164f6dcb44acce4fdcb428abfe5771a1128304a0f34ab9ff7c",
"severity": "CRITICAL",
"vulnerability_ids": ["CVE-2025-68121","CVE-2026-27143","GO-2026-4337-stdlib","GO-2026-5005-golang.org/x/crypto","GO-2026-5006-golang.org/x/crypto","GO-2026-5017-golang.org/x/crypto","GO-2026-5019-golang.org/x/crypto","GO-2026-5020-golang.org/x/crypto","GO-2026-5021-golang.org/x/crypto","GO-2026-5023-golang.org/x/crypto","GO-2026-5026-golang.org/x/net"]
},

Same is visible in the offiical repository
https://hub.docker.com/layers/library/mongo/7.0.34/images/sha256-f11d03e9d23a4fa6131dd6a840cb5fb6bbfb557861f9c20f4b5a501192ac1584

[jprecuch]

It seems the latest are good. Closing

[tianon]

I'm glad your issue is resolved, but you may want to read https://github.com/docker-library/faq#why-does-my-security-scanner-show-that-an-image-has-cves anyhow

[jprecuch]

Reopening. It seems only windows images have 0 vulnerabilities. linux/amd64 still has tons of critical+high
https://hub.docker.com/layers/library/mongo/7.0.34/images/sha256-f11d03e9d23a4fa6131dd6a840cb5fb6bbfb557861f9c20f4b5a501192ac1584

[jurcyk]

dockerhub flagged the latest 8.3.4

https://hub.docker.com/layers/library/mongo/8.3.4/images/sha256-c00dfdf15a19a25d427485b1134643ad7efd2a572e61255cefd51e488f87d04f