fix: upgrade alpine packages in final image to address CVE-2026-63073 - #331
Merged
Conversation
The pinned alpine base ships openssl 3.5.7-r0, which is affected by CVE-2026-63073. The patched 3.5.8-r0 is already published in the apk repos, but alpine:latest has not been rebuilt since 3.24.1, so bumping the digest is currently a no-op. Upgrading at build time picks up the patched package now and self-heals future package CVEs between base image rebuilds. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
archf
approved these changes
Sep 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
CVE-2026-63073 — OpenSSL DoS via a format string in CMP message validation. Fixed in Alpine's
openssl3.5.8-r0.The pinned base in
Dockerfileships the vulnerable version:Bumping the digest does not fix this today. That image is Alpine 3.24.1, built 2026-06-16. Docker Official Images rebuild on Alpine point releases, not on individual package patches, so
alpine:lateststill resolves to the same digest and will until 3.24.2 ships.Change
RUN apk --no-cache upgradein the final stage. The patched package is already inv3.24/main, so this picks it up at build time, and it self-heals future package CVEs during the gap between base image rebuilds.Verified against the pinned base:
Risk
Low. The runner binary is Go and uses
crypto/tls, not libssl —libcrypto3/libssl3are present only forapkand busyboxssl_client, and nothing here acts as a CMP client. This clears the scanner finding rather than fixing a live exposure.Related: #325 (points Dependabot at the root Dockerfile so digest bumps actually get proposed).
🤖 Generated with Claude Code