caddy:2 (alpine 3.23.7) - Trivy Report - 2026-11-08 04:00:21.472763444 +0100 CET m=+0.032438623

alpine
Package Vulnerability ID Severity Installed Version Fixed Version Links
brotli-libs CVE-2026-111497 CRITICAL 1.2.0-r0 1.2.1-r0 http://www.openwall.com/lists/oss-security/2026/10/23/25 http://www.openwall.com/lists/oss-security/2026/10/24/6 http://www.openwall.com/lists/oss-security/2026/10/26/12 http://www.openwall.com/lists/oss-security/2026/10/26/13 http://www.openwall.com/lists/oss-security/2026/10/26/16 http://www.openwall.com/lists/oss-security/2026/11/03/2 https://access.redhat.com/errata/RHSA-2026:90495 https://access.redhat.com/errata/RHSA-2026:92492 https://access.redhat.com/security/cve/CVE-2026-111497 https://advisory.echohq.com/cve/CVE-2026-111497 https://broccoli2shell.com https://bugzilla.redhat.com/2558973 https://bugzilla.redhat.com/2562054 https://bugzilla.redhat.com/show_bug.cgi?id=2558973 https://cert-portal.siemens.com/productcert/html/ssa-045512.html https://cert-portal.siemens.com/productcert/html/ssa-443410.html https://cert-portal.siemens.com/productcert/html/ssa-898633.html https://creativecommons.org/licenses/by/4.0/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111497 https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/ https://errata.almalinux.org/9/ALSA-2026-92492.html https://errata.rockylinux.org/RLSA-2026:90495 https://github.com/advisories/GHSA-9v8h-qqgm-4m35 https://github.com/andybalholm/brotli/releases/tag/v1.2.7 https://github.com/dotnet/announcements/issues/494 https://github.com/google/brotli https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0 https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6 https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12 https://github.com/google/brotli/releases/tag/v1.0.10 https://github.com/google/brotli/releases/tag/v1.1.1 https://github.com/google/brotli/releases/tag/v1.2.1 https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2026-4322.yaml https://github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yaml https://linux.oracle.com/cve/CVE-2026-111497.html https://linux.oracle.com/errata/ELSA-2026-92492.html https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148 https://nodejs.org/en/blog/vulnerability/october-2026-security-releases https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high https://nvd.nist.gov/vuln/detail/CVE-2026-111497 https://opensourcemalware.com/blog/node2shell-affects-python https://patchtheplanet.org/brotli https://pypi.org/project/Brotli https://pypi.org/project/brotlicffi https://ubuntu.com/security/notices/USN-8956-1 https://ubuntu.com/security/notices/USN-8956-2 https://ubuntu.com/security/notices/USN-8958-1 https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497 https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497 https://www.cve.org/CVERecord?id=CVE-2026-111497
curl CVE-2026-92392 HIGH 8.22.0-r0 8.23.0-r0 http://www.openwall.com/lists/oss-security/2026/10/18/5 http://www.openwall.com/lists/oss-security/2026/10/18/6 https://access.redhat.com/security/cve/CVE-2026-92392 https://curl.se/docs/CVE-2026-92392.html https://curl.se/docs/CVE-2026-92392.json https://hackerone.com/reports/4030333 https://nvd.nist.gov/vuln/detail/CVE-2026-92392 https://ubuntu.com/security/notices/USN-8927-1 https://ubuntu.com/security/notices/USN-8927-2 https://www.cve.org/CVERecord?id=CVE-2026-92392
libcurl CVE-2026-92392 HIGH 8.22.0-r0 8.23.0-r0 http://www.openwall.com/lists/oss-security/2026/10/18/5 http://www.openwall.com/lists/oss-security/2026/10/18/6 https://access.redhat.com/security/cve/CVE-2026-92392 https://curl.se/docs/CVE-2026-92392.html https://curl.se/docs/CVE-2026-92392.json https://hackerone.com/reports/4030333 https://nvd.nist.gov/vuln/detail/CVE-2026-92392 https://ubuntu.com/security/notices/USN-8927-1 https://ubuntu.com/security/notices/USN-8927-2 https://www.cve.org/CVERecord?id=CVE-2026-92392
No Misconfigurations found
gobinary
Package Vulnerability ID Severity Installed Version Fixed Version Links
github.com/go-jose/go-jose/v3 CVE-2026-116587 HIGH v3.0.5 https://access.redhat.com/security/cve/CVE-2026-116587 https://github.com/go-jose/go-jose https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230 https://github.com/go-jose/go-jose/releases/tag/v4.1.6 https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q https://nvd.nist.gov/vuln/detail/CVE-2026-116587 https://www.cve.org/CVERecord?id=CVE-2026-116587
github.com/go-jose/go-jose/v4 CVE-2026-116587 HIGH v4.1.5 4.1.6 https://access.redhat.com/security/cve/CVE-2026-116587 https://github.com/go-jose/go-jose https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230 https://github.com/go-jose/go-jose/releases/tag/v4.1.6 https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q https://nvd.nist.gov/vuln/detail/CVE-2026-116587 https://www.cve.org/CVERecord?id=CVE-2026-116587
golang.org/x/net CVE-2026-78661 HIGH v0.59.0 0.62.0 https://access.redhat.com/security/cve/CVE-2026-78661 https://go.dev/cl/849365 https://go.dev/issue/82224 https://groups.google.com/g/golang-announce/c/sqrs2vTx_Xs https://nvd.nist.gov/vuln/detail/CVE-2026-78661 https://pkg.go.dev/vuln/GO-2026-6860 https://www.cve.org/CVERecord?id=CVE-2026-78661
golang.org/x/net CVE-2026-78669 HIGH v0.59.0 0.60.0 https://access.redhat.com/errata/RHSA-2026:93617 https://access.redhat.com/security/cve/CVE-2026-78669 https://bugzilla.redhat.com/2548334 https://bugzilla.redhat.com/2548336 https://bugzilla.redhat.com/2548341 https://bugzilla.redhat.com/2548344 https://bugzilla.redhat.com/2556068 https://bugzilla.redhat.com/show_bug.cgi?id=2548334 https://bugzilla.redhat.com/show_bug.cgi?id=2548336 https://bugzilla.redhat.com/show_bug.cgi?id=2548341 https://bugzilla.redhat.com/show_bug.cgi?id=2548344 https://bugzilla.redhat.com/show_bug.cgi?id=2556068 https://creativecommons.org/licenses/by/4.0/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031 https://errata.almalinux.org/9/ALSA-2026-93617.html https://errata.rockylinux.org/RLSA-2026:93617 https://github.com/golang/go/issues/81742 https://go.dev/cl/847186 https://go.dev/cl/847308 https://go.dev/issue/81742 https://groups.google.com/g/golang-announce/c/U2fTuyDJznI https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs https://linux.oracle.com/cve/CVE-2026-78669.html https://linux.oracle.com/errata/ELSA-2026-95519.html https://nvd.nist.gov/vuln/detail/CVE-2026-78669 https://pkg.go.dev/vuln/GO-2026-6611 https://ubuntu.com/security/notices/USN-8935-1 https://www.cve.org/CVERecord?id=CVE-2026-78669 https://www.openwall.com/lists/oss-security/2026/10/08/9
stdlib CVE-2026-111943 HIGH v1.26.8 1.26.10, 1.27.3 http://www.openwall.com/lists/oss-security/2026/10/20/29 https://access.redhat.com/errata/RHSA-2026:95518 https://access.redhat.com/security/cve/CVE-2026-111943 https://bugzilla.redhat.com/2548336 https://bugzilla.redhat.com/2556068 https://bugzilla.redhat.com/show_bug.cgi?id=2548336 https://bugzilla.redhat.com/show_bug.cgi?id=2556068 https://creativecommons.org/licenses/by/4.0/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031 https://errata.almalinux.org/9/ALSA-2026-95518.html https://errata.rockylinux.org/RLSA-2026:95518 https://github.com/golang/go/issues/82345 https://go.dev/cl/851047 https://go.dev/issue/82345 https://groups.google.com/g/golang-announce/c/66pojueaQek https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU https://linux.oracle.com/cve/CVE-2026-111943.html https://linux.oracle.com/errata/ELSA-2026-95519.html https://nvd.nist.gov/vuln/detail/CVE-2026-111943 https://pkg.go.dev/vuln/GO-2026-6809 https://www.cve.org/CVERecord?id=CVE-2026-111943
stdlib CVE-2026-78667 HIGH v1.26.8 1.26.9, 1.27.2 https://access.redhat.com/errata/RHSA-2026:93617 https://access.redhat.com/security/cve/CVE-2026-78667 https://bugzilla.redhat.com/2548334 https://bugzilla.redhat.com/2548336 https://bugzilla.redhat.com/2548341 https://bugzilla.redhat.com/2548344 https://bugzilla.redhat.com/2556068 https://bugzilla.redhat.com/show_bug.cgi?id=2548334 https://bugzilla.redhat.com/show_bug.cgi?id=2548336 https://bugzilla.redhat.com/show_bug.cgi?id=2548341 https://bugzilla.redhat.com/show_bug.cgi?id=2548344 https://bugzilla.redhat.com/show_bug.cgi?id=2556068 https://creativecommons.org/licenses/by/4.0/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031 https://errata.almalinux.org/9/ALSA-2026-93617.html https://errata.rockylinux.org/RLSA-2026:93617 https://github.com/golang/go/issues/81858 https://go.dev/cl/847309 https://go.dev/issue/81858 https://groups.google.com/g/golang-announce/c/U2fTuyDJznI https://linux.oracle.com/cve/CVE-2026-78667.html https://linux.oracle.com/errata/ELSA-2026-95519.html https://nvd.nist.gov/vuln/detail/CVE-2026-78667 https://pkg.go.dev/vuln/GO-2026-6609 https://ubuntu.com/security/notices/USN-8935-1 https://www.cve.org/CVERecord?id=CVE-2026-78667 https://www.openwall.com/lists/oss-security/2026/10/08/9
stdlib CVE-2026-78669 HIGH v1.26.8 1.26.9, 1.27.2 https://access.redhat.com/errata/RHSA-2026:93617 https://access.redhat.com/security/cve/CVE-2026-78669 https://bugzilla.redhat.com/2548334 https://bugzilla.redhat.com/2548336 https://bugzilla.redhat.com/2548341 https://bugzilla.redhat.com/2548344 https://bugzilla.redhat.com/2556068 https://bugzilla.redhat.com/show_bug.cgi?id=2548334 https://bugzilla.redhat.com/show_bug.cgi?id=2548336 https://bugzilla.redhat.com/show_bug.cgi?id=2548341 https://bugzilla.redhat.com/show_bug.cgi?id=2548344 https://bugzilla.redhat.com/show_bug.cgi?id=2556068 https://creativecommons.org/licenses/by/4.0/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78667 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-78669 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94440 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031 https://errata.almalinux.org/9/ALSA-2026-93617.html https://errata.rockylinux.org/RLSA-2026:93617 https://github.com/golang/go/issues/81742 https://go.dev/cl/847186 https://go.dev/cl/847308 https://go.dev/issue/81742 https://groups.google.com/g/golang-announce/c/U2fTuyDJznI https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs https://linux.oracle.com/cve/CVE-2026-78669.html https://linux.oracle.com/errata/ELSA-2026-95519.html https://nvd.nist.gov/vuln/detail/CVE-2026-78669 https://pkg.go.dev/vuln/GO-2026-6611 https://ubuntu.com/security/notices/USN-8935-1 https://www.cve.org/CVERecord?id=CVE-2026-78669 https://www.openwall.com/lists/oss-security/2026/10/08/9
stdlib CVE-2026-97031 HIGH v1.26.8 1.26.9, 1.27.2 https://access.redhat.com/errata/RHSA-2026:95518 https://access.redhat.com/security/cve/CVE-2026-97031 https://bugzilla.redhat.com/2548336 https://bugzilla.redhat.com/2556068 https://bugzilla.redhat.com/show_bug.cgi?id=2548336 https://bugzilla.redhat.com/show_bug.cgi?id=2556068 https://creativecommons.org/licenses/by/4.0/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111943 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97031 https://errata.almalinux.org/9/ALSA-2026-95518.html https://errata.rockylinux.org/RLSA-2026:95518 https://go.dev/cl/847312 https://go.dev/issue/81855 https://groups.google.com/g/golang-announce/c/U2fTuyDJznI https://linux.oracle.com/cve/CVE-2026-97031.html https://linux.oracle.com/errata/ELSA-2026-95519.html https://nvd.nist.gov/vuln/detail/CVE-2026-97031 https://pkg.go.dev/vuln/GO-2026-6607 https://www.cve.org/CVERecord?id=CVE-2026-97031
No Misconfigurations found