nginx:alpine (alpine 3.24.3) - Trivy Report - 2026-11-08 04:01:21.765662825 +0100 CET m=+0.037012328

alpine
Package	Vulnerability ID	Severity	Installed Version	Fixed Version	Links
brotli-libs	CVE-2026-111497	CRITICAL	1.2.0-r1	1.2.1-r0	http://www.openwall.com/lists/oss-security/2026/10/23/25 http://www.openwall.com/lists/oss-security/2026/10/24/6 http://www.openwall.com/lists/oss-security/2026/10/26/12 http://www.openwall.com/lists/oss-security/2026/10/26/13 http://www.openwall.com/lists/oss-security/2026/10/26/16 http://www.openwall.com/lists/oss-security/2026/11/03/2 https://access.redhat.com/errata/RHSA-2026:90495 https://access.redhat.com/errata/RHSA-2026:92492 https://access.redhat.com/security/cve/CVE-2026-111497 https://advisory.echohq.com/cve/CVE-2026-111497 https://broccoli2shell.com https://bugzilla.redhat.com/2558973 https://bugzilla.redhat.com/2562054 https://bugzilla.redhat.com/show_bug.cgi?id=2558973 https://cert-portal.siemens.com/productcert/html/ssa-045512.html https://cert-portal.siemens.com/productcert/html/ssa-443410.html https://cert-portal.siemens.com/productcert/html/ssa-898633.html https://creativecommons.org/licenses/by/4.0/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-111497 https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/ https://errata.almalinux.org/9/ALSA-2026-92492.html https://errata.rockylinux.org/RLSA-2026:90495 https://github.com/advisories/GHSA-9v8h-qqgm-4m35 https://github.com/andybalholm/brotli/releases/tag/v1.2.7 https://github.com/dotnet/announcements/issues/494 https://github.com/google/brotli https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0 https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6 https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12 https://github.com/google/brotli/releases/tag/v1.0.10 https://github.com/google/brotli/releases/tag/v1.1.1 https://github.com/google/brotli/releases/tag/v1.2.1 https://github.com/pypa/advisory-database/tree/main/vulns/brotli/PYSEC-2026-4322.yaml https://github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yaml https://linux.oracle.com/cve/CVE-2026-111497.html https://linux.oracle.com/errata/ELSA-2026-92492.html https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148 https://nodejs.org/en/blog/vulnerability/october-2026-security-releases https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high https://nvd.nist.gov/vuln/detail/CVE-2026-111497 https://opensourcemalware.com/blog/node2shell-affects-python https://patchtheplanet.org/brotli https://pypi.org/project/Brotli https://pypi.org/project/brotlicffi https://ubuntu.com/security/notices/USN-8956-1 https://ubuntu.com/security/notices/USN-8956-2 https://ubuntu.com/security/notices/USN-8958-1 https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497 https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497 https://www.cve.org/CVERecord?id=CVE-2026-111497
curl	CVE-2026-92392	HIGH	8.22.0-r0	8.23.0-r0	http://www.openwall.com/lists/oss-security/2026/10/18/5 http://www.openwall.com/lists/oss-security/2026/10/18/6 https://access.redhat.com/security/cve/CVE-2026-92392 https://curl.se/docs/CVE-2026-92392.html https://curl.se/docs/CVE-2026-92392.json https://hackerone.com/reports/4030333 https://nvd.nist.gov/vuln/detail/CVE-2026-92392 https://ubuntu.com/security/notices/USN-8927-1 https://ubuntu.com/security/notices/USN-8927-2 https://www.cve.org/CVERecord?id=CVE-2026-92392
libcurl	CVE-2026-92392	HIGH	8.22.0-r0	8.23.0-r0	http://www.openwall.com/lists/oss-security/2026/10/18/5 http://www.openwall.com/lists/oss-security/2026/10/18/6 https://access.redhat.com/security/cve/CVE-2026-92392 https://curl.se/docs/CVE-2026-92392.html https://curl.se/docs/CVE-2026-92392.json https://hackerone.com/reports/4030333 https://nvd.nist.gov/vuln/detail/CVE-2026-92392 https://ubuntu.com/security/notices/USN-8927-1 https://ubuntu.com/security/notices/USN-8927-2 https://www.cve.org/CVERecord?id=CVE-2026-92392
libexpat	CVE-2026-113351	HIGH	2.9.0-r0	2.10.0-r0	https://access.redhat.com/security/cve/CVE-2026-113351 https://github.com/libexpat/libexpat https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L1560 https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L860-L884 https://github.com/libexpat/libexpat/pull/1431 https://nvd.nist.gov/vuln/detail/CVE-2026-113351 https://www.cve.org/CVERecord?id=CVE-2026-113351 https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.9.0-denial-of-service-via-xml-parserreset
libexpat	CVE-2026-115506	HIGH	2.9.0-r0	2.10.0-r0	https://access.redhat.com/security/cve/CVE-2026-115506 https://github.com/hannob/lololol https://github.com/libexpat/libexpat https://github.com/libexpat/libexpat/issues/1160 https://github.com/libexpat/libexpat/pull/1433 https://nvd.nist.gov/vuln/detail/CVE-2026-115506 https://www.cve.org/CVERecord?id=CVE-2026-115506 https://www.vulncheck.com/advisories/libexpat-through-2.9.0-denial-of-service-via-billion-laughs-detection-delay
libexpat	CVE-2026-117610	HIGH	2.9.0-r0	2.10.0-r0	https://access.redhat.com/security/cve/CVE-2026-117610 https://github.com/libexpat/libexpat https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L3468-L3510 https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16fafd55876260701e04279a7489d https://github.com/libexpat/libexpat/pull/1444 https://nvd.nist.gov/vuln/detail/CVE-2026-117610 https://www.cve.org/CVERecord?id=CVE-2026-117610 https://www.vulncheck.com/advisories/libexpat-through-2.9.0-null-pointer-dereference-via-external-entity-subparser
libexpat	CVE-2026-118370	HIGH	2.9.0-r0	2.10.0-r0	https://access.redhat.com/security/cve/CVE-2026-118370 https://github.com/libexpat/libexpat https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140 https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c https://github.com/libexpat/libexpat/pull/1450 https://nvd.nist.gov/vuln/detail/CVE-2026-118370 https://www.cve.org/CVERecord?id=CVE-2026-118370 https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes
No Misconfigurations found