Bug: CVE-2026-2673 (HIGH) in latest Docker image blocking updates — OpenSSL 3.5.5 needs rebuild

[BeBeRex56]

Bug Report: CVE-2026-2673 (HIGH) in latest image blocking container updates

Describe the bug
The anirdev/slink:latest Docker image currently ships with OpenSSL 3.5.5, which contains a HIGH severity vulnerability (CVE-2026-2673). This is blocking automated container update pipelines that perform vulnerability scanning (e.g. Dockhand with Grype/Trivy) from pulling the new image.

Vulnerability details

CVE	Severity	Package	Current Version	Fixed In
CVE-2026-2673	HIGH	openssl	3.5.5	3.5.6
CVE-2025-60876	MEDIUM	busybox	1.37.0	—
CVE-2025-46394	LOW	busybox	1.37.0	—
CVE-2024-58251	LOW	busybox	1.37.0	—

The HIGH severity OpenSSL CVE is the primary blocker — a fix is available in OpenSSL 3.5.6.

Environment

• Image: anirdev/slink:latest (Alpine 3.23)
• Scanner: Grype + Trivy
• Total packages scanned: 142

Expected behavior
The published image should be rebuilt against a base that includes OpenSSL 3.5.6 so that the HIGH CVE is resolved.

Steps to reproduce

1. Pull anirdev/slink:latest
2. Run a Grype or Trivy vulnerability scan against the image
3. Observe CVE-2026-2673 flagged as HIGH severity

Possible fix
Rebuilding the Docker image against an updated Alpine 3.23 base (or bumping the OpenSSL dependency directly) should resolve the HIGH CVE, as the patch is already available in OpenSSL 3.5.6.

Thanks for maintaining this project!

[andrii-kryvoviaz]

Hi, thanks for reporting this. Alpine repository still has OpenSSL 3.5.5. I won't build it from source, so might take some time to include it in the next patches.

Btw, in the last build I ditched base php image, which had many CVEs for months and went with DHI instead. This alone reduces the amount of CVEs, so I would recommend the latest over 1.9.6.

[andrii-kryvoviaz]

Closing this, as the latest release already got OpenSSL 3.5.6 included: