False Positive: GO-2026-5932 incorrectly flags golang.org/x/crypto even if openpgp subpackage is not used #10944
Answered
by
DmitriyLewen
av-commits
asked this question in
Q&A
IDsGO-2026-5932 DescriptionTrivy incorrectly flags golang.org/x/crypto as vulnerable to GO-2026-5932 in Go container image scans, stating there is no fixed version available. However, according to the official Go Vulnerability Database, this vulnerability solely affects the unmaintained golang.org/x/crypto/openpgp sub-package and its immediate sub-modules, not the entire root golang.org/x/crypto module. When a project updates golang.org/x/crypto to a modern version (e.g., v0.54.0) and imports other safe sub-packages like golang.org/x/crypto/ssh without importing or using the openpgp sub-package anywhere in the code, the official govulncheck tool correctly reports no vulnerabilities. Trivy seems to ignore the specific sub-path restriction and treats the root module as permanently vulnerable because the original openpgp package was deprecated without a fixed version. Reproduction Steps1. Create a Go project using golang.org/x/crypto v0.54.0 (e.g. import golang.org/x/crypto/ssh). Ensure golang.org/x/crypto/openpgp is NOT imported.
2. Run govulncheck ./... -> Result: No vulnerabilities found. (go install golang.org/x/vuln/cmd/govulncheck@latest)
3. Build a Docker image containing the compiled binary. (docker build, docker save)
4. Scan the image using Trivy: trivy image --input <image-path, tar>TargetContainer Image ScannerVulnerability Target OSalpine Debug Outputscanner [ / ]$ trivy image --debug --input /tmp/image
2026-07-09T14:02:33Z DEBUG No plugins loaded
2026-07-09T14:02:33Z DEBUG Default config file "file_path=trivy.yaml" not found, using built in values
2026-07-09T14:02:33Z DEBUG Cache dir dir="/home/scanner/.cache/trivy"
2026-07-09T14:02:33Z DEBUG Cache dir dir="/home/scanner/.cache/trivy"
2026-07-09T14:02:33Z DEBUG Parsed severities severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2026-07-09T14:02:33Z DEBUG Ignore statuses statuses=[]
2026-07-09T14:02:33Z DEBUG DB update was skipped because the local DB is the latest
2026-07-09T14:02:33Z DEBUG DB info schema=2 updated_at=2026-07-09T07:49:39.818995618Z next_update=2026-07-10T07:49:39.818995497Z downloaded_at=2026-07-09T12:30:07.240093722Z
2026-07-09T14:02:33Z DEBUG [pkg] Package types types=[os library]
2026-07-09T14:02:33Z DEBUG [pkg] Package relationships relationships=[unknown root workspace direct indirect]
2026-07-09T14:02:33Z INFO [vuln] Vulnerability scanning is enabled
2026-07-09T14:02:33Z INFO [secret] Secret scanning is enabled
2026-07-09T14:02:33Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2026-07-09T14:02:33Z INFO [secret] Please see https://trivy.dev/docs/v0.68/guide/scanner/secret#recommendation for faster secret detection
2026-07-09T14:02:33Z DEBUG Initializing scan cache... type="fs"
2026-07-09T14:02:33Z DEBUG [notification] Running version check
2026-07-09T14:02:33Z DEBUG [secret] No secret config detected config_path="trivy-secret.yaml"
2026-07-09T14:02:33Z DEBUG [secret] No secret config detected config_path="trivy-secret.yaml"
2026-07-09T14:02:33Z DEBUG Created process-specific temp directory path="/tmp/trivy-220062"
2026-07-09T14:02:33Z DEBUG [image] Detected image ID image_id="sha256:ae27907f9803259c44fde760e40fa3f246f7234565ae4a43be4896ee02bb5d38"
2026-07-09T14:02:33Z DEBUG [image] Detected diff ID diff_ids=[sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c sha256:f87f3d2feab840d71a91fc5a5699a664b175be3c61c2c92eee18c42b47e4244c sha256:511343ba2398e3d42d82ca7332c33b57f2222d977597cdc9fc8a7d8a9c125534]
2026-07-09T14:02:33Z DEBUG [image] Detected base layers diff_ids=[sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c]
2026-07-09T14:02:33Z DEBUG [image] No matching repo tag/digest found for artifact, using first one name="/tmp/image" ref="index.docker.io//tmp/image:latest" fallback="vul1-try1:latest"
2026-07-09T14:02:33Z INFO Detected OS family="alpine" version="3.24.1"
2026-07-09T14:02:33Z WARN This OS version is not on the EOL list family="alpine" version="3.24"
2026-07-09T14:02:33Z INFO [alpine] Detecting vulnerabilities... os_version="3.24" repository="3.24" pkg_num=16
2026-07-09T14:02:33Z INFO Number of language-specific files num=1
2026-07-09T14:02:33Z INFO [gobinary] Detecting vulnerabilities...
2026-07-09T14:02:33Z DEBUG [gobinary] Scanning packages for vulnerabilities file_path="usr/bin/vul1-try1"
2026-07-09T14:02:33Z DEBUG [gobinary] Skipping vulnerability scan as no version is detected for the package name="wgnet.ch/vul1-try1"
2026-07-09T14:02:33Z WARN Using severities from other vendors for some vulnerabilities. Read https://trivy.dev/docs/v0.68/guide/scanner/vulnerability#severity-selection for details.
2026-07-09T14:02:33Z DEBUG Specified ignore file does not exist file=".trivyignore"
2026-07-09T14:02:33Z DEBUG [vex] VEX filtering is disabled
Report Summary
┌────────────────────────────┬──────────┬─────────────────┬─────────┐
│ Target │ Type │ Vulnerabilities │ Secrets │
├────────────────────────────┼──────────┼─────────────────┼─────────┤
│ /tmp/image (alpine 3.24.1) │ alpine │ 0 │ - │
├────────────────────────────┼──────────┼─────────────────┼─────────┤
│ usr/bin/vul1-try1 │ gobinary │ 1 │ - │
└────────────────────────────┴──────────┴─────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)
usr/bin/vul1-try1 (gobinary)
Total: 1 (UNKNOWN: 1, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
┌─────────────────────┬───────────────┬──────────┬──────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├─────────────────────┼───────────────┼──────────┼──────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────┤
│ golang.org/x/crypto │ GO-2026-5932 │ UNKNOWN │ affected │ v0.54.0 │ │ The golang.org/x/crypto/openpgp package is unmaintained, │
│ │ │ │ │ │ │ unsafe by design, and has known security... │
└─────────────────────┴───────────────┴──────────┴──────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────┘
2026-07-09T14:02:33Z DEBUG Cleaning up temp directory path="/tmp/trivy-220062"
trivy image -f json --debug --input /tmp/image
2026-07-09T14:03:56Z DEBUG No plugins loaded
2026-07-09T14:03:56Z DEBUG Default config file "file_path=trivy.yaml" not found, using built in values
2026-07-09T14:03:56Z DEBUG Cache dir dir="/home/scanner/.cache/trivy"
2026-07-09T14:03:56Z DEBUG Cache dir dir="/home/scanner/.cache/trivy"
2026-07-09T14:03:56Z DEBUG Parsed severities severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2026-07-09T14:03:56Z DEBUG Ignore statuses statuses=[]
2026-07-09T14:03:56Z DEBUG DB update was skipped because the local DB is the latest
2026-07-09T14:03:56Z DEBUG DB info schema=2 updated_at=2026-07-09T07:49:39.818995618Z next_update=2026-07-10T07:49:39.818995497Z downloaded_at=2026-07-09T12:30:07.240093722Z
2026-07-09T14:03:56Z DEBUG [pkg] Package types types=[os library]
2026-07-09T14:03:56Z DEBUG [pkg] Package relationships relationships=[unknown root workspace direct indirect]
2026-07-09T14:03:56Z INFO [vuln] Vulnerability scanning is enabled
2026-07-09T14:03:56Z INFO [secret] Secret scanning is enabled
2026-07-09T14:03:56Z DEBUG [notification] Running version check
2026-07-09T14:03:56Z INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2026-07-09T14:03:56Z INFO [secret] Please see https://trivy.dev/docs/v0.68/guide/scanner/secret#recommendation for faster secret detection
2026-07-09T14:03:56Z DEBUG Initializing scan cache... type="fs"
2026-07-09T14:03:56Z DEBUG [secret] No secret config detected config_path="trivy-secret.yaml"
2026-07-09T14:03:56Z DEBUG [secret] No secret config detected config_path="trivy-secret.yaml"
2026-07-09T14:03:56Z DEBUG Created process-specific temp directory path="/tmp/trivy-220098"
2026-07-09T14:03:56Z DEBUG [image] Detected image ID image_id="sha256:ae27907f9803259c44fde760e40fa3f246f7234565ae4a43be4896ee02bb5d38"
2026-07-09T14:03:56Z DEBUG [image] Detected diff ID diff_ids=[sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c sha256:f87f3d2feab840d71a91fc5a5699a664b175be3c61c2c92eee18c42b47e4244c sha256:511343ba2398e3d42d82ca7332c33b57f2222d977597cdc9fc8a7d8a9c125534]
2026-07-09T14:03:56Z DEBUG [image] Detected base layers diff_ids=[sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c]
2026-07-09T14:03:56Z DEBUG [image] No matching repo tag/digest found for artifact, using first one name="/tmp/image" ref="index.docker.io//tmp/image:latest" fallback="vul1-try1:latest"
2026-07-09T14:03:56Z INFO Detected OS family="alpine" version="3.24.1"
2026-07-09T14:03:56Z WARN This OS version is not on the EOL list family="alpine" version="3.24"
2026-07-09T14:03:56Z INFO [alpine] Detecting vulnerabilities... os_version="3.24" repository="3.24" pkg_num=16
2026-07-09T14:03:56Z INFO Number of language-specific files num=1
2026-07-09T14:03:56Z INFO [gobinary] Detecting vulnerabilities...
2026-07-09T14:03:56Z DEBUG [gobinary] Scanning packages for vulnerabilities file_path="usr/bin/vul1-try1"
2026-07-09T14:03:56Z DEBUG [gobinary] Skipping vulnerability scan as no version is detected for the package name="wgnet.ch/vul1-try1"
2026-07-09T14:03:56Z WARN Using severities from other vendors for some vulnerabilities. Read https://trivy.dev/docs/v0.68/guide/scanner/vulnerability#severity-selection for details.
2026-07-09T14:03:56Z DEBUG Specified ignore file does not exist file=".trivyignore"
2026-07-09T14:03:56Z DEBUG [vex] VEX filtering is disabled
{
"SchemaVersion": 2,
"ReportID": "019f4731-3a22-702d-a007-76204d80e8ae",
"CreatedAt": "2026-07-09T14:03:56.322013173Z",
"ArtifactID": "sha256:fb04971433a9a88faa4edd69756f12a32582fc260ad581e83bfdaf881b3b2f2c",
"ArtifactName": "/tmp/image",
"ArtifactType": "container_image",
"Metadata": {
"Size": 14615552,
"OS": {
"Family": "alpine",
"Name": "3.24.1"
},
"ImageID": "sha256:ae27907f9803259c44fde760e40fa3f246f7234565ae4a43be4896ee02bb5d38",
"DiffIDs": [
"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c",
"sha256:f87f3d2feab840d71a91fc5a5699a664b175be3c61c2c92eee18c42b47e4244c",
"sha256:511343ba2398e3d42d82ca7332c33b57f2222d977597cdc9fc8a7d8a9c125534"
],
"RepoTags": [
"vul1-try1:latest"
],
"Reference": "vul1-try1:latest",
"ImageConfig": {
"architecture": "amd64",
"container": "b1fd875836967c3522756d5c6f32edc612e2170bb8de3a1814340e397332f498",
"created": "2026-07-09T13:53:47.960621472Z",
"history": [
{
"created": "2026-06-16T00:01:29.967161902Z",
"created_by": "ADD alpine-minirootfs-3.24.1-x86_64.tar.gz / # buildkit",
"comment": "buildkit.dockerfile.v0"
},
{
"created": "2026-06-16T00:01:29.967161902Z",
"created_by": "CMD [\"/bin/sh\"]",
"comment": "buildkit.dockerfile.v0",
"empty_layer": true
},
{
"created": "2026-07-09T13:53:44.252921276Z",
"created_by": "/bin/sh -c #(nop) LABEL maintainer=andrin@vocat.ch",
"empty_layer": true
},
{
"created": "2026-07-09T13:53:44.608124206Z",
"created_by": "/bin/sh -c #(nop) ENV TZ=Europe/Zurich",
"empty_layer": true
},
{
"created": "2026-07-09T13:53:44.944580518Z",
"created_by": "/bin/sh -c #(nop) COPY file:37884541285fe8b40efb2a4b8d0e3ffe6d54cb1f5da3130ed8b749ed17a4c65d in /usr/bin "
},
{
"created": "2026-07-09T13:53:47.601158851Z",
"created_by": "/bin/sh -c apk update --no-cache \u0026\u0026 apk upgrade --no-cache"
},
{
"created": "2026-07-09T13:53:47.960621472Z",
"created_by": "/bin/sh -c #(nop) CMD [\"/bin/sh\" \"-c\" \"/usr/bin/vul1-try1\"]",
"empty_layer": true
}
],
"os": "linux",
"rootfs": {
"type": "layers",
"diff_ids": [
"sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c",
"sha256:f87f3d2feab840d71a91fc5a5699a664b175be3c61c2c92eee18c42b47e4244c",
"sha256:511343ba2398e3d42d82ca7332c33b57f2222d977597cdc9fc8a7d8a9c125534"
]
},
"config": {
"Cmd": [
"/bin/sh",
"-c",
"/usr/bin/vul1-try1"
],
"Env": [
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
"TZ=Europe/Zurich"
],
"Image": "sha256:824b01049b4ec09a3f2deebe8220c297534093e5b02f5207a02a39ae401a12a0",
"Labels": {
"maintainer": "andrin@vocat.ch"
},
"WorkingDir": "/"
}
},
"Layers": [
{
"Size": 8697856,
"DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c"
},
{
"Size": 5891072,
"DiffID": "sha256:f87f3d2feab840d71a91fc5a5699a664b175be3c61c2c92eee18c42b47e4244c"
},
{
"Size": 26624,
"DiffID": "sha256:511343ba2398e3d42d82ca7332c33b57f2222d977597cdc9fc8a7d8a9c125534"
}
]
},
"Results": [
{
"Target": "/tmp/image (alpine 3.24.1)",
"Class": "os-pkgs",
"Type": "alpine",
"Packages": [
{
"ID": "alpine-baselayout@3.7.2-r1",
"Name": "alpine-baselayout",
"Identifier": {
"PURL": "pkg:apk/alpine/alpine-baselayout@3.7.2-r1?arch=x86_64\u0026distro=3.24.1",
"UID": "d01dfc4b865041e"
},
"Version": "3.7.2-r1",
"Arch": "x86_64",
"SrcName": "alpine-baselayout",
"SrcVersion": "3.7.2-r1",
"Licenses": [
"GPL-2.0-only"
],
"Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e",
"DependsOn": [
"alpine-baselayout-data@3.7.2-r1",
"busybox-binsh@1.37.0-r31"
],
"Layer": {
"DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c"
},
"Digest": "sha1:f0fcfdc2f4da058af6473bc45c4eab62916225b2",
"InstalledFiles": [
"etc/motd",
"etc/crontabs/root",
"etc/modprobe.d/aliases.conf",
"etc/modprobe.d/blacklist.conf",
"etc/modprobe.d/i386.conf",
"etc/profile.d/20locale.sh",
"etc/profile.d/README",
"etc/profile.d/color_prompt.sh.disabled",
"usr/lib/sysctl.d/00-alpine.conf",
"var/lock",
"var/run",
"var/spool/mail",
"var/spool/cron/crontabs"
]
},
{
"ID": "alpine-baselayout-data@3.7.2-r1",
"Name": "alpine-baselayout-data",
"Identifier": {
"PURL": "pkg:apk/alpine/alpine-baselayout-data@3.7.2-r1?arch=x86_64\u0026distro=3.24.1",
"UID": "91c8d4630d79993d"
},
"Version": "3.7.2-r1",
"Arch": "x86_64",
"SrcName": "alpine-baselayout",
"SrcVersion": "3.7.2-r1",
"Licenses": [
"GPL-2.0-only"
],
"Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e",
"Layer": {
"DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c"
},
"Digest": "sha1:c6f9bded17d844b6f1b0bb5766d2c35c0d5c8508",
"InstalledFiles": [
"etc/fstab",
"etc/group",
"etc/hostname",
"etc/hosts",
"etc/inittab",
"etc/modules",
"etc/mtab",
"etc/nsswitch.conf",
"etc/passwd",
"etc/profile",
"etc/protocols",
"etc/services",
"etc/shadow",
"etc/shells",
"etc/sysctl.conf"
]
},
{
"ID": "alpine-keys@2.6-r0",
"Name": "alpine-keys",
"Identifier": {
"PURL": "pkg:apk/alpine/alpine-keys@2.6-r0?arch=x86_64\u0026distro=3.24.1",
"UID": "b39e363743654908"
},
"Version": "2.6-r0",
"Arch": "x86_64",
"SrcName": "alpine-keys",
"SrcVersion": "2.6-r0",
"Licenses": [
"MIT"
],
"Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e",
"Layer": {
"DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c"
},
"Digest": "sha1:d8d6b80e53c059a77e4915da78ba964f3ffea240",
"InstalledFiles": [
"etc/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub",
"etc/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub",
"etc/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub",
"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub",
"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub",
"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub",
"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub",
"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub",
"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub",
"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub",
"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub",
"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub",
"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub",
"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub",
"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub",
"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub",
"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub",
"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub",
"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub",
"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub",
"usr/share/apk/keys/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub",
"usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-58199dcc.rsa.pub",
"usr/share/apk/keys/aarch64/alpine-devel@lists.alpinelinux.org-616ae350.rsa.pub",
"usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub",
"usr/share/apk/keys/armhf/alpine-devel@lists.alpinelinux.org-616a9724.rsa.pub",
"usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-524d27bb.rsa.pub",
"usr/share/apk/keys/armv7/alpine-devel@lists.alpinelinux.org-616adfeb.rsa.pub",
"usr/share/apk/keys/loongarch64/alpine-devel@lists.alpinelinux.org-66ba20fe.rsa.pub",
"usr/share/apk/keys/mips64/alpine-devel@lists.alpinelinux.org-5e69ca50.rsa.pub",
"usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-58cbb476.rsa.pub",
"usr/share/apk/keys/ppc64le/alpine-devel@lists.alpinelinux.org-616abc23.rsa.pub",
"usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-60ac2099.rsa.pub",
"usr/share/apk/keys/riscv64/alpine-devel@lists.alpinelinux.org-616db30d.rsa.pub",
"usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-58e4f17d.rsa.pub",
"usr/share/apk/keys/s390x/alpine-devel@lists.alpinelinux.org-616ac3bc.rsa.pub",
"usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub",
"usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub",
"usr/share/apk/keys/x86/alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub",
"usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub",
"usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub",
"usr/share/apk/keys/x86_64/alpine-devel@lists.alpinelinux.org-6165ee59.rsa.pub"
]
},
{
"ID": "alpine-release@3.24.1-r0",
"Name": "alpine-release",
"Identifier": {
"PURL": "pkg:apk/alpine/alpine-release@3.24.1-r0?arch=x86_64\u0026distro=3.24.1",
"UID": "d642b0f1f447ca38"
},
"Version": "3.24.1-r0",
"Arch": "x86_64",
"SrcName": "alpine-base",
"SrcVersion": "3.24.1-r0",
"Licenses": [
"MIT"
],
"Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e",
"DependsOn": [
"alpine-keys@2.6-r0"
],
"Layer": {
"DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c"
},
"Digest": "sha1:bc6912a25cdc7733e0035ed509eceaa4026946e3",
"InstalledFiles": [
"etc/alpine-release",
"etc/issue",
"etc/os-release",
"etc/secfixes.d/alpine",
"usr/lib/os-release"
]
},
{
"ID": "apk-tools@3.0.6-r0",
"Name": "apk-tools",
"Identifier": {
"PURL": "pkg:apk/alpine/apk-tools@3.0.6-r0?arch=x86_64\u0026distro=3.24.1",
"UID": "8109babd829ef74f"
},
"Version": "3.0.6-r0",
"Arch": "x86_64",
"SrcName": "apk-tools",
"SrcVersion": "3.0.6-r0",
"Licenses": [
"GPL-2.0-only"
],
"Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e",
"DependsOn": [
"ca-certificates-bundle@20260611-r0",
"libapk@3.0.6-r0",
"libcrypto3@3.5.7-r0",
"musl@1.2.6-r2",
"zlib@1.3.2-r0"
],
"Layer": {
"DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c"
},
"Digest": "sha1:043333589798a1f52e09ae63f026c6c8fa676d34",
"InstalledFiles": [
"sbin/apk"
]
},
{
"ID": "busybox@1.37.0-r31",
"Name": "busybox",
"Identifier": {
"PURL": "pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64\u0026distro=3.24.1",
"UID": "34f80ac1cf92a328"
},
"Version": "1.37.0-r31",
"Arch": "x86_64",
"SrcName": "busybox",
"SrcVersion": "1.37.0-r31",
"Licenses": [
"GPL-2.0-only"
],
"Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e",
"DependsOn": [
"musl@1.2.6-r2"
],
"Layer": {
"DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c"
},
"Digest": "sha1:b5405ebc02f7dd8be95b6265c54b243d5456ab8f",
"InstalledFiles": [
"bin/busybox",
"etc/securetty",
"etc/busybox-paths.d/busybox",
"etc/logrotate.d/acpid",
"etc/network/if-up.d/dad",
"etc/udhcpc/udhcpc.conf",
"usr/share/udhcpc/default.script"
]
},
{
"ID": "busybox-binsh@1.37.0-r31",
"Name": "busybox-binsh",
"Identifier": {
"PURL": "pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64\u0026distro=3.24.1",
"UID": "c326fa9b6d2dcf39"
},
"Version": "1.37.0-r31",
"Arch": "x86_64",
"SrcName": "busybox",
"SrcVersion": "1.37.0-r31",
"Licenses": [
"GPL-2.0-only"
],
"Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e",
"DependsOn": [
"busybox@1.37.0-r31"
],
"Layer": {
"DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c"
},
"Digest": "sha1:5cbd14acc6f1804c5bac6c77dc2c492f010b0fc7",
"InstalledFiles": [
"bin/sh"
]
},
{
"ID": "ca-certificates-bundle@20260611-r0",
"Name": "ca-certificates-bundle",
"Identifier": {
"PURL": "pkg:apk/alpine/ca-certificates-bundle@20260611-r0?arch=x86_64\u0026distro=3.24.1",
"UID": "6c40a8d356d65a84"
},
"Version": "20260611-r0",
"Arch": "x86_64",
"SrcName": "ca-certificates",
"SrcVersion": "20260611-r0",
"Licenses": [
"MPL-2.0",
"MIT"
],
"Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e",
"Layer": {
"DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c"
},
"Digest": "sha1:c9534a03750bdfae341f10969016090fc11febbd",
"InstalledFiles": [
"etc/ssl/cert.pem",
"etc/ssl/certs/ca-certificates.crt",
"etc/ssl1.1/cert.pem",
"etc/ssl1.1/certs"
]
},
{
"ID": "libapk@3.0.6-r0",
"Name": "libapk",
"Identifier": {
"PURL": "pkg:apk/alpine/libapk@3.0.6-r0?arch=x86_64\u0026distro=3.24.1",
"UID": "81e80460ef1380b1"
},
"Version": "3.0.6-r0",
"Arch": "x86_64",
"SrcName": "apk-tools",
"SrcVersion": "3.0.6-r0",
"Licenses": [
"GPL-2.0-only"
],
"Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e",
"DependsOn": [
"libcrypto3@3.5.7-r0",
"libssl3@3.5.7-r0",
"musl@1.2.6-r2",
"zlib@1.3.2-r0"
],
"Layer": {
"DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c"
},
"Digest": "sha1:523a8f58104589f74f743d501c81bf6517155378",
"InstalledFiles": [
"usr/lib/libapk.so.3.0.0"
]
},
{
"ID": "libcrypto3@3.5.7-r0",
"Name": "libcrypto3",
"Identifier": {
"PURL": "pkg:apk/alpine/libcrypto3@3.5.7-r0?arch=x86_64\u0026distro=3.24.1",
"UID": "62056e3aa4d5bf84"
},
"Version": "3.5.7-r0",
"Arch": "x86_64",
"SrcName": "openssl",
"SrcVersion": "3.5.7-r0",
"Licenses": [
"Apache-2.0"
],
"Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e",
"DependsOn": [
"musl@1.2.6-r2"
],
"Layer": {
"DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c"
},
"Digest": "sha1:481afbc52bcf06f2316c93a0a81ce8f72bed503e",
"InstalledFiles": [
"etc/ssl/ct_log_list.cnf",
"etc/ssl/ct_log_list.cnf.dist",
"etc/ssl/openssl.cnf",
"etc/ssl/openssl.cnf.dist",
"usr/lib/libcrypto.so.3",
"usr/lib/engines-3/afalg.so",
"usr/lib/engines-3/capi.so",
"usr/lib/engines-3/loader_attic.so",
"usr/lib/engines-3/padlock.so",
"usr/lib/ossl-modules/legacy.so"
]
},
{
"ID": "libssl3@3.5.7-r0",
"Name": "libssl3",
"Identifier": {
"PURL": "pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64\u0026distro=3.24.1",
"UID": "454f3f7c0deb69d"
},
"Version": "3.5.7-r0",
"Arch": "x86_64",
"SrcName": "openssl",
"SrcVersion": "3.5.7-r0",
"Licenses": [
"Apache-2.0"
],
"Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e",
"DependsOn": [
"libcrypto3@3.5.7-r0",
"musl@1.2.6-r2"
],
"Layer": {
"DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c"
},
"Digest": "sha1:240c8252d1ca145873c03c997966698eb509f745",
"InstalledFiles": [
"usr/lib/libssl.so.3"
]
},
{
"ID": "musl@1.2.6-r2",
"Name": "musl",
"Identifier": {
"PURL": "pkg:apk/alpine/musl@1.2.6-r2?arch=x86_64\u0026distro=3.24.1",
"UID": "88c486aad34372b6"
},
"Version": "1.2.6-r2",
"Arch": "x86_64",
"SrcName": "musl",
"SrcVersion": "1.2.6-r2",
"Licenses": [
"MIT"
],
"Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e",
"Layer": {
"DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c"
},
"Digest": "sha1:0f7e5827e4e1a73631beda27b78431a8ba240e05",
"InstalledFiles": [
"lib/ld-musl-x86_64.so.1",
"lib/libc.musl-x86_64.so.1"
]
},
{
"ID": "musl-utils@1.2.6-r2",
"Name": "musl-utils",
"Identifier": {
"PURL": "pkg:apk/alpine/musl-utils@1.2.6-r2?arch=x86_64\u0026distro=3.24.1",
"UID": "97ae5d17e282d20b"
},
"Version": "1.2.6-r2",
"Arch": "x86_64",
"SrcName": "musl",
"SrcVersion": "1.2.6-r2",
"Licenses": [
"MIT",
"BSD-2-Clause",
"GPL-2.0-or-later"
],
"Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e",
"DependsOn": [
"musl@1.2.6-r2",
"scanelf@1.3.9-r1"
],
"Layer": {
"DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c"
},
"Digest": "sha1:75ada3c48d63ec5d87c42fdf934a3fdd11298dc5",
"InstalledFiles": [
"sbin/ldconfig",
"usr/bin/getconf",
"usr/bin/getent",
"usr/bin/iconv",
"usr/bin/ldd"
]
},
{
"ID": "scanelf@1.3.9-r1",
"Name": "scanelf",
"Identifier": {
"PURL": "pkg:apk/alpine/scanelf@1.3.9-r1?arch=x86_64\u0026distro=3.24.1",
"UID": "d5d2225ec7c581b6"
},
"Version": "1.3.9-r1",
"Arch": "x86_64",
"SrcName": "pax-utils",
"SrcVersion": "1.3.9-r1",
"Licenses": [
"GPL-2.0-only"
],
"Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e",
"DependsOn": [
"musl@1.2.6-r2"
],
"Layer": {
"DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c"
},
"Digest": "sha1:013f903d0ba219673aebbdd04f74bb5ed82b01f0",
"InstalledFiles": [
"usr/bin/scanelf"
]
},
{
"ID": "ssl_client@1.37.0-r31",
"Name": "ssl_client",
"Identifier": {
"PURL": "pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64\u0026distro=3.24.1",
"UID": "c588fade499b034d"
},
"Version": "1.37.0-r31",
"Arch": "x86_64",
"SrcName": "busybox",
"SrcVersion": "1.37.0-r31",
"Licenses": [
"GPL-2.0-only"
],
"Maintainer": "Sören Tempel \u003csoeren+alpine@soeren-tempel.net\u003e",
"DependsOn": [
"libcrypto3@3.5.7-r0",
"libssl3@3.5.7-r0",
"musl@1.2.6-r2"
],
"Layer": {
"DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c"
},
"Digest": "sha1:c220f4a5125a313af733e98def94132bb1e9d40d",
"InstalledFiles": [
"usr/bin/ssl_client"
]
},
{
"ID": "zlib@1.3.2-r0",
"Name": "zlib",
"Identifier": {
"PURL": "pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64\u0026distro=3.24.1",
"UID": "c7d706f532eb095d"
},
"Version": "1.3.2-r0",
"Arch": "x86_64",
"SrcName": "zlib",
"SrcVersion": "1.3.2-r0",
"Licenses": [
"Zlib"
],
"Maintainer": "Natanael Copa \u003cncopa@alpinelinux.org\u003e",
"DependsOn": [
"musl@1.2.6-r2"
],
"Layer": {
"DiffID": "sha256:34884abbe92863fce933ed7c39c0e045631af0ed86d5cc0dfbdf9fdca426ce3c"
},
"Digest": "sha1:dd4c3d102acaef2a71a1495951d55fabc8680613",
"InstalledFiles": [
"usr/lib/libz.so.1",
"usr/lib/libz.so.1.3.2"
]
}
]
},
{
"Target": "usr/bin/vul1-try1",
"Class": "lang-pkgs",
"Type": "gobinary",
"Packages": [
{
"ID": "wgnet.ch/vul1-try1",
"Name": "wgnet.ch/vul1-try1",
"Identifier": {
"PURL": "pkg:golang/wgnet.ch/vul1-try1",
"UID": "340afccdda0b3263"
},
"Relationship": "root",
"DependsOn": [
"golang.org/x/crypto@v0.54.0",
"stdlib@v1.26.5"
],
"Layer": {
"DiffID": "sha256:f87f3d2feab840d71a91fc5a5699a664b175be3c61c2c92eee18c42b47e4244c"
}
},
{
"ID": "stdlib@v1.26.5",
"Name": "stdlib",
"Identifier": {
"PURL": "pkg:golang/stdlib@v1.26.5",
"UID": "bc9fa43d784e8f7"
},
"Version": "v1.26.5",
"Relationship": "direct",
"Layer": {
"DiffID": "sha256:f87f3d2feab840d71a91fc5a5699a664b175be3c61c2c92eee18c42b47e4244c"
}
},
{
"ID": "golang.org/x/crypto@v0.54.0",
"Name": "golang.org/x/crypto",
"Identifier": {
"PURL": "pkg:golang/golang.org/x/crypto@v0.54.0",
"UID": "e7fa18a541ac9530"
},
"Version": "v0.54.0",
"Layer": {
"DiffID": "sha256:f87f3d2feab840d71a91fc5a5699a664b175be3c61c2c92eee18c42b47e4244c"
}
}
],
"Vulnerabilities": [
{
"VulnerabilityID": "GO-2026-5932",
"PkgID": "golang.org/x/crypto@v0.54.0",
"PkgName": "golang.org/x/crypto",
"PkgIdentifier": {
"PURL": "pkg:golang/golang.org/x/crypto@v0.54.0",
"UID": "e7fa18a541ac9530"
},
"InstalledVersion": "v0.54.0",
"Status": "affected",
"Layer": {
"DiffID": "sha256:f87f3d2feab840d71a91fc5a5699a664b175be3c61c2c92eee18c42b47e4244c"
},
"DataSource": {
"ID": "govulndb",
"Name": "The Go Vulnerability Database",
"URL": "https://pkg.go.dev/vuln/"
},
"Fingerprint": "sha256:7a0445339bbafa3856d62dc1dc891117400723af3e3d6e3f1ad922b2b8b89932",
"Title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues",
"Description": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.",
"Severity": "UNKNOWN",
"References": [
"https://go.dev/issue/44226",
"https://pkg.go.dev/vuln/GO-2026-5932"
]
}
]
}
]
}
2026-07-09T14:03:56Z DEBUG Cleaning up temp directory path="/tmp/trivy-220098"VersionVersion: 0.68.2
Vulnerability DB:
Version: 2
UpdatedAt: 2026-07-09 07:49:39.818995618 +0000 UTC
NextUpdate: 2026-07-10 07:49:39.818995497 +0000 UTC
DownloadedAt: 2026-07-09 12:30:07.240093722 +0000 UTCChecklist
|
Answered by
DmitriyLewen
Jul 10, 2026
Replies: 1 comment 3 replies
|
Hi @av-commits, thanks for the detailed report! This is a known limitation rather than a false positive we can fix on the detection side. To build the list of Go dependencies, Trivy relies on the module information embedded in the binary (the same data as Extracting the list of imported sub-packages from a binary is possible in theory, but it's problematic in practice and comes with a number of caveats, so we don't do it today. We did consider integrating Regards, Dmitriy |
3 replies
|
Hi @DmitriyLewen, thanks for your response. Until now, I could handle this simply by updating the library, even if I didn't use the sub-package. However, in this case, we won't see a fixed version until they remove the entire sub-package. Therefore, my only immediate option is to tell Trivy to ignore GO-2026-5932. You previously shared a link to #2845, but that ticket is closed and does not provide a solution for the overall problem (e.g., attaching a VEX document). What is your recommendation on how to achieve a sustainable, long-term solution? |
|
You can create a openVEX document using govulncheck and filter out this vulnerability, being confident that your code doesn't use this subpackage. |
|
Ok, I use harbor, so I have no access to the trivy parameters. But I found the discussion to transport it over OCI-attestation (--vex oci). Fould following goharbor/harbor#22720, will try to push that. |
Answer selected by
av-commits
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hi @av-commits, thanks for the detailed report!
This is a known limitation rather than a false positive we can fix on the detection side.
To build the list of Go dependencies, Trivy relies on the module information embedded in the binary (the same data as
go version -m). That output contains only modules, not the individual sub-packages that were imported. Because of this, Trivy cannot tell whether the vulnerablegolang.org/x/crypto/openpgpsub-package is actually used, and it flags the whole module as affected.Extracting the list of imported sub-packages from a binary is possible in theory, but it's problematic in practice and comes with a number of caveats, so we don't do it today.
We …