Summary
Image: ghcr.io/github/gh-aw-firewall/squid:0.27.44@sha256:83e48bbe12...
13 High, 9 Medium vulnerabilities (all in bind-libs/bind-tools, busybox, nghttp2-libs); 36 license policy violations.
Remediation
- Upgrade
bind-libs/bind-tools to >= 9.20.26-r0 (Alpine package update) to resolve all 13 High + 2 Medium BIND CVEs.
- Update
busybox/ssl_client and nghttp2-libs via apk upgrade once patched Alpine packages are published for CVE-2025-60876 and CVE-2026-58055.
- License violations are largely standard Alpine GPL-2.0/LGPL base-layer packages (busybox, apk-tools, musl-utils, libgcc, alpine-baselayout) plus squid/curl/bash/net-tools dependencies — evaluate as an accepted policy exception for base-OS packages.
Vulnerabilities
22 vulnerabilities, primarily BIND (bind-libs/bind-tools)
License Violations
36 rejected/unknown licenses
| Package |
Version |
License(s) |
| apk-tools |
3.0.6-r0 |
GPL-2.0-only |
| libcap2 |
2.78-r0 |
GPL-2.0-only |
| squid |
7.6-r0 |
GPL-2.0-or-later |
| musl-utils |
1.2.6-r2 |
GPL-2.0-or-later |
| libgcc |
15.2.0-r5 |
GPL-2.0-or-later, LGPL-2.1-or-later |
| libstdc++ |
15.2.0-r5 |
GPL-2.0-or-later, LGPL-2.1-or-later |
| bind-libs |
9.20.24-r0 |
MPL-2.0 |
| ssl_client |
1.37.0-r31 |
GPL-2.0-only |
| curl |
8.21.0-r0 |
curl |
| ncurses-terminfo-base |
6.6_p20260516-r0 |
X11 |
| libcom_err |
1.47.4-r0 |
GPL-2.0-or-later, LGPL-2.0-or-later |
| libltdl |
2.6.0-r1 |
LGPL-2.0-or-later, GPL-2.0-or-later |
| libunistring |
1.4.2-r0 |
GPL-2.0-or-later, LGPL-3.0-or-later |
| libmd |
1.2.0-r0 |
AND, Beerware, Domain, Public |
| acl-libs |
2.3.2-r1 |
LGPL-2.1-or-later, GPL-2.0-or-later |
| libidn2 |
2.3.8-r0 |
GPL-2.0-or-later, LGPL-3.0-or-later |
| mii-tool |
2.10-r3 |
GPL-2.0-or-later |
| net-tools |
2.10-r3 |
GPL-2.0-or-later |
| alpine-baselayout-data |
3.7.2-r1 |
GPL-2.0-only |
| ca-certificates-bundle |
20260611-r0 |
MPL-2.0 |
| readline |
8.3.3-r1 |
GPL-3.0-or-later |
| zlib |
1.3.2-r0 |
Zlib |
| libcurl |
8.21.0-r0 |
curl |
| libapk |
3.0.6-r0 |
GPL-2.0-only |
| xz-libs |
5.8.3-r0 |
0BSD, AND, GPL-2.0-or-later, LGPL-2.1-or-later, Public-Domain |
| zstd-libs |
1.5.7-r2 |
GPL-2.0-or-later |
| alpine-baselayout |
3.7.2-r1 |
GPL-2.0-only |
| logrotate |
3.22.0-r0 |
GPL-2.0-or-later |
| sqlite-libs |
3.53.2-r0 |
blessing |
| bash |
5.3.9-r1 |
GPL-3.0-or-later |
| busybox |
1.37.0-r31 |
GPL-2.0-only |
| busybox-binsh |
1.37.0-r31 |
GPL-2.0-only |
| scanelf |
1.3.9-r1 |
GPL-2.0-only |
| libncursesw |
6.6_p20260516-r0 |
X11 |
| keyutils-libs |
1.6.3-r4 |
GPL-2.0-or-later, LGPL-2.0-or-later |
| bind-tools |
9.20.24-r0 |
MPL-2.0 |
| userspace-rcu |
0.15.3-r0 |
LGPL-2.1-or-later |
Generated by 🛡️ Daily Container Image Security Scan · auto · 327.5 AIC · ⌖ 10.6 AIC · ⊞ 6.5K · ◷
Summary
Image:
ghcr.io/github/gh-aw-firewall/squid:0.27.44@sha256:83e48bbe12...13 High, 9 Medium vulnerabilities (all in
bind-libs/bind-tools,busybox,nghttp2-libs); 36 license policy violations.Remediation
bind-libs/bind-toolsto >= 9.20.26-r0 (Alpine package update) to resolve all 13 High + 2 Medium BIND CVEs.busybox/ssl_clientandnghttp2-libsviaapk upgradeonce patched Alpine packages are published for CVE-2025-60876 and CVE-2026-58055.Vulnerabilities
22 vulnerabilities, primarily BIND (bind-libs/bind-tools)
License Violations
36 rejected/unknown licenses