{ "vulnerabilities": [ { "id": "SNYK-ALPINE323-UTILLINUX-19533446", "cpes": [], "title": "Missing Release of File Descriptor or Handle after Effective Lifetime", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<2.41.6-r1" ] }, "exploit": "Not Defined", "fixedIn": [ "2.41.6-r1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.9, "malicious": false, "isDisputed": false, "references": [ { "url": "https://access.redhat.com/security/cve/CVE-2026-78408", "title": "https://access.redhat.com/security/cve/CVE-2026-78408" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522497" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63162", "title": "https://access.redhat.com/errata/RHSA-2026:63162" }, { "url": "http://www.openwall.com/lists/oss-security/2026/09/05/2", "title": "http://www.openwall.com/lists/oss-security/2026/09/05/2" }, { "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj", "title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "cvssV3BaseScore": 7.9, "modificationTime": "2026-09-02T18:25:42.573221Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "cvssV3BaseScore": 7.9, "modificationTime": "2026-09-03T07:55:50.442401Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 6.6, "modificationTime": "2026-09-28T11:03:15.966733Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.9, "cvssVersion": "3.1", "modificationTime": "2026-09-02T18:25:42.573221Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.9, "cvssVersion": "3.1", "modificationTime": "2026-09-03T07:55:50.442401Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 6.6, "cvssVersion": "3.1", "modificationTime": "2026-09-28T11:03:15.966733Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nThe nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.\n## Remediation\nUpgrade `Alpine:3.23` `util-linux` to version 2.41.6-r1 or higher.\n## References\n- [https://access.redhat.com/security/cve/CVE-2026-78408](https://access.redhat.com/security/cve/CVE-2026-78408)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522497](https://bugzilla.redhat.com/show_bug.cgi?id=2522497)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [http://www.openwall.com/lists/oss-security/2026/09/05/2](http://www.openwall.com/lists/oss-security/2026/09/05/2)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj](https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj)\n", "epssDetails": { "percentile": "0.07392", "probability": "0.00186", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-78408" ], "CWE": [ "CWE-775" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "util-linux", "creationTime": "2026-09-05T02:47:27.643332Z", "disclosureTime": "2026-09-02T16:17:23.687000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "alpine:3.23", "publicationTime": "2026-09-05T02:47:27.646768Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-28T11:03:16.374347Z", "socialTrendAlert": false, "relativeImportance": null, "severityWithCritical": "high", "from": [ "docker-image|docker.io/redis@8.8.0-alpine", "util-linux/setpriv@2.41.4-r0" ], "upgradePath": [ false, "util-linux/setpriv@2.41.6-r1" ], "isUpgradable": true, "isPatchable": false, "name": "util-linux/setpriv", "version": "2.41.4-r0", "nearestFixedInVersion": "2.41.6-r1" }, { "id": "SNYK-ALPINE323-UTILLINUX-19533448", "cpes": [], "title": "Detection of Error Condition Without Action", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<2.41.6-r0" ] }, "exploit": "Not Defined", "fixedIn": [ "2.41.6-r0" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://github.com/util-linux/util-linux", "title": "https://github.com/util-linux/util-linux" }, { "url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476", "title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L476" }, { "url": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892", "title": "https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c%23L892" }, { "url": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a", "title": "https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a" }, { "url": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc", "title": "https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc" }, { "url": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf", "title": "https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf" }, { "url": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper", "title": "https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper" }, { "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f", "title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-09-04T01:29:18.083087Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-09-03T07:55:06.120226Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-09-28T11:03:10.796717Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.083087Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-09-03T07:55:06.120226Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-09-28T11:03:10.796717Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nutil-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation.\n## Remediation\nUpgrade `Alpine:3.23` `util-linux` to version 2.41.6-r0 or higher.\n## References\n- [https://github.com/util-linux/util-linux](https://github.com/util-linux/util-linux)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476)\n- [https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892](https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892)\n- [https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a](https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a)\n- [https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc](https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc)\n- [https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf](https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf)\n- [https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper](https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f](https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f)\n", "epssDetails": { "percentile": "0.10694", "probability": "0.00216", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-76642" ], "CWE": [ "CWE-390" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "util-linux", "creationTime": "2026-09-05T02:47:47.009773Z", "disclosureTime": "2026-09-03T13:06:08.440000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "alpine:3.23", "publicationTime": "2026-09-05T02:47:47.016498Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-28T11:03:11.370502Z", "socialTrendAlert": false, "relativeImportance": null, "severityWithCritical": "high", "from": [ "docker-image|docker.io/redis@8.8.0-alpine", "util-linux/setpriv@2.41.4-r0" ], "upgradePath": [ false, "util-linux/setpriv@2.41.6-r0" ], "isUpgradable": true, "isPatchable": false, "name": "util-linux/setpriv", "version": "2.41.4-r0", "nearestFixedInVersion": "2.41.6-r0" }, { "id": "SNYK-ALPINE323-UTILLINUX-19533449", "cpes": [], "title": "Time-of-check Time-of-use (TOCTOU)", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<2.41.6-r0" ] }, "exploit": "Not Defined", "fixedIn": [ "2.41.6-r0" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://access.redhat.com/security/cve/CVE-2026-78410", "title": "https://access.redhat.com/security/cve/CVE-2026-78410" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2522684" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63162", "title": "https://access.redhat.com/errata/RHSA-2026:63162" }, { "url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m", "title": "https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-09-02T18:25:41.718430Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-09-03T07:55:46.643606Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-09-28T11:03:20.409615Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-09-02T18:25:41.718430Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-09-03T07:55:46.643606Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-09-28T11:03:20.409615Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `util-linux` package and not the `util-linux` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nA flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.\n## Remediation\nUpgrade `Alpine:3.23` `util-linux` to version 2.41.6-r0 or higher.\n## References\n- [https://access.redhat.com/security/cve/CVE-2026-78410](https://access.redhat.com/security/cve/CVE-2026-78410)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2522684](https://bugzilla.redhat.com/show_bug.cgi?id=2522684)\n- [https://access.redhat.com/errata/RHSA-2026:63162](https://access.redhat.com/errata/RHSA-2026:63162)\n- [https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m](https://github.com/util-linux/util-linux/security/advisories/GHSA-rh77-686x-2f2m)\n", "epssDetails": { "percentile": "0.04035", "probability": "0.00156", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-78410" ], "CWE": [ "CWE-367" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "util-linux", "creationTime": "2026-09-05T02:48:07.745405Z", "disclosureTime": "2026-09-02T16:17:23.983000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "alpine:3.23", "publicationTime": "2026-09-05T02:48:07.750246Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-28T11:03:20.883210Z", "socialTrendAlert": false, "relativeImportance": null, "severityWithCritical": "high", "from": [ "docker-image|docker.io/redis@8.8.0-alpine", "util-linux/setpriv@2.41.4-r0" ], "upgradePath": [ false, "util-linux/setpriv@2.41.6-r0" ], "isUpgradable": true, "isPatchable": false, "name": "util-linux/setpriv", "version": "2.41.4-r0", "nearestFixedInVersion": "2.41.6-r0" }, { "id": "SNYK-ALPINE323-ZLIB-20541565", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.3.2-r1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.3.2-r1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.23` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-10-07T03:03:50.501449Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "alpine:3.23", "publicationTime": "2026-10-07T03:03:50.509150Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:02.003141Z", "socialTrendAlert": false, "relativeImportance": null, "severityWithCritical": "high", "from": [ "docker-image|docker.io/redis@8.8.0-alpine", "zlib/zlib@1.3.2-r0" ], "upgradePath": [ false, "zlib/zlib@1.3.2-r1" ], "isUpgradable": true, "isPatchable": false, "name": "zlib/zlib", "version": "1.3.2-r0", "nearestFixedInVersion": "1.3.2-r1" }, { "id": "SNYK-ALPINE323-ZLIB-20541565", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.3.2-r1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.3.2-r1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.23` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-10-07T03:03:50.501449Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "alpine:3.23", "publicationTime": "2026-10-07T03:03:50.509150Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:02.003141Z", "socialTrendAlert": false, "relativeImportance": null, "severityWithCritical": "high", "from": [ "docker-image|docker.io/redis@8.8.0-alpine", "apk-tools/apk-tools@3.0.6-r0", "zlib/zlib@1.3.2-r0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib", "version": "1.3.2-r0", "nearestFixedInVersion": "1.3.2-r1" }, { "id": "SNYK-ALPINE323-ZLIB-20541565", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<1.3.2-r1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.3.2-r1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.23` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-10-07T03:03:50.501449Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "alpine:3.23", "publicationTime": "2026-10-07T03:03:50.509150Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:02.003141Z", "socialTrendAlert": false, "relativeImportance": null, "severityWithCritical": "high", "from": [ "docker-image|docker.io/redis@8.8.0-alpine", "apk-tools/apk-tools@3.0.6-r0", "apk-tools/libapk@3.0.6-r0", "zlib/zlib@1.3.2-r0" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib", "version": "1.3.2-r0", "nearestFixedInVersion": "1.3.2-r1" } ], "ok": false, "dependencyCount": 22, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "apk", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": { "os": { "prettyName": "Alpine Linux v3.23" } }, "summary": "6 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 4, "projectName": "docker-image|docker.io/redis", "platform": "linux/amd64", "hasUnknownVersions": false, "path": "docker.io/redis:8.8.0-alpine/redis" }