docker.io/newrelic/infrastructure-bundle:3.3.33
Base OS: alpine 3.24.150 vulnerabilities fixed
Patched Image
ghcr.io/verity-org/newrelic/infrastructure-bundle:3.3.33
Supply Chain
Full compliance detailsSignedSLSA L3SBOMRekor
Verify this artifact
Cosign signature
cosign verify \ --certificate-identity-regexp "https://github.com/verity-org/verity/.github/workflows/" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ ghcr.io/verity-org/newrelic/infrastructure-bundle:3.3.33
Build provenance
gh attestation verify \ oci://ghcr.io/verity-org/newrelic/infrastructure-bundle:3.3.33 \ --owner verity-org
Before patching
Found 105 vulnerabilities in the original image. 50 fixed by Copa. 55 remaining after patching.
27 HIGH19 MEDIUM2 LOW57 UNKNOWN
Fix available — pending patch
These vulnerabilities have upstream fixes but could not be automatically patched. Manual remediation may be required.
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39824UNKNOWN
- Package
- golang.org/x/sys
- Installed
- v0.41.0
- Fixed
- 0.44.0
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39824UNKNOWN
- Package
- golang.org/x/sys
- Installed
- v0.42.0
- Fixed
- 0.44.0
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.4
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39824 | golang.org/x/sys | v0.41.0 | 0.44.0 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39824 | golang.org/x/sys | v0.42.0 | 0.44.0 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.4 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
Awaiting upstream fix
No fix is available yet for these vulnerabilities. They can be suppressed in your compliance tooling until an upstream fix is released.
- GO-2026-5932UNKNOWN
- Package
- golang.org/x/crypto
- Installed
- v0.53.0
- Fixed
- GO-2026-5932UNKNOWN
- Package
- golang.org/x/crypto
- Installed
- v0.52.0
- Fixed
- GO-2026-5932UNKNOWN
- Package
- golang.org/x/crypto
- Installed
- v0.53.0
- Fixed
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| GO-2026-5932 | golang.org/x/crypto | v0.53.0 | UNKNOWN | |
| GO-2026-5932 | golang.org/x/crypto | v0.52.0 | UNKNOWN | |
| GO-2026-5932 | golang.org/x/crypto | v0.53.0 | UNKNOWN |
Original image reference
docker.io/newrelic/infrastructure-bundle:3.3.33