ghcr.io/aquasecurity/trivy:0.71.1

Base OS: alpine 3.23.445 vulnerabilities fixed

Patched Image

ghcr.io/verity-org/aquasecurity/trivy:0.71.1

Supply Chain

SignedSLSA L3SBOMRekor

Verify this artifact

Cosign signature

cosign verify \
  --certificate-identity-regexp "https://github.com/verity-org/verity/.github/workflows/" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ghcr.io/verity-org/aquasecurity/trivy:0.71.1

Build provenance

gh attestation verify \
  oci://ghcr.io/verity-org/aquasecurity/trivy:0.71.1 \
  --owner verity-org

Before patching

Found 66 vulnerabilities in the original image. 45 fixed by Copa. 21 remaining after patching.

14 HIGH25 MEDIUM22 LOW5 UNKNOWN

Fix available — pending patch

These vulnerabilities have upstream fixes but could not be automatically patched. Manual remediation may be required.

CVE-2026-53488HIGH
Package
github.com/containerd/containerd/v2
Installed
v2.3.1
Fixed
2.0.10, 2.1.9, 2.2.5, 2.3.2
CVE-2026-53489HIGH
Package
github.com/containerd/containerd/v2
Installed
v2.3.1
Fixed
2.1.9, 2.2.5, 2.3.2
CVE-2026-53492HIGH
Package
github.com/containerd/containerd/v2
Installed
v2.3.1
Fixed
2.1.9, 2.2.5, 2.3.2
CVE-2026-25681HIGH
Package
golang.org/x/net
Installed
v0.54.0
Fixed
0.55.0
CVE-2026-27136HIGH
Package
golang.org/x/net
Installed
v0.54.0
Fixed
0.55.0
CVE-2026-39821HIGH
Package
golang.org/x/net
Installed
v0.54.0
Fixed
0.55.0
CVE-2026-50151HIGH
Package
oras.land/oras-go/v2
Installed
v2.6.0
Fixed
2.6.1
CVE-2026-47262MEDIUM
Package
github.com/containerd/containerd/v2
Installed
v2.3.1
Fixed
2.0.10, 2.1.9, 2.2.5, 2.3.2
CVE-2026-50195MEDIUM
Package
github.com/containerd/containerd/v2
Installed
v2.3.1
Fixed
2.1.9, 2.2.5, 2.3.2
CVE-2026-49834MEDIUM
Package
github.com/sigstore/sigstore-go
Installed
v1.1.4
Fixed
1.2.0
CVE-2026-49835MEDIUM
Package
github.com/sigstore/timestamp-authority/v2
Installed
v2.0.6
Fixed
2.1.0
CVE-2026-25680MEDIUM
Package
golang.org/x/net
Installed
v0.54.0
Fixed
0.55.0
CVE-2026-42502MEDIUM
Package
golang.org/x/net
Installed
v0.54.0
Fixed
0.55.0
CVE-2026-42506MEDIUM
Package
golang.org/x/net
Installed
v0.54.0
Fixed
0.55.0
CVE-2026-50162MEDIUM
Package
oras.land/oras-go/v2
Installed
v2.6.0
Fixed
2.6.1
GHSA-vh4v-2xq2-g5cgMEDIUM
Package
oras.land/oras-go/v2
Installed
v2.6.0
Fixed
2.6.1
CVE-2026-42505MEDIUM
Package
stdlib
Installed
v1.26.4
Fixed
1.25.12, 1.26.5, 1.27.0-rc.2
CVE-2026-48978LOW
Package
oras.land/oras-go/v2
Installed
v2.6.0
Fixed
2.6.1
CVE-2026-39822UNKNOWN
Package
stdlib
Installed
v1.26.4
Fixed
1.25.12, 1.26.5, 1.27.0-rc.2

ID	Package	Installed	Fixed	Severity
CVE-2026-53488	github.com/containerd/containerd/v2	v2.3.1	2.0.10, 2.1.9, 2.2.5, 2.3.2	HIGH
CVE-2026-53489	github.com/containerd/containerd/v2	v2.3.1	2.1.9, 2.2.5, 2.3.2	HIGH
CVE-2026-53492	github.com/containerd/containerd/v2	v2.3.1	2.1.9, 2.2.5, 2.3.2	HIGH
CVE-2026-25681	golang.org/x/net	v0.54.0	0.55.0	HIGH
CVE-2026-27136	golang.org/x/net	v0.54.0	0.55.0	HIGH
CVE-2026-39821	golang.org/x/net	v0.54.0	0.55.0	HIGH
CVE-2026-50151	oras.land/oras-go/v2	v2.6.0	2.6.1	HIGH
CVE-2026-47262	github.com/containerd/containerd/v2	v2.3.1	2.0.10, 2.1.9, 2.2.5, 2.3.2	MEDIUM
CVE-2026-50195	github.com/containerd/containerd/v2	v2.3.1	2.1.9, 2.2.5, 2.3.2	MEDIUM
CVE-2026-49834	github.com/sigstore/sigstore-go	v1.1.4	1.2.0	MEDIUM
CVE-2026-49835	github.com/sigstore/timestamp-authority/v2	v2.0.6	2.1.0	MEDIUM
CVE-2026-25680	golang.org/x/net	v0.54.0	0.55.0	MEDIUM
CVE-2026-42502	golang.org/x/net	v0.54.0	0.55.0	MEDIUM
CVE-2026-42506	golang.org/x/net	v0.54.0	0.55.0	MEDIUM
CVE-2026-50162	oras.land/oras-go/v2	v2.6.0	2.6.1	MEDIUM
GHSA-vh4v-2xq2-g5cg	oras.land/oras-go/v2	v2.6.0	2.6.1	MEDIUM
CVE-2026-42505	stdlib	v1.26.4	1.25.12, 1.26.5, 1.27.0-rc.2	MEDIUM
CVE-2026-48978	oras.land/oras-go/v2	v2.6.0	2.6.1	LOW
CVE-2026-39822	stdlib	v1.26.4	1.25.12, 1.26.5, 1.27.0-rc.2	UNKNOWN

Awaiting upstream fix

No fix is available yet for these vulnerabilities. They can be suppressed in your compliance tooling until an upstream fix is released.

CVE-2026-50163HIGH
Package
oras.land/oras-go/v2
Installed
v2.6.0
Fixed
GO-2026-5932UNKNOWN
Package
golang.org/x/crypto
Installed
v0.52.0
Fixed

ID	Package	Installed	Fixed	Severity
CVE-2026-50163	oras.land/oras-go/v2	v2.6.0		HIGH
GO-2026-5932	golang.org/x/crypto	v0.52.0		UNKNOWN

Original image reference

ghcr.io/aquasecurity/trivy:0.71.1