CVEs in pactfoundation/pact-broker:2.138.0-pactbroker2.119.0 docker image

[CTrando]

Software versions

pactfoundation/pact-broker:2.138.0-pactbroker2.119.0

Expected behaviour

No security vulnerabilities reported by scanners

Actual behaviour

We are scanning the docker image with trivy and we have seen some CVEs in the latest image version.

• CVE-2025-14017
• CVE-2025-14524
• CVE-2025-14819
• CVE-2026-1965
• CVE-2026-27135
• CVE-2026-3494
• CVE-2026-3783
• CVE-2026-3784
• CVE-2026-3805
• CVE-2026-44168
• CVE-2026-44169
• CVE-2026-44170
• CVE-2026-44171
• CVE-2026-44172
• CVE-2026-44173
• CVE-2026-48163
• CVE-2026-48165

Would you be able to cut a new image version with these CVEs resolved? Thank you very much!

[YOU54F]

We also scan with trivy and none of the CVE's are noted in the latest report, can you provide a copy of the output as part of your report please

https://github.com/pact-foundation/pact-broker-docker/actions/workflows/audit.yml

I have been able to update supercronic, nokogiri and a couple of others but supercronic requires a new release cut with dependency updates, and erb/net-imap from the 3.4.9 standard ruby gemset are showing vulns too. There isn't a later 3.4.x ruby release, so we may need to upgrade to 4.x

release workflow will be stopped by those outstanding without us adding exceptions

[ermul]

Here's what I'm seeing when I run the scan:

Table Text

Ruby (gemspec)

Total: 14 (UNKNOWN: 0, LOW: 1, MEDIUM: 4, HIGH: 6, CRITICAL: 3)

┌──────────────────────────────────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬──────────────────────────────────────────────┬──────────────────────────────────────────────────────────────┐
│                       Library                        │    Vulnerability    │ Severity │ Status │ Installed Version │                Fixed Version                 │                            Title                             │
├──────────────────────────────────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼──────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ erb (erb-4.0.3.gemspec)                              │ CVE-2026-41316      │ HIGH     │ fixed  │ 4.0.3             │ ~> 4.0.3.1, ~> 4.0.4.1, ~> 6.0.1.1, >= 6.0.4 │ erb: ERB: Arbitrary code execution via deserialization       │
│                                                      │                     │          │        │                   │                                              │ bypass                                                       │
│                                                      │                     │          │        │                   │                                              │ https://avd.aquasec.com/nvd/cve-2026-41316                   │
├──────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ net-imap (net-imap-0.4.21.gemspec)                   │ CVE-2026-42257      │ CRITICAL │        │ 0.4.21            │ ~> 0.4.24, ~> 0.5.14, >= 0.6.4               │ net-imap: Net::IMAP: Arbitrary IMAP command injection via    │
│                                                      │                     │          │        │                   │                                              │ CRLF sequences in unvalidated input...                       │
│                                                      │                     │          │        │                   │                                              │ https://avd.aquasec.com/nvd/cve-2026-42257                   │
│                                                      ├─────────────────────┤          │        │                   │                                              ├──────────────────────────────────────────────────────────────┤
│                                                      │ CVE-2026-42258      │          │        │                   │                                              │ ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via   │
│                                                      │                     │          │        │                   │                                              │ Symbol Arguments                                             │
│                                                      │                     │          │        │                   │                                              │ https://avd.aquasec.com/nvd/cve-2026-42258                   │
│                                                      ├─────────────────────┼──────────┤        │                   │                                              ├──────────────────────────────────────────────────────────────┤
│                                                      │ CVE-2026-42245      │ HIGH     │        │                   │                                              │ ruby: net-imap: Net::IMAP: Denial of Service via crafted     │
│                                                      │                     │          │        │                   │                                              │ IMAP responses                                               │
│                                                      │                     │          │        │                   │                                              │ https://avd.aquasec.com/nvd/cve-2026-42245                   │
│                                                      ├─────────────────────┤          │        │                   ├──────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                      │ CVE-2026-42246      │          │        │                   │ ~> 0.3.10, ~> 0.4.24, ~> 0.5.14, >= 0.6.4    │ Net::IMAP implements Internet Message Access Protocol (IMAP) │
│                                                      │                     │          │        │                   │                                              │ client fu ...                                                │
│                                                      │                     │          │        │                   │                                              │ https://avd.aquasec.com/nvd/cve-2026-42246                   │
│                                                      ├─────────────────────┼──────────┤        │                   ├──────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                      │ CVE-2026-42256      │ MEDIUM   │        │                   │ ~> 0.4.24, ~> 0.5.14, >= 0.6.4               │ ruby/net-imap: ruby: Net::IMAP: Denial of Service via large  │
│                                                      │                     │          │        │                   │                                              │ iteration count in SCRAM...                                  │
│                                                      │                     │          │        │                   │                                              │ https://avd.aquasec.com/nvd/cve-2026-42256                   │
│                                                      ├─────────────────────┤          │        │                   ├──────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                                                      │ CVE-2026-47240      │          │        │                   │ 0.6.4.1, 0.5.15                              │ Net::IMAP: Command Injection via non-synchronizing literal   │
│                                                      │                     │          │        │                   │                                              │ in "raw" argument                                            │
│                                                      │                     │          │        │                   │                                              │ https://avd.aquasec.com/nvd/cve-2026-47240                   │
│                                                      ├─────────────────────┤          │        │                   │                                              ├──────────────────────────────────────────────────────────────┤
│                                                      │ CVE-2026-47242      │          │        │                   │                                              │ Net::IMAP: Command Injection via ID command argument         │
│                                                      │                     │          │        │                   │                                              │ https://avd.aquasec.com/nvd/cve-2026-47242                   │
│                                                      ├─────────────────────┼──────────┤        │                   │                                              ├──────────────────────────────────────────────────────────────┤
│                                                      │ CVE-2026-47241      │ LOW      │        │                   │                                              │ Net::IMAP: Denial of Service via incomplete raw argument     │
│                                                      │                     │          │        │                   │                                              │ validation                                                   │
│                                                      │                     │          │        │                   │                                              │ https://avd.aquasec.com/nvd/cve-2026-47241                   │
├──────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ nokogiri (nokogiri-1.19.2-x86_64-linux-musl.gemspec) │ GHSA-c4rq-3m3g-8wgx │ HIGH     │        │ 1.19.2            │ >= 1.19.3                                    │ Nokogiri CSS selector tokenizer has regular expression       │
│                                                      │                     │          │        │                   │                                              │ backtracking                                                 │
│                                                      │                     │          │        │                   │                                              │ https://github.com/advisories/GHSA-c4rq-3m3g-8wgx            │
│                                                      ├─────────────────────┼──────────┤        │                   │                                              ├──────────────────────────────────────────────────────────────┤
│                                                      │ GHSA-v2fc-qm4h-8hqv │ MEDIUM   │        │                   │                                              │ Nokogiri XSLT transform has a memory leak                    │
│                                                      │                     │          │        │                   │                                              │ https://github.com/advisories/GHSA-v2fc-qm4h-8hqv            │
├──────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ puma (puma-7.2.0.gemspec)                            │ CVE-2026-47736      │ HIGH     │        │ 7.2.0             │ ~> 7.2.1, >= 8.0.2                           │ Puma PROXY Protocol v1 Parser Allows Remote Memory           │
│                                                      │                     │          │        │                   │                                              │ Exhaustion                                                   │
│                                                      │                     │          │        │                   │                                              │ https://avd.aquasec.com/nvd/cve-2026-47736                   │
│                                                      ├─────────────────────┤          │        │                   │                                              ├──────────────────────────────────────────────────────────────┤
│                                                      │ CVE-2026-47737      │          │        │                   │                                              │ Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on  │
│                                                      │                     │          │        │                   │                                              │ Persistent Connections                                       │
│                                                      │                     │          │        │                   │                                              │ https://avd.aquasec.com/nvd/cve-2026-47737                   │
├──────────────────────────────────────────────────────┼─────────────────────┼──────────┤        ├───────────────────┼──────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ zlib (zlib-3.1.1.gemspec)                            │ CVE-2026-27820      │ CRITICAL │        │ 3.1.1             │ ~> 3.0.1, ~> 3.1.2, >= 3.2.3                 │ zlib: zlib: Memory corruption via buffer overflow in         │
│                                                      │                     │          │        │                   │                                              │ Zlib::GzipReader                                             │
│                                                      │                     │          │        │                   │                                              │ https://avd.aquasec.com/nvd/cve-2026-27820                   │
└──────────────────────────────────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴──────────────────────────────────────────────┴──────────────────────────────────────────────────────────────┘

usr/local/bin/supercronic-linux-amd64 (gobinary)

Total: 20 (UNKNOWN: 0, LOW: 1, MEDIUM: 7, HIGH: 12, CRITICAL: 0)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │  Fixed Version  │                            Title                             │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib  │ CVE-2026-25679 │ HIGH     │ fixed  │ v1.25.7           │ 1.25.8, 1.26.1  │ net/url: Incorrect parsing of IPv6 host literals in net/url  │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2026-25679                   │
│         ├────────────────┤          │        │                   ├─────────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-32280 │          │        │                   │ 1.25.9, 1.26.2  │ crypto/x509: crypto/tls: golang: Go: Denial of Service       │
│         │                │          │        │                   │                 │ vulnerability in certificate chain building...               │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2026-32280                   │
│         ├────────────────┤          │        │                   │                 ├──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-32281 │          │        │                   │                 │ crypto/x509: golang: Go crypto/x509: Denial of Service via   │
│         │                │          │        │                   │                 │ inefficient certificate chain validation...                  │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2026-32281                   │
│         ├────────────────┤          │        │                   │                 ├──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-32283 │          │        │                   │                 │ crypto/tls: golang: Go crypto/tls: Denial of Service via     │
│         │                │          │        │                   │                 │ multiple TLS 1.3 key...                                      │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2026-32283                   │
│         ├────────────────┤          │        │                   ├─────────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-33811 │          │        │                   │ 1.25.10, 1.26.3 │ net: golang: Go net package: Denial of Service via long      │
│         │                │          │        │                   │                 │ CNAME response...                                            │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2026-33811                   │
│         ├────────────────┤          │        │                   │                 ├──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-33814 │          │        │                   │                 │ When processing HTTP/2 SETTINGS frames, transport will enter │
│         │                │          │        │                   │                 │ an infini ...                                                │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2026-33814                   │
│         ├────────────────┤          │        │                   │                 ├──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-39820 │          │        │                   │                 │ Well-crafted inputs reaching ParseAddress, ParseAddressList, │
│         │                │          │        │                   │                 │ and Parse ...                                                │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2026-39820                   │
│         ├────────────────┤          │        │                   │                 ├──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-39823 │          │        │                   │                 │ CVE-2026-27142 fixed a vulnerability in which URLs were not  │
│         │                │          │        │                   │                 │ correctly ......                                             │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2026-39823                   │
│         ├────────────────┤          │        │                   │                 ├──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-39825 │          │        │                   │                 │ ReverseProxy can forward queries containing parameters not   │
│         │                │          │        │                   │                 │ visible to ...                                               │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2026-39825                   │
│         ├────────────────┤          │        │                   │                 ├──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-39836 │          │        │                   │                 │ ELSA-2026-22112: go-toolset:ol8 security update (IMPORTANT)  │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2026-39836                   │
│         ├────────────────┤          │        │                   │                 ├──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-42499 │          │        │                   │                 │ Pathological inputs could cause DoS through consumePhrase    │
│         │                │          │        │                   │                 │ when parsing ...                                             │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2026-42499                   │
│         ├────────────────┤          │        │                   ├─────────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-42504 │          │        │                   │ 1.25.11, 1.26.4 │ Decoding a maliciously-crafted MIME header containing many   │
│         │                │          │        │                   │                 │ invalid enc ...                                              │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2026-42504                   │
│         ├────────────────┼──────────┤        │                   ├─────────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-27142 │ MEDIUM   │        │                   │ 1.25.8, 1.26.1  │ html/template: URLs in meta content attribute actions are    │
│         │                │          │        │                   │                 │ not escaped in html/template...                              │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2026-27142                   │
│         ├────────────────┤          │        │                   ├─────────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-27145 │          │        │                   │ 1.25.11, 1.26.4 │ *x509.Certificate).VerifyHostname previously called          │
│         │                │          │        │                   │                 │ matchHostnames in ...                                        │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2026-27145                   │
│         ├────────────────┤          │        │                   ├─────────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-32282 │          │        │                   │ 1.25.9, 1.26.2  │ golang: internal/syscall/unix: Root.Chmod can follow         │
│         │                │          │        │                   │                 │ symlinks out of the root                                     │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2026-32282                   │
│         ├────────────────┤          │        │                   │                 ├──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-32288 │          │        │                   │                 │ archive/tar: golang: Go's archive/tar package: Denial of     │
│         │                │          │        │                   │                 │ Service via maliciously-crafted archive                      │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2026-32288                   │
│         ├────────────────┤          │        │                   │                 ├──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-32289 │          │        │                   │                 │ html/template: golang: html/template: Cross-Site Scripting   │
│         │                │          │        │                   │                 │ (XSS) via improper context and brace depth...                │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2026-32289                   │
│         ├────────────────┤          │        │                   ├─────────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-39826 │          │        │                   │ 1.25.10, 1.26.3 │ html/template: golang: html/template: Cross-site scripting   │
│         │                │          │        │                   │                 │ due to incorrect script tag escaping                         │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2026-39826                   │
│         ├────────────────┤          │        │                   ├─────────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-42507 │          │        │                   │ 1.25.11, 1.26.4 │ When returning errors, functions in the net/textproto        │
│         │                │          │        │                   │                 │ package would in ...                                         │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2026-42507                   │
│         ├────────────────┼──────────┤        │                   ├─────────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2026-27139 │ LOW      │        │                   │ 1.25.8, 1.26.1  │ os: FileInfo can escape from a Root in golang os module      │
│         │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2026-27139                   │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────┴──────────────────────────────────────────────────────────────┘

[ermul]

Skimming through https://github.com/pact-foundation/pact-broker-docker/actions/runs/27204219646/job/80315665561 this appears to be build the image and then run the scan against it and different dependencies are built into the image. Comparing the version numbers referenced in the output tables (column 1) from both of our screenshots, they do not match.

edit for context: My results are for docker.io/pactfoundation/pact-broker:2.138.0-pactbroker2.119.0

[YOU54F]

Thanks @ermul

The scan is running against the master branch, which has an updated lockfile which resolves many of the ruby issues, and an updated version of supercronic which addresses most of the golang vulns.

none of our CVE's match the OP's

[CTrando]

Ah, that's good then! Do you know if there's an image tagged against the master branch that we can use?

[YOU54F]

I have raised a PR against supercronic which resolves some of the vulns.

net-imap and erb are default gems for ruby 3.4.9 and the current versions have recorded vulns.

https://stdgems.org/erb/

Upgrading to the latest ruby 4.0.5, resolves the erb vuln but leaves us with a vulnerability in json 2.18 and net-imap 0.6.2

https://stdgems.org/net-imap/
https://stdgems.org/json/

We cannot delete default gems, and they reside even after doing a gem update --default --all or specifying individual upgrades for erb/net-imap or json.

So barring adding CVE exceptions to the trivy config, we require the following

1. release of supercronic with updated stdlib as per linked PR
2. new release of ruby 3.4.x with erb/net-imap updated to latest
3. new release of ruby 4.0.x with net-imap and json updated to latest

[YOU54F]

I've added some exceptions for those and got a release out

https://github.com/pact-foundation/pact-broker-docker/releases/tag/2.139.0-pactbroker2.119.0