Known CVEs
This page mirrors SECURITY.md in the repository. Suppressions are maintained in a single OpenVEX document at .vex/openvex.json, which is attached to every published image.
Suppressed as not affected
CVE-2023-27482, Home Assistant Supervisor
Docker Scout flags this against the images because the Alpine supervisor package shares a name with Home Assistant's Supervisor component. The images use supervisord, the general-purpose process manager from supervisord.org. No Home Assistant code is present. Justification: vulnerable_code_not_present.
CVE-2025-60876, BusyBox wget header injection
An HTTP header injection in BusyBox's wget applet through 1.37.0. Alpine has not patched it. The images install the standalone wget package, which shadows the BusyBox applet in PATH, and no entrypoint, build step or runtime process invokes wget at all; everything uses curl. BusyBox cannot be removed because it provides Alpine's coreutils. Justification: vulnerable_code_not_in_execute_path.
When to revisit: when Alpine releases a patched BusyBox, or if any future change starts using BusyBox wget.
Fixed in the images
curl, seven libcurl CVEs
Alpine 3.21 shipped curl 8.14.1 with CVE-2025-14017, CVE-2025-13034, CVE-2025-15079, CVE-2025-14819, CVE-2025-14524, CVE-2025-10966 and CVE-2025-15224, all fixed in 8.18.0. The base image used to pull curl from Alpine edge to work around it. Since the move to Alpine 3.23 and then 3.24 the stock package is 8.22.0, so no override is needed.
setuptools, CVE-2025-47273 and CVE-2026-59890
A path traversal in PackageIndex.download() (fixed in 78.1.1) and a MANIFEST.in exclusion bypass when building source distributions (fixed in 83.0.0). Alpine 3.24's py3-setuptools is 82.0.1. setuptools is present only because Supervisor depends on it, and neither code path is exercised at runtime, but it is upgraded to 83 or later at build time via pip so scanners report nothing.
Earlier images on Alpine 3.21 had to cap setuptools below 81 because Supervisor 4.2.5 imported pkg_resources, which setuptools 81 removed. Alpine 3.23 and 3.24 ship Supervisor 4.3.0, which uses importlib.metadata, so the cap is gone.
musl, CVE-2026-40200 and CVE-2026-6042
The pinned Alpine 3.21 digest shipped musl-utils 1.2.5-r9, flagged for an arbitrary code execution via stack overflow (HIGH) and a GB18030 decoder denial of service (MEDIUM). The base image now runs apk upgrade before installing anything, so every published image receives Alpine security updates at build time regardless of how old the pinned digest is.
Adding a suppression
Add a statement to .vex/openvex.json with the CVE, the affected products, a status of not_affected and a justification, then document the reasoning in SECURITY.md. Never suppress a finding that could be fixed by upgrading a package instead.