Detections
Analytics
Alpine: multiple docker packages: security update to 29.9.3-r0
high Tenable Cloud Security Plugin ID 478586
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go,
including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT)
standards. Prior to 4.1.6, go-jose parses attacker-controlled RSA modulus and prime values from JWKs
without enforcing size and consistency bounds before passing them to crypto/rsa.PrivateKey.Validate. On Go
1.24 and later, crafted large or degenerate RSA parameters can make that validation consume cubic CPU
time, allowing remote denial of service in applications that parse JWKs from untrusted sources. This issue
is fixed in version 4.1.6. (CVE-2026-116587)
- compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming
decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized
count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable to retain
stale fse.Scratch decode-table state from the prior block, and nextFast then derives an out-of-range state
and indexes beyond the table instead of returning a decode error. Both blocks are required to preserve and
then reuse the stale state, allowing untrusted zstd input to crash an application. This issue is fixed in
version 1.20.2. (CVE-2026-116591)
Solution
Update the docker library and its related packages to version 29.9.3-r0 or later.See Also
https://security.alpinelinux.org/vuln/CVE-2026-115538
https://security.alpinelinux.org/vuln/CVE-2026-115539
Plugin Details
Severity: High
ID: 478586
Version: Revision 1.1
Type: Local
Published: 11/6/2026
Updated: 11/6/2026
Supported Sensors: Agentless Assessment
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.73
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2026-116591
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS Score Source: CVE-2026-116587
CVSS v4
Risk Factor: High
Base Score: 8.7
Threat Score: 6.6
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 10/26/2026
Reference Information
CVE: CVE-2026-115538, CVE-2026-115539, CVE-2026-116587, CVE-2026-116591