[container-image-scan] Container findings for mcp/arxiv-mcp-server

[github-actions]

Summary

• Image: mcp/arxiv-mcp-server
• Pinned reference: mcp/arxiv-mcp-server@sha256:6dc6bba6dfed97f4ad6eb8d23a5c98ef5b7fa6184937d54b2d675801cd9dd29e
• Vulnerabilities: 131 total (16 Critical, 115 High)
• License violations: 124

Vulnerabilities

131 vulnerabilities (click to expand)

• High: CVE-2025-6965: libsqlite3-0@3.40.1-2+deb12u1 (fix: 3.40.1-2+deb12u2) ((securitytracker.debian.org/redacted)
• Critical: CVE-2025-15467: libssl3@3.0.17-1deb12u2 (fix: 3.0.18-1deb12u2) ((securitytracker.debian.org/redacted)
• Critical: CVE-2025-15467: openssl@3.0.17-1deb12u2 (fix: 3.0.18-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2026-45447: libssl3@3.0.17-1deb12u2 (fix: 3.0.20-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2026-45447: openssl@3.0.17-1deb12u2 (fix: 3.0.20-1deb12u2) ((securitytracker.debian.org/redacted)
• High: GHSA-38jv-5279-wg99: urllib3@2.5.0 (fix: 2.6.3) (GHSA-38jv-5279-wg99)
• High: GHSA-wp53-j4wj-2cfg: python-multipart@0.0.20 (fix: 0.0.22) (GHSA-wp53-j4wj-2cfg)
• High: GHSA-cx63-2mw6-8hw5: setuptools@65.5.1 (fix: 70.0.0) (GHSA-cx63-2mw6-8hw5)
• High: CVE-2025-9230: libssl3@3.0.17-1deb12u2 (fix: 3.0.17-1deb12u3) ((securitytracker.debian.org/redacted)
• High: CVE-2025-9230: openssl@3.0.17-1deb12u2 (fix: 3.0.17-1deb12u3) ((securitytracker.debian.org/redacted)
• High: CVE-2023-31484: perl-base@5.36.0-7+deb12u2 (fix: 5.36.0-7+deb12u3) ((securitytracker.debian.org/redacted)
• High: CVE-2025-13836: python@3.11.13 (fix: 3.10.20, 3.11.15, 3.12.13, 3.13.11, 3.14.1, 3.15.0a3) ((nvd.nist.gov/redacted)
• High: GHSA-5rjg-fvgr-3xxf: setuptools@65.5.1 (fix: 78.1.1) (GHSA-5rjg-fvgr-3xxf)
• High: CVE-2026-42009: libgnutls30@3.7.9-2+deb12u5 (fix: 3.7.9-2+deb12u7) ((securitytracker.debian.org/redacted)
• Critical: CVE-2026-42010: libgnutls30@3.7.9-2+deb12u5 (fix: 3.7.9-2+deb12u7) ((securitytracker.debian.org/redacted)
• High: CVE-2026-33846: libgnutls30@3.7.9-2+deb12u5 (fix: 3.7.9-2+deb12u7) ((securitytracker.debian.org/redacted)
• High: CVE-2026-31790: libssl3@3.0.17-1deb12u2 (fix: 3.0.19-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2026-31790: openssl@3.0.17-1deb12u2 (fix: 3.0.19-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2025-13151: libtasn1-6@4.19.0-2+deb12u1 ((securitytracker.debian.org/redacted)
• High: CVE-2026-28388: libssl3@3.0.17-1deb12u2 (fix: 3.0.19-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2026-28388: openssl@3.0.17-1deb12u2 (fix: 3.0.19-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2026-28389: libssl3@3.0.17-1deb12u2 (fix: 3.0.19-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2026-28389: openssl@3.0.17-1deb12u2 (fix: 3.0.19-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2026-28390: libssl3@3.0.17-1deb12u2 (fix: 3.0.19-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2026-28390: openssl@3.0.17-1deb12u2 (fix: 3.0.19-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2026-34180: libssl3@3.0.17-1deb12u2 (fix: 3.0.20-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2026-34180: openssl@3.0.17-1deb12u2 (fix: 3.0.20-1deb12u2) ((securitytracker.debian.org/redacted)
• Critical: CVE-2026-33845: libgnutls30@3.7.9-2+deb12u5 (fix: 3.7.9-2+deb12u7) ((securitytracker.debian.org/redacted)
• High: CVE-2025-69421: libssl3@3.0.17-1deb12u2 (fix: 3.0.18-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2025-69421: openssl@3.0.17-1deb12u2 (fix: 3.0.18-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2026-28387: libssl3@3.0.17-1deb12u2 (fix: 3.0.19-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2026-28387: openssl@3.0.17-1deb12u2 (fix: 3.0.19-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2025-69420: libssl3@3.0.17-1deb12u2 (fix: 3.0.18-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2025-69420: openssl@3.0.17-1deb12u2 (fix: 3.0.18-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2026-5260: libgnutls30@3.7.9-2+deb12u5 (fix: 3.7.9-2+deb12u7) ((securitytracker.debian.org/redacted)
• High: CVE-2026-7210: python@3.11.13 (fix: 3.13.14, 3.14.6, 3.15.0b2) ((nvd.nist.gov/redacted)
• High: GHSA-2xpw-w6gg-jr37: urllib3@2.5.0 (fix: 2.6.0) (GHSA-2xpw-w6gg-jr37)
• High: GHSA-gm62-xv2j-4w53: urllib3@2.5.0 (fix: 2.6.0) (GHSA-gm62-xv2j-4w53)
• High: CVE-2026-11940: python@3.11.13 (fix: 3.15.0b4) ((nvd.nist.gov/redacted)
• High: GHSA-pp6c-gr5w-3c5g: python-multipart@0.0.20 (fix: 0.0.27) (GHSA-pp6c-gr5w-3c5g)
• High: CVE-2026-7383: libssl3@3.0.17-1deb12u2 (fix: 3.0.20-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2026-7383: openssl@3.0.17-1deb12u2 (fix: 3.0.20-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2026-15308: python@3.11.13 (fix: 3.15.0) ((nvd.nist.gov/redacted)
• High: GHSA-7f5h-v6xp-fcq8: starlette@0.47.1 (fix: 0.49.1) (GHSA-7f5h-v6xp-fcq8)
• Critical: CVE-2026-5450: libc-bin@2.36-9+deb12u10 ((securitytracker.debian.org/redacted)
• Critical: CVE-2026-5450: libc6@2.36-9+deb12u10 ((securitytracker.debian.org/redacted)
• High: CVE-2026-6100: python@3.11.13 (fix: 3.13.14, 3.14.5rc1, 3.15.0b1) ((nvd.nist.gov/redacted)
• High: CVE-2025-8194: python@3.11.13 (fix: 3.9.24, 3.10.19, 3.11.14, 3.12.12, 3.13.6, 3.14.0rc2) ((nvd.nist.gov/redacted)
• High: CVE-2026-40355: libgssapi-krb5-2@1.20.1-2+deb12u3 (fix: 1.20.1-2+deb12u5) ((securitytracker.debian.org/redacted)
• High: CVE-2026-40355: libk5crypto3@1.20.1-2+deb12u3 (fix: 1.20.1-2+deb12u5) ((securitytracker.debian.org/redacted)
• High: CVE-2026-40355: libkrb5-3@1.20.1-2+deb12u3 (fix: 1.20.1-2+deb12u5) ((securitytracker.debian.org/redacted)
• High: CVE-2026-40355: libkrb5support0@1.20.1-2+deb12u3 (fix: 1.20.1-2+deb12u5) ((securitytracker.debian.org/redacted)
• High: CVE-2026-4224: python@3.11.13 (fix: 3.13.13, 3.14.4, 3.15.0a8) ((nvd.nist.gov/redacted)
• High: CVE-2026-40356: libgssapi-krb5-2@1.20.1-2+deb12u3 (fix: 1.20.1-2+deb12u5) ((securitytracker.debian.org/redacted)
• High: CVE-2026-40356: libk5crypto3@1.20.1-2+deb12u3 (fix: 1.20.1-2+deb12u5) ((securitytracker.debian.org/redacted)
• High: CVE-2026-40356: libkrb5-3@1.20.1-2+deb12u3 (fix: 1.20.1-2+deb12u5) ((securitytracker.debian.org/redacted)
• High: CVE-2026-40356: libkrb5support0@1.20.1-2+deb12u3 (fix: 1.20.1-2+deb12u5) ((securitytracker.debian.org/redacted)
• High: CVE-2026-45445: libssl3@3.0.17-1deb12u2 (fix: 3.0.20-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2026-45445: openssl@3.0.17-1deb12u2 (fix: 3.0.20-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2026-9076: libssl3@3.0.17-1deb12u2 (fix: 3.0.20-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2026-9076: openssl@3.0.17-1deb12u2 (fix: 3.0.20-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2026-0915: libc-bin@2.36-9+deb12u10 (fix: 2.36-9+deb12u14) ((securitytracker.debian.org/redacted)
• High: CVE-2026-0915: libc6@2.36-9+deb12u10 (fix: 2.36-9+deb12u14) ((securitytracker.debian.org/redacted)
• High: CVE-2025-4802: libc-bin@2.36-9+deb12u10 (fix: 2.36-9+deb12u11) ((securitytracker.debian.org/redacted)
• High: CVE-2025-4802: libc6@2.36-9+deb12u10 (fix: 2.36-9+deb12u11) ((securitytracker.debian.org/redacted)
• High: CVE-2026-3833: libgnutls30@3.7.9-2+deb12u5 (fix: 3.7.9-2+deb12u7) ((securitytracker.debian.org/redacted)
• Critical: CVE-2026-8376: perl-base@5.36.0-7+deb12u2 ((securitytracker.debian.org/redacted)
• High: GHSA-9h52-p55h-vw2f: mcp@1.10.1 (fix: 1.23.0) (GHSA-9h52-p55h-vw2f)
• Critical: CVE-2026-13221: perl-base@5.36.0-7+deb12u2 ((securitytracker.debian.org/redacted)
• Critical: CVE-2026-42496: perl-base@5.36.0-7+deb12u2 ((securitytracker.debian.org/redacted)
• High: GHSA-6mq8-rvhq-8wgg: aiohttp@3.12.14 (fix: 3.13.3) (GHSA-6mq8-rvhq-8wgg)
• High: CVE-2026-42011: libgnutls30@3.7.9-2+deb12u5 (fix: 3.7.9-2+deb12u7) ((securitytracker.debian.org/redacted)
• High: CVE-2026-11972: python@3.11.13 (fix: 3.15.0b4) ((nvd.nist.gov/redacted)
• High: CVE-2025-69720: libncursesw6@6.4-4 ((securitytracker.debian.org/redacted)
• High: CVE-2025-69720: libtinfo6@6.4-4 ((securitytracker.debian.org/redacted)
• High: CVE-2025-69720: ncurses-base@6.4-4 ((securitytracker.debian.org/redacted)
• High: CVE-2025-69720: ncurses-bin@6.4-4 ((securitytracker.debian.org/redacted)
• High: CVE-2026-3644: python@3.11.13 (fix: 3.13.13, 3.14.4, 3.15.0a8) ((nvd.nist.gov/redacted)
• Critical: CVE-2026-12087: perl-base@5.36.0-7+deb12u2 ((securitytracker.debian.org/redacted)
• High: CVE-2026-9538: perl-base@5.36.0-7+deb12u2 ((securitytracker.debian.org/redacted)
• High: CVE-2026-9669: python@3.11.13 (fix: 3.13.14, 3.14.6, 3.15.0b3) ((nvd.nist.gov/redacted)
• Critical: CVE-2026-57433: perl-base@5.36.0-7+deb12u2 ((securitytracker.debian.org/redacted)
• High: CVE-2026-42013: libgnutls30@3.7.9-2+deb12u5 (fix: 3.7.9-2+deb12u7) ((securitytracker.debian.org/redacted)
• High: CVE-2025-69419: libssl3@3.0.17-1deb12u2 (fix: 3.0.18-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2025-69419: openssl@3.0.17-1deb12u2 (fix: 3.0.18-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2025-15281: libc-bin@2.36-9+deb12u10 (fix: 2.36-9+deb12u14) ((securitytracker.debian.org/redacted)
• High: CVE-2025-15281: libc6@2.36-9+deb12u10 (fix: 2.36-9+deb12u14) ((securitytracker.debian.org/redacted)
• Critical: CVE-2026-34182: libssl3@3.0.17-1deb12u2 (fix: 3.0.20-1deb12u2) ((securitytracker.debian.org/redacted)
• Critical: CVE-2026-34182: openssl@3.0.17-1deb12u2 (fix: 3.0.20-1deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2026-2219: dpkg@1.21.22 (fix: 1.21.23) ((securitytracker.debian.org/redacted)
• High: CVE-2026-42497: perl-base@5.36.0-7+deb12u2 ((securitytracker.debian.org/redacted)
• High: CVE-2026-3298: python@3.11.13 (fix: 3.13.14, 3.14.5rc1, 3.15.0b1) ((nvd.nist.gov/redacted)
• High: CVE-2025-6020: libpam-modules@1.5.2-6+deb12u1 (fix: 1.5.2-6+deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2025-6020: libpam-modules-bin@1.5.2-6+deb12u1 (fix: 1.5.2-6+deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2025-6020: libpam-runtime@1.5.2-6+deb12u1 (fix: 1.5.2-6+deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2025-6020: libpam0g@1.5.2-6+deb12u1 (fix: 1.5.2-6+deb12u2) ((securitytracker.debian.org/redacted)
• High: GHSA-82w8-qh3p-5jfq: starlette@0.47.1 (fix: 1.3.1) (GHSA-82w8-qh3p-5jfq)
• High: CVE-2026-4046: libc-bin@2.36-9+deb12u10 (fix: 2.36-9+deb12u14) ((securitytracker.debian.org/redacted)
• High: CVE-2026-4046: libc6@2.36-9+deb12u10 (fix: 2.36-9+deb12u14) ((securitytracker.debian.org/redacted)
• High: GHSA-5rvq-cxj2-64vf: python-multipart@0.0.20 (fix: 0.0.30) (GHSA-5rvq-cxj2-64vf)
• High: CVE-2026-0861: libc-bin@2.36-9+deb12u10 (fix: 2.36-9+deb12u14) ((securitytracker.debian.org/redacted)
• High: CVE-2026-0861: libc6@2.36-9+deb12u10 (fix: 2.36-9+deb12u14) ((securitytracker.debian.org/redacted)
• High: CVE-2026-48959: perl-base@5.36.0-7+deb12u2 ((securitytracker.debian.org/redacted)
• High: CVE-2026-5928: libc-bin@2.36-9+deb12u10 ((securitytracker.debian.org/redacted)
• High: CVE-2026-5928: libc6@2.36-9+deb12u10 ((securitytracker.debian.org/redacted)
• High: GHSA-wqp7-x3pw-xc5r: starlette@0.47.1 (fix: 1.1.0) (GHSA-wqp7-x3pw-xc5r)
• High: CVE-2025-6297: dpkg@1.21.22 (fix: 1.21.23) ((securitytracker.debian.org/redacted)
• High: CVE-2026-42012: libgnutls30@3.7.9-2+deb12u5 (fix: 3.7.9-2+deb12u7) ((securitytracker.debian.org/redacted)
• High: CVE-2026-41992: gzip@1.12-1 ((securitytracker.debian.org/redacted)
• High: CVE-2026-4437: libc-bin@2.36-9+deb12u10 (fix: 2.36-9+deb12u14) ((securitytracker.debian.org/redacted)
• High: CVE-2026-4437: libc6@2.36-9+deb12u10 (fix: 2.36-9+deb12u14) ((securitytracker.debian.org/redacted)
• High: GHSA-qccp-gfcp-xxvc: urllib3@2.5.0 (fix: 2.7.0) (GHSA-qccp-gfcp-xxvc)
• High: GHSA-jpw9-pfvf-9f58: mcp@1.10.1 (fix: 1.27.2) (GHSA-jpw9-pfvf-9f58)
• Critical: CVE-2026-31789: libssl3@3.0.17-1deb12u2 (fix: 3.0.19-1deb12u2) ((securitytracker.debian.org/redacted)
• Critical: CVE-2026-31789: openssl@3.0.17-1deb12u2 (fix: 3.0.19-1deb12u2) ((securitytracker.debian.org/redacted)
• High: GHSA-8rrh-rw8j-w5fx: wheel@0.45.1 (fix: 0.46.2) (GHSA-8rrh-rw8j-w5fx)
• High: CVE-2026-48962: perl-base@5.36.0-7+deb12u2 ((securitytracker.debian.org/redacted)
• High: GHSA-cq5v-8q36-5273: aiohttp@3.12.14 (fix: 3.14.3) (GHSA-cq5v-8q36-5273)
• High: CVE-2026-4786: python@3.11.13 (fix: 3.13.14, 3.14.5rc1, 3.15.0b1) ((nvd.nist.gov/redacted)
• Critical: CVE-2025-7458: libsqlite3-0@3.40.1-2+deb12u1 ((securitytracker.debian.org/redacted)
• High: CVE-2026-7017: perl-base@5.36.0-7+deb12u2 ((securitytracker.debian.org/redacted)
• High: CVE-2026-5435: libc-bin@2.36-9+deb12u10 ((securitytracker.debian.org/redacted)
• High: CVE-2026-5435: libc6@2.36-9+deb12u10 ((securitytracker.debian.org/redacted)
• High: CVE-2026-57432: perl-base@5.36.0-7+deb12u2 ((securitytracker.debian.org/redacted)
• High: CVE-2026-4878: libcap2@1:2.66-4+deb12u1 (fix: 1:2.66-4+deb12u3) ((securitytracker.debian.org/redacted)
• High: CVE-2026-11822: libsqlite3-0@3.40.1-2+deb12u1 ((securitytracker.debian.org/redacted)
• High: CVE-2026-11824: libsqlite3-0@3.40.1-2+deb12u1 ((securitytracker.debian.org/redacted)
• High: GHSA-vj7q-gjh5-988w: mcp@1.10.1 (fix: 1.28.1) (GHSA-vj7q-gjh5-988w)
• High: CVE-2026-54369: libacl1@2.3.1-3 ((securitytracker.debian.org/redacted)
• High: CVE-2025-68973: gpgv@2.2.40-1.1 (fix: 2.2.40-1.1+deb12u2) ((securitytracker.debian.org/redacted)
• High: CVE-2026-54370: libacl1@2.3.1-3 ((securitytracker.debian.org/redacted)

Licenses

124 license policy violations (click to expand)

• bash@5.2.15-2+b8 (BSD-4-Clause-UC, GFDL-1.3-only, GFDL-NIV-1.3, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, Latex2e, MIT-like, permissive)
• mount@2.38.1-5+deb12u3 (BSD-4-Clause, BSLA, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, public-domain)
• libcom-err2@1.47.0-2 (GPL, GPL-2.0-only, GPL-2.0-or-later, Kazlib, LGPL-2.0-only, Latex2e)
• findutils@4.9.0-4 (FSFAP, FSFULLR, GFDL-1.3-only, GFDL-NIV-1.3+, GPL, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, X11, public-domain)
• logsave@1.47.0-2 (GPL, GPL-2.0-only, GPL-2.0-or-later, Kazlib, LGPL-2.0-only, Latex2e)
• libnsl2@1.3.0-2 (GPL-2.0-only, GPL-2+-autoconf-exception, GPL-2+-libtool-exception, GPL-3.0-only, GPL-3+-autoconf-exception, LGPL-2.1-only, LGPL-2.1-or-later, permissive-autoconf-m4, permissive-autoconf-m4-no-warranty, permissive-configure, permissive-fsf, permissive-makefile-in)
• libstdc++6@12.2.0-14+deb12u1 (BSD-4-Clause-UC, GPL-2.0-or-later, GPL-3.0-or-later, HPND, LGPL-2.0-or-later, LGPL-2.1-or-later, NCSA, Spencer-94, Unicode-DFS-2015, Zlib)
• sgmllib3k@1.0.0 (BSD License)
• libgnutls30@3.7.9-2+deb12u5 (CC0-1.0, GPL-3.0-or-later, LGPL-2.1-or-later)
• passwd@1:4.13+dfsg1-1+deb12u1 (GPL-1.0-only, GPL-2.0-only, GPL-2.0-or-later, public-domain)
• gzip@1.12-1 (FSF-manpages, GFDL-1.3+-no-invariant, GFDL-3, GPL-3.0-only, GPL-3.0-or-later)
• cli-32@UNKNOWN (no licenses found)
• cli@UNKNOWN (no licenses found)
• libgdbm6@1.23-3 (GFDL-NIV-1.3+, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later)
• sed@4.9-1 (BSD-4-Clause-UC, BSL-1.0, GFDL-1.3-only, GFDL-NIV-1.3+, GPL-3.0-only, GPL-3.0-or-later, X11, pcre)
• zlib1g@1:1.2.13.dfsg-1 (Zlib)
• libcap2@1:2.66-4+deb12u1 (GPL-2.0-only, GPL-2.0-or-later)
• util-linux-extra@2.38.1-5+deb12u3 (BSD-4-Clause, BSLA, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, public-domain)
• libc6@2.36-9+deb12u10 (GPL-2.0-only, HPND, LGPL-2.1-or-later, Spencer-94)
• libsemanage-common@3.4-1 (LGPL-2.1-or-later)
• libselinux1@3.4-1+b6 (libselinux-1.0)
• libzstd1@1.5.4+dfsg2-5 (Expat, GPL-2.0-only, Zlib)
• libc-bin@2.36-9+deb12u10 (GPL-2.0-only, HPND, LGPL-2.1-or-later, Spencer-94)
• base-passwd@3.6.1 (GPL-2.0-only, public-domain)
• multidict@6.6.3 (Apache License 2.0)
• libuuid1@2.38.1-5+deb12u3 (BSD-4-Clause, BSLA, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, public-domain)
• gui-arm64@UNKNOWN (no licenses found)
• gpgv@2.2.40-1.1 (CC0-1.0, Expat, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, RFC-Reference, TinySCHEME, permissive)
• libffi8@3.4.4-1 (Expat, GPL, GPL-2.0-or-later, GPL-3.0-or-later, MPL-1.1, X11, public-domain)
• readline-common@8.2-1.3 (GFDL, GFDL-NIV-1.3+, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, ISC-no-attribution)
• libdebconfclient0@0.270 (GPL-2.0-only, GPL-2.0-or-later)
• usr-is-merged@37~deb12u1 (GPL-2.0-only, GPL-2.0-or-later)
• aiosignal@1.4.0 (Apache 2.0)
• coreutils@9.1-1 (BSD-4-Clause-UC, FSFULLR, GFDL-1.3-only, GFDL-NIV-1.3, GPL-3.0-only, GPL-3.0-or-later)
• init-system-helpers@1.65.2 (GPL-2.0-only, GPL-2.0-or-later)
• libmount1@2.38.1-5+deb12u3 (BSD-4-Clause, BSLA, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, public-domain)
• libsemanage2@3.4-1+b5 (LGPL-2.1-or-later)
• libncursesw6@6.4-4 (MIT/X11, X11)
• base-files@12.4+deb12u11 (GPL-2.0-or-later)
• libssl3@3.0.17-1~deb12u2 (Artistic, GPL-1.0-only, GPL-1.0-or-later)
• libreadline8@8.2-1.3 (GFDL, GFDL-NIV-1.3+, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, ISC-no-attribution)
• libacl1@2.3.1-3 (GPL-2.0-only, GPL-2.0-or-later, LGPL-2.0-or-later, LGPL-2.1-only)
• libseccomp2@2.5.4-1+deb12u1 (LGPL-2.1-only)
• libunistring2@1.0-2 (FreeSoftware, GFDL-1.2-only, GFDL-1.2-or-later, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-3.0-only, LGPL-3.0-or-later)
• libkrb5-3@1.20.1-2+deb12u3 (BSD-4-Clause, BSD-4-Clause-UC, CC-BY-SA-3.0, HPND, OLDAP-2.8, RSA-MD)
• libsystemd0@252.38-1~deb12u1 (CC0-1.0, Expat, GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, public-domain)
• ncurses-bin@6.4-4 (MIT/X11, X11)
• libaudit-common@1:3.0.9-1 (GPL-1.0-only, GPL-2.0-only, LGPL-2.1-only)
• libbz2-1.0@1.0.8-5+b1 (BSD-variant, GPL-2.0-only)
• Simple Launcher@1.1.0.14 (no licenses found)
• cli-arm64@UNKNOWN (no licenses found)
• gui@UNKNOWN (no licenses found)
• sysvinit-utils@3.06-4 (GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only)
• libsmartcols1@2.38.1-5+deb12u3 (BSD-4-Clause, BSLA, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, public-domain)
• libss2@1.47.0-2 (GPL, GPL-2.0-only, GPL-2.0-or-later, Kazlib, LGPL-2.0-only, Latex2e)
• libaudit1@1:3.0.9-1 (GPL-1.0-only, GPL-2.0-only, LGPL-2.1-only)
• libhogweed6@3.8.1-2 (Expat, GAP, GPL, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-3.0-or-later, public-domain)
• libtirpc-common@1.3.3+ds-1 (GPL-2.0-only, LGPL-2.1-only)
• dash@0.5.12-2 (GPL-2.0-only, GPL-2.0-or-later, public-domain)
• openssl@3.0.17-1~deb12u2 (Artistic, GPL-1.0-only, GPL-1.0-or-later)
• libext2fs2@1.47.0-2 (GPL, GPL-2.0-only, GPL-2.0-or-later, Kazlib, LGPL-2.0-only, Latex2e)
• gui-32@UNKNOWN (no licenses found)
• libgcrypt20@1.10.1-3 (LGPL-2.1-or-later)
• libpam-runtime@1.5.2-6+deb12u1 (BSD-tcp_wrappers, Beerware, GPL, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.0-only, LGPL-2.0-or-later, public-domain)
• libattr1@1:2.5.1-4 (GPL-2.0-only, GPL-2.0-or-later, LGPL-2.0-or-later, LGPL-2.1-only)
• libsqlite3-0@3.40.1-2+deb12u1 (GPL-2.0-only, GPL-2.0-or-later, public-domain)
• tar@1.34+dfsg-1.2+deb12u1 (GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-3.0-only, LGPL-3.0-or-later)
• libidn2-0@2.3.3-1+b1 (GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-3.0-only, LGPL-3.0-or-later, Unicode)
• libdb5.3@5.3.28+dfsg2-1 (Artistic, BSD-3-clause-fjord, GPL, GPL-3.0-only, MIT-old, MS-PL, Sleepycat, TCL-like, X11, Zlib)
• libgssapi-krb5-2@1.20.1-2+deb12u3 (BSD-4-Clause, BSD-4-Clause-UC, CC-BY-SA-3.0, HPND, OLDAP-2.8, RSA-MD)
• libpcre2-8-0@10.42-1 (BSD-3-clause-Cambridge, X11, public-domain)
• cli-64@UNKNOWN (no licenses found)
• perl-base@5.36.0-7+deb12u2 (Artistic, Artistic-2.0, Artistic-dist, BSD-3-clause-GENERIC, BSD-3-clause-with-weird-numbering, BSD-4-clause-POWERDOG, BZIP, DONT-CHANGE-THE-GPL, Expat, GPL-1.0-only, GPL-1.0-or-later, GPL-2.0-only, GPL-2.0-or-later, GPL-3+-WITH-BISON-EXCEPTION, HSIEH-BSD, HSIEH-DERIVATIVE, LGPL-2.1-only, REGCOMP, REGCOMP,, RRA-KEEP-THIS-NOTICE, SDBM-PUBLIC-DOMAIN, TEXT-TABS, Unicode, Zlib)
• typing-extensions@4.14.1 (PSF-2.0)
• libblkid1@2.38.1-5+deb12u3 (BSD-4-Clause, BSLA, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, public-domain)
• libudev1@252.38-1~deb12u1 (CC0-1.0, Expat, GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, public-domain)
• debianutils@5.7-0.5~deb12u1 (GPL-2.0-only, GPL-2.0-or-later, SMAIL-GPL, public-domain)
• grep@3.8-5 (GPL-3.0-only, GPL-3.0-or-later)
• libmd0@1.0.4-2 (BSD-3-clause-Aaron-D-Gifford, Beerware, public-domain-md4, public-domain-md5, public-domain-sha1)
• libgcc-s1@12.2.0-14+deb12u1 (BSD-4-Clause-UC, GPL-2.0-or-later, GPL-3.0-or-later, HPND, LGPL-2.0-or-later, LGPL-2.1-or-later, NCSA, Spencer-94, Unicode-DFS-2015, Zlib)
• certifi@2025.7.9 (MPL-2.0)
• python-dateutil@2.9.0.post0 (Dual License)
• libcrypt1@1:4.4.33-2 (no licenses found)
• annotated-types@0.7.0 (no licenses found)
• libgmp10@2:6.2.1+dfsg1-1.1 (GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-3.0-only, LGPL-3.0-or-later)
• gcc-12-base@12.2.0-14+deb12u1 (BSD-4-Clause-UC, GPL-2.0-or-later, GPL-3.0-or-later, HPND, LGPL-2.0-or-later, LGPL-2.1-or-later, NCSA, Spencer-94, Unicode-DFS-2015, Zlib)
• libpam-modules-bin@1.5.2-6+deb12u1 (BSD-tcp_wrappers, Beerware, GPL, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.0-only, LGPL-2.0-or-later, public-domain)
• libtinfo6@6.4-4 (MIT/X11, X11)
• bsdutils@1:2.38.1-5+deb12u3 (BSD-4-Clause, BSLA, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, public-domain)
• liblzma5@5.4.1-1 (Autoconf, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, LGPL-2.0-only, LGPL-2.1-only, LGPL-2.1-or-later, PD, PD-debian, config-h, noderivs, permissive-fsf, permissive-nowarranty, probably-PD)
• login@1:4.13+dfsg1-1+deb12u1 (GPL-1.0-only, GPL-2.0-only, GPL-2.0-or-later, public-domain)
• ncurses-base@6.4-4 (MIT/X11, X11)
• debian-archive-keyring@2023.3+deb12u2 (GPL-2.0-or-later)
• libgpg-error0@1.46-1 (GPL-3.0-only, GPL-3.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, g10-permissive)
• libtasn1-6@4.19.0-2+deb12u1 (GPL-3.0-or-later, LGPL-2.1-or-later)
• ca-certificates@20230311+deb12u1 (GPL-2.0-only, GPL-2.0-or-later, MPL-2.0)
• libapt-pkg6.0@2.6.1 (Expat, GPL-2.0-only, GPL-2.0-or-later)
• libk5crypto3@1.20.1-2+deb12u3 (BSD-4-Clause, BSD-4-Clause-UC, CC-BY-SA-3.0, HPND, OLDAP-2.8, RSA-MD)
• pymupdf@1.26.3 (Dual Licensed - GNU AFFERO GPL 3.0 or Artifex Commercial License)
• gui-64@UNKNOWN (no licenses found)
• util-linux@2.38.1-5+deb12u3 (BSD-4-Clause, BSLA, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, public-domain)
• dpkg@1.21.22 (GPL-2.0-only, GPL-2.0-or-later, public-domain-s-s-d)
• tzdata@2025b-0+deb12u1 (public-domain)
• libp11-kit0@0.24.1-2 (ISC+IBM, LGPL-2.1-only, LGPL-2.1-or-later, permissive-like-automake-output, same-as-rest-of-p11kit)
• libcap-ng0@0.8.3-1+b3 (GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, LGPL-2.1-only, LGPL-2.1-or-later)
• libsepol2@3.4-2.1 (GPL-2.0-only, GPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, Zlib)
• libkrb5support0@1.20.1-2+deb12u3 (BSD-4-Clause, BSD-4-Clause-UC, CC-BY-SA-3.0, HPND, OLDAP-2.8, RSA-MD)
• libxxhash0@0.8.1-1 (GPL-2.0-only)
• aiohappyeyeballs@2.6.1 (PSF-2.0)
• libpam-modules@1.5.2-6+deb12u1 (BSD-tcp_wrappers, Beerware, GPL, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.0-only, LGPL-2.0-or-later, public-domain)
• libpam0g@1.5.2-6+deb12u1 (BSD-tcp_wrappers, Beerware, GPL, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.0-only, LGPL-2.0-or-later, public-domain)
• pymupdf4llm@0.0.26 (Dual Licensed - GNU AFFERO GPL 3.0 or Artifex Commercial License)
• diffutils@1:3.8-4 (FSFAP, FSFULLR, GFDL-1.3-only, GFDL-NIV-1.3, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, X11, public-domain)
• apt@2.6.1 (Expat, GPL-2.0-only, GPL-2.0-or-later)
• adduser@3.134 (GPL-2.0-only, GPL-2.0-or-later)
• libkeyutils1@1.6.3-2 (GPL-2.0-only, GPL-2.0-or-later, LGPL-2.0-only, LGPL-2.0-or-later)
• python@3.11.13 (no licenses found)
• liblz4-1@1.9.4-1 (GPL-2.0-only, GPL-2.0-or-later)
• mawk@1.3.4.20200120-3.1 (CC-BY-3.0, GPL-2.0-only, X11)
• netbase@6.4 (GPL-2.0-only)
• libnettle8@3.8.1-2 (Expat, GAP, GPL, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-or-later, LGPL, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-3.0-or-later, public-domain)
• e2fsprogs@1.47.0-2 (GPL, GPL-2.0-only, GPL-2.0-or-later, Kazlib, LGPL-2.0-only, Latex2e)
• libtirpc3@1.3.3+ds-1 (GPL-2.0-only, LGPL-2.1-only)
• hostname@3.23+nmu1 (GPL-2.0-only)

Remediation

• Rebase on a patched Debian 12 (bookworm) base image to pick up fixes for the Critical libc6/libc-bin (CVE-2026-5450), perl-base (CVE-2026-8376, CVE-2026-13221, CVE-2026-42496), libssl3/openssl (CVE-2025-15467), and libgnutls30 (CVE-2026-42010, CVE-2026-33845) CVEs.
• Upgrade the openssl/libssl3 and libgnutls30 packages to their listed fixed versions to resolve the remaining High-severity Debian package CVEs.
• Upgrade Python to 3.15.0+ / 3.13.14+ (per-CVE fix versions listed) to resolve the numerous CVE-2026-* Python interpreter CVEs.
• Upgrade urllib3 to 2.7.0+, starlette to 0.49.1+/1.1.0+, setuptools to 78.1.1+, python-multipart to 0.0.27+, and mcp to 1.28.1+ to resolve the listed GHSA advisories.
• Review the extensive list of GPL/LGPL/AGPL and dual-licensed (pymupdf, pymupdf4llm) components against project license policy.

Generated by 🛡️ Daily Container Image Security Scan · auto · 445.4 AIC · ⌖ 18.1 AIC · ⊞ 6.5K · ◷

[github-actions]

🍪 Issue Monster selected this for Copilot

I have identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 4.4 AIC · ⌖ 4.21 AIC · ⊞ 10.9K · ◷