llm-api-gateway 0.8.3: 32 stop-action CVEs from the distroless_go base (openssl, libc6)

NGC security scans of nvstaging/nvcf/llm-api-gateway:0.8.3 report 47
vulnerabilities, 32 of them with gateAction: stop. None are whitelisted.

AMD64 and ARM64 are identical, 47 findings each with the same severity split,
so this is the shared base layer rather than anything arch-specific.

Every finding is an OS package

No application-layer findings. All 47 are gate: vulnerabilities on dpkg
packages, which means they come from the base image, not from our Go code or
its module dependencies.

The four CRITICALs are two openssl CVEs counted once per package:

• CVE-2026-31789, 3.5.5-1~deb13u1 -> fixed in 3.5.5-1~deb13u2
• CVE-2026-34182, 3.5.5-1~deb13u1 -> fixed in 3.5.6-1~deb13u2

Both fixes are available in Debian 13 point updates, so the installed base is
one security update behind.

Base image

llm-api-gateway builds on @distroless_go (BUILD.bazel, go_oci_image),
pinned in the root MODULE.bazel:

oci.pull(
    name = "distroless_go",
    digest = "sha256:938bd28ce4ddb800118a951774203e7563c2067a72b20ae6b85d2c7da165a178",
    image = "nvcr.io/nvidia/distroless/go",
    platforms = ["linux/amd64", "linux/arm64/v8"],
)

Repinning that digest to a build carrying the updated openssl and libc6 should
clear all 47. Worth checking whether an updated nvcr.io/nvidia/distroless/go
exists before deciding whether this is a repin or a request to whoever
publishes that base.

Scope beyond this service

Every Go service in the repo shares @distroless_go, so the same findings very
likely apply across the fleet. llm-api-gateway is just where the scan was
run. Worth scanning one or two others to confirm before treating it as
service-specific.

Why this surfaced by hand

The pulse-scan job in the nvpublish pipeline has produced zero scan coverage
since 2026-07-31 (SSA token rejected with HTTP 401), and because the job is
allow_failure: true the pipelines stayed green. These CSVs came from NGC's
own scanner instead. nvpublish!73 makes that failure visible; it does not fix
the credential.

Separately, pulse-scan passes --platform linux/amd64 only, so its coverage
would have been amd64-only even when working. The NGC scan above shows arm64
carries the same 47.

Not verified

Whether a fixed nvcr.io/nvidia/distroless/go digest is currently published,
and whether the 28 HIGHs all clear with the same bump; I read the severity and
package fields but did not enumerate each HIGH's fixed-in version.

Start with the distroless_go definition in MODULE.bazel and its use in BUILD.bazel through go_oci_image. Check whether a newer nvcr.io/nvidia/distroless/go digest contains the Debian 13 openssl and libc6 fixes, then scan one or two other Go services that share the base. Done means the base is updated or the publisher is engaged, and the 47 findings are confirmed cleared across the affected images.