envoyproxy / envoyproxy/gateway
Multiple CVEs found in base image package (libc6)
- Dominant language
- Go
- Stars
- 3k
- Forks
- 864
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 140
Description
### Description
A dependency security scan has flagged multiple vulnerabilities (two HIGH, one MEDIUM) within the core `libc6` package embedded in the base container image.
**What issue is being seen?**
The current container image includes an outdated version of `libc6` (`2.41-12+deb13u2`) which contains known security risks.
Vulnerability Matrix:
* CVE-2026-4046 | Severity: 7.5 (HIGH) | [NVD Link](https://nvd.nist.gov/vuln/detail/CVE-2026-4046)
* CVE-2026-4437 | Severity: 7.5 (HIGH) | [NVD Link](https://nvd.nist.gov/vuln/detail/CVE-2026-4437)
* CVE-2026-4438 | Severity: 5.4 (MEDIUM) | [NVD Link](https://nvd.nist.gov/vuln/detail/CVE-2026-4438)
**What should be happening instead?**
The container images should use a patched version of the base image or package (`2.41-12+deb13u3` or later) to ensure zero known high-severity vulnerabilities are present in production artifacts.
### Repro steps
To reproduce the finding, scan the compiled container image using any standard vulnerability scanner (e.g., Trivy or Grype).
**Sample Scan Command:**
```bash
trivy image envoy-gateway:latest --severity HIGH,MEDIUM
```
**Target Scan Object Data:**
* **Package URL (PURL):** `pkg:deb/debian/libc6@2.41-12%2Bdeb13u2?arch=arm64&distro=debian-13.4`
### Environment
* **Gateway Version:** v1.8.1
* **Envoy Version:** v1.38.1
* **Image Architecture/OS:** Debian 13.4 (`arm64`)
### Logs
* Note: As this is a static image dependency vulnerability rather than a runtime traffic failure, standard access logs do not apply.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.