envoyproxy / envoyproxy/gateway

Multiple CVEs found in base image package (libc6)

Open
#9,228 2 comments 0 reactions 0 assignees View on GitHub
stale triage
Dominant language
Go
Stars
3k
Forks
864
Avg merge
2d 2h
Merged PRs (30d)
140

Description

### Description
A dependency security scan has flagged multiple vulnerabilities (two HIGH, one MEDIUM) within the core `libc6` package embedded in the base container image.

**What issue is being seen?**
The current container image includes an outdated version of `libc6` (`2.41-12+deb13u2`) which contains known security risks.

Vulnerability Matrix:
* CVE-2026-4046 | Severity: 7.5 (HIGH) | [NVD Link](https://nvd.nist.gov/vuln/detail/CVE-2026-4046)
* CVE-2026-4437 | Severity: 7.5 (HIGH) | [NVD Link](https://nvd.nist.gov/vuln/detail/CVE-2026-4437)
* CVE-2026-4438 | Severity: 5.4 (MEDIUM) | [NVD Link](https://nvd.nist.gov/vuln/detail/CVE-2026-4438)

**What should be happening instead?**
The container images should use a patched version of the base image or package (`2.41-12+deb13u3` or later) to ensure zero known high-severity vulnerabilities are present in production artifacts.

### Repro steps
To reproduce the finding, scan the compiled container image using any standard vulnerability scanner (e.g., Trivy or Grype).

**Sample Scan Command:**
```bash
trivy image envoy-gateway:latest --severity HIGH,MEDIUM
```

**Target Scan Object Data:**
* **Package URL (PURL):** `pkg:deb/debian/libc6@2.41-12%2Bdeb13u2?arch=arm64&distro=debian-13.4`

### Environment
* **Gateway Version:** v1.8.1
* **Envoy Version:** v1.38.1
* **Image Architecture/OS:** Debian 13.4 (`arm64`)

### Logs
* Note: As this is a static image dependency vulnerability rather than a runtime traffic failure, standard access logs do not apply.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.