Review the CVE scan workflow
Open
area/security
release/v3.5
release/v3.6
stale
type/feature
- Dominant language
- Go
- Stars
- 52.3k
- Forks
- 10.5k
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 43
Description
### What would you like to be added?
Recently there is a glibc CVE https://nvd.nist.gov/vuln/detail/CVE-2026-0861.
It is an OS-level CVE in glibc rather than a Go runtime issue. etcd is built with CGO disabled, so it does not depend on glibc at runtime. It comes from the container base image. Upgrading the base image is recommended, but the etcd binary itself is not affected by this CVE.
But the problem is why our CVE scan workflow did not detect this?
### Why is this needed?
to guarantee security and avoid CVE noise
cc @ArkaSaha30 @ivanvc
Contributor guide
Assessment
This issue has not been assessed yet.