haproxy 3.3.16-alpine-tpio.1 grype

Critical0

High0

Medium3

Low0

Gate passed

publish scan at 2026-10-09T13:15:51Z. Digest: sha256:ba110856a084d7a5b9d61325ef6a24928371b3a9b22a37270a53929c5a7c1e7e.

Predicates verified from the signed registry attestations.

CRITICAL/HIGH findings (2)

Findings are grouped by advisory, package, installed version and binary path. Real and unresolved findings are blocking. The original scan gate and counts are preserved.


CVE-2026-55203	haproxy `os`	3.3.16	2.4.36, 2.6.30, 2.8.25, 3.0.24, 3.2.20, 3.4.1	grype: CRITICAL (CVE-2026-55203)	false positive Reviewed OpenVEX marks this finding fixed; Grype applied that statement.	fixed in this image (reviewed VEX)
CVE-2026-55204	haproxy `os`	3.3.16	2.4.36, 2.6.30, 2.8.25, 3.0.24, 3.2.20, 3.4.1	grype: HIGH (CVE-2026-55204)	false positive Reviewed OpenVEX marks this finding fixed; Grype applied that statement.	fixed in this image (reviewed VEX)

Predicate type: https://thepeoples.io/attestations/grype-report/v1. SHA-256 of original predicate (compact JSON plus newline): 24d992b94423b6f2c263823c1a45b35356de80cc0646018147e0f51f79eb817e.

cosign verify-attestation --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog --type https://thepeoples.io/attestations/grype-report/v1 oci.thepeoples.io/hardened/haproxy@sha256:ba110856a084d7a5b9d61325ef6a24928371b3a9b22a37270a53929c5a7c1e7e | jq -r '.payload' | base64 -d | jq -c '.predicate' | sha256sum

Full grype.json JSON


CVE-2025-60876	busybox	1.37.0-r31	not available	Medium	not suppressed
CVE-2025-60876	busybox-binsh	1.37.0-r31	not available	Medium	not suppressed
CVE-2025-60876	ssl_client	1.37.0-r31	not available	Medium	not suppressed
CVE-2026-55203	haproxy	3.3.16	2.4.36, 2.6.30, 2.8.25, 3.0.24, 3.2.20, 3.4.1	Critical	[{"namespace": "vex", "vex-status": "fixed"}]
CVE-2026-55204	haproxy	3.3.16	2.4.36, 2.6.30, 2.8.25, 3.0.24, 3.2.20, 3.4.1	High	[{"namespace": "vex", "vex-status": "fixed"}]

5 findings, including suppressed matches where reported.