thepeoples

haproxy 3.3.16-alpine-tpio.1 openvex

Critical0
High0
Medium3
Low0
Gate passed

HAProxy image page

publish scan at 2026-10-09T13:15:51Z. Digest: sha256:ba110856a084d7a5b9d61325ef6a24928371b3a9b22a37270a53929c5a7c1e7e.

Predicates verified from the signed registry attestations.

CRITICAL/HIGH findings (2)

Findings are grouped by advisory, package, installed version and binary path. Real and unresolved findings are blocking. The original scan gate and counts are preserved.

CVE-2026-55203haproxy
os		3.3.162.4.36, 2.6.30, 2.8.25, 3.0.24, 3.2.20, 3.4.1grype: CRITICAL (CVE-2026-55203)false positive

Reviewed OpenVEX marks this finding fixed; Grype applied that statement.

fixed in this image (reviewed VEX)
CVE-2026-55204haproxy
os		3.3.162.4.36, 2.6.30, 2.8.25, 3.0.24, 3.2.20, 3.4.1grype: HIGH (CVE-2026-55204)false positive

Reviewed OpenVEX marks this finding fixed; Grype applied that statement.

fixed in this image (reviewed VEX)

Predicate type: https://openvex.dev/ns. SHA-256 of original predicate (compact JSON plus newline): c9a9cf122fd2afde4d3274b9f73512d04f3729642575487ebbd1a7b10180baea.

cosign verify-attestation --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog --type https://openvex.dev/ns oci.thepeoples.io/hardened/haproxy@sha256:ba110856a084d7a5b9d61325ef6a24928371b3a9b22a37270a53929c5a7c1e7e | jq -r '.payload' | base64 -d | jq -c '.predicate' | sha256sum

Private fields prevent static publication of the original JSON. The view below shows public fields. Fetch the unchanged signed original with the command above.

CVE-2026-55203pkg:generic/haproxy@3.3.16fixedNVD CPE range 'through 3.4.0' ignores stable-branch backports. Fix (upstream commit 5985276) 'BUG/MEDIUM: mux-fcgi: fix uint16_t overflow in drl += drp' shipped in 3.3.11 (2026/06/26) per https://www.haproxy.org/download/3.3/src/CHANGELOG (copy: vex/haproxy-3.3.CHANGELOG.txt line 413). Image runs 3.3.16.2026-10-09T02:10:00Z
CVE-2026-55204pkg:generic/haproxy@3.3.16fixedNVD CPE range 'through 3.4.0' ignores stable-branch backports. Fix (upstream commit 9a6d1fe) 'BUG/MINOR: hpack-tbl: add missing NULL check after hpack_dht_defrag()' shipped in 3.3.11 (2026/06/26) per https://www.haproxy.org/download/3.3/src/CHANGELOG (copy: vex/haproxy-3.3.CHANGELOG.txt line 411). Image runs 3.3.16.2026-10-09T02:10:00Z