thepeoples

haproxy 3.3.16-alpine-tpio.1 trivy

Critical0
High0
Medium3
Low0
Gate passed

HAProxy image page

publish scan at 2026-10-09T13:15:51Z. Digest: sha256:ba110856a084d7a5b9d61325ef6a24928371b3a9b22a37270a53929c5a7c1e7e.

Predicates verified from the signed registry attestations.

CRITICAL/HIGH findings (2)

Findings are grouped by advisory, package, installed version and binary path. Real and unresolved findings are blocking. The original scan gate and counts are preserved.

CVE-2026-55203haproxy
os		3.3.162.4.36, 2.6.30, 2.8.25, 3.0.24, 3.2.20, 3.4.1grype: CRITICAL (CVE-2026-55203)false positive

Reviewed OpenVEX marks this finding fixed; Grype applied that statement.

fixed in this image (reviewed VEX)
CVE-2026-55204haproxy
os		3.3.162.4.36, 2.6.30, 2.8.25, 3.0.24, 3.2.20, 3.4.1grype: HIGH (CVE-2026-55204)false positive

Reviewed OpenVEX marks this finding fixed; Grype applied that statement.

fixed in this image (reviewed VEX)

Predicate type: https://thepeoples.io/attestations/trivy-report/v1. SHA-256 of original predicate (compact JSON plus newline): cf36a5b687d5b5905258419bff8f63ff99632d75b9844814e1f6efa8eab45bd7.

cosign verify-attestation --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog --type https://thepeoples.io/attestations/trivy-report/v1 oci.thepeoples.io/hardened/haproxy@sha256:ba110856a084d7a5b9d61325ef6a24928371b3a9b22a37270a53929c5a7c1e7e | jq -r '.payload' | base64 -d | jq -c '.predicate' | sha256sum

Full trivy.json JSON

0 findings, including suppressed matches where reported.