ghcr.io/pair-ai-platform/go:1.25.14-dev-20261109.19

Go 1.25.14 (dev). Tags: 1.25.14-dev-20261109.19, 1.25-dev, 1.25.14-dev. Index digest sha256:6f246148dfe4f8d0dc091f1b15f3ee7f3158649c4595d0ea62c0b4a1011f4512.

Vulnerabilities · SBOM · Hardening profile

Vulnerabilities

Critical: 1 · High: 10 · Medium: 5 · Low: 1 (Grype)

IDSeverityPackageInstalledComes fromFixed upstream inArchitectures
GO-2026-6612Criticalstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9x86_64, aarch64
CVE-2026-119586Highsqlite-libs3.54.1-r0sqlite-libs 3.54.1-r0no fix yetx86_64, aarch64
CVE-2026-84243Highglibc-2.442.44-r15glibc-2.44 2.44-r15no fix yetx86_64, aarch64
GO-2026-6603Highstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9x86_64, aarch64
GO-2026-6605Highstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9, 1.27.2x86_64, aarch64
GO-2026-6607Highstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9, 1.27.2x86_64, aarch64
GO-2026-6608Highstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9, 1.27.2x86_64, aarch64
GO-2026-6610Highstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9x86_64, aarch64
GO-2026-6611Highstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9x86_64, aarch64
GO-2026-6613Highstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9, 1.27.2x86_64, aarch64
GO-2026-6617Highstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9x86_64, aarch64
CVE-2025-15367Mediumpython-3.133.13.18_git20261030-r0python-3.13 3.13.18_git20261030-r0no fix yetx86_64, aarch64
CVE-2026-116566Mediumpython-3.133.13.18_git20261030-r0python-3.13 3.13.18_git20261030-r0no fix yetx86_64, aarch64
GO-2026-6599Mediumstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9, 1.27.2x86_64, aarch64
GO-2026-6600Mediumstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9, 1.27.2x86_64, aarch64
GO-2026-6809Mediumstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.10, 1.27.3x86_64, aarch64
CVE-2026-103995Lowpython-3.133.13.18_git20261030-r0python-3.13 3.13.18_git20261030-r0no fix yetx86_64, aarch64

Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside the toolchain, for example, comes from that package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.

SBOM

One SPDX SBOM per architecture, also attached to the image as a signed attestation.

x86_64: 75 packages

Download sbom-x86_64.spdx.json · 268.7 MB compressed, 731.3 MB installed

PackageVersionLicense
bash5.3-r14GPL-3.0-or-later
binutils2.47-r3GPL-2.0
build-base1-r10MIT
busybox1.38.0-r3GPL-2.0-only
ca-certificates-bundle20261020-r0MPL-2.0 AND MIT
cyrus-sasl-heimdal-libs2.1.28-r58BSD-3-Clause
gcc16.2.0-r3GPL-3.0-or-later WITH GCC-exception-3.1
gdbm1.26-r9GPL-3.0-or-later
git2.56.0-r3GPL-2.0-or-later AND ( Artistic-1.0-Perl OR GPL-1.0-or-later )
glibc-2.442.44-r15LGPL-2.1-or-later
glibc-2.44-dev2.44-r15LGPL-2.1-or-later
glibc-2.44-locale-posix2.44-r15LGPL-2.1-or-later
gmp6.3.0-r12LGPL-3.0-or-later OR GPL-2.0-or-later
go-1.25-upstream1.25.14-r0BSD-3-Clause
heimdal-libs7.8.0-r55BSD-3-Clause
isl0.28-r6MIT
keyutils-libs1.6.3-r41GPL-2.0-or-later OR LGPL-2.0-or-later
krb5-conf1.0-r10MIT
krb5-libs1.22.2-r6MIT
ld-linux-2.442.44-r15LGPL-2.1-or-later
libatomic16.2.0-r3GPL-3.0-or-later WITH GCC-exception-3.1
libbrotlicommon11.2.1-r3MIT
libbrotlidec11.2.1-r3MIT
libbrotlienc11.2.1-r3MIT
libbz2-11.0.8-r30MPL-2.0 AND MIT
libcom_err1.47.4-r5GPL-2.0-or-later AND LGPL-2.0-or-later AND BSD-3-Clause AND MIT
libcrypt1-2.442.44-r15LGPL-2.1-or-later
libcurl-openssl48.23.0-r3MIT
libedit3.1-r20BSD-3-Clause
libexpat12.10.0-r1MIT
libffi3.8.0-r2MIT
libgcc16.2.0-r3GPL-3.0-or-later WITH GCC-exception-3.1
libgomp16.2.0-r3GPL-3.0-or-later WITH GCC-exception-3.1
libidn22.3.8-r12GPL-2.0-or-later AND LGPL-3.0-or-later
libldap-2.72.7.2-r0OLDAP-2.8
libnghttp2-141.71.0-r0MIT
libpcre2-8-010.49-r3BSD-3-Clause
libpsl0.23.3-r4MIT
libquadmath16.2.0-r3GPL-3.0-or-later WITH GCC-exception-3.1
libselinux3.11-r2libselinux-1.0
libsepol3.11-r3LGPL-2.1
libstdc++16.2.0-r3GPL-3.0-or-later WITH GCC-exception-3.1
libstdc++-dev16.2.0-r3GPL-3.0-or-later WITH GCC-exception-3.1
libunistring1.5-r1GPL-2.0-or-later OR LGPL-3.0-or-later
libuuid2.42.4-r2GPL-3.0-or-later AND GPL-2.0-or-later AND GPL-2.0-only AND GPL-1.0-only AND LGPL-2.1-or-later AND BSD-1-Clause AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND MIT AND CC-PDDC
libverto0.3.2-r11MIT
libxcrypt4.5.2-r8GPL-2.0-or-later AND LGPL-2.1-or-later
libxcrypt-dev4.5.2-r8GPL-2.0-or-later AND LGPL-2.1-or-later
libzstd11.5.7-r13BSD-2-Clause AND GPL-2.0-only
linux-headers7.3.3-r0GPL-2.0-only WITH Linux-syscall-note
lmdb0.9.35-r3OLDAP-2.8
make4.4.1-r15GPL-3.0-or-later
mpc1.4.1-r3LGPL-3.0-or-later
mpdecimal4.0.1-r6BSD-2-Clause
mpfr4.2.2-r5LGPL-3.0-or-later
ncurses6.6.20261107-r0MIT
ncurses-terminfo-base6.6.20261107-r0MIT
nghttp31.19.0-r0MIT
ngtcp21.26.0-r0MIT
openssf-compiler-options20250904-r12CC-BY-4.0
openssh-client10.6_p2-r0ISC
openssl-4.0-libcrypto4.0.3-r8Apache-2.0
openssl-4.0-libssl4.0.3-r8Apache-2.0
openssl-provider-legacy-allowed4.1.0-r0Apache-2.0
pkgconf3.0.10-r2ISC
posix-cc-wrappers2-r10MIT
py3-pip-wheel26.2.2-r2MIT
python-3.133.13.18_git20261030-r0PSF-2.0
python-3.13-base3.13.18_git20261030-r0PSF-2.0
readline8.3-r3GPL-3.0-or-later
sqlite-libs3.54.1-r0blessing
tzdata2026f-r0CC-PDDC
wolfi-baselayout20230201-r31MIT
xz5.8.4-r1GPL-3.0-or-later
zlib1.3.2.1_rc20260921-r2MPL-2.0 AND MIT

aarch64: 75 packages

Download sbom-aarch64.spdx.json · 251.6 MB compressed, 781.8 MB installed

PackageVersionLicense
bash5.3-r14GPL-3.0-or-later
binutils2.47-r3GPL-2.0
build-base1-r10MIT
busybox1.38.0-r3GPL-2.0-only
ca-certificates-bundle20261020-r0MPL-2.0 AND MIT
cyrus-sasl-heimdal-libs2.1.28-r58BSD-3-Clause
gcc16.2.0-r3GPL-3.0-or-later WITH GCC-exception-3.1
gdbm1.26-r9GPL-3.0-or-later
git2.56.0-r3GPL-2.0-or-later AND ( Artistic-1.0-Perl OR GPL-1.0-or-later )
glibc-2.442.44-r15LGPL-2.1-or-later
glibc-2.44-dev2.44-r15LGPL-2.1-or-later
glibc-2.44-locale-posix2.44-r15LGPL-2.1-or-later
gmp6.3.0-r12LGPL-3.0-or-later OR GPL-2.0-or-later
go-1.25-upstream1.25.14-r0BSD-3-Clause
heimdal-libs7.8.0-r55BSD-3-Clause
isl0.28-r6MIT
keyutils-libs1.6.3-r41GPL-2.0-or-later OR LGPL-2.0-or-later
krb5-conf1.0-r10MIT
krb5-libs1.22.2-r6MIT
ld-linux-2.442.44-r15LGPL-2.1-or-later
libatomic16.2.0-r3GPL-3.0-or-later WITH GCC-exception-3.1
libbrotlicommon11.2.1-r3MIT
libbrotlidec11.2.1-r3MIT
libbrotlienc11.2.1-r3MIT
libbz2-11.0.8-r30MPL-2.0 AND MIT
libcom_err1.47.4-r5GPL-2.0-or-later AND LGPL-2.0-or-later AND BSD-3-Clause AND MIT
libcrypt1-2.442.44-r15LGPL-2.1-or-later
libcurl-openssl48.23.0-r3MIT
libedit3.1-r20BSD-3-Clause
libexpat12.10.0-r1MIT
libffi3.8.0-r2MIT
libgcc16.2.0-r3GPL-3.0-or-later WITH GCC-exception-3.1
libgomp16.2.0-r3GPL-3.0-or-later WITH GCC-exception-3.1
libidn22.3.8-r12GPL-2.0-or-later AND LGPL-3.0-or-later
libldap-2.72.7.2-r0OLDAP-2.8
libnghttp2-141.71.0-r0MIT
libpcre2-8-010.49-r3BSD-3-Clause
libpsl0.23.3-r4MIT
libquadmath16.2.0-r3GPL-3.0-or-later WITH GCC-exception-3.1
libselinux3.11-r2libselinux-1.0
libsepol3.11-r3LGPL-2.1
libstdc++16.2.0-r3GPL-3.0-or-later WITH GCC-exception-3.1
libstdc++-dev16.2.0-r3GPL-3.0-or-later WITH GCC-exception-3.1
libunistring1.5-r1GPL-2.0-or-later OR LGPL-3.0-or-later
libuuid2.42.4-r2GPL-3.0-or-later AND GPL-2.0-or-later AND GPL-2.0-only AND GPL-1.0-only AND LGPL-2.1-or-later AND BSD-1-Clause AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause-UC AND MIT AND CC-PDDC
libverto0.3.2-r11MIT
libxcrypt4.5.2-r8GPL-2.0-or-later AND LGPL-2.1-or-later
libxcrypt-dev4.5.2-r8GPL-2.0-or-later AND LGPL-2.1-or-later
libzstd11.5.7-r13BSD-2-Clause AND GPL-2.0-only
linux-headers7.3.3-r0GPL-2.0-only WITH Linux-syscall-note
lmdb0.9.35-r3OLDAP-2.8
make4.4.1-r15GPL-3.0-or-later
mpc1.4.1-r3LGPL-3.0-or-later
mpdecimal4.0.1-r6BSD-2-Clause
mpfr4.2.2-r5LGPL-3.0-or-later
ncurses6.6.20261107-r0MIT
ncurses-terminfo-base6.6.20261107-r0MIT
nghttp31.19.0-r0MIT
ngtcp21.26.0-r0MIT
openssf-compiler-options20250904-r12CC-BY-4.0
openssh-client10.6_p2-r0ISC
openssl-4.0-libcrypto4.0.3-r8Apache-2.0
openssl-4.0-libssl4.0.3-r8Apache-2.0
openssl-provider-legacy-allowed4.1.0-r0Apache-2.0
pkgconf3.0.10-r2ISC
posix-cc-wrappers2-r10MIT
py3-pip-wheel26.2.2-r2MIT
python-3.133.13.18_git20261030-r0PSF-2.0
python-3.13-base3.13.18_git20261030-r0PSF-2.0
readline8.3-r3GPL-3.0-or-later
sqlite-libs3.54.1-r0blessing
tzdata2026f-r0CC-PDDC
wolfi-baselayout20230201-r31MIT
xz5.8.4-r1GPL-3.0-or-later
zlib1.3.2.1_rc20260921-r2MPL-2.0 AND MIT

Hardening profile (OpenSCAP, DISA GPOS SRG)

Derived from the DISA General Purpose Operating System SRG; not an official DISA STIG for containers.

ArchitecturePassed / applicableNot applicableReport
x86_6485 / 91 (93.4%)107OpenSCAP report
aarch6485 / 91 (93.4%)107OpenSCAP report