Go 1.27.3 (runtime). Tags: 1.27.3-20261109.19, 1.27, 1.27.3, latest. Index digest sha256:3f354ecb2824a59cc91380aac032e2c017754d4ccb445279f94d690edc0ea5d7.
Vulnerabilities · SBOM · Hardening profile
High: 2 (Grype)
| ID | Severity | Package | Installed | Comes from | Fixed upstream in | Architectures |
|---|---|---|---|---|---|---|
| CVE-2026-119586 | High | sqlite-libs | 3.54.1-r0 | sqlite-libs 3.54.1-r0 | no fix yet | x86_64, aarch64 |
| CVE-2026-84243 | High | glibc-2.44 | 2.44-r15 | glibc-2.44 2.44-r15 | no fix yet | x86_64, aarch64 |
Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside the toolchain, for example, comes from that package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.
One SPDX SBOM per architecture, also attached to the image as a signed attestation.
Download sbom-x86_64.spdx.json · 87.3 MB compressed, 255.2 MB installed
| Package | Version | License |
|---|---|---|
bash | 5.3-r14 | GPL-3.0-or-later |
busybox | 1.38.0-r3 | GPL-2.0-only |
ca-certificates-bundle | 20261020-r0 | MPL-2.0 AND MIT |
cyrus-sasl-heimdal-libs | 2.1.28-r58 | BSD-3-Clause |
gdbm | 1.26-r9 | GPL-3.0-or-later |
git | 2.56.0-r3 | GPL-2.0-or-later AND ( Artistic-1.0-Perl OR GPL-1.0-or-later ) |
glibc-2.44 | 2.44-r15 | LGPL-2.1-or-later |
glibc-2.44-locale-posix | 2.44-r15 | LGPL-2.1-or-later |
go-1.27-upstream | 1.27.3-r0 | BSD-3-Clause |
heimdal-libs | 7.8.0-r55 | BSD-3-Clause |
keyutils-libs | 1.6.3-r41 | GPL-2.0-or-later OR LGPL-2.0-or-later |
krb5-conf | 1.0-r10 | MIT |
krb5-libs | 1.22.2-r6 | MIT |
ld-linux-2.44 | 2.44-r15 | LGPL-2.1-or-later |
libbrotlicommon1 | 1.2.1-r3 | MIT |
libbrotlidec1 | 1.2.1-r3 | MIT |
libbrotlienc1 | 1.2.1-r3 | MIT |
libcom_err | 1.47.4-r5 | GPL-2.0-or-later AND LGPL-2.0-or-later AND BSD-3-Clause AND MIT |
libcrypt1-2.44 | 2.44-r15 | LGPL-2.1-or-later |
libcurl-openssl4 | 8.23.0-r3 | MIT |
libexpat1 | 2.10.0-r1 | MIT |
libgcc | 16.2.0-r3 | GPL-3.0-or-later WITH GCC-exception-3.1 |
libidn2 | 2.3.8-r12 | GPL-2.0-or-later AND LGPL-3.0-or-later |
libldap-2.7 | 2.7.2-r0 | OLDAP-2.8 |
libnghttp2-14 | 1.71.0-r0 | MIT |
libpcre2-8-0 | 10.49-r3 | BSD-3-Clause |
libpsl | 0.23.3-r4 | MIT |
libunistring | 1.5-r1 | GPL-2.0-or-later OR LGPL-3.0-or-later |
libverto | 0.3.2-r11 | MIT |
libxcrypt | 4.5.2-r8 | GPL-2.0-or-later AND LGPL-2.1-or-later |
lmdb | 0.9.35-r3 | OLDAP-2.8 |
ncurses | 6.6.20261107-r0 | MIT |
ncurses-terminfo-base | 6.6.20261107-r0 | MIT |
nghttp3 | 1.19.0-r0 | MIT |
ngtcp2 | 1.26.0-r0 | MIT |
openssl-4.0-libcrypto | 4.0.3-r8 | Apache-2.0 |
openssl-4.0-libssl | 4.0.3-r8 | Apache-2.0 |
openssl-provider-legacy-allowed | 4.1.0-r0 | Apache-2.0 |
readline | 8.3-r3 | GPL-3.0-or-later |
sqlite-libs | 3.54.1-r0 | blessing |
tzdata | 2026f-r0 | CC-PDDC |
wolfi-baselayout | 20230201-r31 | MIT |
zlib | 1.3.2.1_rc20260921-r2 | MPL-2.0 AND MIT |
Download sbom-aarch64.spdx.json · 81.8 MB compressed, 250.2 MB installed
| Package | Version | License |
|---|---|---|
bash | 5.3-r14 | GPL-3.0-or-later |
busybox | 1.38.0-r3 | GPL-2.0-only |
ca-certificates-bundle | 20261020-r0 | MPL-2.0 AND MIT |
cyrus-sasl-heimdal-libs | 2.1.28-r58 | BSD-3-Clause |
gdbm | 1.26-r9 | GPL-3.0-or-later |
git | 2.56.0-r3 | GPL-2.0-or-later AND ( Artistic-1.0-Perl OR GPL-1.0-or-later ) |
glibc-2.44 | 2.44-r15 | LGPL-2.1-or-later |
glibc-2.44-locale-posix | 2.44-r15 | LGPL-2.1-or-later |
go-1.27-upstream | 1.27.3-r0 | BSD-3-Clause |
heimdal-libs | 7.8.0-r55 | BSD-3-Clause |
keyutils-libs | 1.6.3-r41 | GPL-2.0-or-later OR LGPL-2.0-or-later |
krb5-conf | 1.0-r10 | MIT |
krb5-libs | 1.22.2-r6 | MIT |
ld-linux-2.44 | 2.44-r15 | LGPL-2.1-or-later |
libbrotlicommon1 | 1.2.1-r3 | MIT |
libbrotlidec1 | 1.2.1-r3 | MIT |
libbrotlienc1 | 1.2.1-r3 | MIT |
libcom_err | 1.47.4-r5 | GPL-2.0-or-later AND LGPL-2.0-or-later AND BSD-3-Clause AND MIT |
libcrypt1-2.44 | 2.44-r15 | LGPL-2.1-or-later |
libcurl-openssl4 | 8.23.0-r3 | MIT |
libexpat1 | 2.10.0-r1 | MIT |
libgcc | 16.2.0-r3 | GPL-3.0-or-later WITH GCC-exception-3.1 |
libidn2 | 2.3.8-r12 | GPL-2.0-or-later AND LGPL-3.0-or-later |
libldap-2.7 | 2.7.2-r0 | OLDAP-2.8 |
libnghttp2-14 | 1.71.0-r0 | MIT |
libpcre2-8-0 | 10.49-r3 | BSD-3-Clause |
libpsl | 0.23.3-r4 | MIT |
libunistring | 1.5-r1 | GPL-2.0-or-later OR LGPL-3.0-or-later |
libverto | 0.3.2-r11 | MIT |
libxcrypt | 4.5.2-r8 | GPL-2.0-or-later AND LGPL-2.1-or-later |
lmdb | 0.9.35-r3 | OLDAP-2.8 |
ncurses | 6.6.20261107-r0 | MIT |
ncurses-terminfo-base | 6.6.20261107-r0 | MIT |
nghttp3 | 1.19.0-r0 | MIT |
ngtcp2 | 1.26.0-r0 | MIT |
openssl-4.0-libcrypto | 4.0.3-r8 | Apache-2.0 |
openssl-4.0-libssl | 4.0.3-r8 | Apache-2.0 |
openssl-provider-legacy-allowed | 4.1.0-r0 | Apache-2.0 |
readline | 8.3-r3 | GPL-3.0-or-later |
sqlite-libs | 3.54.1-r0 | blessing |
tzdata | 2026f-r0 | CC-PDDC |
wolfi-baselayout | 20230201-r31 | MIT |
zlib | 1.3.2.1_rc20260921-r2 | MPL-2.0 AND MIT |
Derived from the DISA General Purpose Operating System SRG; not an official DISA STIG for containers.
| Architecture | Passed / applicable | Not applicable | Report |
|---|---|---|---|
| x86_64 | 85 / 91 (93.4%) | 107 | OpenSCAP report |
| aarch64 | 85 / 91 (93.4%) | 107 | OpenSCAP report |