From 7334658927fa00243c9b358fcc1783fe6fc4e517 Mon Sep 17 00:00:00 2001 From: Anso Date: Mon, 13 Apr 2026 10:20:48 -0400 Subject: [PATCH] chore(security): accept CVE-2026-32280 in .trivyignore (#548) Go stdlib crypto/x509 certificate chain building DoS affects Docker CLI 29.4.0 (Go 1.26.1) and Compose v5.1.2 (Go 1.25.8). Fix requires Go 1.25.9 or 1.26.2; no upstream static binary ships a patched runtime yet. Not exploitable in our usage since the CLI and compose plugin connect to the local Docker socket or registries with well-known CAs. --- .trivyignore | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.trivyignore b/.trivyignore index ebb7e8e4..faf6e788 100644 --- a/.trivyignore +++ b/.trivyignore @@ -23,7 +23,7 @@ # Bundled inside /usr/local/bin/docker and docker-compose # --------------------------------------------------------------------------- # Docker CLI 29.4.0 ships Go 1.26.1 and Compose v5.1.2 ships Go 1.25.8. -# Both are vulnerable to CVE-2026-32282 (fix requires Go 1.25.9 or 1.26.2). +# Both Go versions are vulnerable (fix requires Go 1.25.9 or 1.26.2). # No upstream static binary ships a patched Go runtime yet. Revisit on the # next Docker CLI and Compose release. @@ -35,6 +35,14 @@ # release. CVE-2026-32282 +# Justification: Go stdlib crypto/x509 certificate chain building DoS. +# Affects the same Go 1.26.1 (CLI) and 1.25.8 (Compose) runtimes as above. +# The Docker CLI and compose plugin do not perform x509 chain validation +# against untrusted certificates in our usage (they connect to the local +# Docker socket or to registries with well-known CAs). Blocked on upstream +# Go rebuild; revisit on next CLI/Compose release. +CVE-2026-32280 + # --------------------------------------------------------------------------- # Bundled inside /usr/local/lib/docker/cli-plugins/docker-compose (v5.1.2) # ---------------------------------------------------------------------------