[container-image-scan] Container findings for mcp/memory

[github-actions]

Summary

• Image: mcp/memory
• Pinned reference: mcp/memory@sha256:db0c2db07a44b6797eba7a832b1bda142ffc899588aae82c92780cbb2252407f
• Vulnerabilities: 68 total (8 Critical, 60 High)
• License violations: 22

Vulnerabilities

68 vulnerabilities (click to expand)

• Critical: CVE-2025-15467: libcrypto3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
• Critical: CVE-2025-15467: libssl3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-21710: node@22.14.0 (fix: 20.20.2, 22.22.2, 24.14.1, 25.8.2) ((nvd.nist.gov/redacted)
• High: CVE-2025-59465: node@22.14.0 (fix: 20.20.0, 22.22.0, 24.13.0, 25.3.0) ((nvd.nist.gov/redacted)
• High: CVE-2025-55131: node@22.14.0 (fix: 20.20.0, 22.22.0, 24.13.0, 25.3.0) ((nvd.nist.gov/redacted)
• High: GHSA-5j98-mcp5-4vw2: glob@10.4.5 (fix: 10.5.0) (GHSA-5j98-mcp5-4vw2)
• Critical: CVE-2025-55130: node@22.14.0 (fix: 20.20.0, 22.22.0, 24.13.0, 25.3.0) ((nvd.nist.gov/redacted)
• High: CVE-2025-9230: libcrypto3@3.3.3-r0 (fix: 3.3.5-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2025-9230: libssl3@3.3.3-r0 (fix: 3.3.5-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-31790: libcrypto3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-31790: libssl3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28388: libcrypto3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28388: libssl3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28389: libcrypto3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28389: libssl3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28390: libcrypto3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28390: libssl3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-21637: node@22.14.0 (fix: 20.20.0, 22.22.0, 24.13.0, 25.3.0) ((nvd.nist.gov/redacted)
• High: CVE-2025-69421: libcrypto3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2025-69421: libssl3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28387: libcrypto3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2026-28387: libssl3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2025-69420: libcrypto3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2025-69420: libssl3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2025-23166: node@22.14.0 (fix: 20.19.2, 22.15.1, 23.11.1, 24.0.2) ((nvd.nist.gov/redacted)
• High: CVE-2025-59466: node@22.14.0 (fix: 20.20.0, 22.22.0, 24.13.0, 25.3.0) ((nvd.nist.gov/redacted)
• High: GHSA-34x7-hfp2-rc4v: tar@6.2.1 (fix: 7.5.7) (GHSA-34x7-hfp2-rc4v)
• High: GHSA-34x7-hfp2-rc4v: tar@7.4.3 (fix: 7.5.7) (GHSA-34x7-hfp2-rc4v)
• High: GHSA-34x7-hfp2-rc4v: tar@7.4.3 (fix: 7.5.7) (GHSA-34x7-hfp2-rc4v)
• High: GHSA-3ppc-4f35-3m26: minimatch@9.0.5 (fix: 9.0.6) (GHSA-3ppc-4f35-3m26)
• High: CVE-2026-56848: node@22.14.0 (fix: 22.23.2, 24.18.1, 26.5.1) ((nvd.nist.gov/redacted)
• High: CVE-2026-56846: node@22.14.0 (fix: 22.23.2, 24.18.1) ((nvd.nist.gov/redacted)
• High: GHSA-w48q-cv73-mx4w: @modelcontextprotocol/sdk@1.0.1 (fix: 1.24.0) (GHSA-w48q-cv73-mx4w)
• High: GHSA-7r86-cg39-jmmj: minimatch@9.0.5 (fix: 9.0.7) (GHSA-7r86-cg39-jmmj)
• Critical: GHSA-23hp-3jrh-7fpw: tar@6.2.1 (fix: 7.5.19) (GHSA-23hp-3jrh-7fpw)
• Critical: GHSA-23hp-3jrh-7fpw: tar@7.4.3 (fix: 7.5.19) (GHSA-23hp-3jrh-7fpw)
• Critical: GHSA-23hp-3jrh-7fpw: tar@7.4.3 (fix: 7.5.19) (GHSA-23hp-3jrh-7fpw)
• High: GHSA-23c5-xmqv-rm74: minimatch@9.0.5 (fix: 9.0.7) (GHSA-23c5-xmqv-rm74)
• High: CVE-2025-69419: libcrypto3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
• High: CVE-2025-69419: libssl3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
• High: GHSA-8x88-c5mf-7j5w: tar@6.2.1 (fix: 7.5.18) (GHSA-8x88-c5mf-7j5w)
• High: GHSA-8x88-c5mf-7j5w: tar@7.4.3 (fix: 7.5.18) (GHSA-8x88-c5mf-7j5w)
• High: GHSA-8x88-c5mf-7j5w: tar@7.4.3 (fix: 7.5.18) (GHSA-8x88-c5mf-7j5w)
• High: GHSA-qffp-2rhf-9h96: tar@6.2.1 (fix: 7.5.10) (GHSA-qffp-2rhf-9h96)
• High: GHSA-qffp-2rhf-9h96: tar@7.4.3 (fix: 7.5.10) (GHSA-qffp-2rhf-9h96)
• High: GHSA-qffp-2rhf-9h96: tar@7.4.3 (fix: 7.5.10) (GHSA-qffp-2rhf-9h96)
• High: GHSA-rgw5-rvv9-x895: brace-expansion@2.0.1 (fix: 2.1.4) (GHSA-rgw5-rvv9-x895)
• High: GHSA-8qq5-rm4j-mr97: tar@6.2.1 (fix: 7.5.3) (GHSA-8qq5-rm4j-mr97)
• High: GHSA-8qq5-rm4j-mr97: tar@7.4.3 (fix: 7.5.3) (GHSA-8qq5-rm4j-mr97)
• High: GHSA-8qq5-rm4j-mr97: tar@7.4.3 (fix: 7.5.3) (GHSA-8qq5-rm4j-mr97)
• High: GHSA-mh99-v99m-4gvg: brace-expansion@2.0.1 (fix: 2.1.3) (GHSA-mh99-v99m-4gvg)
• High: GHSA-3jxr-9vmj-r5cp: brace-expansion@2.0.1 (fix: 2.1.2) (GHSA-3jxr-9vmj-r5cp)
• Critical: CVE-2026-31789: libcrypto3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
• Critical: CVE-2026-31789: libssl3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
• High: GHSA-mwp4-54f8-5fhr: ip-address@9.0.5 (fix: 10.3.1) (GHSA-mwp4-54f8-5fhr)
• High: GHSA-83g3-92jg-28cx: tar@6.2.1 (fix: 7.5.8) (GHSA-83g3-92jg-28cx)
• High: GHSA-83g3-92jg-28cx: tar@7.4.3 (fix: 7.5.8) (GHSA-83g3-92jg-28cx)
• High: GHSA-83g3-92jg-28cx: tar@7.4.3 (fix: 7.5.8) (GHSA-83g3-92jg-28cx)
• High: GHSA-9ppj-qmqm-q256: tar@6.2.1 (fix: 7.5.11) (GHSA-9ppj-qmqm-q256)
• High: GHSA-9ppj-qmqm-q256: tar@7.4.3 (fix: 7.5.11) (GHSA-9ppj-qmqm-q256)
• High: GHSA-9ppj-qmqm-q256: tar@7.4.3 (fix: 7.5.11) (GHSA-9ppj-qmqm-q256)
• High: GHSA-r6q2-hw4h-h46w: tar@6.2.1 (fix: 7.5.4) (GHSA-r6q2-hw4h-h46w)
• High: GHSA-r6q2-hw4h-h46w: tar@7.4.3 (fix: 7.5.4) (GHSA-r6q2-hw4h-h46w)
• High: GHSA-r6q2-hw4h-h46w: tar@7.4.3 (fix: 7.5.4) (GHSA-r6q2-hw4h-h46w)
• High: CVE-2026-40200: musl@1.2.5-r9 (fix: 1.2.5-r11) ((security.alpinelinux.org/redacted)
• High: CVE-2026-40200: musl-utils@1.2.5-r9 (fix: 1.2.5-r11) ((security.alpinelinux.org/redacted)
• High: GHSA-52v5-jr5w-gjxr: sigstore@3.0.0 (fix: 4.1.1) (GHSA-52v5-jr5w-gjxr)
• High: CVE-2026-58043: node@22.14.0 (fix: 22.23.2, 24.18.1, 26.5.1) ((nvd.nist.gov/redacted)

Licenses

22 license policy violations (click to expand)

• apk-tools@2.14.6-r3 (GPL-2.0-only)
• path-scurry@1.11.1 (BlueOak-1.0.0)
• alpine-baselayout-data@3.6.8-r1 (GPL-2.0-only)
• spdx-exceptions@2.5.0 (CC-BY-3.0)
• libstdc++@14.2.0-r4 (GPL-2.0-or-later, LGPL-2.1-or-later)
• zlib@1.3.1-r2 (Zlib)
• yallist@5.0.0 (BlueOak-1.0.0)
• package-json-from-dist@1.0.1 (BlueOak-1.0.0)
• jackspeak@3.4.3 (BlueOak-1.0.0)
• musl-utils@1.2.5-r9 (GPL-2.0-or-later)
• alpine-baselayout@3.6.8-r1 (GPL-2.0-only)
• busybox@1.37.0-r12 (GPL-2.0-only)
• libgcc@14.2.0-r4 (GPL-2.0-or-later, LGPL-2.1-or-later)
• spdx-license-ids@3.0.20 (CC0-1.0)
• ssl_client@1.37.0-r12 (GPL-2.0-only)
• node@22.14.0 (no licenses found)
• npm@10.9.2 (Artistic-2.0)
• chownr@3.0.0 (BlueOak-1.0.0)
• qrcode-terminal@0.12.0 (Apache 2.0)
• busybox-binsh@1.37.0-r12 (GPL-2.0-only)
• ca-certificates-bundle@20241121-r1 (MPL-2.0)
• scanelf@1.3.8-r1 (GPL-2.0-only)

Remediation

• Rebase on a patched base OS image to resolve the Critical severity CVEs affecting core system libraries (see list above for exact packages/CVEs).
• Upgrade all affected packages/dependencies to their listed fixed versions to address the remaining High-severity findings.
• Review the flagged license violations against project license policy.

Generated by 🛡️ Daily Container Image Security Scan · auto · 445.4 AIC · ⌖ 18.1 AIC · ⊞ 6.5K · ◷

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 3.54 AIC · ⌖ 6.48 AIC · ⊞ 11.3K · ◷