fix(oci/library/alpine): update 3.23.3 ➼ 3.23.6

[tinfoild]

This PR contains the following updates:

Package	Update	Change	OpenSSF
public.ecr.aws/docker/library/alpine (source)	patch	3.23.3 → 3.23.6

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Configuration

📅 Schedule: (in timezone Asia/Singapore)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[cloudflare-workers-and-pages]

Deploying jjgadgets-biohazard with    Cloudflare Pages

Latest commit:	a53dd25
Status:	🚫  Build failed.

View logs

[tinfoild]

kube/kustomization/out00

--- kube/deploy/core/storage/fstrim/app Kustomization: flux-system/1-core-storage-fstrim-app HelmRelease: fstrim/fstrim

+++ kube/deploy/core/storage/fstrim/app Kustomization: flux-system/1-core-storage-fstrim-app HelmRelease: fstrim/fstrim

@@ -51,13 +51,13 @@

               nsenter --mount=/host/proc//ns/mnt --net=/host/proc//ns/net -- sh -c "fstrim --verbose --quiet-unsupported --all"
             command:
             - /bin/sh
             - -c
             image:
               repository: public.ecr.aws/docker/library/alpine
-              tag: 3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
+              tag: 3.23.6@sha256:85fe1e81d6758c208f3e1eed4338a1997e19d4be002d4dd32d3100c9a8c010a0
             probes:
               liveness:
                 enabled: false
               readiness:
                 enabled: false
               startup:

[tinfoild]

kube/helmrelease/out00

--- HelmRelease: fstrim/fstrim CronJob: fstrim/fstrim

+++ HelmRelease: fstrim/fstrim CronJob: fstrim/fstrim

@@ -51,13 +51,13 @@

           - args:
             - |
               nsenter --mount=/host/proc//ns/mnt --net=/host/proc//ns/net -- sh -c "fstrim --verbose --quiet-unsupported --all"
             command:
             - /bin/sh
             - -c
-            image: public.ecr.aws/docker/library/alpine:3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
+            image: public.ecr.aws/docker/library/alpine:3.23.6@sha256:18125326968f1d09ef7b7fff2c06f300767daaf5c6591f735e2f058edfa10a16
             name: main
             resources:
               limits:
                 cpu: 3000m
                 memory: 6Gi
               requests:

[ciel-shieru]

SECURITY VULNERABILITIES FOUND BY CIEL

📅 Scan date: 2026-07-24 03:47 UTC
🤖 Scanner: Ciel Security Scanner
🔗 PR: #5473 — fix(oci/library/alpine): update 3.23.3 ➼ 3.23.5
📦 Packages checked: 1
🔍 Sources: NVD, OSV.dev, GHSA, GHSL, CISA KEV, FortiGuard, CVE.org, Changelog
⚠️ Vulnerabilities found: 2

---

Severity Summary

Severity	Count
CRITICAL	0
HIGH	0
MEDIUM / MODERATE	0
LOW	2
UNKNOWN / NEEDS VERIFICATION	0
Total	2

---

Results

Package: public.ecr.aws/docker/library/alpine

• Ecosystem: Docker (Alpine Linux)
• Old version: 3.23.3 — VULNERABLE (2 LOW CVEs)
• New version: 3.23.5 — CLEAN

Vulnerabilities in version 3.23.3

1. CVE-2026-41080 — Severity: LOW (CVSS 2.9)

   • Description: libexpat insufficient entropy allows hash flooding via crafted XML.
   • Affected versions: < 2.8.0 (expat shipped in Alpine 3.23.3 was < 2.8.1)
   • Fixed in: expat 2.8.0+ (shipped in Alpine 3.23.5 as expat 2.8.1)
   • Sources: NVD, OSV.dev, Alpine changelog
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-41080 | https://gitlab.alpinelinux.org/alpine/aports/-/commit/8ec474c4e7244f58a540c7ea2852c393f8f032e4
   • Status: ✅ Fixed in newer versions

2. CVE-2026-45186 — Severity: LOW (CVSS 2.9)

   • Description: libexpat attribute name collision check DoS via crafted XML input.
   • Affected versions: < 2.8.1
   • Fixed in: expat 2.8.1 (shipped in Alpine 3.23.5)
   • Sources: NVD, OSV.dev, Alpine changelog
   • Evidence: https://nvd.nist.gov/vuln/detail/CVE-2026-45186 | https://gitlab.alpinelinux.org/alpine/aports/-/commit/8ec474c4e7244f58a540c7ea2852c393f8f032e4
   • Status: ✅ Fixed in newer versions

Vulnerabilities in version 3.23.5

No known vulnerabilities found.

Non-applicable findings (verified and excluded)

Finding	Severity	Reason not applicable
CVE-2019-5021	CRITICAL 9.8	NULL root password — fixed in Alpine Docker images since v3.6.5+ (2019); neither version affected
CVE-2018-1000849	HIGH 8.8	apk-tools RCE — fixed in 2.10.1; Alpine 3.23.x uses apk-tools v3.x
CVE-2021-30139	HIGH 7.5	apk-tools buffer overflow — fixed in 2.12.5; Alpine 3.23.x uses apk-tools v3.x
CVE-2021-36159	CRITICAL 9.1	libfetch OOB read — fixed in apk-tools since 2021; Alpine 3.23.x unaffected
CVE-2022-22704	CRITICAL 9.8	zabbix-agent2 — not present in minimal Docker image
+6 more	—	All patched in earlier versions or unrelated products (email client, car stereo, WP plugins, etc.)

Changelog Security Highlights (3.23.3 → 3.23.5)

• expat: security upgrade to 2.8.1 — CVE-2026-41080 (hash flooding), CVE-2026-45186 (DoS)
• linux-lts: upgrade to 6.18.36 — Kernel security and bug fixes (container shares host kernel)

---

Recommendations

• MERGE PRIORITY: LOW — Two LOW-severity expat CVEs remediated by this update. No CRITICAL/HIGH findings in either version. The old version had minor exposure (hash flooding / DoS via XML), mitigated in practice if the container does not parse untrusted XML.
• No new vulnerabilities introduced by the update.
• Merge at own discretion; low urgency.

---

⚠️ This comment was posted by an automated security scanner (Ciel).
To re-scan, trigger the renovate-security-scanner skill.