Update distroless base image to fix CVE-2026-5450
Author: cleleg1Created Sep 15, 2026Updated Sep 16, 2026
Labelsbugdeps
Title: Update distroless base image to fix CVE-2026-5450
Description: To fix the recently patched libc6 package on debian can you please update the base image of base-nossl-debian13:nonroot to the latest one which don't have CVE-2026-5450 anymore. The previous update was done by dependabot but I don't see any opened PR.
Grype scan of the current used image :
➜ ~ grype gcr.io/distroless/base-nossl-debian13:nonroot@sha256:86554c46a420d507ff2d678fd261ab8691fba4875a20302f38a49e684b42a33f
✔ Loaded image gcr.io/distroless/base-nossl-debian13:nonroot@sha256:86554c46a420d507ff2d678fd261ab8691fba4875a20302f38a49e684b42a33f
✔ Parsed image sha256:68ee68c0c58639e6a54e42356e64e0f5b9a2d54282196d7f5e16665d87323d40
✔ Cataloged contents 1c8c6f260a19a61f32df2c7ca3da5279c4725524a02190afe5a6a9a9bde44ce9
├── ✔ Packages [6 packages]
├── ✔ File metadata [1,219 locations]
├── ✔ Executables [273 executables]
└── ✔ File digests [1,219 files]
✔ Scanned for vulnerabilities [19 vulnerability matches]
├── by severity: 1 critical, 3 high, 5 medium, 1 low, 7 negligible (2 unknown)
└── by status: 2 fixed, 17 not-fixed, 0 ignored
NAME INSTALLED FIXED IN TYPE VULNERABILITY SEVERITY EPSS RISK
libc6 2.41-12+deb13u3 2.41-12+deb13u4 deb CVE-2026-5450 Critical 0.5% (41st) 0.5
libc6 2.41-12+deb13u3 deb CVE-2018-20796 Negligible 5.8% (92nd) 0.3
libc6 2.41-12+deb13u3 2.41-12+deb13u4 deb CVE-2026-5928 High 0.4% (30th) 0.3
libc6 2.41-12+deb13u3 (won't fix) deb CVE-2026-6238 Medium 0.4% (29th) 0.2
libc6 2.41-12+deb13u3 (won't fix) deb CVE-2026-5435 High 0.2% (14th) 0.2
libc6 2.41-12+deb13u3 deb CVE-2019-1010022 Negligible 3.2% (87th) 0.2
libc6 2.41-12+deb13u3 deb CVE-2019-1010024 Negligible 3.2% (87th) 0.2
libc6 2.41-12+deb13u3 deb CVE-2019-1010023 Negligible 3.0% (86th) 0.2
libc6 2.41-12+deb13u3 deb CVE-2010-4756 Negligible 2.6% (84th) 0.1
libc6 2.41-12+deb13u3 deb CVE-2019-9192 Negligible 2.4% (83rd) 0.1
libc6 2.41-12+deb13u3 (won't fix) deb CVE-2026-6791 Medium 0.2% (11th) 0.1
libc6 2.41-12+deb13u3 deb CVE-2019-1010025 Negligible 2.3% (82nd) 0.1
libc6 2.41-12+deb13u3 (won't fix) deb CVE-2026-89092 Medium 0.2% (15th) 0.1
libc6 2.41-12+deb13u3 (won't fix) deb CVE-2026-18374 Medium 0.1% (4th) < 0.1
libc6 2.41-12+deb13u3 (won't fix) deb CVE-2026-6368 Low 0.1% (1st) < 0.1
libc6 2.41-12+deb13u3 (won't fix) deb CVE-2026-19499 High N/A N/A
libc6 2.41-12+deb13u3 (won't fix) deb CVE-2026-19542 Medium N/A N/A
libc6 2.41-12+deb13u3 (won't fix) deb CVE-2026-77117 Unknown N/A N/A
libc6 2.41-12+deb13u3 (won't fix) deb CVE-2026-80489 Unknown N/A N/A
A newer version of grype is available for download: 0.118.0 (installed version is 0.115.0)Grype scan of the latest image :
➜ ~ grype gcr.io/distroless/base-nossl-debian13@sha256:8c563c1fb5e120606f0d85733049775faed6192e2bd2223ef283a5393eec22b9
✔ Loaded image gcr.io/distroless/base-nossl-debian13@sha256:8c563c1fb5e120606f0d85733049775faed6192e2bd2223ef283a5393eec22b9
✔ Parsed image sha256:72f868614631b5551a8a56e7bdee00ac751ccf7588d1c9f7fc1c05d7143b043b
✔ Cataloged contents e9fb58c0b2c296bd33153ff31cb53e4cc5f9c7cf390a5771986bca2e45c2520f
├── ✔ Packages [7 packages]
├── ✔ Executables [273 executables]
├── ✔ File metadata [1,231 locations]
└── ✔ File digests [1,231 files]
✔ Scanned for vulnerabilities [17 vulnerability matches]
├── by severity: 0 critical, 2 high, 5 medium, 1 low, 7 negligible (2 unknown)
└── by status: 0 fixed, 17 not-fixed, 0 ignored
NAME INSTALLED FIXED IN TYPE VULNERABILITY SEVERITY EPSS RISK
libc6 2.41-12+deb13u4 deb CVE-2018-20796 Negligible 5.8% (92nd) 0.3
libc6 2.41-12+deb13u4 (won't fix) deb CVE-2026-6238 Medium 0.4% (29th) 0.2
libc6 2.41-12+deb13u4 (won't fix) deb CVE-2026-5435 High 0.2% (14th) 0.2
libc6 2.41-12+deb13u4 deb CVE-2019-1010022 Negligible 3.2% (87th) 0.2
libc6 2.41-12+deb13u4 deb CVE-2019-1010024 Negligible 3.2% (87th) 0.2
libc6 2.41-12+deb13u4 deb CVE-2019-1010023 Negligible 3.0% (86th) 0.2
libc6 2.41-12+deb13u4 deb CVE-2010-4756 Negligible 2.6% (84th) 0.1
libc6 2.41-12+deb13u4 deb CVE-2019-9192 Negligible 2.4% (83rd) 0.1
libc6 2.41-12+deb13u4 (won't fix) deb CVE-2026-6791 Medium 0.2% (11th) 0.1
libc6 2.41-12+deb13u4 deb CVE-2019-1010025 Negligible 2.3% (82nd) 0.1
libc6 2.41-12+deb13u4 (won't fix) deb CVE-2026-89092 Medium 0.2% (15th) 0.1
libc6 2.41-12+deb13u4 (won't fix) deb CVE-2026-18374 Medium 0.1% (4th) < 0.1
libc6 2.41-12+deb13u4 (won't fix) deb CVE-2026-6368 Low 0.1% (1st) < 0.1
libc6 2.41-12+deb13u4 (won't fix) deb CVE-2026-19499 High N/A N/A
libc6 2.41-12+deb13u4 (won't fix) deb CVE-2026-19542 Medium N/A N/A
libc6 2.41-12+deb13u4 (won't fix) deb CVE-2026-77117 Unknown N/A N/A
libc6 2.41-12+deb13u4 (won't fix) deb CVE-2026-80489 Unknown N/A N/A
A newer version of grype is available for download: 0.118.0 (installed version is 0.115.0)Source: envoyproxy/envoy