[container-image-scan] Container findings for mcp/memory

[github-actions]

Summary

Image: mcp/memory
Pinned reference: mcp/memory@sha256:db0c2db07a44b6797eba7a832b1bda142ffc899588aae82c92780cbb2252407f

• Vulnerabilities: 118 total — Critical: 8, High: 55, Medium: 42, Low: 13, Negligible: 0, Unknown: 0
• License policy violations: 22

Remediation

• Rebuild/update the image to pull in patched packages for the vulnerabilities listed below (fixed versions shown where available).
• Review the licenses listed below against policy; consider replacing, removing, or granting an exception for flagged packages.
• Re-run the scan after remediation to confirm the findings are resolved.

Critical & High severity vulnerabilities

[Critical] CVE-2025-15467: libcrypto3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
[Critical] CVE-2025-15467: libssl3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
[Critical] CVE-2025-55130: node@22.14.0 (fix: 20.20.0, 22.22.0, 24.13.0, 25.3.0) ((nvd.nist.gov/redacted)
[Critical] CVE-2026-31789: libcrypto3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
[Critical] CVE-2026-31789: libssl3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
[Critical] GHSA-23hp-3jrh-7fpw: tar@6.2.1 (fix: 7.5.19) (https://github.com/advisories/GHSA-23hp-3jrh-7fpw)
[Critical] GHSA-23hp-3jrh-7fpw: tar@7.4.3 (fix: 7.5.19) (https://github.com/advisories/GHSA-23hp-3jrh-7fpw)
[High] CVE-2025-23166: node@22.14.0 (fix: 20.19.2, 22.15.1, 23.11.1, 24.0.2) ((nvd.nist.gov/redacted)
[High] CVE-2025-55131: node@22.14.0 (fix: 20.20.0, 22.22.0, 24.13.0, 25.3.0) ((nvd.nist.gov/redacted)
[High] CVE-2025-59465: node@22.14.0 (fix: 20.20.0, 22.22.0, 24.13.0, 25.3.0) ((nvd.nist.gov/redacted)
[High] CVE-2025-59466: node@22.14.0 (fix: 20.20.0, 22.22.0, 24.13.0, 25.3.0) ((nvd.nist.gov/redacted)
[High] CVE-2025-69419: libcrypto3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
[High] CVE-2025-69419: libssl3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
[High] CVE-2025-69420: libcrypto3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
[High] CVE-2025-69420: libssl3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
[High] CVE-2025-69421: libcrypto3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
[High] CVE-2025-69421: libssl3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
[High] CVE-2025-9230: libcrypto3@3.3.3-r0 (fix: 3.3.5-r0) ((security.alpinelinux.org/redacted)
[High] CVE-2025-9230: libssl3@3.3.3-r0 (fix: 3.3.5-r0) ((security.alpinelinux.org/redacted)
[High] CVE-2026-21637: node@22.14.0 (fix: 20.20.0, 22.22.0, 24.13.0, 25.3.0) ((nvd.nist.gov/redacted)
[High] CVE-2026-21710: node@22.14.0 (fix: 20.20.2, 22.22.2, 24.14.1, 25.8.2) ((nvd.nist.gov/redacted)
[High] CVE-2026-28387: libcrypto3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
[High] CVE-2026-28387: libssl3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
[High] CVE-2026-28388: libcrypto3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
[High] CVE-2026-28388: libssl3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
[High] CVE-2026-28389: libcrypto3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
[High] CVE-2026-28389: libssl3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
[High] CVE-2026-28390: libcrypto3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
[High] CVE-2026-28390: libssl3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
[High] CVE-2026-31790: libcrypto3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
[High] CVE-2026-31790: libssl3@3.3.3-r0 (fix: 3.3.7-r0) ((security.alpinelinux.org/redacted)
[High] CVE-2026-40200: musl-utils@1.2.5-r9 (fix: 1.2.5-r11) ((security.alpinelinux.org/redacted)
[High] CVE-2026-40200: musl@1.2.5-r9 (fix: 1.2.5-r11) ((security.alpinelinux.org/redacted)
[High] GHSA-23c5-xmqv-rm74: minimatch@9.0.5 (fix: 9.0.7) (https://github.com/advisories/GHSA-23c5-xmqv-rm74)
[High] GHSA-34x7-hfp2-rc4v: tar@6.2.1 (fix: 7.5.7) (https://github.com/advisories/GHSA-34x7-hfp2-rc4v)
[High] GHSA-34x7-hfp2-rc4v: tar@7.4.3 (fix: 7.5.7) (https://github.com/advisories/GHSA-34x7-hfp2-rc4v)
[High] GHSA-3jxr-9vmj-r5cp: brace-expansion@2.0.1 (fix: 2.1.2) (https://github.com/advisories/GHSA-3jxr-9vmj-r5cp)
[High] GHSA-3ppc-4f35-3m26: minimatch@9.0.5 (fix: 9.0.6) (https://github.com/advisories/GHSA-3ppc-4f35-3m26)
[High] GHSA-52v5-jr5w-gjxr: sigstore@3.0.0 (fix: 4.1.1) (https://github.com/advisories/GHSA-52v5-jr5w-gjxr)
[High] GHSA-5j98-mcp5-4vw2: glob@10.4.5 (fix: 10.5.0) (https://github.com/advisories/GHSA-5j98-mcp5-4vw2)
[High] GHSA-7r86-cg39-jmmj: minimatch@9.0.5 (fix: 9.0.7) (https://github.com/advisories/GHSA-7r86-cg39-jmmj)
[High] GHSA-83g3-92jg-28cx: tar@6.2.1 (fix: 7.5.8) (https://github.com/advisories/GHSA-83g3-92jg-28cx)
[High] GHSA-83g3-92jg-28cx: tar@7.4.3 (fix: 7.5.8) (https://github.com/advisories/GHSA-83g3-92jg-28cx)
[High] GHSA-8qq5-rm4j-mr97: tar@6.2.1 (fix: 7.5.3) (https://github.com/advisories/GHSA-8qq5-rm4j-mr97)
[High] GHSA-8qq5-rm4j-mr97: tar@7.4.3 (fix: 7.5.3) (https://github.com/advisories/GHSA-8qq5-rm4j-mr97)
[High] GHSA-8x88-c5mf-7j5w: tar@6.2.1 (fix: 7.5.18) (https://github.com/advisories/GHSA-8x88-c5mf-7j5w)
[High] GHSA-8x88-c5mf-7j5w: tar@7.4.3 (fix: 7.5.18) (https://github.com/advisories/GHSA-8x88-c5mf-7j5w)
[High] GHSA-9ppj-qmqm-q256: tar@6.2.1 (fix: 7.5.11) (https://github.com/advisories/GHSA-9ppj-qmqm-q256)
[High] GHSA-9ppj-qmqm-q256: tar@7.4.3 (fix: 7.5.11) (https://github.com/advisories/GHSA-9ppj-qmqm-q256)
[High] GHSA-mh99-v99m-4gvg: brace-expansion@2.0.1 (fix: 5.0.8) (https://github.com/advisories/GHSA-mh99-v99m-4gvg)
[High] GHSA-qffp-2rhf-9h96: tar@6.2.1 (fix: 7.5.10) (https://github.com/advisories/GHSA-qffp-2rhf-9h96)
[High] GHSA-qffp-2rhf-9h96: tar@7.4.3 (fix: 7.5.10) (https://github.com/advisories/GHSA-qffp-2rhf-9h96)
[High] GHSA-r6q2-hw4h-h46w: tar@6.2.1 (fix: 7.5.4) (https://github.com/advisories/GHSA-r6q2-hw4h-h46w)
[High] GHSA-r6q2-hw4h-h46w: tar@7.4.3 (fix: 7.5.4) (https://github.com/advisories/GHSA-r6q2-hw4h-h46w)
[High] GHSA-w48q-cv73-mx4w: `@modelcontextprotocol/sdk`@1.0.1 (fix: 1.24.0) (https://github.com/advisories/GHSA-w48q-cv73-mx4w)

Medium / Low / Negligible / Unknown vulnerabilities (55 findings, 51 unique)

[Low] CVE-2024-58251: busybox-binsh@1.37.0-r12 (fix: 1.37.0-r14) ((security.alpinelinux.org/redacted)
[Low] CVE-2024-58251: busybox@1.37.0-r12 (fix: 1.37.0-r14) ((security.alpinelinux.org/redacted)
[Low] CVE-2024-58251: ssl_client@1.37.0-r12 (fix: 1.37.0-r14) ((security.alpinelinux.org/redacted)
[Low] CVE-2025-23165: node@22.14.0 (fix: 20.19.2, 22.15.1) ((nvd.nist.gov/redacted)
[Low] CVE-2025-46394: busybox-binsh@1.37.0-r12 (fix: 1.37.0-r14) ((security.alpinelinux.org/redacted)
[Low] CVE-2025-46394: busybox@1.37.0-r12 (fix: 1.37.0-r14) ((security.alpinelinux.org/redacted)
[Low] CVE-2025-46394: ssl_client@1.37.0-r12 (fix: 1.37.0-r14) ((security.alpinelinux.org/redacted)
[Low] CVE-2026-21715: node@22.14.0 (fix: 20.20.2, 22.22.2, 24.14.1, 25.8.2) ((nvd.nist.gov/redacted)
[Low] CVE-2026-21716: node@22.14.0 (fix: 20.20.2, 22.22.2, 24.14.1, 25.8.2) ((nvd.nist.gov/redacted)
[Low] CVE-2026-48617: node@22.14.0 (fix: 22.23.0, 24.17.0, 26.3.1) ((nvd.nist.gov/redacted)
[Low] CVE-2026-48931: node@22.14.0 (fix: 22.23.0, 24.17.0, 26.3.1) ((nvd.nist.gov/redacted)
[Low] GHSA-73rr-hh4g-fpgx: diff@5.2.0 (fix: 5.2.2) (https://github.com/advisories/GHSA-73rr-hh4g-fpgx)
[Low] GHSA-v6h2-p8h4-qcjw: brace-expansion@2.0.1 (fix: 2.0.2) (https://github.com/advisories/GHSA-v6h2-p8h4-qcjw)
[Medium] CVE-2025-15468: libcrypto3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
[Medium] CVE-2025-15468: libssl3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
[Medium] CVE-2025-55132: node@22.14.0 (fix: 20.20.0, 22.22.0, 24.13.0, 25.3.0) ((nvd.nist.gov/redacted)
[Medium] CVE-2025-60876: busybox-binsh@1.37.0-r12 ((nvd.nist.gov/redacted)
[Medium] CVE-2025-60876: busybox@1.37.0-r12 ((nvd.nist.gov/redacted)
[Medium] CVE-2025-60876: ssl_client@1.37.0-r12 ((nvd.nist.gov/redacted)
[Medium] CVE-2025-66199: libcrypto3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
[Medium] CVE-2025-66199: libssl3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
[Medium] CVE-2025-68160: libcrypto3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
[Medium] CVE-2025-68160: libssl3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
[Medium] CVE-2025-69418: libcrypto3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
[Medium] CVE-2025-69418: libssl3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
[Medium] CVE-2025-9231: libcrypto3@3.3.3-r0 (fix: 3.3.5-r0) ((security.alpinelinux.org/redacted)
[Medium] CVE-2025-9231: libssl3@3.3.3-r0 (fix: 3.3.5-r0) ((security.alpinelinux.org/redacted)
[Medium] CVE-2025-9232: libcrypto3@3.3.3-r0 (fix: 3.3.5-r0) ((security.alpinelinux.org/redacted)
[Medium] CVE-2025-9232: libssl3@3.3.3-r0 (fix: 3.3.5-r0) ((security.alpinelinux.org/redacted)
[Medium] CVE-2026-21713: node@22.14.0 (fix: 20.20.2, 22.22.2, 24.14.1, 25.8.2) ((nvd.nist.gov/redacted)
[Medium] CVE-2026-21714: node@22.14.0 (fix: 20.20.2, 22.22.2, 24.14.1, 25.8.2) ((nvd.nist.gov/redacted)
[Medium] CVE-2026-21717: node@22.14.0 (fix: 20.20.2, 22.22.2, 24.14.1, 25.8.2) ((nvd.nist.gov/redacted)
[Medium] CVE-2026-22795: libcrypto3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
[Medium] CVE-2026-22795: libssl3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
[Medium] CVE-2026-22796: libcrypto3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
[Medium] CVE-2026-22796: libssl3@3.3.3-r0 (fix: 3.3.6-r0) ((security.alpinelinux.org/redacted)
[Medium] CVE-2026-27171: zlib@1.3.1-r2 (fix: 1.3.2-r0) ((security.alpinelinux.org/redacted)
[Medium] CVE-2026-48937: node@22.14.0 (fix: 22.23.0, 24.17.0) ((nvd.nist.gov/redacted)
[Medium] CVE-2026-6042: musl-utils@1.2.5-r9 (fix: 1.2.5-r10) ((security.alpinelinux.org/redacted)
[Medium] CVE-2026-6042: musl@1.2.5-r9 (fix: 1.2.5-r10) ((security.alpinelinux.org/redacted)
[Medium] GHSA-f886-m6hf-6m8v: brace-expansion@2.0.1 (fix: 2.0.3) (https://github.com/advisories/GHSA-f886-m6hf-6m8v)
[Medium] GHSA-gvwx-54wh-qm9j: tar@6.2.1 (fix: 7.5.17) (https://github.com/advisories/GHSA-gvwx-54wh-qm9j)
[Medium] GHSA-gvwx-54wh-qm9j: tar@7.4.3 (fix: 7.5.17) (https://github.com/advisories/GHSA-gvwx-54wh-qm9j)
[Medium] GHSA-jfc7-64v2-mr8c: `@sigstore/core`@2.0.0 (fix: 3.2.1) (https://github.com/advisories/GHSA-jfc7-64v2-mr8c)
[Medium] GHSA-r292-9mhp-454m: tar@6.2.1 (fix: 7.5.21) (https://github.com/advisories/GHSA-r292-9mhp-454m)
[Medium] GHSA-r292-9mhp-454m: tar@7.4.3 (fix: 7.5.21) (https://github.com/advisories/GHSA-r292-9mhp-454m)
[Medium] GHSA-v2v4-37r5-5v8g: ip-address@9.0.5 (fix: 10.1.1) (https://github.com/advisories/GHSA-v2v4-37r5-5v8g)
[Medium] GHSA-vmf3-w455-68vh: tar@6.2.1 (fix: 7.5.16) (https://github.com/advisories/GHSA-vmf3-w455-68vh)
[Medium] GHSA-vmf3-w455-68vh: tar@7.4.3 (fix: 7.5.16) (https://github.com/advisories/GHSA-vmf3-w455-68vh)
[Medium] GHSA-w8wr-v893-vjvp: tar@6.2.1 (fix: 7.5.18) (https://github.com/advisories/GHSA-w8wr-v893-vjvp)
[Medium] GHSA-w8wr-v893-vjvp: tar@7.4.3 (fix: 7.5.18) (https://github.com/advisories/GHSA-w8wr-v893-vjvp)

License policy violations (22 findings, 22 unique)

alpine-baselayout-data@3.6.8-r1 (GPL-2.0-only)
alpine-baselayout@3.6.8-r1 (GPL-2.0-only)
apk-tools@2.14.6-r3 (GPL-2.0-only)
busybox-binsh@1.37.0-r12 (GPL-2.0-only)
busybox@1.37.0-r12 (GPL-2.0-only)
ca-certificates-bundle@20241121-r1 (MPL-2.0)
chownr@3.0.0 (BlueOak-1.0.0)
jackspeak@3.4.3 (BlueOak-1.0.0)
libgcc@14.2.0-r4 (GPL-2.0-or-later, LGPL-2.1-or-later)
libstdc++`@14`.2.0-r4 (GPL-2.0-or-later, LGPL-2.1-or-later)
musl-utils@1.2.5-r9 (GPL-2.0-or-later)
node@22.14.0 (no licenses found)
npm@10.9.2 (Artistic-2.0)
package-json-from-dist@1.0.1 (BlueOak-1.0.0)
path-scurry@1.11.1 (BlueOak-1.0.0)
qrcode-terminal@0.12.0 (Apache 2.0)
scanelf@1.3.8-r1 (GPL-2.0-only)
spdx-exceptions@2.5.0 (CC-BY-3.0)
spdx-license-ids@3.0.20 (CC0-1.0)
ssl_client@1.37.0-r12 (GPL-2.0-only)
yallist@5.0.0 (BlueOak-1.0.0)
zlib@1.3.1-r2 (Zlib)

Generated by 🛡️ Daily Container Image Security Scan · auto · 285.1 AIC · ⌖ 8.51 AIC · ⊞ 6.3K · ◷

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · gpt54 · 1.89 AIC · ⌖ 5.51 AIC · ⊞ 10K · ◷