Rebuild request: eclipse-mosquitto:2.0.22-openssl

[PhilippKorth]

Hi,
please rebuild the official image:

eclipse-mosquitto:2.0.22-openssl
(https://hub.docker.com/_/eclipse-mosquitto/tags?name=2.0.22-openssl)

The current image contains the CVEs:

• CVE-2026-34180
• CVE-2026-34181
• CVE-2026-34182
• CVE-2026-34183
• CVE-2026-45447
• CVE-2026-9076
• CVE-2026-7383
• CVE-2026-42764
• CVE-2026-45445

I rebuilt the image locally using the same Dockerfile, and the CVEs disappeared — so a rebuild without any functional changes should be sufficient.

Could you trigger a rebuild in the Official Images build system?

Thanks!

[yosifkit]

Unfortunately, since we natively build images across 12 architectures, the complexity of our build system is designed to not rebuild images without a change to the build context or its parent image. Concretely, this usually means that this will either be addressed by the build at the next version update to eclipse-mosquitto or if there is an update published to the alpine:3.23 image.

Background:

Tags in the [official-images] library file[s] are only built through an update to that library file or as a result of its base image being updated (ie, an image FROM debian:bookworm would be rebuilt when debian:bookworm is built).

-https://github.com/docker-library/official-images/tree/8384586122f68760fdcfc9472257d177be2d6282#library-definition-files

If there is a package in the base image that needs updates, we rely on image maintainers to update that image, so that all images FROM it can benefit. For example, if the libssl3 package in the alpine:3.23 image has an important update, then the Alpine image maintainers would be responsible for providing an updated base image so that all Docker Official Images FROM it could then be rebuilt.

Official Images FAQ:

Though not every CVE is removed from the images, we take CVEs seriously and try to ensure that images contain the most up-to-date packages available within a reasonable time frame

- https://github.com/docker-library/faq/tree/e5475a9b3d7c34b8a1e3902df0f4959c5b33e593#why-does-my-security-scanner-show-that-an-image-has-cves

To ensure that we don't push contentless image changes, we rely on periodic base image updates.

We strive to publish updated images at least monthly for Debian. We also rebuild earlier if there is a critical security need. Many Official Images are maintained by the community or their respective upstream projects, like Ubuntu, Alpine, and Oracle Linux, and are subject to their own maintenance schedule.

- from the same FAQ link

[bitschubse]

... We also rebuild earlier if there is a critical security need. ....

Doesn't that cover exactly this situation? CVE-2026-34182 and CVE-2026-45447 are classified as critical.

[yosifkit]

"critical security need" doesn't mean that the bug was classified as critical but that there is critical (i.e. urgent) need; in other words, exploitation of the potential vulnerability is imminent and would adversely affect users of the images. A major example was the Heartbleed vulnerability. While some urgent needs are named vulnerabilities, they don't all have such marketing and, as a result, we look at other factors like the EPSS score to decide if the manual effort is worth it. At this time, the scores in this case are low enough that it doesn't justify the extra work to manually rebuild without a parent image change.

CVE-2026-34182
EPSS score
0.0005% (0th percentile)

CVE-2026-45447
EPSS score
0.092% (26th percentile)

I have commented to the Alpine image maintainer that an alpine:3.23 rebuild is desired so that all Alpine 3.23 based images can benefit. If users need updated packages sooner, then they can apk upgrade in their own images FROM eclipse-mosquitto:2.0.22-openssl.

Alternatively, since Alpine 3.24 is already updated for this and other possible vulnerabilities, the eclipse-mosquitto maintainers could change their FROM line to take advantage of it.