Repository navigation
Security Issue: Docker image v4.19.1 has 2 CRITICAL and 6 HIGH vulnerabilities #1381
Description
Trivy scan of migrate/migrate:v4.19.1 reveals 2 CRITICAL and 6 HIGH vulnerabilities. The image is built with Go 1.25.4 which has multiple known CVEs. Alpine 3.19 base image is also EOL.
Go Version
The current image is built with Go 1.25.4. 8 of the 12 vulnerabilities are in the Go stdlib and would be resolved by upgrading to Go 1.25.8+ or Go 1.26.x. This is the single most impactful fix.
Trivy Scan Results (2026-04-01)
OS: Alpine 3.19.9 (EOL) — 6 vulnerabilities (3 MEDIUM, 3 LOW)
- BusyBox CVE-2024-58251 (MEDIUM), CVE-2025-46394 (LOW) — fixed in 1.36.1-r21
Go Binary — 12 vulnerabilities (2 CRITICAL, 6 HIGH, 3 MEDIUM, 1 LOW)
| Severity | CVE | Library | Installed | Fixed |
|---|---|---|---|---|
| CRITICAL | CVE-2026-33186 | google.golang.org/grpc | v1.74.2 | 1.79.3 |
| CRITICAL | CVE-2025-68121 | stdlib (Go 1.25.4) | v1.25.4 | 1.25.7 |
| HIGH | CVE-2025-61726 | stdlib | v1.25.4 | 1.25.6 |
| HIGH | CVE-2025-61728 | stdlib | v1.25.4 | 1.25.6 |
| HIGH | CVE-2025-61729 | stdlib | v1.25.4 | 1.25.5 |
| HIGH | CVE-2026-25679 | stdlib | v1.25.4 | 1.25.8 |
| HIGH | CVE-2026-24051 | go.opentelemetry.io/otel/sdk | v1.36.0 | 1.40.0 |
| HIGH | CVE-2026-32286 | github.com/jackc/pgproto3/v2 | v2.3.3 | no fix |
Suggested Fix
- Upgrade Go to 1.25.8+ or 1.26.x — resolves 8 of 12 vulnerabilities including 1 CRITICAL
- Upgrade Alpine base image to 3.21+ (3.19 is EOL)
- Bump
google.golang.org/grpcto >= 1.79.3 (CRITICAL — authz bypass) - Bump
go.opentelemetry.io/otel/sdkto >= 1.40.0 (HIGH — PATH hijacking)
Environment
- Image:
migrate/migrate:v4.19.1 - Scanner: Trivy v0.69.3
- Scan date: 2026-04-01
Activity
himadri-bhattacharjee commentedon Apr 1, 2026
@dependabot @dhui @HaraldNordgren any plan for next release ?
himadri-bhattacharjee commentedon Apr 7, 2026
@dhui any plan to fix the CVE?
gergo-papp commentedon Apr 15, 2026
@dhui could we create a new release to address these in the docker images that are shipped?
bismayam commentedon Jul 13, 2026
@dhui Is there any schedule for next release ?
nshekhawat commentedon Jul 13, 2026
@dhui @Fontinalis any plans for next release?
Fontinalis commentedon Jul 14, 2026
@bismayam @nshekhawat @gergo-papp @himadri-bhattacharjee
Thank you for flagging - I've started working against
v4.20.0, which would mostly include bug fixes and vulnerability patches - I don't have an exact date yet.nshekhawat commentedon Aug 6, 2026
@Fontinalis Any update on above so we can understand whether this is getting released. Thanks.
mschfh commentedon Aug 24, 2026
@Fontinalis Any news yet? Is there any specific change or feature missing that could be contributed to?
hertzcodes commentedon Aug 31, 2026
@Fontinalis bruh please fix this
hertzcodes commentedon Aug 31, 2026
@Fontinalis security team is raping me
nshekhawat commentedon Aug 31, 2026
@Fontinalis Same here. We are waiting for this release for quite some time specially on the security fixes. We would appreciate it if you could share an update on the current status and expected release timeline. Thanks.