Trivy v0.76.2 release addresses multiple vulnerabilities in container images and Go dependencies

Aqua Security has released Trivy version 0.76.2, a security-focused update that addresses multiple vulnerabilities within its official container images and core Go dependencies. The update involves rebuilding the official images on Alpine 3.24.3 to incorporate fixes for musl, libcurl, and brotli-libs.

In addition to base image updates, the release bumps critical Go libraries to resolve specific security flaws. Users are advised to upgrade to this version and redeploy their container images to ensure these security patches are active in their environments.

Security fixes and dependency updates

• Base Image Security: Official container images were rebuilt using Alpine 3.24.3, resolving CVE-2026-107891 in musl/musl-utils, CVE-2026-111497 in brotli-libs, and 24 CVEs in libcurl, including the high-severity CVE-2026-92392.
• Go Network Library: The golang.org/x/net dependency was updated to v0.62.0 to fix CVE-2026-78661 (quadratic complexity during text node coalescing) and CVE-2026-97045 (missing ancestor namespace checks in raw text rendering).
• JOSE Library: The github.com/go-jose/go-jose/v4 dependency was bumped to v4.1.6 to address GHSA-mgcc-cww5-fp2q.
• Deployment Requirement: The update requires a redeployment of existing container images to apply the underlying Alpine and library patches.

Why it matters

As a widely used vulnerability scanner, Trivy's security posture is critical for DevSecOps pipelines. This update ensures that the tool itself does not introduce vulnerabilities through its own runtime environment or dependencies, maintaining the integrity of container scanning workflows.