dirtydishes/islandflow
1
0
Fork 0
Code Issues 43 Pull requests 3 Projects Releases Packages Wiki Activity Actions

[security][CVE-2026-28389] OpenSSL in Bun runtime image #135

New issue
Open
opened 2026-07-16 13:21:08 +00:00 by dirtydishes · 0 comments
dirtydishes commented 2026-07-16 13:21:08 +00:00
Owner
Copy link

Automation detected a newly untracked active high-severity CVE in the shipped runtime surface.

  • CVE: CVE-2026-28389
  • Affected component: OpenSSL in Bun runtime image
  • Severity: HIGH
  • In-repo version(s): libssl3t64 3.5.5-1deb13u1; openssl-provider-legacy 3.5.5-1deb13u1 in oven/bun:1.3.11
  • Project impact: The Bun runtime image ships vulnerable OpenSSL client packages, so applications using policy-checked certificate validation inherit this OpenSSL bug until the base image is refreshed.
  • Remediation: Rebuild from an oven/bun base that includes Debian 13 OpenSSL 3.5.5-1~deb13u2 or newer.

Counters for this run:

  • unaddressed critical CVEs: 6
  • unaddressed medium/low CVEs: 119
  • unaddressed total CVEs: 163

Sources:

Automation detected a newly untracked active high-severity CVE in the shipped runtime surface. - CVE: CVE-2026-28389 - Affected component: OpenSSL in Bun runtime image - Severity: HIGH - In-repo version(s): libssl3t64 3.5.5-1~deb13u1; openssl-provider-legacy 3.5.5-1~deb13u1 in oven/bun:1.3.11 - Project impact: The Bun runtime image ships vulnerable OpenSSL client packages, so applications using policy-checked certificate validation inherit this OpenSSL bug until the base image is refreshed. - Remediation: Rebuild from an oven/bun base that includes Debian 13 OpenSSL 3.5.5-1~deb13u2 or newer. Counters for this run: - unaddressed critical CVEs: 6 - unaddressed medium/low CVEs: 119 - unaddressed total CVEs: 163 Sources: - https://nvd.nist.gov/vuln/detail/CVE-2026-28389 - https://avd.aquasec.com/nvd/cve-2026-28389
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
lavender/testing123
dashboard-v2
lavender/islandflow-mcmd-8-deterministic-drawer-fixture
lavender/islandflow-mcmd-7-polish-performance-visual-qa
lavender/islandflow-mcmd-6-news-relevance-ordering
lavender/islandflow-mcmd-5-hybrid-detail-model
lavender/islandflow-mcmd-4-dashboard-layout-replacement
lavender/options-smart-flow-support-loop
lavender/fix-contained-durable-tape-tables
lavender/durable-tapes-example-route
lavender/fix-forgejo-security-issues
lavender/fix-github-publish-docs-backfill
lavender/codex-phase-workflow
lavender/fix-docs-pages-auto-publish
lavender/smart-money-phase-01-contracts-vocabulary-closeout
lavender/implementation-phase-plans
lavender/dashboard-route-polish
lavender/configure-hosted-api-endpoint
mock-redesign
lavender/dashboard-command-page
lavender/fix-forgejo-cves-15-18-19
lavender/address-cve-tmp@0.2.5
__dolt_remote_info__
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
dirtydishes/islandflow#135
No description provided.