You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
bin/mc (gobinary)
=================
Total: 6 (HIGH: 6, CRITICAL: 0)
┌─────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib │ CVE-2025-47912 │ HIGH │ fixed │ v1.24.6 │ 1.24.8, 1.25.2 │ The Parse function permits values other than IPv6 addresses │
│ │ │ │ │ │ │ to be incl... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-47912 │
│ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2025-58183 │ │ │ │ │ golang: archive/tar: Unbounded allocation when parsing GNU │
│ │ │ │ │ │ │ sparse map │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-58183 │
│ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2025-58186 │ │ │ │ │ Despite HTTP headers having a default limit of 1MB, the │
│ │ │ │ │ │ │ number of... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-58186 │
│ ├────────────────┤ │ │ ├────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2025-58187 │ │ │ │ 1.24.9, 1.25.3 │ Due to the design of the name constraint checking algorithm, │
│ │ │ │ │ │ │ the proce... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-58187 │
│ ├────────────────┤ │ │ ├────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2025-58188 │ │ │ │ 1.24.8, 1.25.2 │ Validating certificate chains which contain DSA public keys │
│ │ │ │ │ │ │ can cause ...... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-58188 │
│ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2025-61724 │ │ │ │ │ The Reader.ReadResponse function constructs a response │
│ │ │ │ │ │ │ string through ... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-61724 │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴────────────────┴──────────────────────────────────────────────────────────────┘
Steps to reproduce the behavior
Run trivy on mc
mc --version
mc version RELEASE.2025-08-13T08-35-41Z (commit-id=7394ce0dd2a80935aded936b09fa12cbb3cb8096)
Runtime: go1.24.6 linux/arm64
Copyright (c) 2015-2025 MinIO, Inc.
License GNU AGPLv3 https://www.gnu.org/licenses/agpl-3.0.html
Expected behavior
Clean security scans (no CVEs)
Actual behavior
Steps to reproduce the behavior
Run trivy on mc
mc --version
mc version RELEASE.2025-08-13T08-35-41Z (commit-id=7394ce0dd2a80935aded936b09fa12cbb3cb8096)
Runtime: go1.24.6 linux/arm64
Copyright (c) 2015-2025 MinIO, Inc.
License GNU AGPLv3 https://www.gnu.org/licenses/agpl-3.0.html