Rebuild Request: python:3.10-alpine — CVE-2026-23949 & CVE-2026-24049 (HIGH/CRITICAL)

Rebuild Request: `python:3.10-alpine` — CVE-2026-23949 & CVE-2026-24049 (HIGH/CRITICAL)

Summary

The current python:3.10-alpine image ships with outdated versions of jaraco.context and wheel that contain known, fixed vulnerabilities. A rebuild is needed to pick up the patched versions.

Both CVEs have fixed versions available and this should be resolved by a simple image rebuild.

Affected Image

python:3.10-alpine

Vulnerabilities

Library	CVE	Severity	Installed Version	Fixed Version	Description
`jaraco.context`	CVE-2026-23949	HIGH	5.3.0	6.1.0	Path traversal via malicious tar archives
`wheel`	CVE-2026-24049	HIGH	0.45.1	0.46.2	Privilege escalation or arbitrary code execution via malicious wheel file

References:

Impact

These vulnerabilities are being flagged as Critical by JFrog Xray, blocking our CI/CD pipeline builds. The fixes are already available upstream — this requires only an image rebuild to pull in the updated package versions.

According to the description of CVE-2026-23949, jaraco.context is vendored in setuptools. Unfortunately, we have pinned the setuptools and wheel versions in order to prevent breaking changes, so a rebuild won't change the versions of these packages:

python/3.10/alpine3.23/Dockerfile

Lines 125 to 127 in 719683e

    
           'setuptools==79.0.1' \ 
        
           # https://github.com/docker-library/python/issues/1023 
        
           'wheel<0.46' \

See also #1023

Users who need an updated wheel or setuptools and are susceptible to these CVEs can update them before installing/updating any other python packages.

setuptools already is newer than 66.0.0:

$ docker run -it --rm python:3.10-alpine sh
Unable to find image 'python:3.10-alpine' locally
3.10-alpine: Pulling from library/python
530a9815c71f: Pull complete
fef6c4afe209: Pull complete
2ab2d1657c36: Pull complete
9f932b89ad4c: Download complete
2491ffd62a71: Download complete
Digest: sha256:b974a5de91b4ac6da8313502cd5bfe65c499e390d32658e1f2deea26fa5afb14
Status: Downloaded newer image for python:3.10-alpine
/ # pip list
Package    Version
---------- -------
pip        23.0.1
setuptools 79.0.1
wheel      0.45.1

As for wheel (CVE-2026-24049), we cannot update that without breaking many users because wheel made backward incompatible changes (see #1023). If you know you are not affected by the changes in wheel 0.46+, they you can update it in your image FROM python:3.10[...] or migrate to a newer Python version that doesn't include setuptools or wheel (python 3.12+ #954).

I'm looking at the wheel changelog and it seems they re-added bdist_wheel in 0.46.2 / 0.46.3. Given that, is it possible to upgrade to wheel 0.46.3? I'm happy to submit the PR, just want to make sure I'm not missing a reason why this wouldn't work.

Navigation Menu

Repository navigation

Rebuild Request: `python:3.10-alpine` — CVE-2026-23949 & CVE-2026-24049 (HIGH/CRITICAL) #1112