Known issues: upstream CVEs in bundled images (clair:4.9.0, postgres:17-alpine)

[hackertwinten]

Overview

This issue tracks known vulnerabilities in the container images bundled with this chart. All findings are in upstream dependencies — the chart itself and busybox:1.37.0 are clean. Fixes exist in upstream main branches but no new releases have been cut yet.

---

clair:4.9.0 — CRITICAL Go dependency CVEs

Trivy reports several CRITICAL/HIGH CVEs in Clair's Go module dependencies. Upstream fixes have already been merged to quay/clair main via Dependabot but a new image release has not been cut yet.

CVE	Package	Severity	Upstream fix
CVE-2025-68121	TLS / crypto	CRITICAL	quay/clair#2419, #2431
CVE-2026-33186	google.golang.org/grpc	CRITICAL	quay/clair#2428, #2451
CVE-2026-33816	github.com/jackc/pgx	CRITICAL	quay/clair#2443, #2460, #2461

Action: Bump image.tag and appVersion in Chart.yaml once Quay publishes a new quay.io/projectquay/clair release.

---

postgres:17-alpine — gosu vulnerability

Trivy reports a vulnerability in the gosu binary bundled in the official PostgreSQL image.

Package	Upstream tracking
gosu	docker-library/postgres#1350, #1324

Action: Bump postgresql.image.tag in values.yaml once the official postgres image ships a fixed gosu.

---

What is NOT affected

• The chart templates themselves
• busybox:1.37.0 (init container)
• Any chart logic or Kubernetes resources

---

Monitoring

• Watch quay/clair releases for a new image tag
• Watch docker-library/postgres for a gosu fix

This issue will be closed when both images are bumped to versions with clean Trivy scans.