Repository navigation
go-feature-server image ships outdated linux-libc-dev with known kernel CVEs (DSA-6238-1/6253-1/6274-1/6295-1) #7060
Description
The published feastdev/go-feature-server image (tag 0.63.0) ships an outdated linux-libc-dev package in its Debian base layer. The package is flagged by container vulnerability scanners for four Debian Security Advisories.
Because linux-libc-dev is inherited from the base image and not installed by a consumer's Dockerfile, downstream users cannot remediate it on their side.
Affected image
quay.io/feastdev/go-feature-server:0.63.0- Digest:
sha256:c0061802d1a132c7fedc4ef52e1d36d2f1c5f3b21ba054900deba5053fc08283 - Vulnerable package:
linux-libc-dev(Debian kernel headers, from the base image)
Advisories detected
| Advisory | Fixed version (linux-libc-dev ≥) |
|---|---|
| DSA-6238-1 | 6.12.85-1 |
| DSA-6253-1 | 6.12.86-1 |
| DSA-6274-1 | 6.12.88-1 |
| DSA-6295-1 | 6.12.90-1 |
Steps to reproduce
- Pull
feastdev/go-feature-server:0.63.0. - Inspect the installed package version:
docker run --rm feastdev/go-feature-server:0.63.0 dpkg -s linux-libc-dev | grep Version- Observe that the version is below
6.12.90-1and is flagged by scanners (Trivy/Grype/Aqua) against the advisories above.
Expected behavior
The published image scans clean against DSA-6238-1, DSA-6253-1, DSA-6274-1, and DSA-6295-1.
Environment
- Feast version: 0.63.0
- Image:
feastdev/go-feature-server:0.63.0
Activity
shyamaryan commentedon Oct 23, 2026
@shuchu can you pls help fix this?
fix: Build the Go feature server image in two stages
shyamaryan commentedon Oct 30, 2026
@shuchu @NopeCharon Thanks for fixing this!
I found out another vulnerability on Feast 0.67.0 go-feature-server image :
DSA-6582-1 is a critical Debian Security Advisory released on October 23, 2026, addressing a major vulnerability in the brotli compression suite.
shyamaryan commentedon Oct 30, 2026
Raised an issue on this - #7094
fix: Build the Go feature server image in two stages