Request timeline for fixing glibc/linux/sqlite3/perl vulnerabilities still present in fluentd:v1.19.3-2.2

[ckochh2]

Describe the bug

Hello — following up on #487 and #497. Our monthly security scans of the current
published image fluentd:v1.19.3-2.2 (Debian 13 "trixie" base) still show a number
of unpatched Critical/High OS-package vulnerabilities. We confirmed these are present
by pulling and scanning v1.19.3-2.2 directly (Amazon Inspector / grype), and every
one reports fixedInVersion: none — i.e. no upstream Debian fix is available yet.

perl 5.40.1

• CVE-2026-12087 (Critical) — https://nvd.nist.gov/vuln/detail/CVE-2026-12087
• CVE-2026-13221 (Critical) — https://nvd.nist.gov/vuln/detail/CVE-2026-13221
• CVE-2026-57433 (Critical) — https://nvd.nist.gov/vuln/detail/CVE-2026-57433
• CVE-2026-48959 (High) — https://nvd.nist.gov/vuln/detail/CVE-2026-48959
• CVE-2026-48961 (High) — https://nvd.nist.gov/vuln/detail/CVE-2026-48961
• CVE-2026-48962 (High) — https://nvd.nist.gov/vuln/detail/CVE-2026-48962
• CVE-2026-57432 (High) — https://nvd.nist.gov/vuln/detail/CVE-2026-57432
• CVE-2026-7017 (High) — https://nvd.nist.gov/vuln/detail/CVE-2026-7017
• CVE-2026-7010 (Medium) — https://nvd.nist.gov/vuln/detail/CVE-2026-7010
• CVE-2025-15649 (Medium) — https://nvd.nist.gov/vuln/detail/CVE-2025-15649

glibc 2.41

• CVE-2026-5450 (Critical) — https://nvd.nist.gov/vuln/detail/CVE-2026-5450
• CVE-2026-5928 (High) — https://nvd.nist.gov/vuln/detail/CVE-2026-5928

sqlite3 3.46.1

• CVE-2026-11822 (High) — https://nvd.nist.gov/vuln/detail/CVE-2026-11822
• CVE-2026-11824 (High) — https://nvd.nist.gov/vuln/detail/CVE-2026-11824

Totals: 4 Critical + 8 High across perl, glibc, and sqlite3. Note the perl
CVE-2026-48959/48961/48962 entries carried over from #497 and are still unpatched.

Could you share an expected timeline for these packages to be picked up in a
published image? Specifically, we'd like to confirm whether the fixes are pending
upstream in Debian (awaiting a trixie point release) or whether a future
fluentd:v1.19.3-x.y rebuild is planned once Debian ships the patched packages.

To Reproduce

Pull fluentd:v1.19.3-2.2 and scan with any vulnerability scanner
(Docker Scout / grype / Amazon Inspector). All 12 CVEs above are reported with
no fixed version available.

Expected behavior

The latest official image should not contain known Critical/High perl/glibc/sqlite3
vulnerabilities once upstream (Debian) fixes are available, and ideally a rebuilt
image is published shortly after the corresponding Debian point release.

Your Environment

Tag of fluentd-docker-image: `fluentd:v1.19.3-2.2` (Debian 13 trixie).

Your Configuration

N/A — not a runtime config issue; this concerns unpatched OS dependencies
(perl / glibc / sqlite3) in the published image.

Your Error Log

N/A — detected via vulnerability scan of the published image.

Additional context

Chaining from #487 (glibc/systemd, fixed in v1.19.2-2.4) and #497 (perl/expat).

[kenhys]

Thank you for feedback.

fluentd docker image is just a derivative container image, it also takes over upstream vulnerabilities.
In other words, upstream container image is not fixed, we can not fix it too.

https://github.com/fluent/fluentd-docker-image/actions/runs/31673689755

Thus, we can not schedule timeline when fixed image could be available.
(If upstream container image was fixed, we will follow them as soon as possible.)

[kenhys]

FYI: most of perl CVEs will be fixed in next Debian 13.7 point release.

trixie-pu: package perl/5.40.1-6+deb13u1
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146369