Repository navigation
Docker image includes Debian perl-base packages with unresolved CVEs #6686
Description
Summary
The official graphprotocol/graph-node:v0.41.0 container image uses Debian
Bookworm as its runtime base:
https://github.com/graphprotocol/graph-node/blob/v0.41.0/docker/Dockerfile
A container scan reports that the runtime image includes Debian's perl-base
package and flags the following publicly disclosed vulnerabilities:
The current Graph Node Dockerfile also appears to use a dated Debian Bookworm
runtime base:
https://github.com/graphprotocol/graph-node/blob/master/docker/Dockerfile
Request
Would the maintainers consider one of the following?
- Refresh the pinned Debian Bookworm runtime base.
- Upgrade the affected Perl packages when fixed Bookworm packages become
available. - Remove Perl from the final runtime image if it is not required by Graph Node.
- Publish a rebuilt image after the relevant Debian updates become available.
Reproduction
The installed packages can be inspected with:
docker run --rm --entrypoint sh graphprotocol/graph-node:v0.41.0 -c \
'cat /etc/os-release; dpkg-query -W perl-base perl libsocket-perl libio-compress-perl 2>/dev/null || true'Upstream status
Debian is already tracking these issues:
https://security-tracker.debian.org/tracker/CVE-2026-12087
https://security-tracker.debian.org/tracker/CVE-2026-48959
https://security-tracker.debian.org/tracker/CVE-2026-48961
https://security-tracker.debian.org/tracker/CVE-2026-48962
The underlying fixes are already available upstream:
Socket fix:
https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb
IO::Compress fixes:
https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2
https://github.com/pmqs/IO-Compress/commit/33c89d03d6e746ed2ead4f2f6570d47864c61bc7
https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610
Thank you for maintaining the Graph Node container images.
Activity
incrypto32 commentedon Jul 29, 2026
Thanks for the writeup. Looked into all four.
-48959, -48961 and -48962 are IO::Compress issues, and IO::Compress isn't in the runtime image. Only
perl-baseis installed, notperlorlibio-compress-perl. Debian also has -48961 asnot-affectedfor bookworm.-12087 is in
perl-baseviaSocket.pm, but reaching it needs a Perl script callingpack_ip_mreq_source(), and nothing in the image invokes Perl.Removing perl isn't possible.
perl-baseis Essential, and forcing it breaks dpkg's maintainer scripts, leaving an image that can't take another update. Same on trixie and Ubuntu.Refreshing the base won't clear these either. Debian has all four marked vulnerable in bookworm and trixie at every available version. Three are fixed in forky/sid, and -12087 is unfixed across Debian entirely.
We're refreshing anyway since the pin is stale, plus dependabot tracking so Debian's fix lands automatically. PR shortly.