[bhanurp]

Problem

The Xray scan of release bundle ecosystem-cli-docker-images-rb-v2-jf:2.132.0 reports CVE-2026-4738 (Critical) on zlib:1.3.2-r1 in jfrog/jfrog-cli-v2-jf.

Cause

The alpine:3 base image snapshot ships zlib-1.3.2-r1. The runtime stage runs apk add only. It does not upgrade zlib.

Fix

Run apk upgrade --no-cache before apk add in the slim runtime stage. Alpine 3.22, 3.23, 3.24 and edge publish zlib 1.4-r0. Alpine's security database lists CVE-2026-4738 as fixed in 1.4-r0.

Verified

In a local alpine:3 container (3.24.4):

• before apk upgrade: zlib-1.3.2-r1
• after apk upgrade: zlib-1.4-r0

Not verified

• The full image build and the Xray rescan of the bundle.
• The jfrog-docker/alpine:3 mirror on the build server may cache an older package index. If the finding stays after rebuild, check the mirror.
• Xray describes this CVE as a gdal issue and lists no fixed version. If the finding stays with zlib at 1.4-r0, it may be a false positive.

Risk

apk upgrade moves all installed Alpine packages forward, not only zlib. Risk is low for this image.

[github-actions]

View full scan results in JFrog Platform

---

🐸 JFrog Frogbot