🚨 Security: Critical or high vulnerabilities in ida-pro-mcp container

Open
#986 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
62/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
docker, github-actions, python
Domain
devops, security

Research direction

Start with the periodic-security-scan workflow and review the build path for ghcr.io/stacklok/dockyard/uvx/ida-pro-mcp:1.4.0, focusing on the httpx2@2.10.0 dependency and GHSA-8xx6-hgc6-gc2m. Done means the high-severity finding is remediated and the security scan no longer blocks publishing.

Written by the indexing model from the issue text.

Description

grype high security

🚨 Security Scan Alert

A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.

  • Image: ghcr.io/stacklok/dockyard/uvx/ida-pro-mcp:1.4.0
  • Critical vulnerabilities: 0
  • High vulnerabilities: 1
Details

See the Security tab for full details.

High Vulnerabilities
  • GHSA-8xx6-hgc6-gc2m in httpx2@2.10.0: HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)

Automated security scan from periodic-security-scan workflow

Dominant language
Go
Stars
8
Forks
7
Avg merge
2d 5h
Merged PRs (30d)
62

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from stacklok/dockyard

All issues in stacklok/dockyard

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.