ipx-web's image carries curl 8.22.0, affected by CVE-2026-92392 #237
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The ipx-web image is built on caddy:2 (Alpine), which ships curl and libcurl 8.22.0. CVE-2026-92392 (https://curl.se/docs/CVE-2026-92392.html, 2026-10-14) is a use-after-free in curl 8.12.0-8.22.0 when a server answers an HTTP/2 upload with RST_STREAM, shown to be turnable into code execution under narrow conditions; fixed in 8.23.0.
Nothing here runs it: Caddy is Go and does not use libcurl, the Caddyfile and compose file never call curl, and the image has no healthcheck since #218. So it is not reachable, but it is a vulnerable binary in a container that faces the internet. ipx and ipx-directory (Debian slim) have no curl; ipx's HTTP is reqwest/hyper/h2. Fix: remove curl from the final stage (apk del curl), or rebuild once Alpine ships 8.23.0. Found 2026-10-14.
Fixed in
1471b9b, deployed in ipx-web 1.0.2-dev: Dockerfile.web removes curl from caddy:2's image (apk del curl); the image has neither curl nor libcurl, Caddy v2.11.7 serves the page and passes the API as before.