Home / SECURITY / Trivy / v0.76.2
Trivy v0.76.2stable Released Nov 05, 2026
Impact Score: 5/10

Trivy v0.76.2 — Release Notes & Engineering Impact

Source available — automated, not human-reviewed

Component: trivy · Channel: stable. Automated analysis, not a compatibility certification. How this works.

Analysis updated: 2026-11-05.

Compatibility not verified — check source notes
📄 .MD
⚡ Improvements 1 🔧 Bug Fixes 5
⚡ Executive Summary (TL;DR)

Trivy v0.76.2 delivers critical security patches by updating underlying container images to Alpine 3.24.3 and bumping key dependencies including golang.org/x/net and go-jose. Users should upgrade promptly to mitigate vulnerabilities related to libcurl, musl, and Go-based networking components.

Visit Trivy Official Site ↗ Official Release Source ↗ All Trivy Releases 📡 Trivy RSS
Who Does This Impact? (Role-Based Analysis)

💻 Software Engineers & Devs

Upgrade to v0.76.2 to resolve multiple vulnerabilities in Go dependencies and ensure your local development environment is secure.

📊 Product & Engineering Leads

This release maintains security compliance and reduces risk exposure, requiring minimal effort to adopt.

⚙️ DevOps & Security

Redeploy existing Trivy container images to ensure all environment vulnerabilities, particularly those in the base Alpine image, are patched.

⚡ Performance & Enhancements (1)

  • Rebuilt container images on Alpine 3.24.3

🔧 Bug Fixes & Patches (5)

  • Resolved CVE-2026-107891 (musl/musl-utils)
  • Fixed libcurl vulnerabilities including high-severity CVE-2026-92392
  • Resolved CVE-2026-111497 (brotli-libs)
  • Patched vulnerabilities in golang.org/x/net/html (CVE-2026-78661, CVE-2026-97045)
  • Fixed GHSA-mgcc-cww5-fp2q in github.com/go-jose/go-jose/v4
📄 View Raw Release Notes (Original Developer Log)
## 🔐 Security update 🛡️ Trivy v0.76.2 bundles several security fixes: - Official container images are rebuilt on Alpine 3.24.3, which fixes `musl`/`musl-utils` (CVE-2026-107891), and the build picks up fixed `libcurl` (24 CVEs, including HIGH CVE-2026-92392) and `brotli-libs` (CVE-2026-111497) from the `v3.24` package repository. - `golang.org/x/net` is bumped to v0.62.0, fixing two vulnerabilities in `golang.org/x/net/html`: CVE-2026-78661 (quadratic complexity when coalescing text nodes) and CVE-2026-97045 (missing ancestor namespace check when rendering raw text). - `github.com/go-jose/go-jose/v4` is bumped to v4.1.6, fixing [GHSA-mgcc-cww5-fp2q](https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q). We recommend upgrading to v0.76.2 and redeploying container images to apply these updates. ## Changelog * 3f6334d223b52188324af3b9923b4249cd206652 release: v0.76.2 [release/v0.76] (#11552) * 1cabe83c11ffed6e984ab46be8886e1e01516ead fix(deps): bump golang.org/x/net from 0.61.0 to 0.62.0 [backport: release/v0.76] (#11554) * be08de47d0d76fca7e992c0f47fbcf7853f8a713 chore(deps): bump the common group across 1 directory with 14 updates [backport: release/v0.76] (#11555) * a8537d389cbd0fa215eddfddc27150fc7bc82a6c fix(deps): bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 [backport: release/v0.76] (#11553) * ae26b88c3b3c380808e767dfb63f9b8dcd5f64fd fix(deps): bump alpine to 3.24.3 in container images [backport: release/v0.76] (#11551)
← Older Version Trivy v0.76.1