CGA-695f-mr2j-352p

Published

Last updated

https://images.chainguard.dev/security/CGA-695f-mr2j-352p

Package

buck2

RepositoryWolfi

Latest Update

Pending upstream fix

Aliases

CVE-2025-4432
GHSA-c86p-w88r-qvqr

Severity

5.3

Medium

CVSS V3

References

https://nvd.nist.gov/vuln/detail/CVE-2025-4432
https://github.com/advisories/GHSA-c86p-w88r-qvqr

Updates

Status

Pending upstream fix

Impact

The vulnerable ring version 0.16.20 is a transitive dependency brought in by webpki version 0.21.4, requiring webpki to update to the latest ring version before buck2 can update to the newer webpki once available.

Status

Under investigation

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

The trusted source for open source

Talk to an expert

Privacy

Terms

CGA-695f-mr2j-352p

Severity

References

Updates

The trusted source for open source

Product

Solutions

Customers

Resources

Company