# Temporal docker image Vulnerabilities

**URL:** <https://community.temporal.io/t/temporal-docker-image-vulnerabilities/18271>\
**Category:** Community Support\
**Tags:** docker, web-ui, server\
**Created:** [August 28, 2025, 4:20am UTC](https://community.temporal.io/t/temporal-docker-image-vulnerabilities/18271 "2025-08-28T04:20:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dinesh](https://avatars.discourse-cdn.com/v4/letter/d/a8b319/32.png) [@Dinesh](https://community.temporal.io/u/Dinesh)\
**Post date:** [August 28, 2025, 4:20am UTC](https://community.temporal.io/t/temporal-docker-image-vulnerabilities/18271/1 "2025-08-28T04:20:13Z")

</div>

Please help us with a docker image without the below vulnerabilities. I have raised issues as well.

> <https://github.com/temporalio/temporal/issues/8110>
>
> We see the below components of the server:v1.28.0 image have some vulnerabilitie…s. 
> 
> alpine://3.22:libcrypto3:3.5.0-r0 - \*\*CVE-2025-4575\*\*
> go://go.temporal.io/server:1.18.1-0.20230217005328-b313b7f58641 - \*\*CVE-2023-3485\*\*
> go://go.temporal.io/api:1.18.1 - \*\*CVE-2025-1243\*\*
> go://golang.org/x/net:0.34.0 - \*\*CVE-2025-22870\*\*
> go://github.com/golang/go:1.24.1 - \*\*CVE-2025-4673\*\*
> go://google.golang.org/grpc:1.56.3 - \*\*CVE-2024-7246\*\*
> go://go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc:0.36.4 - \*\*CVE-2023-47108\*\*
> go://golang.org/x/crypto:0.32.0 - \*\*CVE-2025-22869\*\*
> go://golang.org/x/oauth2:0.7.0 - \*\*CVE-2025-22868\*\*
> go://github.com/golang-jwt/jwt/v4:4.5.1 - \*\*CVE-2025-30204\*\*
> 
> Please help us with a docker image without these vulnerabilities.

> <https://github.com/temporalio/ui/issues/2837>
>
> We see the below components of the ui:v2.39.0 image have some vulnerabilities.
> 
> …alpine://3.21:c-ares:1.34.3-r0 - \*\*CVE-2025-31498\*\*
> alpine://3.21:curl:8.12.1-r0 - \*\*CVE-2025-4947\*\*
> alpine://3.21:brotli-libs:1.1.0-r2 - \*\*CVE-2020-36846\*\*
> alpine://3.21:libcrypto3:3.3.3-r0 - \*\*CVE-2025-4575\*\*
> go://github.com/golang/go:1.23.4 - \*\*CVE-2024-45341\*\*
> go://golang.org/x/net:0.34.0 - \*\*CVE-2025-4673\*\*
> go://github.com/golang/go:1.23.6 - \*\*CVE-2025-4673\*\*
> go://golang.org/x/crypto:0.32.0 - \*\*CVE-2025-22869\*\*
> go://google.golang.org/grpc:1.66.0 - \*\*CVE-2024-11407\*\*
> 
> Please help us with a docker image without these vulnerabilities.

* * *

We see the below components of the server:v1.28.0 image have some vulnerabilities.

alpine://3.22:libcrypto3:3.5.0-r0 - **CVE-2025-4575**  
go://go.temporal.io/server:1.18.1-0.20230217005328-b313b7f58641 - **CVE-2023-3485**  
go://go.temporal.io/api:1.18.1 - **CVE-2025-1243**  
go://golang.org/x/net:0.34.0 - **CVE-2025-22870**  
go://github.com/golang/go:1.24.1 - **CVE-2025-4673**  
go://google.golang.org/grpc:1.56.3 - **CVE-2024-7246**  
go://go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc:0.36.4 - **CVE-2023-47108**  
go://golang.org/x/crypto:0.32.0 - **CVE-2025-22869**  
go://golang.org/x/oauth2:0.7.0 - **CVE-2025-22868**  
go://github.com/golang-jwt/jwt/v4:4.5.1 - **CVE-2025-30204**

* * *

We see the below components of the ui:v2.39.0 image have some vulnerabilities.

alpine://3.21:c-ares:1.34.3-r0 - **CVE-2025-31498**  
alpine://3.21:curl:8.12.1-r0 - **CVE-2025-4947**  
alpine://3.21:brotli-libs:1.1.0-r2 - **CVE-2020-36846**  
alpine://3.21:libcrypto3:3.3.3-r0 - **CVE-2025-4575**  
go://github.com/golang/go:1.23.4 - **CVE-2024-45341**  
go://golang.org/x/net:0.34.0 - **CVE-2025-4673**  
go://github.com/golang/go:1.23.6 - **CVE-2025-4673**  
go://golang.org/x/crypto:0.32.0 - **CVE-2025-22869**  
go://google.golang.org/grpc:1.66.0 - **CVE-2024-11407**

Please help in expediting the same as we need to plan our remediation plans accordingly.

---

<div class="post-metadata">

**Author:** ![hmmtmm](https://avatars.discourse-cdn.com/v4/letter/h/9e8a1a/32.png) [@hmmtmm](https://community.temporal.io/u/hmmtmm)\
**Post date:** [August 29, 2025, 11:13pm UTC](https://community.temporal.io/t/temporal-docker-image-vulnerabilities/18271/2 "2025-08-29T23:13:13Z")

</div>

I’m working with Temporal on the similar issues with the the UI ad admin docker images. One of the suggestions is to create docker image directly from source. Below script may help.

“[https://github.com/temporalio/docker-builds/blob/main/docker/auto-setup.sh”](https://github.com/temporalio/docker-builds/blob/main/docker/auto-setup.sh%E2%80%9D)