Dotnet Runtime - Alpine 3.23 - Zlib Critical Vulnerability - CVE-2026-22184

[andrewharry]

There is a critical vulnerability in the latest versions of dotnet runtime.

Version Tested: mcr.microsoft.com/dotnet/runtime:10.0.5-alpine3.23-amd64

podman run --rm anchore/syft mcr.microsoft.com/dotnet/runtime:10.0.5-alpine3.23-amd64

Package	Version	Type
zlib	1.3.1-r2	apk

CVE-2026-22184 was fixed with version 1.3.2 which was released last month.

Alpine 3.23 has been patched, but it seems there is an issue with the official Microsoft dotnet images not grabbing the latest? Can we only expect this critical vulnerability to be fixed when Alpine versions?

I have addressed this manually in the dockerfile

# https://github.com/dotnet/dotnet-docker/blob/main/README.aspnet.md
ARG RUNTIME_VERSION=10.0.5-alpine3.23-amd64

# set up base image
FROM mcr.microsoft.com/dotnet/aspnet:$RUNTIME_VERSION AS base

# Force update of zlib to mitigate CVE-2026-22184
RUN apk add --no-cache --upgrade zlib

[lbussell]

Thanks for the report.

In .NET 9+, the Runtime contains a statically linked version of zlib-ng. See https://learn.microsoft.com/dotnet/core/compatibility/containers/9.0/no-zlib. We don't manually install zlib in the .NET images, so you get the version from the base image. Your solution for manually upgrading is correct if you are trying to make the vulnerability report go away, or if a part of your app/image depends on the system zlib.

For .NET 8, which depends on the system zlib version, I've kicked off a re-build of the Alpine images.

[michael-pozhigan-wp]

Hi @lbussell ,
I noticed that different dotnet 10 images uses different zlib version. It look like only sdk image updated its base image.
docker run --rm --pull always mcr.microsoft.com/dotnet/sdk:10.0-alpine3.23 sh -c 'apk list --installed zlib'
returns
zlib-1.3.2-r0 aarch64 {zlib} (Zlib) [installed]
but
docker run --rm --pull always mcr.microsoft.com/dotnet/runtime-deps:10.0-alpine3.23 sh -c 'apk list --installed zlib'
still returns
zlib-1.3.1-r2 aarch64 {zlib} (Zlib) [installed]

Based on update policy they should get updates in a same way: https://github.com/dotnet/dotnet-docker/blob/main/README.runtime-deps.md#image-update-policy