Vulnerability management on

Strategies for minimizing your CVE risk

Thu, 16 Nov 2023 11:07:52 +0200

Common vulnerabilities and exposures (CVEs) are an increasing concern for developers and organizations, which is why Chainguard developed its minimal container images that reduce the attack surface. A new CVE in a widely-used application or a vulnerability scan with numerous positive results can significantly impact security posture, compliance requirements, and development timelines.

Chances are, your software has already been impacted by a CVE. It’s likely there are active CVEs in software you are using. After all, there are software vulnerabilities currently in existence that haven’t even been discovered (known as zero-day vulnerabilities). With that said, this conceptual article aims to highlight a few practices and strategies you and your team can use to reduce the risk of CVEs on your software. It also includes a section on tools recommended by Chainguard that can help to reduce your attack surface area and minimize your risk of CVEs.

Check whether a reported CVE affects your container

Thu, 10 Sep 2026 00:00:00 +0000

Use chainctl images advisories list to compare the advisories for the APK packages in an image with the CVEs reported by your scanner.

Note: This command looks up advisories by APK package. Chainguard records a vulnerability in a Go module, Java archive, or other language component against the APK package that ships it, so the results cover those components too. They don’t cover dependencies that your own build adds to the image. For details, see When the finding is a Go module or Java dependency.

Resolve a scanner finding for a CVE Chainguard has fixed

Thu, 01 Oct 2026 14:31:17 +0000

Sometimes the Chainguard Console or a Chainguard security advisory reports a CVE as fixed, but your vulnerability scanner still reports it in the same image. When this blocks a CI security gate, the cause is usually a mismatch between the image you scanned, the data your scanner uses, and Chainguard’s advisory data. Work through the checks on this page in order; they’re arranged so that the most common causes come first.

Using CVE visualizations

Thu, 19 Dec 2024 11:07:52 +0200

Chainguard provides CVE Visualizations for all of its container images. This feature creates reports with CVE comparisons between Chainguard Containers and popular alternatives, as well as historical CVE remediation metrics. CVE Visualizations provide insight into image health and can help teams measure the engineering, security, and economic benefits gained from using Chainguard Containers.

This guide outlines how you can access a container image’s CVE Visualization in both the Chainguard Console and in the Containers Directory.