Issue Station
Sign In
Tools hereToolbox

litellm - 💡(How to fix) Fix [Bug]: Docker image pins glibc version in /etc/apk/world, preventing security upgrades

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Root Cause

The Wolfi APK package manager respects version constraints in /etc/apk/world. When a package is listed as glibc=2.43-r3, apk upgrade will not upgrade it beyond that exact version — it treats it as a user-specified constraint.

Fix Action

Fix / Workaround

This prevents users from upgrading glibc via apk upgrade in derived Dockerfiles, even though newer patched versions (e.g., 2.43-r7) are available in the Wolfi/Chainguard repository.

Multiple critical and high severity CVEs remain unpatched:

Code Example

glibc=2.43-r3
glibc-locale-posix=2.43-r3
ld-linux=2.43-r3
libcrypt1=2.43-r3

---

docker run --rm --entrypoint sh ghcr.io/berriai/litellm:main-latest -c "
  cat /etc/apk/world | grep glibc
  echo '---'
  apk update && apk upgrade 2>&1 | grep glibc
  echo '(no output = glibc was NOT upgraded)'
"
RAW_BUFFERClick to expand / collapse

Bug Description

The official LiteLLM Docker image (ghcr.io/berriai/litellm:main-latest) pins exact versions of glibc and related packages in /etc/apk/world:

glibc=2.43-r3
glibc-locale-posix=2.43-r3
ld-linux=2.43-r3
libcrypt1=2.43-r3

This prevents users from upgrading glibc via apk upgrade in derived Dockerfiles, even though newer patched versions (e.g., 2.43-r7) are available in the Wolfi/Chainguard repository.

Impact

Multiple critical and high severity CVEs remain unpatched:

  • CVE-2026-5450 (Critical) — fixed in 2.43-r7
  • CVE-2026-4437 (High) — fixed in 2.43-r4
  • CVE-2026-4046 (High) — fixed in 2.43-r6
  • CVE-2026-5928 (High) — fixed in 2.43-r7
  • CVE-2026-4438 (Medium) — fixed in 2.43-r4

Users who build on top of the official image and run apk upgrade expect system packages to be updated, but glibc is silently skipped due to the exact version pin.

Root Cause

The Wolfi APK package manager respects version constraints in /etc/apk/world. When a package is listed as glibc=2.43-r3, apk upgrade will not upgrade it beyond that exact version — it treats it as a user-specified constraint.

Reproduction

docker run --rm --entrypoint sh ghcr.io/berriai/litellm:main-latest -c "
  cat /etc/apk/world | grep glibc
  echo '---'
  apk update && apk upgrade 2>&1 | grep glibc
  echo '(no output = glibc was NOT upgraded)'
"

Environment

  • LiteLLM Docker image: ghcr.io/berriai/litellm:main-latest
  • LiteLLM version: 1.82.6
  • Base OS: Wolfi
  • Architecture: x86_64

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING