@steep-lamp-91158 @magnificent-energy-493 @bland-eye-99092 @refined-kangaroo-48640 @creamy-art-71586 @early-magician-18981 We are currently using Ory Hydra in our project and recently conducted a security vulnerability scan on our deployment. The scan reported several CVEs related to dependencies used by Ory Hydra. We would appreciate your guidance on the following points: Validity of Findings: 1. Are these CVEs applicable to Ory Hydra in its current releases? 2. Have these vulnerabilities been assessed by the Ory team, and are any of them considered non-exploitable in the context of Hydra? Security Advisories and Documentation: 1. Is there any documentation, security advisory page, or vulnerability tracking mechanism where we can verify whether these CVEs affect Ory Hydra? 2. Are there release notes that map dependency upgrades to specific CVEs and vulnerability fixes? Remediation Plan: 1. Are there any planned or upcoming Ory Hydra releases that will address the reported vulnerabilities? 2. If fixes are already available in newer Hydra versions, could you please advise which version we should upgrade to? Container Image Dependencies: 1. Several findings are related to Alpine packages such as OpenSSL, musl, BusyBox, and zlib. 2. Are updated Hydra container images available that include patched versions of these operating system dependencies? Please find below a summary of the findings reported by our security scan: CVE / Advisory Severity Package Affected Version Fixed Version CVE-2026-46595 Critical golang.org/x/crypto < 0.52.0 0.52.0 CVE-2026-31789 Critical openssl (Alpine) < 3.3.7-r0 3.3.7-r0 CVE-2026-33815 Critical github.com/jackc/pgx/v5 < 5.9.0 5.9.0 CVE-2026-33816 Critical github.com/jackc/pgx/v5 < 5.9.0 5.9.0 CVE-2026-63073 Critical openssl (Alpine) < 3.3.7-r1 3.3.7-r1 CVE-2026-39821 Critical golang.org/x/net < 1.26.6 1.26.6 CVE-2026-34182 Critical openssl (Alpine) < 3.3.7-r1 3.3.7-r1 CVE-2026-39830 Critical golang.org/x/crypto < 0.52.0 0.52.0 CVE-2026-39831 Critical golang.org/x/crypto < 0.52.0 0.52.0 CVE-2026-39832 Critical golang.org/x/crypto < 0.52.0 0.52.0 CVE-2026-39833 Critical golang.org/x/crypto < 0.52.0 0.52.0 CVE-2026-39834 Critical golang.org/x/crypto < 0.52.0 0.52.0 CVE-2026-42508 Critical golang.org/x/crypto < 0.52.0 0.52.0 CVE-2026-75803 Critical openssl (Alpine) < 3.3.7-r1 3.3.7-r1 GHSA-hrxh-6v49-42gf High google.golang.org/grpc < 1.82.1 1.82.1 CVE-2026-84304 High google.golang.org/grpc <= 1.83.0 1.83.1 CVE-2026-56865 High golang.org/x/mod < 0.40.0 0.40.0 CVE-2026-33810 High Go stdlib < 1.26.2 1.26.2 CVE-2026-40200 High musl (Alpine) < 1.2.5-r11 1.2.5-r11 CVE-2026-29181 High OpenTelemetry <= 1.40.0 1.41.0 CVE-2026-32286 High github.com/jackc/pgproto3/v2 <= 2.3.3 Not Fixed CVE-2026-34986 High github.com/go-jose/go-jose/v3 < 3.0.5 3.0.5 CVE-2026-56854 High golang.org/x/crypto < 0.55.0 0.55.0 CVE-2026-56855 High golang.org/x/crypto < 0.56.0 0.56.0 CVE-2026-39883 High OpenTelemetry SDK <= 1.42.0 1.43.0 CVE-2026-41567 High Docker <= 28.5.2 Not Fixed CVE-2026-42306 High Docker <= 28.5.2 Not Fixed CVE-2026-84445 High google.golang.org/grpc < 1.82.2 1.82.2 CVE-2025-60876 Medium BusyBox (Alpine) <= 1.37.0-r14 Not Fixed CVE-2026-25680 Medium golang.org/x/net < 0.55.0 0.55.0 CVE-2026-84303 Medium google.golang.org/grpc <= 1.83.0 1.83.1 CVE-2026-22184 Medium zlib (Alpine) < 1.3.2-r0 1.3.2-r0 GO-2026-5932 Unspecified golang.org/x/crypto Any version Not Fixed We appreciate your guidance and look forward to your response.

Hello @broad-wolf-22440 please see the Ory Security Policy for answers to your questions: github.com/ory/hydra?tab=security-ov-file