Trivy scans shows several vulnerabilities

SonarQube Server / Community Build
1

Hello team,

Running a Trivy security scan to the latest Community Docker image returned some CRITICAL CVEs dependencies-related:

  • CVE-2025-58057

  • CVE-2025-58056

Could you confirm whether Sonarqube is affected by these vulnerabilities and if so, are there plans to update the affected depencencies?

Steps to reproduce:

trivy image --pkg-types library sonarqube:community

2

Hi,

I’ve unlisted your topic since you’re reporting a vulnerability.

For SonarQube Community Build, we’ve packaged a comprehensive vulnerability listing in the .csv file in the security directory of your SonarQube Community Build distribution. If the vulnerability you’ve found is not reflected there, or if you still have questions after consulting the file, please email security@sonarsource.com rather than making public posts, per our responsible disclosure policy.

 
Thx,