Alpine 3.24 musl 1.2.6-r3 incorrectly matched to CVE-2026-107891 using edge's r6 threshold #248

Description

Docker Scout 1.27.0 reports CVE-2026-107891 on the genuine signed Alpine 3.24 musl-1.2.6-r3 package. The reported package URL explicitly has os_version=3.24, but Scout uses an affected range of <1.2.6-r6 and a fixed version of 1.2.6-r6.

Alpine's branch-specific security data lists:

The r6 threshold appears to come from edge despite the Alpine 3.24 package identity. Please check the advisory's distro-branch selection.

Our earlier 1.2.6-r2 images were genuinely affected; we do not dispute or ask to suppress those findings. The false-positive report concerns the replacement 1.2.6-r3 package.

Actual result

The complete unsuppressed native linux/amd64 and linux/arm64 scans both report:

Package         pkg:apk/alpine/musl@1.2.6-r3?os_name=alpine&os_version=3.24
Affected range  <1.2.6-r6
Fixed version   1.2.6-r6

The finding is kind=fail, level=none, severity UNSPECIFIED. Our acceptance gate counts every Scout finding and blocks the image; no severity exclusion, exception or VEX suppression is used.

Producing run: https://github.com/brspoon/keep/actions/runs/39728273258
Commit: 3437692f4473856e875187cd05a55d129e915219
Run attempt: 1. The scanner executable is checksum-pinned, and the original SARIF identifies version 1.27.0.

Expected result

For Alpine 3.24, use the vendor's 1.2.6-r3 fixed threshold, continue reporting this CVE for r2, and do not match the CVE to the authentic r3 package. The edge branch should retain its separate r6 threshold; this is not a request to suppress the CVE globally.

The r3 stable package recipe declares the CVE fixed at r3 and includes the fix patch, corresponding to the upstream fix. The vulnerability was disclosed by the musl maintainer.

Reproduction and environment

Both scans run natively on GitHub-hosted Linux runners. The candidate is built locally from the public repository at the commit above, using a digest-pinned DHI Alpine 3.24 base and replacing its musl with the official signed Alpine 3.24 r3 APK.

The exact scanner command is:

docker-scout cves local://keep-ci --format sarif --output candidate-scout-ARCH.json

No severity, package, base, VEX or suppression filters are set.

Exact replacement packages:

• x86_64 r3 APK, SHA-256 e142255d0fa397f14318996bc10378093dcc069dc3dd1b6818c8f28a789c21da
• aarch64 r3 APK, SHA-256 2e17864102278d9049c3a56f1bceed9e8cf287065617e579325123443daed8a5

Both APK signatures, compressed payload hashes and package metadata were verified using the pinned Alpine architecture keys. The runtime checks also verified the installed loader bytes against the exact APK payload. We retain the old base package's source/license attribution for earlier image layers without relabeling the current installed package.

Evidence

The attached bundle contains original complete Scout 1.27.0 SARIF files from both native r3 scans, complete original Alpine v3.24 and edge security-feed snapshots, the pinned r3 APKBUILD and patch, public package verification records, producing-run metadata and a replayed SHA-256 inventory. The source-tree scanner pins match Docker's published release checksums.

The security feeds were retrieved at 2026-10-22T05:37:09Z. v3.24 data was last modified 2026-10-21T18:11:15Z; edge data was last modified 2026-10-21T22:43:03Z.

Please confirm whether the correction is in the backend advisory data and whether a rescan of these same exact r3 packages will pick it up.

Download the evidence bundle

Bundle SHA-256: 58e07d890ab85b31c00d2931bc839c86521767f7a26232893e95ac04cf232dd9 (56,173 bytes).