Security: packer compiled with dependancy containing critical CVEs

[securepii-dev]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

The latest packer binary (installed from https://releases.hashicorp.com/packer/xxxxx/packer_xxxxx_linux_amd64.zip) contains two Critical CVEs identified by AWS Inspector:

CVE	Severity
CVE-2026-50195	Critical
CVE-2026-53492	Critical

They are both related to github.com/containerd/containerd/v2 and are fixed in versions 2.3.2, 2.2.5 and 2.1.9

[nanonyme]

This seems misleadingly filed. The dependency chain goes packer->syft->stereoscope->containerd. Packer should be updating syft though updating implicit dependency should be a solid workaround. For the record, the problem is fixed in syft 1.46.0 latest being 1.48.0.

[tanmay-hc]

Patched in latest release