Alpine zlib 1.3.2-r0 not yet included in php:8.2/8.3 Alpine images (CVE-2026-27171)

[santitorbra98-blip]

zlib 1.3.2-r0 (fixing CVE-2026-27171) is already available in Alpine 3.23,
but current php:8.2-fpm-alpine and php:8.3-fpm-alpine images still ship zlib 1.3.1-r2.

Could you trigger a rebuild of these images so the patched version is included?

This affects vulnerability scanners like Snyk, which rely on base image manifests.

[tianon]

This package is currently installed as part of alpine:3.23 itself, so unfortunately a rebuild of php is unlikely to pull in an update.

Looking at the details on the CVE, the attack vectors from PHP seem pretty thin at first blush, but I haven't looked deeply.