OCImendby CloudTrace

"No fix available": what to do about unfixable container CVEs

OCImend · 2026-09-26

Short answer

When a scanner shows CVEs with no fix, the distribution has not shipped a patched package (often marked no-dsa, postponed or ignored). Upgrading cannot help. Switch to a slimmer or hardened base that does not contain those packages, watch the image so it is rebuilt when fixes land, and document non-exploitable ones with VEX.

Example measured with OCImend: python:latest vs python:3.12-slim
python:latest
483
3.12-slim
32

Three ways out

  1. 01Rebaseslimmer base, measured
  2. 02Watchrebuilt when fixes ship
  3. 03VEXnot loaded → not affected

Where the CVEs come from

OCImend traces each vulnerable package to the layer and build step that installed it. In python:latest most findings come from a single apt-get install of build tools in the base image, not from Python itself, which is why the -slim variant drops them.

Scan an image →

Questions

What does Debian no-dsa mean?
The Debian security team judged the issue minor enough not to issue a security advisory; it may be fixed in a point release, or never.
Can I ignore unfixable CVEs?
Record why: packages not loaded by the app can be marked not affected in an OpenVEX document, which scanners and auditors can read.

Sources

More guides