Vulnerability Reportgitlab/gitlab-runner:alpine-v18.9.0

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. The dominant practical danger is availability: CVE-2026-34183 lets a remote peer exhaust the QUIC stack's heap with PATH_CHALLENGE floods, and CVE-2026-63072 can corrupt the heap on a crafted CMS message, so an attacker could crash or destabilize any runner workload that terminates TLS or processes attacker-supplied cryptographic input. Note that CVE-2026-63076 only applies if CMP password-based protection is enabled, and CVE-2026-54874 requires an active DTLS endpoint — the runner uses neither, and disabling CMP entirely would fully eliminate CVE-2026-63076. All 104 post-exploit findings are low severity (max 3.82), so the residual risk comes almost entirely from the 217 exposed-surface issues in the pinned OpenSSL and Go dependency set. Rebuilding on a newer OpenSSL 3.5.8 base, as the advisory recommends, clears the highest-severity crypto denial-of-service issues while keeping the digest-pinned trust benefits.