Due to latest vulnerability detected CVE-2023-52425, CVE-2023-52426, I need to upgrade alpine/expat 2.5.0-r2 to expat 2.6.0-r0 in my alpine docker image.

I tried various ways (see below) to upgrade the expat package version during docker build, but the resulting image still shows alpine/expat 2.5.0-r2. I would appreciate any advice on how to do this.

referencing : https://alpine.pkgs.org/3.19/alpine-main-x86_64/expat-2.6.0-r0.apk.html

In my Dockerfile, I tried the following 3 ways to install expat 2.6.0-r0 to no avail:

  1. RUN apk update && apk add --upgrade --no-cache expat

  2. RUN curl -O http://dl-cdn.alpinelinux.org/alpine/v3.19/main/x86_64/expat-2.6.0-r0.apk RUN apk add --allow-untrusted expat-2.6.0-r0.apk

  3. RUN apk add --upgrade --no-cache expat --repository='https://pkgs.alpinelinux.org/package/v3.19/main/x86_64/expat'

  4. RUN echo http://dl-cdn.alpinelinux.org/alpine/v3.19/main/x86_64/ >> /etc/apk/repositories RUN apk --no-cache --update add expatenter image description here

  • You have not shown what the outputs were for the commands you ran, any error or success information would be needed to determine why those commands did not work for you. You could also post a Dockerfile demonstrating the issue you are experiencing. Are you using a version of Alpine which provides the desired version of expat? It looks like you would need to use Alpine v3.16 or newer for your Docker image. You should not use packages from a different version of the Alpine package repository. Commented Feb 13 at 18:31
  • there's no error in my docker build, but my docker desktop docker scout keeps highlighting my alpine/expat is still 2.5.0-r2. I've added picture above. Below's an extract from my build.log : #13 0.998 fetch dl-cdn.alpinelinux.org/alpine/v3.19/main/x86_64/APKINDEX.tar.gz #13 1.072 fetch dl-cdn.alpinelinux.org/alpine/v3.19/community/x86_64/… #13 1.344 (1/2) Installing expat (2.6.0-r0) #13 1.366 (2/2) Installing expat-dev (2.6.0-r0)
    – TJL
    Commented Feb 14 at 5:53

2 Answers 2


I finally managed to resolve this: as I was building my image in stages, if I put the

apk add --upgrade expat

at the last stage, the latest version was applied.  Initially, I was applying the update at the 2nd stage of the build, and I think the updates didn't get propagated to the 3rd stage.


In my Eclipse-built Dockerfile FROM eclipse-temurin:17.0.9_9-jre-alpine, I add:

RUN apk add --upgrade expat

After building the Docker image, SNYK no longer detected any vulnerabilities.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .