AI
A Year of Scanning: What 40,000 CVE Journeys Revealed
Weinberger’s team selected the most popular open-source container projects across different workloads and communities, then scanned 250 images daily for a full year. That produced around 10 million findings. From this data they built 40,000 CVE journeys, each tracing a vulnerability from disclosure to the moment a user pulled a fixed image. Across nearly 8,000 unique CVEs, two numbers stood out: 90% had a fix available, and 40% still lived in production containers for more than 6 months.
AI Slop Is Breaking Open Source Maintainers
curl closed its bug bounty program two months before this conference. Its team named the reason “the death of thousand slopes”: thousands of low-quality AI-generated reports requiring triage with no real findings. libxml’s maintainer stepped down after large companies aimed automated fuzzing and AI tooling at his project. He said none of the generated issues were more important than regular bugs. GitHub opened a product discussion to help maintainers handle the surge. The Hugging Face CEO reported a new PR arriving every 3 minutes.
What Responsible Disclosure Actually Looks Like
The research surfaced maintainers discovering CVEs in their own projects only when a user opened a public issue. The libxml maintainer said he had never heard of a CVE on his project before someone filed a ticket. The tar project had an open CVE with no activity for weeks, and the maintainer learned about it secondhand. Reporters should use private channels, follow the format, respect the SLA, and tell the maintainer first, even when filing with a third party.
From Merged Patch to Pulled Image: Where Time Is Lost
Once a patch merges, a new release still needs to be cut. Critical CVEs get one fast. Lower-severity CVEs can wait weeks. Vulnerability scanners then need to consume advisory feeds and update their databases before detecting the fixed version. Direct dependencies require a pull request and CI run. Indirect transitive dependencies take longer. Upgrading to a newer version risks API changes and dependency conflicts, so projects often wait for a backport, applying the fix to an older supported branch instead.
Cutting CVE Count with Minimal Images and Direct Patching
The default full base image averages 1 GB and arrives with 1,000 to 2,000 CVEs. Switching to a minimal flavor cuts that significantly. Weinberger showed the latest tag carries 40% fewer CVEs than older pinned tags in 80% of images surveyed. For remaining CVEs, Dependabot and Renovate open PRs when a fixed version is available. Copa, a CNCF sandbox project, patches vulnerable packages without a full image rebuild by adding a lightweight layer to the existing container. Useful when a CVE drops on a Friday and waiting for the upstream base image is not an option.
Notable Quotes
the death of thousand slopes which basically mean that he and his team on kill actually needed to handle with thousands of low quality AI slop reports. Mor Weinberger · ▶ 7:37
PR every 3 minutes. Let me repeat new PR every 3 minutes. Mor Weinberger · ▶ 9:16
more than a half of the CVE actually originate in bloated packages that probably you don’t need at your production Mor Weinberger · ▶ 24:15
Key Takeaways
- 90% of container CVEs have a fix available, but 40% persist in containers for more than 6 months.
- More than half of container CVEs originate in bloated packages not needed in production.
- Copa patches containers in-place without a full rebuild, cutting time-to-fix when a CVE drops late in the week.
About the Speaker(s)
Mor Weinberger is a Software Architect at Echo specializing in cloud-native security and software supply chain resilience. His work focuses on scalable systems that detect and mitigate threats across modern cloud environments.
Lior Kaplan is an Open Source evangelist and security expert at Kaplan Open Source. He has worked across upstream projects, Linux distributions, and DevOps teams focused on infrastructure security, and is a longtime Open Source community member.