# Going deep: Upstream distros and hidden CVEs

DevFeed: [Going deep: Upstream distros and hidden CVEs](<https://devfeed.tech/articles/going-deep-upstream-distros-and-hidden-cves-13069.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/going-deep-upstream-distros-and-hidden-cves>)

Published: 2026-02-25T00:00:00Z

Content type: opinion

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [Docker Hardened Images](<https://devfeed.tech/topics/docker-hardened-images.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [container images](<https://devfeed.tech/topics/container-images.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Debian](<https://devfeed.tech/topics/debian.md>), [Docker](<https://devfeed.tech/topics/docker.md>)

Tags: [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [debian](<https://devfeed.tech/tags/debian.md>), [debian-containers](<https://devfeed.tech/tags/debian-containers.md>), [dhi](<https://devfeed.tech/tags/dhi.md>), [docker](<https://devfeed.tech/tags/docker.md>), [docker-containers](<https://devfeed.tech/tags/docker-containers.md>), [docker-hardened-images](<https://devfeed.tech/tags/docker-hardened-images.md>), [security](<https://devfeed.tech/tags/security.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [vex](<https://devfeed.tech/tags/vex.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [zero-cves](<https://devfeed.tech/tags/zero-cves.md>)

## AI overview

The article argues that container vendors relying on upstream distributions such as Debian or Alpine can inherit vulnerabilities because fixes may lag between upstream availability and downstream image releases. It examines Docker Hardened Images and claims that some CVEs are suppressed through no-DSA classifications and VEX documents even when fixes exist upstream but have not been incorporated into the images.

## Source excerpt

Are all zero-CVE images truly secure? A deep dive into Debian no-DSA, VEX suppression, and why transparency matters in container supply chain security.