The Python 3.10.21 image is returning to the official upstream interpreter instead of rebuilding CPython with a local XML hash-salt backport. A temporary Grype exception for CVE-2026-7210 is limited to the python binary package at version 3.10.21. This accepts the outstanding vulnerability; it does not remediate it.
Remove the exception once an official Python 3.10 Alpine image includes the upstream fix (expected in Python 3.10.22; verify inclusion before removing the exception).
- Update the Python 3.10 image version to the fixed upstream release.
- Confirm the release includes the upstream XML hash-salt fix.
- Remove the CVE-2026-7210 rule from
.grype.yaml; delete the file if no rules remain.
- Build and test the supported Python 3.10 variants on amd64 and arm64, and verify Grype passes without the exception.
The Python 3.10.21 image is returning to the official upstream interpreter instead of rebuilding CPython with a local XML hash-salt backport. A temporary Grype exception for CVE-2026-7210 is limited to the
pythonbinary package at version3.10.21. This accepts the outstanding vulnerability; it does not remediate it.Remove the exception once an official Python 3.10 Alpine image includes the upstream fix (expected in Python 3.10.22; verify inclusion before removing the exception).
.grype.yaml; delete the file if no rules remain.