Alpine 3.21.9, 3.22.7, 3.23.7 and 3.24.3 released

Key points

Alpine Linux has published four stable point releases, 3.21.9, 3.22.7, 3.23.7 and 3.24.3, dated 2026-10-21. They consist of security fixes to core components. The full list of changes is in the project's git log.

Core components

• ca-certificates: updated to deal with the compromise of an eMudhra intermediate certificate authority.
• musl: fixes CVE-2026-107891.
• zlib: fixes CVE-2026-85091.

OpenSSL

• Picks up the fixes from OpenSSL's advisory of September 29, 2026.
• Fixed in all four releases: CVE-2026-35189, CVE-2026-54872, CVE-2026-54875, CVE-2026-72897, CVE-2026-75804, CVE-2026-75805, CVE-2026-75806, CVE-2026-77696, CVE-2026-84782 and CVE-2026-84784.
• CVE-2026-42772 and CVE-2026-54873 are fixed in 3.22.7, 3.23.7 and 3.24.3 but not in 3.21.9.

PHP (3.23 and 3.24 only)

• The 3.23 and 3.24 branches also carry security fixes for PHP 8.3 through 8.5.
• Fixed: CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-7875-c8px-7q5f).
• Systems on 3.21 or 3.22 do not get these PHP fixes in this round.

Summary by DistroNews, based on the original post.