Alpine 3.21.9, 3.22.7, 3.23.7 and 3.24.3 released

The Alpine Linux project is pleased to announce the immediate availability of new stable releases:

• 3.21.9
• 3.22.7
• 3.23.7
• 3.24.3

Those releases include security fixes across core components.

The full list of changes can be found in the git log.

ca-certificates

Updated ca-certificates package, addressing the eMudhra intermediate CA compromise.

musl

• CVE-2026-107891

OpenSSL

Security fixes addressing the September 29, 2026 advisory:

• CVE-2026-35189
• CVE-2026-42772 (not in 3.21.9)
• CVE-2026-54872
• CVE-2026-54873 (not in 3.21.9)
• CVE-2026-54875
• CVE-2026-72897
• CVE-2026-75804
• CVE-2026-75805
• CVE-2026-75806
• CVE-2026-77696
• CVE-2026-84782
• CVE-2026-84784

zlib

• CVE-2026-85091

PHP (3.23/3.24 only)

The 3.23 and 3.24 stable branches additionally include security fixes for PHP 8.3 through 8.5:

• CVE-2026-109618 (GHSA-w8hw-w9fx-j79w)
• CVE-2026-109619 (GHSA-7875-c8px-7q5f)