Why Isn’t the Fix in My Container? Tracking CVE Propagation Across 10,000 Projects - Mor Weinberger, Echo Security & Lior Kaplan, Kaplan Open Source
Abstract
We analyzed CVE remediation patterns across 10,000 open source projects to uncover a critical problem: vulnerabilities fixed upstream often take weeks or months to reach downstream containers. This lag creates massive security exposure windows in Kubernetes environments.In this talk, we’ll present our findings showing how CVE fixes flow (or stall) across ecosystem layers, from upstream projects to package managers to base images to final containers. You’ll see real metrics on remediation delays, and the compounding effect of layered dependencies.But we won’t stop at the problem. The second half focuses on practical solutions. From automated patch backporting to in-place image patching with tools like Copa. You’ll learn how to build workflows that dramatically reduce MTTR, including dependency automation patterns and risk-based prioritization.Attendees will leave with both a data-driven understanding of the CVE remediation challenge and a practical playbook for fixing it.