3.123.0+2026.10.27

Features

Vulnerability lookups between scans: Between scans, the platform checks the dependencies of your images against new vulnerability data. These lookups now run in parallel, four at a time by default, instead of one at a time. Before, a lookup that failed with a temporary error skipped that dependency until the next refresh. Failed lookups are now retried up to two times, and a dependency that still fails is looked up again on later refreshes. On-premises installations can change the number of parallel lookups with server.vdb.componentVulnerabilitiesConcurrency.
Server memory limit (on-premises): The server containers now set GOMEMLIMIT to 85% of their container memory limit. The server then frees memory more often as it nears the limit, which can help prevent out-of-memory restarts. Change the percentage with server.goMemLimitPercent, or set it to 0 to turn this off. A GOMEMLIMIT environment variable that you set yourself takes precedence.

New Context-Aware Rule Detection (Mitigate)
- Added a Mitigate check for U-Boot images built with a boot command that loads images without verifying their signatures. An attacker with access to the U-Boot shell, or control over the boot script, can use such a command to boot a tampered image and gain privileged control of the device (CWE-288, CVSS 7.6). The finding names the boot command, for example bootz.

Total for empty results: When a search or filter in a grid matched nothing, the grid showed no result total. The total is part of the pagination, which is hidden when there are no results. Grids now show “Total 0” in that case.

Report media types in the OpenAPI specification: The OpenAPI specification declared application/json for the SBOM and CBOM report endpoints, which return CycloneDX and SPDX media types such as application/vnd.cyclonedx+json and application/spdx+json. The specification now declares these media types. It also declares the Content-Disposition header that the SBOM, CBOM and VEX report endpoints send. The responses themselves have not changed. See SBOM Reports, CBOM Reports and VEX Reports.

U-Boot bootdelay on AARCH64: The Mitigate check for the U-Boot bootdelay setting now reads the value correctly from upstream U-Boot binaries built for AARCH64.
U-Boot environment outside the image: Mitigate tried to read the default U-Boot environment past the end of the image. It now reads the environment only within the image.

RSA OID: When RSA matched both the OID 1.2.840.113549.1.1.1 and the OID 2.5.8.1.1, CryptoScan now reports 1.2.840.113549.1.1.1.

U-Boot Mitigate findings: The Binarly Risk Score formula now has weights for three Mitigate findings for U-Boot images: missing FIT signature verification support, a missing public key in the control FDT, and unsafe boot commands. They score the same as the finding for U-Boot images that load their environment from external storage, because they have the same metric values. Existing risk scores are recalculated.