how often the image is rebuilt to fix vulnerability in dependencies or underlaying image

[cwrx777]

for example, there's new vulnerabilities found and are fixed in the latest apache,
how soon can the php-apache image be rebuilt and pushed to dockerhub?

[joshtrichards]

https://github.com/docker-library/faq#why-does-my-security-scanner-show-that-an-image-has-cves

Though if you're referring specifically to CVE-2025-54090, at least in the Debian images it's irrelevant since it's only applicable to images that would have Apache HTTP 2.4.64, which won't be the case for LTS Debian images.

https://security-tracker.debian.org/tracker/CVE-2025-54090
https://security-tracker.debian.org/tracker/source-package/apache2