diff --git a/pkg/fanal/applier/docker.go b/pkg/fanal/applier/docker.go
index 6d1967497ab9..c14c95538c65 100644
--- a/pkg/fanal/applier/docker.go
+++ b/pkg/fanal/applier/docker.go
@@ -31,9 +31,10 @@ type History struct {
 }
 
 func findPackage(e ftypes.Package, s []ftypes.Package) *ftypes.Package {
-	for _, a := range s {
+	for i := range s {
+		a := &s[i] // do not range by value to avoid heap allocations
 		if a.Name == e.Name && a.Version == e.Version && a.Release == e.Release {
-			return &a
+			return a
 		}
 	}
 	return nil