Vulnerability Reportamazon/aws-xray-daemon:latest

amazon/aws-xray-daemon:latestamazon/aws-xray-daemon:3.xamazon/aws-xray-daemon:3.7.1

digestsha256:38393637b3147cf66552b1c096de362a331990612dbe324dcd6bacd23c2ae07e

Executive Summary

Last scanned: Nov 4, 2026

Threat ScoreNEEDS ATTENTION• CVE-2026-78659 in the libcap package is the only finding that affects the verdict. It is a denial-of-service flaw in Go's HTTP/2 server code compiled into the xray binary, and a remote client could crash the daemon by sending crafted HTTP/2 trailers.• The scan reported 36 exposed findings in total, but only one has a severity of 6.0 or higher, and the highest severity is 6.0. None are known to be actively exploited.• The flaw matters only if the daemon's TCP port actually serves HTTP/2 traffic, which the available information does not confirm. No special configuration is stated as required.• The main process is a statically linked Go program that does not load system shared libraries, so the other OS library findings are not reachable through it.• The scan found 4 post-exploit-only findings, all with a severity below 3.0. They matter only after the container is already compromised and do not raise the verdict.• The publisher is a verified publisher with a TRUSTED verdict, and the image is pinned by digest.

26/100NEEDS ATTENTION

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The main concern is CVE-2026-78659, a denial-of-service flaw that a remote client could use to exhaust memory and crash the X-Ray daemon, which would interrupt trace collection. Whether this applies depends on whether the port handles HTTP/2 traffic, which is not confirmed here. The other exposed findings are of lower severity and do not change the verdict, and the remaining post-exploit findings only matter after a compromise. Updating the libcap-related components in a future image rebuild is a reasonable way to close this gap.

Hardening plan for this image · 4 steps

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

40 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-78659	MEDIUM6	libcap 2.73-1.amzn2023.0.7 fixed in 2.73-1.amzn2023.0.8	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-111943	MEDIUM5.44	stdlib v1.26.9 fixed in 1.26.10, 1.27.3	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-86145	MEDIUM4.92	pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5	0.4% Theoretical Threat	Directly Exposed
CVE-2026-86145	MEDIUM4.92	pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5	0.4% Theoretical Threat	Directly Exposed
CVE-2026-103111	MEDIUM4.56	pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5	0.3% Theoretical Threat	Directly Exposed
CVE-2026-103111	MEDIUM4.56	pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5	0.3% Theoretical Threat	Directly Exposed
CVE-2026-78667	MEDIUM4.5	libcap 2.73-1.amzn2023.0.7 fixed in 2.73-1.amzn2023.0.8	0.5% Theoretical Threat	Directly Exposed
CVE-2026-94440	MEDIUM4.5	libcap 2.73-1.amzn2023.0.7 fixed in 2.73-1.amzn2023.0.8	0.5% Theoretical Threat	Directly Exposed
CVE-2026-84782	MEDIUM4.44	openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	0.8% Theoretical Threat	Directly Exposed
CVE-2026-84782	MEDIUM4.44	openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	0.8% Theoretical Threat	Directly Exposed
CVE-2026-19553	MEDIUM4.44	python3-libs 3.9.25-1.amzn2023.0.9 fixed in 3.9.25-1.amzn2023.0.11	0.5% Theoretical Threat	Directly Exposed
CVE-2026-113470	MEDIUM4.14	ca-certificates 2025.2.76-1.0.amzn2023.0.3 fixed in 2025.2.76-1.0.amzn2023.0.4	0.5% Theoretical Threat	Directly Exposed
CVE-2026-89160	LOW3.9	pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5	0.3% Theoretical Threat	Directly Exposed
CVE-2026-89160	LOW3.9	pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5	0.3% Theoretical Threat	Directly Exposed
CVE-2026-35189	LOW3.7	openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	0.3% Theoretical Threat	Directly Exposed
CVE-2026-35191	LOW3.7	openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	0.7% Theoretical Threat	Directly Exposed
CVE-2026-35189	LOW3.7	openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	0.3% Theoretical Threat	Directly Exposed
CVE-2026-35191	LOW3.7	openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	0.7% Theoretical Threat	Directly Exposed
CVE-2026-54872	LOW3.54	openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	0.4% Theoretical Threat	Directly Exposed
CVE-2026-72897	LOW3.54	openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	0.4% Theoretical Threat	Directly Exposed
CVE-2026-75805	LOW3.54	openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	0.3% Theoretical Threat	Directly Exposed
CVE-2026-54872	LOW3.54	openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	0.4% Theoretical Threat	Directly Exposed
CVE-2026-72897	LOW3.54	openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	0.4% Theoretical Threat	Directly Exposed
CVE-2026-75805	LOW3.54	openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	0.3% Theoretical Threat	Directly Exposed
CVE-2026-89156	LOW3.54	pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5	0.3% Theoretical Threat	Directly Exposed
CVE-2026-89156	LOW3.54	pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5	0.3% Theoretical Threat	Directly Exposed
CVE-2026-42772	LOW3.18	openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	0.5% Theoretical Threat	Directly Exposed
CVE-2026-54873	LOW3.18	openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	0.7% Theoretical Threat	Directly Exposed
CVE-2026-75804	LOW3.18	openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	0.5% Theoretical Threat	Directly Exposed
CVE-2026-75806	LOW3.18	openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	1.1% Low-Moderate Risk	Directly Exposed
CVE-2026-84784	LOW3.18	openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	0.6% Theoretical Threat	Directly Exposed
CVE-2026-42772	LOW3.18	openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	0.5% Theoretical Threat	Directly Exposed
CVE-2026-54873	LOW3.18	openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	0.7% Theoretical Threat	Directly Exposed
CVE-2026-75804	LOW3.18	openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	0.5% Theoretical Threat	Directly Exposed
CVE-2026-75806	LOW3.18	openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	1.1% Low-Moderate Risk	Directly Exposed
CVE-2026-84784	LOW3.18	openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3	0.6% Theoretical Threat	Directly Exposed
CVE-2026-92392	LOW2.92	curl-minimal 8.21.0-5.amzn2023.0.2 fixed in 8.21.0-5.amzn2023.0.3	1.3% Low-Moderate Risk	Post-Exploit
CVE-2026-92392	LOW2.92	libcurl-minimal 8.21.0-5.amzn2023.0.2 fixed in 8.21.0-5.amzn2023.0.3	1.3% Low-Moderate Risk	Post-Exploit
CVE-2026-97689	LOW2.7	python3-pip-wheel 21.3.1-2.amzn2023.0.21 fixed in 21.3.1-2.amzn2023.0.22	0.3% Theoretical Threat	Post-Exploit
CVE-2026-19553	LOW2.66	python3 3.9.25-1.amzn2023.0.9 fixed in 3.9.25-1.amzn2023.0.11	0.5% Theoretical Threat	Post-Exploit

Want to check another image? Run a full scan with the Docker Security Scanner.