Last scanned:
This base/runtime image is a clean foundation for building production images. It does carry 14 exposed-surface findings and 4 post-exploit-only findings, but none of the exposed findings rate 6.0 or higher and none are listed as known exploited, so they do not change the verdict. Images built on top of it should still keep their base layers updated as routine hygiene, since the findings are low severity rather than absent. The image is an official, digest-pinned build from a trusted publisher, which supports its use as a building block. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-111497 | MEDIUM5.59 | libbrotli 1.1.0-1.amzn2023.0.1 fixed in 1.1.0-1.amzn2023.0.2 | 36.0% High Exploitation Risk | Directly Exposed |
| CVE-2026-86145 | MEDIUM4.92 | pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-86145 | MEDIUM4.92 | pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-103111 | MEDIUM4.56 | pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-103111 | MEDIUM4.56 | pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-78659 | MEDIUM4.5 | libcap 2.73-1.amzn2023.0.7 fixed in 2.73-1.amzn2023.0.8 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78667 | MEDIUM4.5 | libcap 2.73-1.amzn2023.0.7 fixed in 2.73-1.amzn2023.0.8 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-94440 | MEDIUM4.5 | libcap 2.73-1.amzn2023.0.7 fixed in 2.73-1.amzn2023.0.8 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-94286 | MEDIUM4.26 | libXtst 1.2.5-1.amzn2023.0.1 fixed in 1.2.5-1.amzn2023.0.2 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-113470 | MEDIUM4.14 | ca-certificates 2025.2.76-1.0.amzn2023.0.3 fixed in 2025.2.76-1.0.amzn2023.0.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89160 | LOW3.9 | pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89160 | LOW3.9 | pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | LOW3.54 | pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | LOW3.54 | pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-92392 | LOW2.92 | curl-minimal 8.21.0-5.amzn2023.0.2 fixed in 8.21.0-5.amzn2023.0.3 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-92392 | LOW2.92 | libcurl-minimal 8.21.0-5.amzn2023.0.2 fixed in 8.21.0-5.amzn2023.0.3 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-19553 | LOW2.66 | python3 3.9.25-1.amzn2023.0.9 fixed in 3.9.25-1.amzn2023.0.11 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-19553 | LOW2.66 | python3-libs 3.9.25-1.amzn2023.0.9 fixed in 3.9.25-1.amzn2023.0.11 | 0.5% Theoretical Threat | Post-Exploit |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.