Last scanned:
This base/runtime image is a reasonable foundation, but it ships vulnerabilities worth remediating in the images built on top of it. The three exposed findings are rated severity 6.0 and are denial-of-service issues rather than code execution or data theft. CVE-2026-78659 and CVE-2026-94440 only become relevant if an application built on this image runs a Go HTTP/2 server or parses multipart uploads, since the default container starts just a bash shell and exposes no ports. Images that add such Go services should confirm whether those code paths are present and rebuild on a patched base where they are. The 14 post-exploit-only findings are low severity and do not change this verdict. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-78659 | MEDIUM6 | libcap 2.73-1.amzn2023.0.7 fixed in 2.73-1.amzn2023.0.8 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78667 | MEDIUM6 | libcap 2.73-1.amzn2023.0.7 fixed in 2.73-1.amzn2023.0.8 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-94440 | MEDIUM6 | libcap 2.73-1.amzn2023.0.7 fixed in 2.73-1.amzn2023.0.8 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-111497 | LOW3.35 | libbrotli 1.1.0-1.amzn2023.0.1 fixed in 1.1.0-1.amzn2023.0.2 | 36.0% High Exploitation Risk | Post-Exploit |
| CVE-2026-86145 | LOW2.95 | pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-86145 | LOW2.95 | pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-92392 | LOW2.92 | curl-minimal 8.21.0-5.amzn2023.0.2 fixed in 8.21.0-5.amzn2023.0.3 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-92392 | LOW2.92 | libcurl-minimal 8.21.0-5.amzn2023.0.2 fixed in 8.21.0-5.amzn2023.0.3 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-103111 | LOW2.74 | pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-103111 | LOW2.74 | pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-19553 | LOW2.66 | python3 3.9.25-1.amzn2023.0.9 fixed in 3.9.25-1.amzn2023.0.11 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-19553 | LOW2.66 | python3-libs 3.9.25-1.amzn2023.0.9 fixed in 3.9.25-1.amzn2023.0.11 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-113470 | LOW2.48 | ca-certificates 2025.2.76-1.0.amzn2023.0.3 fixed in 2025.2.76-1.0.amzn2023.0.4 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-89160 | LOW2.34 | pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-89160 | LOW2.34 | pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-89156 | LOW2.12 | pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-89156 | LOW2.12 | pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Post-Exploit |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.