Vulnerability Reportamazoncorretto:21.0.13-al2023-headful

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. An attacker who reaches an application built on this image could execute arbitrary code or leak data, but only if that application processes untrusted Brotli-compressed input or attacker-supplied regular expressions through PCRE2. Note: CVE-2026-111497 only applies if an application in the image decodes attacker-supplied Brotli-compressed data, and CVE-2026-86145 only applies if an application compiles attacker-controlled regular expressions. The image runs no network service and exposes no ports, so practical exposure depends on the workloads built on top of it. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.