Last scanned:
··This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. The most serious of these, CVE-2026-111497 in libbrotli, could let an attacker run code or crash a service in any inheriting image whose application decodes untrusted Brotli-compressed data. Note: CVE-2026-111497 only applies if an application in the image decodes Brotli input, and CVE-2026-86145 only applies if an application compiles attacker-supplied regular expressions. Teams building on this image should confirm whether their applications use these features and patch the affected libraries in their final image. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.
Hardening plan for this image · 4 steps. The first closes an actively exploited CVE.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-111497 | HIGH8 | libbrotli 1.1.0-1.amzn2023.0.1 fixed in 1.1.0-1.amzn2023.0.2 | 82.6% Actively Exploited | Directly ExposedContext importance: MEDIUM |
| CVE-2026-86145 | MEDIUM6.56 | pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-86145 | MEDIUM6.56 | pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-103111 | MEDIUM6.08 | pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-103111 | MEDIUM6.08 | pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89160 | MEDIUM5.2 | pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89160 | MEDIUM5.2 | pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78659 | MEDIUM4.5 | libcap 2.73-1.amzn2023.0.7 fixed in 2.73-1.amzn2023.0.8 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78667 | MEDIUM4.5 | libcap 2.73-1.amzn2023.0.7 fixed in 2.73-1.amzn2023.0.8 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-94440 | MEDIUM4.5 | libcap 2.73-1.amzn2023.0.7 fixed in 2.73-1.amzn2023.0.8 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-19553 | MEDIUM4.44 | python3-libs 3.9.25-1.amzn2023.0.9 fixed in 3.9.25-1.amzn2023.0.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-94286 | MEDIUM4.26 | libXtst 1.2.5-1.amzn2023.0.1 fixed in 1.2.5-1.amzn2023.0.2 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-113470 | MEDIUM4.14 | ca-certificates 2025.2.76-1.0.amzn2023.0.3 fixed in 2025.2.76-1.0.amzn2023.0.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | LOW3.54 | pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | LOW3.54 | pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-92392 | LOW2.92 | curl-minimal 8.21.0-5.amzn2023.0.2 fixed in 8.21.0-5.amzn2023.0.3 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-92392 | LOW2.92 | libcurl-minimal 8.21.0-5.amzn2023.0.2 fixed in 8.21.0-5.amzn2023.0.3 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-19553 | LOW2.66 | python3 3.9.25-1.amzn2023.0.9 fixed in 3.9.25-1.amzn2023.0.11 | 0.5% Theoretical Threat | Post-Exploit |
Want to check another image? Run a full scan with the Docker Security Scanner.