Last scanned:
This base/runtime image is a reasonable foundation, but it ships vulnerabilities worth remediating in the images built on top of it. The most notable item is CVE-2026-45447 in the OpenSSL libraries, which could crash or possibly enable code execution in an application that parses untrusted PKCS#7 or S/MIME messages. Note: CVE-2026-45447 only applies if an application uses the PKCS7 API on untrusted messages, and avoiding that path in dependent applications would fully remove this exposure. CVE-2026-63072 would matter only for applications that decrypt untrusted CMS messages, and its impact is limited to crashes. The scan found no actively exploited issues, so these findings do not block use of the base image, but dependent images should be rebuilt on patched OpenSSL packages. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.
Hardening plan for this image · 5 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-45447 | MEDIUM6.48 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 4.0% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-45447 | MEDIUM6.48 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 4.0% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-63072 | MEDIUM6 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-63072 | MEDIUM6 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-34182 | MEDIUM5.92 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 1.1% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-34182 | MEDIUM5.92 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 1.1% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-45445 | MEDIUM5.46 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-45445 | MEDIUM5.46 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-85091 | MEDIUM5 | zlib 1.3.2-r0 fixed in 1.3.2-r1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-54875 | MEDIUM4.7 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-54875 | MEDIUM4.7 | libssl3 3.3.7-r0 fixed in 3.3.7-r2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-34183 | MEDIUM4.5 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63076 | MEDIUM4.5 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-34183 | MEDIUM4.5 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63076 | MEDIUM4.5 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-84782 | MEDIUM4.44 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r2 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-84782 | MEDIUM4.44 | libssl3 3.3.7-r0 fixed in 3.3.7-r2 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl 1.2.5-r11 fixed in 1.2.5-r12 | — | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl-utils 1.2.5-r11 fixed in 1.2.5-r12 | — | Directly Exposed |
| CVE-2026-42768 | LOW3.78 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-42768 | LOW3.78 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-35189 | LOW3.7 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-45446 | LOW3.7 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.7 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-35189 | LOW3.7 | libssl3 3.3.7-r0 fixed in 3.3.7-r2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-45446 | LOW3.7 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.7 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-54872 | LOW3.54 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-72897 | LOW3.54 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75805 | LOW3.54 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-77696 | LOW3.54 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42770 | LOW3.54 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-63073 | LOW3.54 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-9076 | LOW3.54 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-54872 | LOW3.54 | libssl3 3.3.7-r0 fixed in 3.3.7-r2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-72897 | LOW3.54 | libssl3 3.3.7-r0 fixed in 3.3.7-r2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75805 | LOW3.54 | libssl3 3.3.7-r0 fixed in 3.3.7-r2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-77696 | LOW3.54 | libssl3 3.3.7-r0 fixed in 3.3.7-r2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42770 | LOW3.54 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-63073 | LOW3.54 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-9076 | LOW3.54 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-75804 | LOW3.18 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-75806 | LOW3.18 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r2 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-84784 | LOW3.18 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42766 | LOW3.18 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-75804 | LOW3.18 | libssl3 3.3.7-r0 fixed in 3.3.7-r2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-75806 | LOW3.18 | libssl3 3.3.7-r0 fixed in 3.3.7-r2 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-84784 | LOW3.18 | libssl3 3.3.7-r0 fixed in 3.3.7-r2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42766 | LOW3.18 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 1.1% Low-Moderate Risk | Directly Exposed |
Want to check another image? Run a full scan with the Docker Security Scanner.