Vulnerability Reportamazoncorretto:25.0.4-al2023-headless

This base/runtime image ships critical vulnerabilities that any image built on it would inherit; they must be remediated before the final image goes to production. If an application in an inheriting image decodes attacker-supplied Brotli data, CVE-2026-111497 could let an attacker corrupt memory and potentially execute code within the container, and because the image runs as root by default, the impact could be severe. Updating the libbrotli package to a fixed version in the final image is the required remediation. CVE-2026-70906 is a lower-severity JDK font-loading denial-of-service issue that only applies to Java applications rendering untrusted fonts, so it is a secondary concern. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.