Vulnerability Reportamazoncorretto:25.0.5-al2023-headful

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. An attacker who reaches an application that decodes untrusted Brotli data or compiles untrusted regular expressions could corrupt memory, crash the workload, or possibly run code within it. Note: CVE-2026-86145 only applies if an application compiles attacker-supplied regular expressions through PCRE2, and CVE-2026-103111 only applies when such patterns are compiled with the JIT API. No known-exploited vulnerabilities are listed, and the image runs no listening service by default, which limits practical exposure. Rebuild the final image on a patched base and confirm which downstream workloads actually use these libraries in risky ways. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.