Last scanned:
This base/runtime image is a clean foundation for building production images. It does carry 8 exposed-surface and 4 post-exploit-only vulnerabilities, but all are rated at low or moderate severity, none are known to be actively exploited, and none reach the severity levels that would drive a higher verdict. Images built on top of it would inherit these findings, so they should still be tracked during normal patching cycles. The image's official, digest-pinned provenance adds further confidence in its baseline. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-86145 | MEDIUM4.92 | pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-103111 | MEDIUM4.56 | pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-78659 | MEDIUM4.5 | libcap 2.73-1.amzn2023.0.7 fixed in 2.73-1.amzn2023.0.8 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78667 | MEDIUM4.5 | libcap 2.73-1.amzn2023.0.7 fixed in 2.73-1.amzn2023.0.8 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-94440 | MEDIUM4.5 | libcap 2.73-1.amzn2023.0.7 fixed in 2.73-1.amzn2023.0.8 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-19553 | MEDIUM4.44 | python3-libs 3.9.25-1.amzn2023.0.9 fixed in 3.9.25-1.amzn2023.0.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89160 | LOW3.9 | pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | LOW3.54 | pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-111497 | LOW3.35 | libbrotli 1.1.0-1.amzn2023.0.1 fixed in 1.1.0-1.amzn2023.0.2 | 36.0% High Exploitation Risk | Post-Exploit |
| CVE-2026-92392 | LOW2.92 | curl-minimal 8.21.0-5.amzn2023.0.2 fixed in 8.21.0-5.amzn2023.0.3 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-92392 | LOW2.92 | libcurl-minimal 8.21.0-5.amzn2023.0.2 fixed in 8.21.0-5.amzn2023.0.3 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-19553 | LOW2.66 | python3 3.9.25-1.amzn2023.0.9 fixed in 3.9.25-1.amzn2023.0.11 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-86145 | NONE0 | pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-103111 | NONE0 | pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-113470 | NONE0 | ca-certificates 2025.2.76-1.0.amzn2023.0.3 fixed in 2025.2.76-1.0.amzn2023.0.4 | 0.5% Theoretical Threat | Not Applicable |
| CVE-2026-89160 | NONE0 | pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-89156 | NONE0 | pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.