Vulnerability Reportamazoncorretto:27

This base/runtime image is a reasonable foundation, but it ships vulnerabilities worth remediating in the images built on top of it. The only elevated item is CVE-2026-63072 in openssl-libs and openssl-fips-provider-latest, where a crafted CMS message can trigger a small out-of-bounds heap write that corrupts memory and typically crashes the decrypting process, a denial-of-service impact at severity 6.0. Reachability is conditional: this code path is only exercised if a downstream image actually calls OpenSSL CMS decryption on attacker-supplied messages, which a plain Java runtime does not do by default. The 31 post-exploit-only findings inherited alongside it all remain below the 6.0 threshold, so they do not change the picture. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.