This base/runtime image is a clean foundation for building production images. It contains one low-severity post-exploit vulnerability (severity 2.78) that requires local access and poses no practical risk in typical deployments. The image is officially maintained and pinned by digest, guaranteeing consistency. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-7598 | LOW2.78 | libssh2 1.4.3-12.amzn2.2.6 fixed in 1.4.3-12.amzn2.2.7 | 0.4% Theoretical Threat | Post-Exploit |