Vulnerability Reportamazonlinux:2.0.20260930.0

amazonlinux:2.0.20260930.0
digestsha256:23deb2446a3a3110debae6a9e36b72d0ecb4e2660e19db8b838476f8f7a85a76

Executive Summary

Last scanned:

Threat Score
0/100SAFE
Reputation
TRUSTED

This base/runtime image is a clean foundation for building production images. The image is officially published and highly trusted, and the vulnerability scan found only 4 exposed vulnerabilities, none of which reached a high severity level. The maximum exposed severity is 5.95, and there are no critical findings in the post-exploitation surface. This low risk profile makes it suitable for use as a building block in production environments. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.

Vulnerabilities

Vulnerability Log

8 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-78367MEDIUM5.95
python2-rpm
4.11.3-48.amzn2.0.5
fixed in 4.11.3-48.amzn2.0.6
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-78367MEDIUM5.95
rpm-build-libs
4.11.3-48.amzn2.0.5
fixed in 4.11.3-48.amzn2.0.6
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-78367MEDIUM5.95
rpm-libs
4.11.3-48.amzn2.0.5
fixed in 4.11.3-48.amzn2.0.6
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-78367LOW3.57
rpm
4.11.3-48.amzn2.0.5
fixed in 4.11.3-48.amzn2.0.6
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-35189LOW3.15
openssl-libs
1:1.0.2k-24.amzn2.0.22
fixed in 1:1.0.2k-24.amzn2.0.23
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-66046LOW2.29
expat
2.1.0-15.amzn2.0.8
fixed in 2.1.0-15.amzn2.0.9
0.7%
Theoretical Threat
Post-Exploit
CVE-2026-84782LOW2.26
openssl-libs
1:1.0.2k-24.amzn2.0.22
fixed in 1:1.0.2k-24.amzn2.0.23
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-54872LOW1.81
openssl-libs
1:1.0.2k-24.amzn2.0.22
fixed in 1:1.0.2k-24.amzn2.0.23
0.3%
Theoretical Threat
Post-Exploit

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.