Vulnerability Reportamazonlinux:2.0.20261102.0

amazonlinux:2.0.20261102.0amazonlinux:2

digestsha256:a16ae10b6b355377cc6efea843e771daa582ee0339352f425749304178d7c191

Executive Summary

Last scanned: Nov 4, 2026

Threat ScoreNEEDS ATTENTION• Amazon Linux 2 (Karoo) reached end of support: the distribution no longer ships security fixes for it. Rebuild on a supported release.• The scan recorded no exposed or post-exploit vulnerabilities for this image, so no specific CVE currently drives the verdict.• The threat score sits in the NEEDS_ATTENTION band, which reflects the base image's overall posture rather than any identified flaw.• The container runs as root by default, which increases the impact of any future flaw in images built on top of it.• The image comes from the Docker Official publisher with a TRUSTED reputation verdict and is pinned by digest, which supports its provenance.

25/100NEEDS ATTENTION

ReputationOFFICIAL• Official Docker Hub Image• Pinned by digest (Immutable)

TRUSTED

This base/runtime image is a reasonable foundation, but it ships vulnerabilities worth remediating in the images built on top of it. The scan recorded zero exposed or post-exploit findings, so nothing in the current results directly drives this verdict. The main concern is inherited risk: Amazon Linux 2 has reached end of support and will no longer receive security fixes, so any flaw discovered later may remain unpatched in images built on it. Teams building on this image should plan a migration to a supported base and keep running the container as root only where it is strictly necessary. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.

Hardening plan for this image · 2 steps. The first cuts risk from 25 to 0.

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

0 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
No vulnerabilities found matching filters.

Want to check another image? Run a full scan with the Docker Security Scanner.