Vulnerability Reportamazonlinux:2023

Name: amazonlinux:2023 Security Vulnerability Report
Creator: BaseImage
Keywords: amazonlinux:2023, Docker security, vulnerability scan, CVE, container security, SBOM

amazonlinux:latestamazonlinux:2023.11.20260526.0amazonlinux:2023

DIGESTsha256:267b42d61c8eb5537270b62ec97b73bb104708d9245d343b5eeb1d92f0f65d3d

Executive Summary

CAUTION

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. Exploiting vulnerabilities such as CVE-2026-48864 and CVE-2026-48863 in the critical `libsolv` library could lead to information disclosure, arbitrary code execution, or denial of service during package management operations. While this is an official and trusted Amazon Linux image, the presence of multiple high-severity flaws that are broadly applicable makes it unsuitable for direct production use without careful risk assessment and mitigation strategies.

Threat Score

74/100

CAUTION

Two high-severity vulnerabilities (>= 7.0) are present on the exposed surface, with a maximum severity of 7.8, posing significant immediate risk.
Critical library `libsolv` is affected by multiple flaws, including CVE-2026-48864 (severity 7.8) and CVE-2026-48863 (severity 7.5).
These `libsolv` vulnerabilities could lead to information disclosure, arbitrary code execution, or denial of service via crafted repository data or PGP signatures.
Despite being an official and trusted image, the scan reveals multiple high-impact runtime risks that require immediate attention.

Reputation

TRUSTED

Docker Official

OFFICIAL

Official Docker Hub Image
Pinned by digest (Immutable)

BaseImage/

amazonlinux:2023

Hardened

Grade

A+

Vulns

Verified & secured for production

Vulnerabilities

Vulnerability Log

6 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-48864	HIGH7.8	libsolv 0.7.22-1.amzn2023.0.3 fixed in 0.7.22-1.amzn2023.0.4	—	Directly ExposedContext importance: HIGH
CVE-2026-48863	HIGH7.5	libsolv 0.7.22-1.amzn2023.0.3 fixed in 0.7.22-1.amzn2023.0.4	—	Directly ExposedContext importance: HIGH
CVE-2026-9149	MEDIUM6.5	libsolv 0.7.22-1.amzn2023.0.3 fixed in 0.7.22-1.amzn2023.0.4	—	Directly ExposedContext importance: HIGH
CVE-2026-9150	MEDIUM5.2	libsolv 0.7.22-1.amzn2023.0.3 fixed in 0.7.22-1.amzn2023.0.4	—	Directly ExposedContext importance: MEDIUM
CVE-2026-6019	LOW1.87	python3 3.9.25-1.amzn2023.0.5 fixed in 3.9.25-1.amzn2023.0.6	<0.1% Theoretical Threat	Post-Exploit
CVE-2026-6019	LOW1.87	python3-libs 3.9.25-1.amzn2023.0.5 fixed in 3.9.25-1.amzn2023.0.6	<0.1% Theoretical Threat	Post-Exploit