Vulnerability Reportapache/kafka:4.2.2

apache/kafka:4.2.2apache/kafka:4.2.2-rc1

digestsha256:1213eb3943d551e5ed1fca7a4e109001cee35770b66a02a0c37a8964efe09b69

Executive Summary

Last scanned: Nov 2, 2026

Threat ScoreSAFE• The scan found 11 exposed-surface vulnerabilities, with a highest severity of 5.0, so none are high-severity or known to be actively exploited.• No exposed-surface findings are reachable in normal operation at a severity that would affect the verdict.• The 4 findings that matter only after the container is already compromised have a highest severity of 3.79, which gives them little practical impact here.• The image is pinned by digest and comes from the apache publisher with a RELIABLE reputation verdict and a high pull count.

3/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (52M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. The scan found 11 vulnerabilities reachable from the network, but the most severe scores only 5.0, and none are known to be actively exploited. The 4 findings that matter only after an attacker has already compromised the container have low severity and little practical impact in this context. Keeping the image pinned by digest and monitoring for new findings will help maintain this posture.

Already in good shape · 4 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

15 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-85091	MEDIUM5	zlib 1.3.2-r0 fixed in 1.3.2-r1	0.5% Theoretical Threat	Directly Exposed
CVE-2026-89407	MEDIUM4.5	com.fasterxml.jackson.core:jackson-core 2.21.6 fixed in 2.18.11, 2.21.7, 2.22.3	0.6% Theoretical Threat	Directly Exposed
CVE-2026-89425	MEDIUM4.5	com.fasterxml.jackson.core:jackson-core 2.21.6 fixed in 2.21.7, 2.22.3, 2.18.11	0.5% Theoretical Threat	Directly Exposed
CVE-2026-91776	MEDIUM4.5	com.fasterxml.jackson.core:jackson-databind 2.21.6 fixed in 2.18.11, 2.21.7, 2.22.3	0.5% Theoretical Threat	Directly Exposed
CVE-2026-91777	MEDIUM4.5	com.fasterxml.jackson.core:jackson-databind 2.21.6 fixed in 2.21.7, 2.18.11, 2.22.3	0.5% Theoretical Threat	Directly Exposed
CVE-2026-106450	MEDIUM4.24	at.yawk.lz4:lz4-java 1.11.2 fixed in 1.11.4	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-106451	MEDIUM4.2	at.yawk.lz4:lz4-java 1.11.2 fixed in 1.11.4	0.1% Theoretical Threat	Directly Exposed
CVE-2026-107891	MEDIUM4	musl 1.2.6-r2 fixed in 1.2.6-r3	—	Directly Exposed
CVE-2026-107891	MEDIUM4	musl-utils 1.2.6-r2 fixed in 1.2.6-r3	—	Directly Exposed
CVE-2026-111497	LOW3.79	brotli-libs 1.2.0-r1 fixed in 1.2.1-r0	82.6% Actively Exploited	Post-Exploit
CVE-2026-102633	LOW3.54	libexpat 2.8.4-r0 fixed in 2.9.0-r0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-106449	LOW2.96	at.yawk.lz4:lz4-java 1.11.2 fixed in 1.11.4	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-77214	LOW2.95	libexpat 2.8.4-r0 fixed in 2.9.0-r0	0.3% Theoretical Threat	Post-Exploit
CVE-2026-93990	LOW2.7	libexpat 2.8.4-r0 fixed in 2.8.5-r0	0.4% Theoretical Threat	Post-Exploit
CVE-2026-46675	LOW2.12	libpng 1.6.58-r1 fixed in 1.6.59-r0	—	Post-Exploit

Want to check another image? Run a full scan with the Docker Security Scanner.