Vulnerability Reportbitnami/postgresql:latest

bitnami/postgresql:latest

digestsha256:b418fd5f001c272aad93ac1febf783f543ee45d8e359d58bd5afc3d2a9b62290

Executive Summary

Last scanned: Nov 10, 2026

Threat ScoreNEEDS ATTENTION• CVE-2026-73515 in the postgis package (version 3.6.4) is the only finding that sets the verdict. It can let an authenticated database user read nearby server memory or crash the database server with a malformed FlatGeobuf value.• The scan found one exposed-surface vulnerability in total, with a maximum severity of 6.48, and none are known to be actively exploited.• The flaw only matters if the PostGIS extension is installed in a database and the attacker already holds a valid database login.• No vulnerabilities were found that matter only after the container is already compromised.• The image comes from a RELIABLE publisher (bitnami) and is pinned by digest, which supports consistent deployments.

27/100NEEDS ATTENTION

ReputationPOPULAR COMMUNITY• High Reputation Community Image (3767M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The one finding that affects the verdict, CVE-2026-73515 in the postgis package, is a moderate-severity flaw that lets a logged-in database user read some server memory or crash the database. Note: CVE-2026-73515 only applies if the PostGIS extension is installed in a database, and it requires a valid database login, so it is not reachable by anonymous clients. Removing the PostGIS extension from databases that do not need it would fully eliminate this risk.

Hardening plan for this image · 2 steps

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

1 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-73515	MEDIUM6.48	postgis 3.6.4 fixed in 3.7.0	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM

Want to check another image? Run a full scan with the Docker Security Scanner.