Last scanned:
··This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker who could reach an exposed H2 console or influence a database connection URL could execute code on the server, and the container runs as root by default, which would widen the impact. Note: CVE-2021-42392 only applies if the H2 console or a JDBC URL is reachable from outside, which the deployed webapps do not indicate. Note: CVE-2026-65905 only applies if DIGEST authentication is configured, which is not stated for this image. The scan found 12 findings at severity 7.0 or higher, so review them before exposing the service on ports 8080 or 9000.
Hardening plan for this image · 3 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2021-42392 | HIGH8 | com.h2database:h2 1.4.200 fixed in 2.0.206 | 83.2% Actively Exploited | Directly ExposedContext importance: MEDIUM |
| CVE-2022-23221 | HIGH8 | com.h2database:h2 1.4.200 fixed in 2.1.210 | 64.8% Actively Exploited | Directly ExposedContext importance: MEDIUM |
| CVE-2016-1000027 | HIGH8 | org.springframework:spring-web 5.3.39 fixed in 6.0.0 | 33.2% High Exploitation Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-65905 | HIGH7.84 | org.apache.tomcat.embed:tomcat-embed-core 9.0.119 fixed in 11.0.25, 10.1.58, 9.0.121 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-65905 | HIGH7.84 | org.apache.tomcat:tomcat-catalina 9.0.119 fixed in 11.0.25, 10.1.58, 9.0.121 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-47884 | HIGH7.84 | org.springframework:spring-webmvc 5.3.39 fixed in 7.0.9 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2024-38819 | HIGH7.8 | org.springframework:spring-webmvc 5.3.39 fixed in 6.1.14 | 56.5% Actively Exploited | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89407 | HIGH7.5 | com.fasterxml.jackson.core:jackson-core 2.22.0 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-65182 | HIGH7.28 | org.apache.tomcat.embed:tomcat-embed-core 9.0.119 fixed in 11.0.25, 10.1.58, 9.0.121 | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-68525 | HIGH7.28 | org.apache.tomcat.embed:tomcat-embed-core 9.0.119 fixed in 11.0.25, 10.1.58, 9.0.121 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-65182 | HIGH7.28 | org.apache.tomcat:tomcat-catalina 9.0.119 fixed in 11.0.25, 10.1.58, 9.0.121 | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-68525 | HIGH7.28 | org.apache.tomcat:tomcat-catalina 9.0.119 fixed in 11.0.25, 10.1.58, 9.0.121 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89425 | MEDIUM6 | com.fasterxml.jackson.core:jackson-core 2.22.0 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-68497 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.22.0 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-91776 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.22.0 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-91777 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.22.0 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-41842 | MEDIUM6 | org.springframework:spring-webmvc 5.3.39 fixed in 7.0.8, 6.2.19 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2020-15250 | MEDIUM5.5 | junit:junit 4.10 fixed in 4.13.1 | 1.7% Low-Moderate Risk | Directly Exposed |
| CVE-2021-23463 | MEDIUM5.46 | com.h2database:h2 1.4.200 fixed in 2.0.202 | 2.8% Low-Moderate Risk | Directly Exposed |
| CVE-2025-11226 | MEDIUM5.44 | ch.qos.logback:logback-core 1.2.13 fixed in 1.5.19, 1.3.16 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2022-45868 | MEDIUM5.3 | com.h2database:h2 1.4.200 fixed in 2.2.220 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-41001 | MEDIUM5.3 | org.springframework.boot:spring-boot-autoconfigure 2.7.18 fixed in 4.0.7, 3.5.15 | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-59889 | MEDIUM5.2 | com.fasterxml.jackson.core:jackson-databind 2.22.0 fixed in 2.21.5, 2.18.9, 2.22.1 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2024-38816 | MEDIUM5.17 | org.springframework:spring-webmvc 5.3.39 fixed in 6.1.13 | 21.3% High Exploitation Risk | Directly Exposed |
| CVE-2026-1225 | MEDIUM5 | ch.qos.logback:logback-core 1.2.13 fixed in 1.5.25 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-41845 | MEDIUM4.88 | org.springframework:spring-webmvc 5.3.39 fixed in 7.0.8, 6.2.19 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-41844 | MEDIUM4.88 | org.springframework:spring-webmvc 5.3.39 fixed in 7.0.8, 6.2.19 | 0.1% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-41846 | MEDIUM4.88 | org.springframework:spring-webmvc 5.3.39 fixed in 7.0.8, 6.2.19 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2025-41242 | MEDIUM4.72 | org.springframework:spring-webmvc 5.3.39 fixed in 6.2.10 | 2.1% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-22737 | MEDIUM4.72 | org.springframework:spring-webmvc 5.3.39 fixed in 7.0.6, 6.2.17 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-41841 | MEDIUM4.72 | org.springframework:spring-webmvc 5.3.39 fixed in 7.0.8, 6.2.19 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-41843 | MEDIUM4.72 | org.springframework:spring-webmvc 5.3.39 fixed in 7.0.8, 6.2.19 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2024-12798 | MEDIUM4.67 | ch.qos.logback:logback-core 1.2.13 fixed in 1.5.13, 1.3.15 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-40983 | MEDIUM4.5 | io.micrometer:micrometer-core 1.16.5 fixed in 1.16.6, 1.15.12 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-40984 | MEDIUM4.5 | io.micrometer:micrometer-core 1.16.5 fixed in 1.16.6, 1.15.12 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-41848 | MEDIUM4.5 | org.springframework:spring-core 5.3.39 fixed in 7.0.8, 6.2.19 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-41849 | MEDIUM4.5 | org.springframework:spring-expression 5.3.39 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-41850 | MEDIUM4.5 | org.springframework:spring-expression 5.3.39 fixed in 7.0.8, 6.2.19 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-41851 | MEDIUM4.5 | org.springframework:spring-expression 5.3.39 fixed in 7.0.8, 6.2.19 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-83557 | MEDIUM4.48 | com.fasterxml.jackson.core:jackson-databind 2.22.0 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-19032 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.22.0 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54515 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.22.0 fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-77310 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.22.0 fixed in 2.18.9, 2.21.5, 2.22.1 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-22745 | MEDIUM4.24 | org.springframework:spring-webmvc 5.3.39 fixed in 7.0.7, 6.2.18 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-41853 | MEDIUM4.24 | org.springframework:spring-webmvc 5.3.39 fixed in 7.0.8, 6.2.19 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-40973 | MEDIUM4.2 | org.springframework.boot:spring-boot 2.7.18 fixed in 4.0.6, 3.5.14 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-41249 | LOW3.83 | org.springframework:spring-core 5.3.39 fixed in 6.2.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2025-22235 | LOW3.73 | org.springframework.boot:spring-boot 2.7.18 fixed in 3.3.11, 3.4.5 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2024-38820 | LOW3.6 | org.springframework:spring-web 5.3.39 fixed in 6.1.14 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2024-38828 | LOW3.6 | org.springframework:spring-webmvc 5.3.39 fixed in 5.3.42 | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-49844 | LOW3.54 | org.apache.logging.log4j:log4j-api 2.26.0 fixed in 2.25.5, 2.26.1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-54291 | LOW3.54 | org.postgresql:postgresql 42.7.11 fixed in 42.7.12 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-41852 | LOW3.18 | org.springframework:spring-expression 5.3.39 fixed in 7.0.8, 6.2.19 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-10532 | LOW2.9 | ch.qos.logback:logback-core 1.2.13 fixed in 1.5.34 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2024-12801 | LOW2.8 | ch.qos.logback:logback-core 1.2.13 fixed in 1.5.13, 1.3.15 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2024-38820 | LOW2.7 | org.springframework:spring-context 5.3.39 fixed in 6.1.14 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-22741 | LOW2.48 | org.springframework:spring-webmvc 5.3.39 fixed in 7.0.7, 6.2.18 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-22735 | LOW2.08 | org.springframework:spring-webmvc 5.3.39 fixed in 7.0.6, 6.2.17 | 0.1% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2025-22233 | LOW1.58 | org.springframework:spring-context 5.3.39 fixed in 6.2.7, 6.1.20 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-9828 | LOW1.2 | ch.qos.logback:logback-core 1.2.13 fixed in 1.5.33 | 0.4% Theoretical Threat | Directly Exposed |
Want to check another image? Run a full scan with the Docker Security Scanner.