Vulnerability Reportcaddy:2.11.8

caddy:2.11.8

digestsha256:331f98eb44dac52de20de040cc38635bae9db91a4cec39b713963fb39b2b5350

Executive Summary

Last scanned: Nov 5, 2026

Threat ScoreSAFE• The scan found one exposed-surface finding with a maximum severity of 4.0, which is below the level that affects the verdict.• No known exploited vulnerabilities and no findings with severity of 6.0 or higher were reported in the exposed surface.• No post-exploit-only findings were reported, so nothing matters only after the container is already compromised.• The image is an official Docker Hub image pinned by digest, and the reputation check returned TRUSTED.• The main process is a statically linked Go binary, so flaws in OS libraries are not reachable through it.

0/100SAFE

ReputationOFFICIAL• Official Docker Hub Image• Pinned by digest (Immutable)

TRUSTED

This image is safe for production use. The scan found one low-severity issue in the exposed surface with a maximum severity of 4.0, which does not affect the verdict given its limited impact. No findings were recorded that matter only after the container is compromised. The image is an official, digest-pinned build and the main Caddy process does not load system shared libraries, so routine patching of the base image is still advisable as good hygiene.

Already in good shape · 1 hardening step left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

1 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.57.0 No fix yet	—	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.