Last scanned:
This base/runtime image is a reasonable foundation, but it ships vulnerabilities worth remediating in the images built on top of it. The most notable are CVE-2023-2650 (potential DoS when connecting to a malicious server) and CVE-2026-31789 (heap buffer overflow on 32-bit systems only). Both are medium severity and are partially mitigated by typical deployment contexts—e.g., the container likely runs on 64-bit Linux and only connects to trusted endpoints. Additionally, CVE-2023-0464 and CVE-2026-28388 require enabling non-default certificate policy or delta CRL processing, so they pose no risk under standard configurations. Upgrading the openssl-libs package to a patched version is recommended to eliminate these inherited flaws. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2023-2650 | MEDIUM6.76 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 75.1% Actively Exploited | Directly ExposedContext importance: MEDIUM |
| CVE-2026-31789 | MEDIUM6.66 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2023-0464 | MEDIUM6 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 3.7% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-28388 | MEDIUM6 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 1.1% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-4105 | MEDIUM5.7 | systemd-libs 239-82.el8_10.17 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-4437 | MEDIUM5.52 | glibc 2.28-251.el8_10.37 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-6238 | MEDIUM5.52 | glibc 2.28-251.el8_10.37 fixed in 2.28-251.el8_10.40 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-4437 | MEDIUM5.52 | glibc-common 2.28-251.el8_10.37 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-6238 | MEDIUM5.52 | glibc-common 2.28-251.el8_10.37 fixed in 2.28-251.el8_10.40 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-4437 | MEDIUM5.52 | glibc-minimal-langpack 2.28-251.el8_10.37 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-6238 | MEDIUM5.52 | glibc-minimal-langpack 2.28-251.el8_10.37 fixed in 2.28-251.el8_10.40 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-41184 | MEDIUM5.52 | github.com/projectcalico/calico v3.31.5-58-g302912362136 fixed in 3.31.6, 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f | 0.5% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-41185 | MEDIUM5.52 | github.com/projectcalico/calico v3.31.5-58-g302912362136 fixed in 3.31.6, 1.11.0-cni-plugin.0.20260417001138-cd73bc2cea0f | 0.3% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2019-14250 | MEDIUM5.5 | libgcc 8.5.0-28.el8_10 No fix yet | 2.3% Low-Moderate Risk | Directly Exposed |
| CVE-2024-0727 | MEDIUM5.5 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 3.2% Low-Moderate Risk | Directly Exposed |
| CVE-2021-3997 | MEDIUM5.5 | systemd-libs 239-82.el8_10.17 No fix yet | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-54370 | MEDIUM5.35 | libacl 2.2.53-3.el8 fixed in 2.4.0-1.el8_10 | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-54371 | MEDIUM5.35 | libattr 2.4.48-3.el8 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-42768 | MEDIUM5.35 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2023-0466 | MEDIUM5.3 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2023-0465 | MEDIUM5.3 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-13757 | MEDIUM5.27 | p11-kit-trust 0.23.22-2.el8 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-5435 | MEDIUM5.02 | glibc 2.28-251.el8_10.37 fixed in 2.28-251.el8_10.40 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-5435 | MEDIUM5.02 | glibc-common 2.28-251.el8_10.37 fixed in 2.28-251.el8_10.40 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-5435 | MEDIUM5.02 | glibc-minimal-langpack 2.28-251.el8_10.37 fixed in 2.28-251.el8_10.40 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-15468 | MEDIUM5.02 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2025-69420 | MEDIUM5.02 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-22796 | MEDIUM5.02 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-42770 | MEDIUM5.02 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-9076 | MEDIUM5.02 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-34180 | MEDIUM5 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2024-2511 | MEDIUM4.81 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 54.0% Actively Exploited | Directly Exposed |
| CVE-2022-3606 | MEDIUM4.67 | libbpf 0.5.0-1.el8 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | MEDIUM4.67 | libgcc 8.5.0-28.el8_10 No fix yet | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2025-15469 | MEDIUM4.67 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-22795 | MEDIUM4.67 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-7383 | MEDIUM4.67 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-27171 | MEDIUM4.67 | zlib 1.2.11-25.el8 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-42766 | MEDIUM4.5 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-34743 | MEDIUM4.5 | xz-libs 5.2.4-4.el8_6 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42505 | MEDIUM4.5 | stdlib v1.25.11 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2018-20839 | MEDIUM4.3 | systemd-libs 239-82.el8_10.17 No fix yet | 2.5% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42250 | MEDIUM4.25 | bzip2-libs 1.0.6-28.el8_10 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-5450 | MEDIUM4.25 | glibc 2.28-251.el8_10.37 fixed in 2.28-251.el8_10.38 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-5928 | MEDIUM4.25 | glibc 2.28-251.el8_10.37 fixed in 2.28-251.el8_10.40 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-5450 | MEDIUM4.25 | glibc-common 2.28-251.el8_10.37 fixed in 2.28-251.el8_10.38 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-5928 | MEDIUM4.25 | glibc-common 2.28-251.el8_10.37 fixed in 2.28-251.el8_10.40 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-5450 | MEDIUM4.25 | glibc-minimal-langpack 2.28-251.el8_10.37 fixed in 2.28-251.el8_10.38 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-5928 | MEDIUM4.25 | glibc-minimal-langpack 2.28-251.el8_10.37 fixed in 2.28-251.el8_10.40 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2021-24032 | MEDIUM4 | libzstd 1.4.4-1.el8 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2024-13176 | MEDIUM4 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2025-68160 | MEDIUM4 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-4598 | MEDIUM4 | systemd-libs 239-82.el8_10.17 No fix yet | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2024-25260 | LOW3.4 | elfutils-libelf 0.190-2.el8 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-4438 | LOW3.4 | glibc 2.28-251.el8_10.37 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-4438 | LOW3.4 | glibc-common 2.28-251.el8_10.37 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-4438 | LOW3.4 | glibc-minimal-langpack 2.28-251.el8_10.37 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2025-69418 | LOW3.4 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-46836 | LOW3.37 | net-tools 2.0-0.52.20160912git.el8 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-5958 | LOW3.21 | sed 4.5-5.el8_10 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-56391 | LOW3.11 | coreutils-single 8.30-17.el8_10 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2018-20657 | LOW2.7 | libgcc 8.5.0-28.el8_10 No fix yet | 4.0% Low-Moderate Risk | Post-Exploit |
| CVE-2022-4899 | LOW2.7 | libzstd 1.4.4-1.el8 No fix yet | 1.6% Low-Moderate Risk | Post-Exploit |
| CVE-2026-28390 | LOW2.7 | openssl-libs 1:1.1.1k-16.el8_6 fixed in 1:1.1.1k-17.el8_6 | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2026-28389 | LOW2.7 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2022-41409 | LOW2.7 | pcre2 10.32-3.el8_6 No fix yet | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2026-13595 | LOW2.7 | util-linux 2.32.1-48.el8_10 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-28387 | LOW2.48 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2026-41991 | LOW2.4 | gzip 1.9-13.el8_5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-27456 | LOW2.4 | util-linux 2.32.1-48.el8_10 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-29111 | LOW2.39 | systemd-libs 239-82.el8_10.17 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-39822 | LOW2.39 | stdlib v1.25.11 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2021-45940 | LOW2.34 | libbpf 0.5.0-1.el8 No fix yet | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2021-45941 | LOW2.34 | libbpf 0.5.0-1.el8 No fix yet | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2025-69421 | LOW2.29 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2025-5278 | LOW2.24 | coreutils-single 8.30-17.el8_10 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-56392 | LOW2.24 | coreutils-single 8.30-17.el8_10 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-54369 | LOW2.17 | libacl 2.2.53-3.el8 fixed in 2.4.0-1.el8_10 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2024-41996 | LOW2.12 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2026-42771 | LOW1.99 | openssl-libs 1:1.1.1k-16.el8_6 No fix yet | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | shadow-utils 2:4.6-23.el8_10 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2025-11961 | LOW1.61 | libpcap 14:1.9.1-5.el8 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2021-39537 | NONE0 | ncurses-base 6.1-10.20180224.el8 No fix yet | 3.2% Low-Moderate Risk | Not Applicable |
| CVE-2021-39537 | NONE0 | ncurses-libs 6.1-10.20180224.el8 No fix yet | 3.2% Low-Moderate Risk | Not Applicable |
| CVE-2020-19185 | NONE0 | ncurses-base 6.1-10.20180224.el8 No fix yet | 1.4% Low-Moderate Risk | Not Applicable |
| CVE-2020-19186 | NONE0 | ncurses-base 6.1-10.20180224.el8 No fix yet | 1.5% Low-Moderate Risk | Not Applicable |
| CVE-2020-19187 | NONE0 | ncurses-base 6.1-10.20180224.el8 No fix yet | 1.4% Low-Moderate Risk | Not Applicable |
| CVE-2020-19188 | NONE0 | ncurses-base 6.1-10.20180224.el8 No fix yet | 1.4% Low-Moderate Risk | Not Applicable |
| CVE-2020-19189 | NONE0 | ncurses-base 6.1-10.20180224.el8 No fix yet | 1.9% Low-Moderate Risk | Not Applicable |
| CVE-2020-19190 | NONE0 | ncurses-base 6.1-10.20180224.el8 No fix yet | 1.4% Low-Moderate Risk | Not Applicable |
| CVE-2023-50495 | NONE0 | ncurses-base 6.1-10.20180224.el8 No fix yet | 1.0% Theoretical Threat | Not Applicable |
| CVE-2020-19185 | NONE0 | ncurses-libs 6.1-10.20180224.el8 No fix yet | 1.4% Low-Moderate Risk | Not Applicable |
| CVE-2020-19186 | NONE0 | ncurses-libs 6.1-10.20180224.el8 No fix yet | 1.5% Low-Moderate Risk | Not Applicable |
| CVE-2020-19187 | NONE0 | ncurses-libs 6.1-10.20180224.el8 No fix yet | 1.4% Low-Moderate Risk | Not Applicable |
| CVE-2020-19188 | NONE0 | ncurses-libs 6.1-10.20180224.el8 No fix yet | 1.4% Low-Moderate Risk | Not Applicable |
| CVE-2020-19189 | NONE0 | ncurses-libs 6.1-10.20180224.el8 No fix yet | 1.9% Low-Moderate Risk | Not Applicable |
| CVE-2020-19190 | NONE0 | ncurses-libs 6.1-10.20180224.el8 No fix yet | 1.4% Low-Moderate Risk | Not Applicable |
| CVE-2023-50495 | NONE0 | ncurses-libs 6.1-10.20180224.el8 No fix yet | 1.0% Theoretical Threat | Not Applicable |
| CVE-2018-19211 | NONE0 | ncurses-base 6.1-10.20180224.el8 No fix yet | 0.9% Theoretical Threat | Not Applicable |
| CVE-2018-19211 | NONE0 | ncurses-libs 6.1-10.20180224.el8 No fix yet | 0.9% Theoretical Threat | Not Applicable |
| GO-2026-5932 | NONE0 | golang.org/x/crypto v0.53.0 No fix yet | — | Not Applicable |
| CVE-2026-56852 | NONE0 | golang.org/x/text v0.38.0 fixed in 0.39.0 | 0.4% Theoretical Threat | Not Applicable |
| GHSA-hrxh-6v49-42gf | NONE0 | google.golang.org/grpc v1.79.3 fixed in 1.82.1 | — | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.