Last scanned:
This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker who exploited the top Spring MVC or Jackson findings could execute code on the server, or stall the service through crafted requests. CVE-2026-47884 only becomes reachable if the application uses a catch-all view mapping, and CVE-2026-54512 only applies if polymorphic typing is enabled with an allow-list validator, so confirm whether either configuration is present before deployment. None of the findings are known to be actively exploited, but the container's root default user and exposed web port increase the impact if one is exploited. Review the application's routing and Jackson configuration, and apply compensating controls such as network restrictions and least-privilege runtime settings.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-47884 | HIGH7.84 | org.springframework:spring-webmvc 6.2.19 fixed in 7.0.9 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-47890 | HIGH7.84 | org.springframework:spring-webmvc 6.2.19 fixed in 7.0.9 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54512 | MEDIUM6.48 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.18.8, 3.1.4, 2.21.4 | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54513 | MEDIUM6.48 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.18.8, 2.21.4, 3.1.4 | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-68497 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-91777 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54399 | MEDIUM6 | org.apache.httpcomponents.core5:httpcore5 5.3.6 fixed in 5.4.3, 5.5-beta2 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54872 | MEDIUM5.9 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-72897 | MEDIUM5.9 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75805 | MEDIUM5.9 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-77696 | MEDIUM5.9 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42770 | MEDIUM5.9 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-63073 | MEDIUM5.9 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-9076 | MEDIUM5.9 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-54872 | MEDIUM5.9 | libssl3 3.3.7-r0 fixed in 3.3.7-r2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-72897 | MEDIUM5.9 | libssl3 3.3.7-r0 fixed in 3.3.7-r2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75805 | MEDIUM5.9 | libssl3 3.3.7-r0 fixed in 3.3.7-r2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-77696 | MEDIUM5.9 | libssl3 3.3.7-r0 fixed in 3.3.7-r2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42770 | MEDIUM5.9 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-63073 | MEDIUM5.9 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-9076 | MEDIUM5.9 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-65905 | MEDIUM5.88 | org.apache.tomcat.embed:tomcat-embed-core 11.0.22 fixed in 11.0.25, 10.1.58, 9.0.121 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-111497 | MEDIUM5.59 | brotli-libs 1.1.0-r2 fixed in 1.1.1-r0 | 36.0% High Exploitation Risk | Directly Exposed |
| CVE-2026-45445 | MEDIUM5.46 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-45445 | MEDIUM5.46 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-75595 | MEDIUM5.46 | io.netty:netty-handler 4.1.135.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-65182 | MEDIUM5.46 | org.apache.tomcat.embed:tomcat-embed-core 11.0.22 fixed in 11.0.25, 10.1.58, 9.0.121 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-68525 | MEDIUM5.46 | org.apache.tomcat.embed:tomcat-embed-core 11.0.22 fixed in 11.0.25, 10.1.58, 9.0.121 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-8763 | MEDIUM5.46 | org.bouncycastle:bcprov-jdk18on 1.80.2 fixed in 1.85 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75804 | MEDIUM5.3 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-75806 | MEDIUM5.3 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r2 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-84784 | MEDIUM5.3 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42766 | MEDIUM5.3 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-75804 | MEDIUM5.3 | libssl3 3.3.7-r0 fixed in 3.3.7-r2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-75806 | MEDIUM5.3 | libssl3 3.3.7-r0 fixed in 3.3.7-r2 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-84784 | MEDIUM5.3 | libssl3 3.3.7-r0 fixed in 3.3.7-r2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42766 | MEDIUM5.3 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-64607 | MEDIUM5.3 | org.apache.httpcomponents.client5:httpclient5 5.5.2 fixed in 5.6.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-41001 | MEDIUM5.3 | org.springframework.boot:spring-boot-autoconfigure 3.5.14 fixed in 4.0.7, 3.5.15 | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-59888 | MEDIUM5.2 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.18.8, 2.21.4 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-59889 | MEDIUM5.2 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.21.5, 2.18.9, 2.22.1 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| GHSA-mhm7-754m-9p8w | MEDIUM5.2 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.18.9, 2.21.5 | — | Directly ExposedContext importance: MEDIUM |
| CVE-2026-85091 | MEDIUM5 | zlib 1.3.2-r0 fixed in 1.3.2-r1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-86145 | MEDIUM4.92 | pcre2 10.43-r0 fixed in 10.43-r1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-45447 | MEDIUM4.86 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 4.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-45447 | MEDIUM4.86 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 4.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-54875 | MEDIUM4.7 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-54875 | MEDIUM4.7 | libssl3 3.3.7-r0 fixed in 3.3.7-r2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89161 | MEDIUM4.68 | pcre2 10.43-r0 fixed in 10.43-r1 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-103111 | MEDIUM4.56 | pcre2 10.43-r0 fixed in 10.43-r1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-26740 | MEDIUM4.5 | giflib 5.2.2-r1 fixed in 5.2.2-r2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-34183 | MEDIUM4.5 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63072 | MEDIUM4.5 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-63076 | MEDIUM4.5 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-34183 | MEDIUM4.5 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63072 | MEDIUM4.5 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-63076 | MEDIUM4.5 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-2100 | MEDIUM4.5 | p11-kit 0.25.5-r2 fixed in 0.26.2-r0 | 1.3% Low-Moderate Risk | Directly Exposed |
| CVE-2026-2100 | MEDIUM4.5 | p11-kit-trust 0.25.5-r2 fixed in 0.26.2-r0 | 1.3% Low-Moderate Risk | Directly Exposed |
| CVE-2026-68494 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.18.6 fixed in 2.18.8, 2.21.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89407 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.18.6 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.18.6 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-40983 | MEDIUM4.5 | io.micrometer:micrometer-core 1.15.11 fixed in 1.16.6, 1.15.12 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-40984 | MEDIUM4.5 | io.micrometer:micrometer-core 1.15.11 fixed in 1.16.6, 1.15.12 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-59901 | MEDIUM4.5 | io.netty:netty-codec 4.1.133.Final fixed in 4.1.136.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-55831 | MEDIUM4.5 | io.netty:netty-codec-http 4.1.133.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-55833 | MEDIUM4.5 | io.netty:netty-codec-http 4.1.133.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-56745 | MEDIUM4.5 | io.netty:netty-codec-http 4.1.133.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-59898 | MEDIUM4.5 | io.netty:netty-codec-http 4.1.133.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59899 | MEDIUM4.5 | io.netty:netty-codec-http 4.1.133.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-59903 | MEDIUM4.5 | io.netty:netty-codec-http 4.1.133.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-56819 | MEDIUM4.5 | io.netty:netty-codec-http2 4.1.133.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-48043 | MEDIUM4.5 | io.netty:netty-codec-http2 4.1.133.Final fixed in 4.1.135.Final, 4.2.15.Final | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-75596 | MEDIUM4.5 | io.netty:netty-handler 4.1.135.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-54428 | MEDIUM4.5 | org.apache.httpcomponents.core5:httpcore5-h2 5.3.6 fixed in 5.4.3, 5.5-beta2 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-13506 | MEDIUM4.5 | org.bouncycastle:bcprov-jdk18on 1.80.2 fixed in 1.85 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-83557 | MEDIUM4.48 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-84782 | MEDIUM4.44 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r2 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-34182 | MEDIUM4.44 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-84782 | MEDIUM4.44 | libssl3 3.3.7-r0 fixed in 3.3.7-r2 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-34182 | MEDIUM4.44 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-89157 | MEDIUM4.44 | pcre2 10.43-r0 fixed in 10.43-r1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-19032 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54514 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.18.8, 2.21.4, 3.1.4 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54515 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-77310 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.18.6 fixed in 2.18.9, 2.21.5, 2.22.1 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-107891 | MEDIUM4 | musl 1.2.5-r11 fixed in 1.2.5-r12 | — | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl-utils 1.2.5-r11 fixed in 1.2.5-r12 | — | Directly Exposed |
| CVE-2026-89158 | LOW3.9 | pcre2 10.43-r0 fixed in 10.43-r1 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89160 | LOW3.9 | pcre2 10.43-r0 fixed in 10.43-r1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-56746 | LOW3.9 | io.netty:netty-codec-http 4.1.133.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59921 | LOW3.9 | io.netty:netty-codec-http 4.1.133.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-0636 | LOW3.9 | org.bouncycastle:bcprov-jdk18on 1.80.2 fixed in 1.84 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-42768 | LOW3.78 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-42768 | LOW3.78 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-35189 | LOW3.7 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-45446 | LOW3.7 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.7 | libcrypto3 3.3.7-r0 fixed in 3.3.7-r1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-35189 | LOW3.7 | libssl3 3.3.7-r0 fixed in 3.3.7-r2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-45446 | LOW3.7 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.7 | libssl3 3.3.7-r0 fixed in 3.3.7-r1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-9370 | LOW3.7 | com.github.ulisesbocchio:jasypt-spring-boot 3.0.5 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-9370 | LOW3.7 | com.github.ulisesbocchio:jasypt-spring-boot-starter 3.0.5 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-46675 | LOW3.54 | libpng 1.6.57-r0 fixed in 1.6.59-r0 | — | Directly Exposed |
| CVE-2026-89156 | LOW3.54 | pcre2 10.43-r0 fixed in 10.43-r1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-49844 | LOW3.54 | org.apache.logging.log4j:log4j-api 2.25.4 fixed in 2.25.5, 2.26.1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-113730 | LOW3.36 | ognl:ognl 3.3.4 fixed in 3.4.13 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-40930 | LOW3.24 | libpng 1.6.57-r0 fixed in 1.6.59-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-50020 | LOW3.18 | io.netty:netty-codec-http 4.1.133.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-47244 | LOW3.18 | io.netty:netty-codec-http2 4.1.133.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-50560 | LOW3.18 | io.netty:netty-codec-http2 4.1.133.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59900 | LOW3.18 | io.netty:netty-codec-http2 4.1.133.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-10532 | LOW2.9 | ch.qos.logback:logback-core 1.5.25 fixed in 1.5.34 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-9828 | LOW1.2 | ch.qos.logback:logback-core 1.5.25 fixed in 1.5.33 | 0.4% Theoretical Threat | Directly Exposed |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.