Vulnerability Reportcurlimages/curl:8.22.0

curlimages/curl:8.22.0

digestsha256:58adaa4e8dca9c988bae2aba4ab3434a0bb2da16bbe3f92dec39ec7785166777

Executive Summary

Last scanned: Nov 2, 2026

Threat ScoreCAUTION• CVE-2026-111497 in the brotli-libs package is the finding that sets this verdict. It is a known actively exploited flaw, and it could let a malicious server crash curl or possibly run code when curl decompresses its response.• The flaw needs a non-default option: curl must decompress brotli responses, such as with --compressed, or the server must send brotli-encoded content.• Because curl's normal job is fetching remote content, the risk comes from any server the container contacts, not only from inbound traffic.• The scan found 4 exposed findings in total, 1 of which is listed as actively exploited, with a maximum severity of 8.0.• The scan found 9 findings that matter only after the container is already compromised, and the highest of these has a severity of 2.7.• The publisher's reputation is RELIABLE, with the image pinned by digest.

61/100CAUTION

ReputationPOPULAR COMMUNITY• High Reputation Community Image (6757M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. A malicious server could send a crafted brotli response that crashes curl or possibly runs code on the container when curl decompresses it, which could expose the data and jobs this container handles. Note: CVE-2026-111497 only applies if curl is set to decompress brotli responses or the servers it contacts send brotli-encoded content. Confirm whether your deployment uses those options before relying on this image, and treat the flaw as a priority to patch or restrict.

Hardening plan for this image · 5 steps. The first closes an actively exploited CVE.

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

13 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-111497	HIGH8	brotli-libs 1.2.0-r1 fixed in 1.2.1-r0	82.6% Actively Exploited	Directly ExposedContext importance: MEDIUM
CVE-2026-85091	MEDIUM5	zlib 1.3.2-r0 fixed in 1.3.2-r1	0.5% Theoretical Threat	Directly Exposed
CVE-2026-107891	MEDIUM4	musl 1.2.6-r2 fixed in 1.2.6-r3	—	Directly Exposed
CVE-2026-107891	MEDIUM4	musl-utils 1.2.6-r2 fixed in 1.2.6-r3	—	Directly Exposed
CVE-2026-58050	LOW2.7	libssh2 1.11.1-r3 fixed in 1.11.1-r4	0.4% Theoretical Threat	Post-Exploit
CVE-2025-15661	LOW2.34	libssh2 1.11.1-r3 fixed in 1.11.1-r4	0.6% Theoretical Threat	Post-Exploit
CVE-2026-58051	LOW2.34	libssh2 1.11.1-r3 fixed in 1.11.1-r4	0.3% Theoretical Threat	Post-Exploit
CVE-2026-66032	LOW2.34	libssh2 1.11.1-r3 fixed in 1.11.1-r4	0.4% Theoretical Threat	Post-Exploit
CVE-2026-66033	LOW2.34	libssh2 1.11.1-r3 fixed in 1.11.1-r4	0.6% Theoretical Threat	Post-Exploit
CVE-2026-66034	LOW2.12	libssh2 1.11.1-r3 fixed in 1.11.1-r4	0.4% Theoretical Threat	Post-Exploit
CVE-2026-58055	LOW1.94	nghttp2 1.69.0-r0 fixed in 1.70.0-r0	0.3% Theoretical Threat	Post-Exploit
CVE-2026-58055	LOW1.94	nghttp2-libs 1.69.0-r0 fixed in 1.70.0-r0	0.3% Theoretical Threat	Post-Exploit
CVE-2026-66035	LOW1.91	libssh2 1.11.1-r3 fixed in 1.11.1-r4	0.5% Theoretical Threat	Post-Exploit

Want to check another image? Run a full scan with the Docker Security Scanner.