Last scanned:
This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The main practical risk is CVE-2026-78667, which could let an attacker cause service slowdown or denial of service by sending crafted HTTP Range headers to Navidrome's media streaming endpoints. There are 22 exposed findings in total and 50 post-exploit-only findings, but none reach severity 7.0 or higher, so the image does not rise to CAUTION or DANGEROUS. Because the top issue affects availability rather than code execution, auth bypass, or data exposure, the impact is service disruption rather than host compromise. Keep the digest pin and apply upstream updates when a fixed Go stdlib is available.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-78667 | MEDIUM6.38 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-111943 | MEDIUM5.44 | stdlib v1.27.1 fixed in 1.26.10, 1.27.3 | — | Directly ExposedContext importance: MEDIUM |
| CVE-2026-94448 | MEDIUM5.18 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-97030 | MEDIUM5.18 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-78669 | MEDIUM5.1 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78659 | MEDIUM5.1 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78669 | MEDIUM5.1 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78659 | MEDIUM5.1 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-94440 | MEDIUM5.1 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-102633 | MEDIUM5.02 | libexpat 2.8.5-r0 fixed in 2.9.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | MEDIUM5.02 | pcre2 10.46-r0 fixed in 10.46-r1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-97032 | MEDIUM5.02 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-97032 | MEDIUM5.02 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-114437 | MEDIUM4.8 | github.com/go-chi/chi/v5 v5.3.2 fixed in 5.4.0 | — | Directly Exposed |
| CVE-2026-40930 | MEDIUM4.59 | libpng 1.6.57-r0 fixed in 1.6.59-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-78663 | MEDIUM4.5 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78663 | MEDIUM4.5 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2025-13034 | LOW3.47 | curl 8.14.1-r3 fixed in 8.14.1-r4 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-14819 | LOW3.47 | curl 8.14.1-r3 fixed in 8.14.1-r4 | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2025-13034 | LOW3.47 | libcurl 8.14.1-r3 fixed in 8.14.1-r4 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-14819 | LOW3.47 | libcurl 8.14.1-r3 fixed in 8.14.1-r4 | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2026-3784 | LOW3.31 | curl 8.14.1-r3 fixed in 8.14.1-r4 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-6429 | LOW3.31 | curl 8.14.1-r3 fixed in 8.14.1-r4 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-8924 | LOW3.31 | curl 8.14.1-r3 fixed in 8.14.1-r4 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2025-14524 | LOW3.31 | curl 8.14.1-r3 fixed in 8.14.1-r4 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-3784 | LOW3.31 | libcurl 8.14.1-r3 fixed in 8.14.1-r4 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-6429 | LOW3.31 | libcurl 8.14.1-r3 fixed in 8.14.1-r4 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-8924 | LOW3.31 | libcurl 8.14.1-r3 fixed in 8.14.1-r4 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2025-14524 | LOW3.31 | libcurl 8.14.1-r3 fixed in 8.14.1-r4 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-3805 | LOW3.21 | curl 8.14.1-r3 fixed in 8.14.1-r4 | 1.0% Theoretical Threat | Post-Exploit |
| CVE-2026-3805 | LOW3.21 | libcurl 8.14.1-r3 fixed in 8.14.1-r4 | 1.0% Theoretical Threat | Post-Exploit |
| CVE-2026-3783 | LOW2.91 | curl 8.14.1-r3 fixed in 8.14.1-r4 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-3783 | LOW2.91 | libcurl 8.14.1-r3 fixed in 8.14.1-r4 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-89162 | LOW2.8 | pcre2 10.46-r0 fixed in 10.46-r1 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-56857 | LOW2.8 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-4873 | LOW2.7 | curl 8.14.1-r3 fixed in 8.14.1-r4 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-6253 | LOW2.7 | curl 8.14.1-r3 fixed in 8.14.1-r4 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-7168 | LOW2.7 | curl 8.14.1-r3 fixed in 8.14.1-r4 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-4873 | LOW2.7 | libcurl 8.14.1-r3 fixed in 8.14.1-r4 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-6253 | LOW2.7 | libcurl 8.14.1-r3 fixed in 8.14.1-r4 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-7168 | LOW2.7 | libcurl 8.14.1-r3 fixed in 8.14.1-r4 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-77214 | LOW2.51 | libexpat 2.8.5-r0 fixed in 2.9.0-r0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-86145 | LOW2.51 | pcre2 10.46-r0 fixed in 10.46-r1 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-8286 | LOW2.48 | curl 8.14.1-r3 fixed in 8.14.1-r4 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-92392 | LOW2.48 | curl 8.14.1-r3 fixed in 8.14.1-r4 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-8286 | LOW2.48 | libcurl 8.14.1-r3 fixed in 8.14.1-r4 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-92392 | LOW2.48 | libcurl 8.14.1-r3 fixed in 8.14.1-r4 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-89161 | LOW2.39 | pcre2 10.46-r0 fixed in 10.46-r1 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-103111 | LOW2.33 | pcre2 10.46-r0 fixed in 10.46-r1 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-5773 | LOW2.29 | curl 8.14.1-r3 fixed in 8.14.1-r4 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-6276 | LOW2.29 | curl 8.14.1-r3 fixed in 8.14.1-r4 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-8927 | LOW2.29 | curl 8.14.1-r3 fixed in 8.14.1-r4 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-5773 | LOW2.29 | libcurl 8.14.1-r3 fixed in 8.14.1-r4 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-6276 | LOW2.29 | libcurl 8.14.1-r3 fixed in 8.14.1-r4 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-8927 | LOW2.29 | libcurl 8.14.1-r3 fixed in 8.14.1-r4 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-78660 | LOW2.29 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-97031 | LOW2.29 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-78660 | LOW2.29 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-89157 | LOW2.26 | pcre2 10.46-r0 fixed in 10.46-r1 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-46675 | LOW2.12 | libpng 1.6.57-r0 fixed in 1.6.59-r0 | — | Post-Exploit |
| CVE-2026-89158 | LOW1.99 | pcre2 10.46-r0 fixed in 10.46-r1 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-89160 | LOW1.99 | pcre2 10.46-r0 fixed in 10.46-r1 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-56866 | LOW1.99 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-94439 | LOW1.99 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-1965_1 | NONE0 | curl 8.14.1-r3 fixed in 8.14.1-r4 | — | Not Applicable |
| CVE-2026-1965_2 | NONE0 | curl 8.14.1-r3 fixed in 8.14.1-r4 | — | Not Applicable |
| CVE-2026-1965_1 | NONE0 | libcurl 8.14.1-r3 fixed in 8.14.1-r4 | — | Not Applicable |
| CVE-2026-1965_2 | NONE0 | libcurl 8.14.1-r3 fixed in 8.14.1-r4 | — | Not Applicable |
| CVE-2026-107891 | NONE0 | musl 1.2.5-r12 fixed in 1.2.5-r13 | — | Not Applicable |
| CVE-2026-107891 | NONE0 | musl-utils 1.2.5-r12 fixed in 1.2.5-r13 | — | Not Applicable |
| CVE-2026-85091 | NONE0 | zlib 1.3.2-r0 fixed in 1.3.2-r1 | 0.4% Theoretical Threat | Not Applicable |
| GO-2026-5932 | NONE0 | golang.org/x/crypto v0.57.0 No fix yet | — | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.