Vulnerability Reporteclipse-temurin:17.0.19_10-jdk-ubi9-minimal

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. The main concern is CVE-2026-111497 in the libbrotli package, which is actively exploited in the wild and could let an attacker run code or read memory in any process that decodes untrusted Brotli data. The exposure is conditional: the default startup command does not decode Brotli, so images that add a Brotli-decoding component and feed it outside input carry the real risk. The scan also found many other exposed and post-compromise findings, but they are lower severity and do not change the verdict. Because this image runs as root by default, any inherited flaw that is exploited would have broader reach, so the final image should be rebuilt against a patched libbrotli before it goes to production. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.