Vulnerability Reporteclipse-temurin:21-jdk-alpine

This base/runtime image is a reasonable foundation, but it ships vulnerabilities worth remediating in the images built on top of it. The one finding, CVE-2026-111497, is a Brotli decoder out-of-bounds write with a severity of 6.0 that is listed as known exploited. Note: CVE-2026-111497 only applies if an application built on this image decodes untrusted Brotli-compressed data, which jshell does not do by default. Images inheriting this base should confirm that no component decodes attacker-supplied Brotli streams, and should update the brotli-libs package in their final image when a fix is available. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.