Vulnerability Reporteclipse-temurin:21.0.12_8-jre-alpine-3.24

eclipse-temurin:21.0.12_8-jre-alpine-3.24

digestsha256:974b08960c5d96694c780e65b2d5705268ab1e1ca1a0dd0caf4ba6c3fe34d699

Executive Summary

Last scanned: Sep 12, 2026

Threat ScoreSAFE• Trusted foundation: Docker Official publisher with a 100 trust score and immutable digest pin.• Pre-calculated threat score is 0, placing this image in the SAFE band.• Scan shows 4 exposed-surface entries, but the maximum severity among them is 0.0 — nothing high or critical to inherit.• 30 post-exploit-only entries exist, yet none reach severity 6.0 (max 2.7), so they carry no material inherited risk.• No top exposed-surface or post-exploit findings were flagged, so there are no CVE-specific blockers to call out.

0/100SAFE

ReputationOFFICIAL• Official Docker Hub Image• Pinned by digest (Immutable)

TRUSTED

This base/runtime image is a clean foundation for building production images. It is published by Docker Official and pinned by digest, so images built on it inherit a trusted, reproducible Eclipse Temurin runtime. The scan does report 4 exposed-surface entries and 30 post-exploit-only entries, but the exposed entries top out at severity 0.0 and the post-exploit entries at 2.7 with none reaching the 6.0 mark, so there is no high or critical inherited risk to remediate. No top findings were flagged for this image, so nothing here changes the build-on-it guidance; keep the digest pin and apply your normal layer hardening on top. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.

Relevant for eclipse-temurin:21.0.12_8-jre-alpine-3.24

How to fix CVEs in runtime Docker images

Only a handful of these findings are real. Five steps that cut the count — and VEX for the rest.

Read the article

Vulnerabilities

Vulnerability Log

34 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-18798	LOW2.7	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.5% Low-Moderate Risk	Post-Exploit
CVE-2026-63076	LOW2.7	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.3% Low-Moderate Risk	Post-Exploit
CVE-2026-18798	LOW2.7	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.5% Low-Moderate Risk	Post-Exploit
CVE-2026-63076	LOW2.7	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.3% Low-Moderate Risk	Post-Exploit
CVE-2026-18798	LOW2.7	openssl 3.5.7-r0 fixed in 3.5.8-r0	1.5% Low-Moderate Risk	Post-Exploit
CVE-2026-63076	LOW2.7	openssl 3.5.7-r0 fixed in 3.5.8-r0	1.3% Low-Moderate Risk	Post-Exploit
CVE-2026-76957	LOW2.39	libexpat 2.8.3-r0 fixed in 2.8.4-r0	0.1% Theoretical Threat	Post-Exploit
CVE-2026-14456	LOW2.29	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-63072	LOW2.29	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-14457	LOW2.29	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.0% Theoretical Threat	Post-Exploit
CVE-2026-54874	LOW2.29	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-63074	LOW2.29	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-63075	LOW2.29	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-76956	LOW2.29	libexpat 2.8.3-r0 fixed in 2.8.4-r0	0.3% Theoretical Threat	Post-Exploit
CVE-2026-14456	LOW2.29	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-63072	LOW2.29	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-14457	LOW2.29	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.0% Theoretical Threat	Post-Exploit
CVE-2026-54874	LOW2.29	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-63074	LOW2.29	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-63075	LOW2.29	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-14456	LOW2.29	openssl 3.5.7-r0 fixed in 3.5.8-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-63072	LOW2.29	openssl 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-14457	LOW2.29	openssl 3.5.7-r0 fixed in 3.5.8-r0	1.0% Theoretical Threat	Post-Exploit
CVE-2026-54874	LOW2.29	openssl 3.5.7-r0 fixed in 3.5.8-r0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-63074	LOW2.29	openssl 3.5.7-r0 fixed in 3.5.8-r0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-63075	LOW2.29	openssl 3.5.7-r0 fixed in 3.5.8-r0	0.5% Theoretical Threat	Post-Exploit
CVE-2026-63073	LOW1.81	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.9% Theoretical Threat	Post-Exploit
CVE-2026-63073	LOW1.81	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.9% Theoretical Threat	Post-Exploit
CVE-2026-63073	LOW1.81	openssl 3.5.7-r0 fixed in 3.5.8-r0	0.9% Theoretical Threat	Post-Exploit
CVE-2026-75803	NONE0	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.2% Theoretical Threat	Not Applicable
CVE-2026-66046	NONE0	libexpat 2.8.3-r0 fixed in 2.8.4-r0	0.6% Theoretical Threat	Not Applicable
CVE-2026-76641	NONE0	libexpat 2.8.3-r0 fixed in 2.8.4-r0	0.4% Theoretical Threat	Not Applicable
CVE-2026-75803	NONE0	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.2% Theoretical Threat	Not Applicable
CVE-2026-75803	NONE0	openssl 3.5.7-r0 fixed in 3.5.8-r0	0.2% Theoretical Threat	Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.