Vulnerability Reporteclipse-temurin:25.0.4.1_1-jre-noble

eclipse-temurin:25.0.4.1_1-jre-nobleeclipse-temurin:25-jre-noble

digestsha256:3f2223fe04b750aa5a8179e29b5c9a1ddf7665fc9bb08bfe11ad01d143bc13a5

Executive Summary

Last scanned: Oct 20, 2026

Threat ScoreSAFE• Official Docker Hub image from Docker Official publisher, pinned by digest, with trust score 100/100.• Pre-calculated threat score is 0, placing it in the SAFE band (0-24).• Stats show 11 exposed findings and 14 post-exploit findings, but exposed_count_ge6 is 0 and exposed_max_severity is 4.67.• Post-exploit findings are also low severity: post_count_ge6 is 0 and post_max_severity is 2.8.• No CVE IDs are listed in the provided top exposed or post-exploit findings, so no specific CVE can be cited.• This is a general-purpose base/runtime image; inherited risk from the reported low-severity findings is limited.

0/100SAFE

ReputationOFFICIAL• Official Docker Hub Image• Pinned by digest (Immutable)

TRUSTED

This base/runtime image is a clean foundation for building production images. The provided stats do show 11 exposed and 14 post-exploit findings, but none are at or above severity 6.0, and the maximum severities are 4.67 and 2.8 respectively, so they do not raise the verdict. No specific CVE IDs are present in the top findings, so there are no named CVEs to remediate from this input. Images built on it should still follow normal patching and rebuild cadence. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.

Relevant for eclipse-temurin:25.0.4.1_1-jre-noble

How to fix CVEs in runtime Docker images

Only a handful of these findings are real. Five steps that cut the count — and VEX for the rest.

Read the article

Vulnerabilities

Vulnerability Log

28 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2025-66382	MEDIUM4.67	libexpat1 2.6.1-2ubuntu0.6 No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2026-18374	MEDIUM4.17	libc-bin 2.39-0ubuntu8.9 No fix yet	0.1% Theoretical Threat	Directly Exposed
CVE-2026-18374	MEDIUM4.17	libc6 2.39-0ubuntu8.9 No fix yet	0.1% Theoretical Threat	Directly Exposed
CVE-2026-89092	LOW3.57	libc-bin 2.39-0ubuntu8.9 No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2026-89092	LOW3.57	libc6 2.39-0ubuntu8.9 No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2026-102473	LOW2.8	dash 0.5.12-6ubuntu5 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-40228	LOW2.8	libsystemd0 255.4-1ubuntu8.17 No fix yet	0.1% Theoretical Threat	Directly Exposed
CVE-2026-40228	LOW2.8	libudev1 255.4-1ubuntu8.17 No fix yet	0.1% Theoretical Threat	Directly Exposed
CVE-2026-86145	LOW2.51	libpcre2-8-0 10.42-4ubuntu2.1 No fix yet	0.4% Theoretical Threat	Post-Exploit
CVE-2026-89161	LOW2.39	libpcre2-8-0 10.42-4ubuntu2.1 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-103111	LOW2.33	libpcre2-8-0 10.42-4ubuntu2.1 No fix yet	0.2% Theoretical Threat	Post-Exploit
CVE-2026-88647	LOW2.26	libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet	0.2% Theoretical Threat	Post-Exploit
CVE-2026-89157	LOW2.26	libpcre2-8-0 10.42-4ubuntu2.1 No fix yet	0.3% Theoretical Threat	Post-Exploit
CVE-2026-18477	LOW2.24	tar 1.35+dfsg-3ubuntu0.4 No fix yet	<0.1% Theoretical Threat	Post-Exploit
CVE-2026-18508	LOW2.24	tar 1.35+dfsg-3ubuntu0.4 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-102474	LOW2.04	dash 0.5.12-6ubuntu5 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-89158	LOW1.99	libpcre2-8-0 10.42-4ubuntu2.1 No fix yet	0.2% Theoretical Threat	Post-Exploit
CVE-2026-89160	LOW1.99	libpcre2-8-0 10.42-4ubuntu2.1 No fix yet	0.3% Theoretical Threat	Post-Exploit
CVE-2024-56433	LOW1.84	passwd 1:4.13+dfsg1-4ubuntu3.2 No fix yet	0.4% Theoretical Threat	Post-Exploit
CVE-2026-67693	LOW1.81	libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet	0.2% Theoretical Threat	Post-Exploit
CVE-2026-89156	LOW1.81	libpcre2-8-0 10.42-4ubuntu2.1 No fix yet	0.3% Theoretical Threat	Post-Exploit
CVE-2026-18374	NONE0	locales 2.39-0ubuntu8.9 No fix yet	0.1% Theoretical Threat	Not Applicable
CVE-2026-89092	NONE0	locales 2.39-0ubuntu8.9 No fix yet	0.2% Theoretical Threat	Not Applicable
CVE-2024-56433	NONE0	login 1:4.13+dfsg1-4ubuntu3.2 No fix yet	0.4% Theoretical Threat	Not Applicable
CVE-2026-95184	NONE0	libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet	0.2% Theoretical Threat	Not Applicable
CVE-2026-95209	NONE0	libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet	0.2% Theoretical Threat	Not Applicable
CVE-2026-95210	NONE0	libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet	0.2% Theoretical Threat	Not Applicable
CVE-2026-85091	NONE0	zlib1g 1:1.3.dfsg-3.1ubuntu2.2 No fix yet	0.4% Theoretical Threat	Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.