Vulnerability Reportfluent/fluent-bit:5.1.0-debug

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker could cause denial-of-service against BIND's DNS-over-HTTPS service if it is enabled, or potentially trigger uncontrolled recursion in glibc regex handling via crafted input, though this container starts Fluent Bit rather than BIND named. The image has 1050 exposed findings and 718 post-exploit-only findings, but the maximum exposed severity is 7.5 and post-exploit findings are below 6.0, so the risk is significant rather than critical. If BIND/named is not required, removing or not exposing bind9-libs would fully eliminate CVE-2026-77692; CVE-2018-20796 only matters if crafted regex input reaches affected glibc routines. Overall, pin the digest, restrict network access, and remediate the exposed packages at severity 7 or higher before production use.