Vulnerability Reportgolang:1.25.14

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. An attacker could trigger a QUIC server denial of service via CVE-2026-18798 or, in a systemd-homed environment, use CVE-2026-16742 to gain elevated local privileges. These OpenSSL QUIC/CMP/RPK issues only apply when those features are enabled, and disabling them fully eliminates the associated OpenSSL risks. Although the image has 689 exposed findings and 173 at severity 6.0 or above, the post-exploit set has no findings at 6.0 or above, so the primary inherited risk is the exposed vulnerability surface. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.