Last scanned:
This image is safe for production use. The provided vulnerability stats show one exposed finding and one post-exploit-only finding, but the exposed max severity is 0.0 and no exposed finding reaches severity 6.0, while the post-exploit max severity is only 2.33. No top exposed-surface or post-exploit findings, and therefore no CVE IDs, were listed in the inputs, so there is no high-impact exploit path to act on. The official HAProxy image is pinned by digest and trusted, which supports its use in production. No specific compensating control is required by the available findings.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-103111 | LOW2.33 | pcre2 10.48-r0 fixed in 10.49-r0 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-85091 | NONE0 | zlib 1.3.2-r0 fixed in 1.3.2-r1 | 0.4% Theoretical Threat | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.