Last scanned:
··This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The most significant findings in the istio.io/istio package, CVE-2022-31045 and CVE-2019-14993, mainly threaten availability by causing the proxy to crash or exhaust resources, and their relevance depends on specific Envoy or Istio configurations. CVE-2021-39155 and CVE-2021-39156 could bypass authorization rules, but only if matching policies are actually in place. The scan found 31 exposed findings, so these issues are real, but none are known to be actively exploited and none reach the main process's OS libraries, which is why they do not push the verdict higher.
Hardening plan for this image · 3 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2022-31045 | HIGH7.84 | istio.io/istio v0.0.0-20261107013529-19cc19624069 fixed in 1.12.18, 1.13.5, 1.14.1 | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2019-14993 | MEDIUM6 | istio.io/istio v0.0.0-20261107013529-19cc19624069 fixed in 1.1.13, 1.2.4 | 2.3% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2021-39155 | MEDIUM6 | istio.io/istio v0.0.0-20261107013529-19cc19624069 fixed in 1.9.8, 1.10.4, 1.11.1 | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2021-39156 | MEDIUM6 | istio.io/istio v0.0.0-20261107013529-19cc19624069 fixed in 1.9.8, 1.10.4, 1.11.1 | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-18374 | MEDIUM4.9 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc6 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2022-23635 | MEDIUM4.5 | istio.io/istio v0.0.0-20261107013529-19cc19624069 fixed in 1.13.1, 1.12.4, 1.11.7 | 1.7% Low-Moderate Risk | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc6 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-88647 | MEDIUM4.14 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-88648 | MEDIUM4.14 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-103111 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.2 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-86145 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89157 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.2 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89161 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.2 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-107161 | MEDIUM4.14 | libsasl2-2 2.1.28+dfsg1-5ubuntu3.1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-107161 | MEDIUM4.14 | libsasl2-modules-db 2.1.28+dfsg1-5ubuntu3.1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-22185 | MEDIUM4.08 | liblmdb0 0.9.31-1build1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| GO-2026-5932 | MEDIUM4 | golang.org/x/crypto v0.58.0 No fix yet | — | Directly Exposed |
| CVE-2026-89158 | LOW3.9 | libpcre2-8-0 10.42-4ubuntu2.2 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89160 | LOW3.9 | libpcre2-8-0 10.42-4ubuntu2.2 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-67693 | LOW3.54 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | LOW3.54 | libpcre2-8-0 10.42-4ubuntu2.2 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2025-29481 | LOW3.31 | libbpf1 1:1.3.0-2build2 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-1352 | LOW3.31 | libelf1t64 0.190-1.1ubuntu0.1 No fix yet | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2025-1376 | LOW3.31 | libelf1t64 0.190-1.1ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-102473 | LOW3.3 | dash 0.5.12-6ubuntu5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-40228 | LOW3.3 | libsystemd0 255.4-1ubuntu8.18 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-40228 | LOW3.3 | libudev1 255.4-1ubuntu8.18 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95184 | LOW3.18 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95209 | LOW3 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | — | Directly Exposed |
| CVE-2026-95210 | LOW3 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-18477 | LOW2.64 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-18508 | LOW2.64 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-102474 | LOW2.4 | dash 0.5.12-6ubuntu5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | login 1:4.13+dfsg1-4ubuntu3.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | passwd 1:4.13+dfsg1-4ubuntu3.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
Want to check another image? Run a full scan with the Docker Security Scanner.