Last scanned:
··This image carries significant risk; production deployment is highly discouraged without strict compensating controls. The main exposure is denial-of-service: a remote client reaching the gRPC, Thrift-over-HTTP, or HTTP/2 listeners could exhaust CPU or memory and interrupt trace collection or crash the Jaeger process. Several of the top findings, such as GHSA-HRXH-6V49-42GF, are reachable in default operation, and the xDS-related parts of that advisory only apply when xDS policies are used, which Jaeger does not normally do. No single compensating control in the provided data fully removes these risks, so rate limiting and network isolation of the collector ports should be planned alongside a rebuild against patched library versions.
Hardening plan for this image · 5 steps. The first cuts risk from 66 to 0.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| GHSA-hrxh-6v49-42gf | HIGH8.8 | google.golang.org/grpc v1.81.0 fixed in 1.82.1 | — | Directly ExposedContext importance: HIGH |
| CVE-2026-43871 | HIGH7.5 | github.com/apache/thrift v0.23.1-0.20260429145742-d2acd3c49e58 fixed in 0.24.0 | 1.0% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2026-84304 | HIGH7.5 | google.golang.org/grpc v1.81.0 fixed in 1.83.1 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-56859 | HIGH7.5 | stdlib v1.26.3 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-78669 | HIGH7.5 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-78659 | HIGH7.5 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-56858 | MEDIUM6.48 | stdlib v1.26.3 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42768 | MEDIUM6.3 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-42768 | MEDIUM6.3 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-84303 | MEDIUM6.3 | google.golang.org/grpc v1.81.0 fixed in 1.83.1 | 0.3% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-94448 | MEDIUM6.1 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-97030 | MEDIUM6.1 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-33818 | MEDIUM6 | stdlib v1.26.3 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56853 | MEDIUM6 | stdlib v1.26.3 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56860 | MEDIUM6 | stdlib v1.26.3 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56862 | MEDIUM6 | stdlib v1.26.3 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78667 | MEDIUM6 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97031 | MEDIUM6 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-94440 | MEDIUM6 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42764 | MEDIUM5.9 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42769 | MEDIUM5.9 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-42770 | MEDIUM5.9 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-63073 | MEDIUM5.9 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-9076 | MEDIUM5.9 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-42764 | MEDIUM5.9 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42769 | MEDIUM5.9 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-42770 | MEDIUM5.9 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-63073 | MEDIUM5.9 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-9076 | MEDIUM5.9 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-97032 | MEDIUM5.9 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-7383 | MEDIUM5.5 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-7383 | MEDIUM5.5 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-45445 | MEDIUM5.46 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-45445 | MEDIUM5.46 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-42766 | MEDIUM5.3 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42767 | MEDIUM5.3 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42766 | MEDIUM5.3 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42767 | MEDIUM5.3 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42505 | MEDIUM5.3 | stdlib v1.26.3 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42507 | MEDIUM5.3 | stdlib v1.26.3 fixed in 1.25.11, 1.26.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-78663 | MEDIUM5.3 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-39828 | MEDIUM5.28 | golang.org/x/crypto v0.50.0 fixed in 0.52.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-39832 | MEDIUM5.22 | golang.org/x/crypto v0.50.0 fixed in 0.52.0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-34180 | MEDIUM5 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-34180 | MEDIUM5 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-85091 | MEDIUM5 | zlib 1.3.2-r0 fixed in 1.3.2-r1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-39821 | MEDIUM4.92 | golang.org/x/net v0.53.0 fixed in 0.55.0 | 1.8% Low-Moderate Risk | Directly Exposed |
| CVE-2026-39821 | MEDIUM4.92 | stdlib v1.26.3 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 1.8% Low-Moderate Risk | Directly Exposed |
| CVE-2026-45447 | MEDIUM4.86 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 4.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-45447 | MEDIUM4.86 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 4.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-39831 | MEDIUM4.86 | golang.org/x/crypto v0.50.0 fixed in 0.52.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-25681 | MEDIUM4.86 | golang.org/x/net v0.53.0 fixed in 0.55.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-27136 | MEDIUM4.86 | golang.org/x/net v0.53.0 fixed in 0.55.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-39822 | MEDIUM4.68 | stdlib v1.26.3 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-14456 | MEDIUM4.5 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-18798 | MEDIUM4.5 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 1.7% Low-Moderate Risk | Directly Exposed |
| CVE-2026-34183 | MEDIUM4.5 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63072 | MEDIUM4.5 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-63076 | MEDIUM4.5 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-14457 | MEDIUM4.5 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-54874 | MEDIUM4.5 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63074 | MEDIUM4.5 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63075 | MEDIUM4.5 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-14456 | MEDIUM4.5 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-18798 | MEDIUM4.5 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 1.7% Low-Moderate Risk | Directly Exposed |
| CVE-2026-34183 | MEDIUM4.5 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63072 | MEDIUM4.5 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-63076 | MEDIUM4.5 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-14457 | MEDIUM4.5 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-54874 | MEDIUM4.5 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63074 | MEDIUM4.5 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63075 | MEDIUM4.5 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63209 | MEDIUM4.5 | github.com/klauspost/compress v1.18.6 fixed in 1.18.7 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-39829 | MEDIUM4.5 | golang.org/x/crypto v0.50.0 fixed in 0.52.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-39830 | MEDIUM4.5 | golang.org/x/crypto v0.50.0 fixed in 0.52.0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-39835 | MEDIUM4.5 | golang.org/x/crypto v0.50.0 fixed in 0.52.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-46597 | MEDIUM4.5 | golang.org/x/crypto v0.50.0 fixed in 0.52.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-46600 | MEDIUM4.5 | golang.org/x/net v0.53.0 fixed in 0.56.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-78669 | MEDIUM4.5 | golang.org/x/net v0.53.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78659 | MEDIUM4.5 | golang.org/x/net v0.53.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78660 | MEDIUM4.5 | golang.org/x/net v0.53.0 fixed in 0.60.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-56851 | MEDIUM4.5 | golang.org/x/text v0.36.0 fixed in 0.41.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-56852 | MEDIUM4.5 | golang.org/x/text v0.36.0 fixed in 0.39.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-84445 | MEDIUM4.5 | google.golang.org/grpc v1.81.0 fixed in 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78660 | MEDIUM4.5 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-34182 | MEDIUM4.44 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-34182 | MEDIUM4.44 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42508 | MEDIUM4.44 | golang.org/x/crypto v0.50.0 fixed in 0.52.0 | 6.9% Low-Moderate Risk | Directly Exposed |
| CVE-2026-46595 | MEDIUM4.26 | golang.org/x/crypto v0.50.0 fixed in 0.52.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-56854 | MEDIUM4.08 | golang.org/x/crypto v0.50.0 fixed in 0.55.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-111943 | MEDIUM4.08 | stdlib v1.26.3 fixed in 1.26.10, 1.27.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl 1.2.5-r23 fixed in 1.2.5-r24 | — | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl-utils 1.2.5-r23 fixed in 1.2.5-r24 | — | Directly Exposed |
| CVE-2026-81871 | LOW3.9 | go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 fixed in 0.21.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-39827 | LOW3.9 | golang.org/x/crypto v0.50.0 fixed in 0.52.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-39834 | LOW3.9 | golang.org/x/crypto v0.50.0 fixed in 0.52.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-25680 | LOW3.9 | golang.org/x/net v0.53.0 fixed in 0.55.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-56866 | LOW3.9 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-94439 | LOW3.9 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-34181 | LOW3.78 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-34181 | LOW3.78 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-45446 | LOW3.7 | libcrypto3 3.5.6-r0 fixed in 3.5.7-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.7 | libcrypto3 3.5.6-r0 fixed in 3.5.8-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-45446 | LOW3.7 | libssl3 3.5.6-r0 fixed in 3.5.7-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.7 | libssl3 3.5.6-r0 fixed in 3.5.8-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-42502 | LOW3.66 | golang.org/x/net v0.53.0 fixed in 0.55.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-97032 | LOW3.54 | golang.org/x/net v0.53.0 fixed in 0.60.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-39833 | LOW3.3 | golang.org/x/crypto v0.50.0 fixed in 0.52.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-81870 | LOW3.3 | go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 fixed in 1.45.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-81870 | LOW3.3 | go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 fixed in 1.45.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-81870 | LOW3.3 | go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 fixed in 1.45.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-81870 | LOW3.3 | go.opentelemetry.io/otel/sdk v1.43.0 fixed in 1.45.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-56857 | LOW3.3 | stdlib v1.26.3 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42506 | LOW3.24 | golang.org/x/net v0.53.0 fixed in 0.55.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-81872 | LOW3.18 | go.opentelemetry.io/otel/sdk/log v0.19.0 fixed in 0.21.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-46598 | LOW3.18 | golang.org/x/crypto v0.50.0 fixed in 0.52.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-56855 | LOW3.18 | golang.org/x/crypto v0.50.0 fixed in 0.56.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-78662 | LOW3.18 | golang.org/x/crypto v0.50.0 fixed in 0.56.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-78663 | LOW3.18 | golang.org/x/net v0.53.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-27145 | LOW2.7 | stdlib v1.26.3 fixed in 1.25.11, 1.26.4 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-42504 | LOW2.7 | stdlib v1.26.3 fixed in 1.25.11, 1.26.4 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-46600 | LOW2.7 | stdlib v1.26.3 fixed in 1.26.6, 1.27.0-rc.3 | 0.5% Theoretical Threat | Post-Exploit |
| GO-2026-5932 | LOW2.4 | golang.org/x/crypto v0.50.0 No fix yet | — | Directly Exposed |
Want to check another image? Run a full scan with the Docker Security Scanner.