Last scanned:
··This tag now points to a newer build; the report below is for the previous build until the new one is scanned.
This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. It has exposed_total 20, including 3 findings at or above the 6 severity threshold, but none at or above the 7 threshold and the maximum exposed severity is 6.38. The most relevant issues, CVE-2026-78669 and CVE-2026-78667, can let a remote peer consume CPU and degrade availability on Jaeger's HTTP/2/gRPC or file-serving endpoints. Post-exploit-only findings total 3 and max out at 1.99. No special configuration is required for these findings, so exposure depends on whether those endpoints are reachable. Restricting Jaeger's HTTP/2/gRPC and UI/API endpoints to trusted networks would fully eliminate the remote DoS paths for untrusted peers.
Hardening plan for this image · 3 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-78669 | MEDIUM6.38 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-78667 | MEDIUM6.38 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-78669 | MEDIUM6.38 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-111943 | MEDIUM5.44 | stdlib v1.27.1 fixed in 1.26.10, 1.27.3 | — | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97031 | MEDIUM5.1 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97032 | MEDIUM5.02 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-97032 | MEDIUM5.02 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-78663 | LOW3.6 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78663 | LOW3.6 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-94439 | LOW3.31 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-94448 | LOW3.11 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-56857 | LOW2.8 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-56866 | LOW1.99 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-56855 | LOW1.62 | golang.org/x/crypto v0.55.0 fixed in 0.56.0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-78662 | LOW1.62 | golang.org/x/crypto v0.55.0 fixed in 0.56.0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-85091 | NONE0 | zlib 1.3.2-r0 fixed in 1.3.2-r1 | 0.4% Theoretical Threat | Not Applicable |
| GO-2026-5932 | NONE0 | golang.org/x/crypto v0.55.0 No fix yet | — | Not Applicable |
| CVE-2026-78659 | NONE0 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Not Applicable |
| CVE-2026-78660 | NONE0 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-78659 | NONE0 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Not Applicable |
| CVE-2026-78660 | NONE0 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-94440 | NONE0 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-97030 | NONE0 | stdlib v1.27.1 fixed in 1.26.9, 1.27.2 | 0.2% Theoretical Threat | Not Applicable |
Want to check another image? Run a full scan with the Docker Security Scanner.