Last scanned:
This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker who sends a crafted Brotli-compressed stream could corrupt memory and possibly execute code on the Jetty server handling port 8080 (CVE-2026-111497). Note: CVE-2026-111497 only applies if a component in this image decodes Brotli-compressed input with the native library, which is not enabled by default. Not enabling any component that decodes Brotli input would fully eliminate this exposure. The other 14 exposed-surface findings and 4 post-exploit-only findings are acknowledged, but they do not drive this verdict.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-111497 | HIGH7.45 | libbrotli 1.1.0-1.amzn2023.0.1 fixed in 1.1.0-1.amzn2023.0.2 | 36.0% High Exploitation Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-86145 | MEDIUM4.92 | pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-86145 | MEDIUM4.92 | pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-103111 | MEDIUM4.56 | pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-103111 | MEDIUM4.56 | pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-107161 | MEDIUM4.5 | cyrus-sasl-lib 2.1.27-18.amzn2023.0.3 fixed in 2.1.27-18.amzn2023.0.4 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-78659 | MEDIUM4.5 | libcap 2.73-1.amzn2023.0.7 fixed in 2.73-1.amzn2023.0.8 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78667 | MEDIUM4.5 | libcap 2.73-1.amzn2023.0.7 fixed in 2.73-1.amzn2023.0.8 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-94440 | MEDIUM4.5 | libcap 2.73-1.amzn2023.0.7 fixed in 2.73-1.amzn2023.0.8 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-94286 | MEDIUM4.26 | libXtst 1.2.5-1.amzn2023.0.1 fixed in 1.2.5-1.amzn2023.0.2 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-113470 | MEDIUM4.14 | ca-certificates 2025.2.76-1.0.amzn2023.0.3 fixed in 2025.2.76-1.0.amzn2023.0.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89160 | LOW3.9 | pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89160 | LOW3.9 | pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | LOW3.54 | pcre2 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | LOW3.54 | pcre2-syntax 10.40-1.amzn2023.0.4 fixed in 10.40-1.amzn2023.0.5 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-92392 | LOW2.92 | curl-minimal 8.21.0-5.amzn2023.0.2 fixed in 8.21.0-5.amzn2023.0.3 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-92392 | LOW2.92 | libcurl-minimal 8.21.0-5.amzn2023.0.2 fixed in 8.21.0-5.amzn2023.0.3 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-19553 | LOW2.66 | python3 3.9.25-1.amzn2023.0.9 fixed in 3.9.25-1.amzn2023.0.11 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-19553 | LOW2.66 | python3-libs 3.9.25-1.amzn2023.0.9 fixed in 3.9.25-1.amzn2023.0.11 | 0.5% Theoretical Threat | Post-Exploit |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.