Vulnerability Reportkarsten13/magicmirror:develop_alpine

karsten13/magicmirror:develop_alpine

digestsha256:ecf13d06e1470fde051b19d6e82fc7f5bf6de4cc41554075f8834b148b21fb0c

Executive Summary

Last scanned: Aug 3, 2026

Threat ScoreNEEDS ATTENTION• Exposed surface includes two medium-severity vulnerabilities: CVE-2026-48779 (WebSocket DoS) and CVE-2026-33630 (c-ares DoS), with a max severity of 6.38.• CVE-2026-48779 is remotely exploitable by any WebSocket peer and can cause memory exhaustion, leading to container crash (denial of service).• CVE-2026-33630 requires a malicious or compromised DNS server and affects outbound DNS resolution; exploitation is less direct but still possible.• Trust is reliable (2M+ pulls, pinned by digest), and no critical (>=7.0) vulnerabilities are present in the top findings.• Total findings are moderate: 17 exposed with 2 at severity >=6.0, and 2 post-exploit findings with max severity 2.29.

25/100NEEDS ATTENTION

ReputationPOPULAR COMMUNITY• High Reputation Community Image (2M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The most significant risk is CVE-2026-48779, which allows a remote WebSocket client to crash the container through memory exhaustion, enabling denial of service. CVE-2026-33630 could also crash the service if a malicious DNS server responds to outbound lookups. No critical-severity vulnerabilities or remote code execution paths were identified, and the image is from a popular trusted publisher, so deployment is reasonable provided the affected ws and c-ares packages are updated promptly.

Hardening plan for this image · 3 steps

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

19 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-48779	MEDIUM6.38	ws 8.20.1 fixed in 5.2.5, 6.2.4, 7.5.11, 8.21.0	0.8% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-33630	MEDIUM6	c-ares 1.34.6-r0 fixed in 1.34.8-r0	—	Directly ExposedContext importance: MEDIUM
CVE-2026-56132	MEDIUM5.87	libexpat 2.7.5-r0 fixed in 2.8.2-r0	0.1% Theoretical Threat	Directly Exposed
CVE-2026-56403	MEDIUM5.87	libexpat 2.7.5-r0 fixed in 2.8.2-r0	0.1% Theoretical Threat	Directly Exposed
CVE-2026-56404	MEDIUM5.87	libexpat 2.7.5-r0 fixed in 2.8.2-r0	0.1% Theoretical Threat	Directly Exposed
CVE-2026-56405	MEDIUM5.87	libexpat 2.7.5-r0 fixed in 2.8.2-r0	0.1% Theoretical Threat	Directly Exposed
CVE-2026-56406	MEDIUM5.87	libexpat 2.7.5-r0 fixed in 2.8.2-r0	0.1% Theoretical Threat	Directly Exposed
CVE-2026-56407	MEDIUM5.87	libexpat 2.7.5-r0 fixed in 2.8.2-r0	0.1% Theoretical Threat	Directly Exposed
CVE-2026-56410	MEDIUM5.87	libexpat 2.7.5-r0 fixed in 2.8.2-r0	0.1% Theoretical Threat	Directly Exposed
CVE-2026-56411	MEDIUM5.87	libexpat 2.7.5-r0 fixed in 2.8.2-r0	0.1% Theoretical Threat	Directly Exposed
CVE-2026-50219	MEDIUM5.02	libexpat 2.7.5-r0 fixed in 2.8.2-r0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-56412	MEDIUM5.02	libexpat 2.7.5-r0 fixed in 2.8.2-r0	0.1% Theoretical Threat	Directly Exposed
CVE-2026-56131	LOW3.82	libexpat 2.7.5-r0 fixed in 2.8.2-r0	0.1% Theoretical Threat	Directly Exposed
CVE-2026-41080	LOW3.15	libexpat 2.7.5-r0 fixed in 2.8.1-r0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-45186	LOW2.29	libexpat 2.7.5-r0 fixed in 2.8.1-r0	0.4% Theoretical Threat	Post-Exploit
CVE-2026-13149	LOW2.29	brace-expansion 5.0.6 fixed in 5.0.7, 1.1.16, 2.1.2	0.3% Theoretical Threat	Post-Exploit
CVE-2026-56408	NONE0	libexpat 2.7.5-r0 fixed in 2.8.2-r0	0.1% Theoretical Threat	Not Applicable
CVE-2026-56409	NONE0	libexpat 2.7.5-r0 fixed in 2.8.2-r0	0.1% Theoretical Threat	Not Applicable
CVE-2026-14257	NONE0	brace-expansion 5.0.6 fixed in 5.0.8, 3.0.3, 2.1.3, 1.1.17	0.3% Theoretical Threat	Not Applicable

Want to check another image? Run a full scan with the Docker Security Scanner.