Vulnerability Reportkindest/node:v1.37.0

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. The most impactful findings are OpenSSL denial-of-service flaws such as CVE-2026-18798, where a malformed QUIC initial packet triggers a double free and heap corruption that typically terminates the process, and systemd-homed issues such as CVE-2026-16742, which can let a locally logged-in user escalate privileges by adding themselves to arbitrary system groups. In practice an attacker able to reach an exposed TLS/QUIC or CMP endpoint could repeatedly crash the service, while anyone with local shell access to a container running homed-managed accounts could gain elevated rights inside that container. Note that the CMP and QUIC issues only apply if those features are enabled in the applications built on top, the RPK issue requires a key-only raw-public-key configuration, and the privilege escalation requires systemd-homed managed users, so disabling the QUIC listener in your downstream image fully eliminates the double-free exposure. The 209 post-exploit findings are all below severity 6.0 and represent no practical escalation path on their own; prioritise patching the OpenSSL and systemd packages in your derived image rather than avoiding this base. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.