Last scanned:
··This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The scan found 55 vulnerabilities in total, and the four most relevant ones carry a severity of 6.0 with none known to be actively exploited. The most significant is CVE-2026-33487, an authentication bypass that only matters if SAML single sign-on is enabled, so leaving that feature off removes this path. The remaining findings are denial-of-service issues that depend on specific features or direct HTTP/2 exposure, and they are unlikely to compromise data but could slow or stall the service under abuse. Updating the affected Go dependencies in the next image build would address these findings.
Hardening plan for this image · 5 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-33487 | MEDIUM6 | github.com/russellhaering/goxmldsig v1.5.0 fixed in 1.6.0 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-46603 | MEDIUM6 | golang.org/x/image v0.44.0 fixed in 0.45.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78669 | MEDIUM6 | golang.org/x/net v0.56.0 fixed in 0.60.0 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78659 | MEDIUM6 | golang.org/x/net v0.56.0 fixed in 0.60.0 | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-5435 | MEDIUM5.9 | libc6 2.36-9+deb12u14 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-6791 | MEDIUM5.9 | libc6 2.36-9+deb12u14 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-77117 | MEDIUM5.9 | libc6 2.36-9+deb12u14 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-80489 | MEDIUM5.9 | libc6 2.36-9+deb12u14 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-54872 | MEDIUM5.9 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75805 | MEDIUM5.9 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-77696 | MEDIUM5.9 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-6368 | MEDIUM5.5 | libc6 2.36-9+deb12u14 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-33186 | MEDIUM5.46 | google.golang.org/grpc v1.72.0 fixed in 1.79.3 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-8674 | MEDIUM5.3 | libc6 2.36-9+deb12u14 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-75806 | MEDIUM5.3 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u2 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42767 | MEDIUM5.3 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-56865 | MEDIUM5.28 | golang.org/x/mod v0.37.0 fixed in 0.40.0 | 0.1% Theoretical Threat | Directly Exposed |
| GHSA-hrxh-6v49-42gf | MEDIUM5.28 | google.golang.org/grpc v1.72.0 fixed in 1.82.1 | — | Directly Exposed |
| CVE-2026-5450 | MEDIUM5 | libc6 2.36-9+deb12u14 No fix yet | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-5928 | MEDIUM5 | libc6 2.36-9+deb12u14 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc6 2.36-9+deb12u14 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-56864 | MEDIUM4.86 | golang.org/x/mod v0.37.0 fixed in 0.40.0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-97032 | MEDIUM4.72 | golang.org/x/net v0.56.0 fixed in 0.60.0 | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-63072 | MEDIUM4.5 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u1 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-63076 | MEDIUM4.5 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u1 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-54874 | MEDIUM4.5 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63074 | MEDIUM4.5 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63209 | MEDIUM4.5 | github.com/klauspost/compress v1.18.0 fixed in 1.18.7 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78660 | MEDIUM4.5 | golang.org/x/net v0.56.0 fixed in 0.60.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-56851 | MEDIUM4.5 | golang.org/x/text v0.40.0 fixed in 0.41.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-84304 | MEDIUM4.5 | google.golang.org/grpc v1.72.0 fixed in 1.83.1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-84445 | MEDIUM4.5 | google.golang.org/grpc v1.72.0 fixed in 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-84782 | MEDIUM4.44 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u2 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-78663 | MEDIUM4.24 | golang.org/x/net v0.56.0 fixed in 0.60.0 | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-86805 | MEDIUM4.2 | libc6 2.36-9+deb12u14 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-19542 | MEDIUM4.2 | libc6 2.36-9+deb12u14 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc6 2.36-9+deb12u14 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-56854 | MEDIUM4.08 | golang.org/x/crypto v0.53.0 fixed in 0.55.0 | 0.4% Theoretical Threat | Directly Exposed |
| DLA-4845-1 | MEDIUM4 | ca-certificates 20250419~deb12u1 fixed in 20250419~deb12u2 | — | Directly Exposed |
| CVE-2010-4756 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 2.6% Low-Moderate Risk | Directly Exposed |
| CVE-2018-20796 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 5.8% Low-Moderate Risk | Directly Exposed |
| CVE-2019-1010022 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 3.2% Low-Moderate Risk | Directly Exposed |
| CVE-2019-1010023 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 3.1% Low-Moderate Risk | Directly Exposed |
| CVE-2019-1010024 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 3.2% Low-Moderate Risk | Directly Exposed |
| CVE-2019-1010025 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 2.5% Low-Moderate Risk | Directly Exposed |
| CVE-2019-9192 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 2.4% Low-Moderate Risk | Directly Exposed |
| CVE-2026-84303 | LOW3.78 | google.golang.org/grpc v1.72.0 fixed in 1.83.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-97399 | LOW3.7 | libc6 2.36-9+deb12u14 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-35189 | LOW3.7 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.7 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-26958 | LOW3.7 | filippo.io/edwards25519 v1.1.0 fixed in 1.1.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-56855 | LOW3.18 | golang.org/x/crypto v0.53.0 fixed in 0.56.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-78662 | LOW3.18 | golang.org/x/crypto v0.53.0 fixed in 0.56.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-95818 | LOW2.52 | libc6 2.36-9+deb12u14 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-19499 | LOW2.45 | libc6 2.36-9+deb12u14 No fix yet | 0.3% Theoretical Threat | Post-Exploit |
| GO-2026-5932 | LOW2.4 | golang.org/x/crypto v0.53.0 No fix yet | — | Directly Exposed |
| CVE-2026-6238 | LOW2.34 | libc6 2.36-9+deb12u14 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2025-27587 | LOW2.12 | libssl3 3.0.20-1~deb12u2 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| DLA-4792-1 | NONE0 | tzdata 2026b-0+deb12u1 fixed in 2026c-0+deb12u1 | — | Not Applicable |
| DLA-4854-1 | NONE0 | tzdata 2026b-0+deb12u1 fixed in 2026e-0+deb12u1 | — | Not Applicable |
Want to check another image? Run a full scan with the Docker Security Scanner.