Last scanned:
··This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The two findings that affect the verdict, CVE-2026-78669 and CVE-2026-78659 in golang.org/x/net, are denial-of-service flaws that could slow or crash Mattermost if a remote client sends crafted HTTP/2 traffic. Both only apply when TLS is enabled on the Mattermost listener, which is not the plain default, so their relevance depends on your configuration. Nothing in the scan is known to be actively exploited, and the remaining exposed findings do not change the verdict.
Hardening plan for this image · 5 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-78669 | MEDIUM6 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78659 | MEDIUM6 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-6368 | MEDIUM5.5 | libc6 2.36-9+deb12u14 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-8674 | MEDIUM5.3 | libc6 2.36-9+deb12u14 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-75806 | MEDIUM5.3 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u2 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42767 | MEDIUM5.3 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-5450 | MEDIUM5 | libc6 2.36-9+deb12u14 No fix yet | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-5928 | MEDIUM5 | libc6 2.36-9+deb12u14 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc6 2.36-9+deb12u14 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-97032 | MEDIUM4.72 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-63072 | MEDIUM4.5 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u1 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-63076 | MEDIUM4.5 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u1 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-54874 | MEDIUM4.5 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63074 | MEDIUM4.5 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78660 | MEDIUM4.5 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-84782 | MEDIUM4.44 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u2 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-78663 | MEDIUM4.24 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-86805 | MEDIUM4.2 | libc6 2.36-9+deb12u14 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-95818 | MEDIUM4.2 | libc6 2.36-9+deb12u14 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-19542 | MEDIUM4.2 | libc6 2.36-9+deb12u14 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc6 2.36-9+deb12u14 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-19499 | MEDIUM4.08 | libc6 2.36-9+deb12u14 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| DLA-4845-1 | MEDIUM4 | ca-certificates 20250419~deb12u1 fixed in 20250419~deb12u2 | — | Directly Exposed |
| GO-2026-5932 | MEDIUM4 | golang.org/x/crypto v0.57.0 No fix yet | — | Directly Exposed |
| CVE-2026-6238 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2010-4756 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 2.6% Low-Moderate Risk | Directly Exposed |
| CVE-2018-20796 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 5.8% Low-Moderate Risk | Directly Exposed |
| CVE-2019-1010022 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 3.2% Low-Moderate Risk | Directly Exposed |
| CVE-2019-1010023 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 3.1% Low-Moderate Risk | Directly Exposed |
| CVE-2019-1010024 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 3.2% Low-Moderate Risk | Directly Exposed |
| CVE-2019-1010025 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 2.5% Low-Moderate Risk | Directly Exposed |
| CVE-2019-9192 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 2.4% Low-Moderate Risk | Directly Exposed |
| CVE-2026-97399 | LOW3.7 | libc6 2.36-9+deb12u14 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-35189 | LOW3.7 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.7 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-5435 | LOW3.54 | libc6 2.36-9+deb12u14 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-6791 | LOW3.54 | libc6 2.36-9+deb12u14 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-77117 | LOW3.54 | libc6 2.36-9+deb12u14 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-80489 | LOW3.54 | libc6 2.36-9+deb12u14 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-54872 | LOW3.54 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75805 | LOW3.54 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-77696 | LOW3.54 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-27587 | LOW2.12 | libssl3 3.0.20-1~deb12u2 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| DLA-4792-1 | NONE0 | tzdata 2026b-0+deb12u1 fixed in 2026c-0+deb12u1 | — | Not Applicable |
| DLA-4854-1 | NONE0 | tzdata 2026b-0+deb12u1 fixed in 2026e-0+deb12u1 | — | Not Applicable |
Want to check another image? Run a full scan with the Docker Security Scanner.