Vulnerability Reportmilvusdb/milvus:2.6-20260618-5074b358

milvusdb/milvus:2.6-20260618-5074b358
digestsha256:938d5b40563973641d3787ae71febdc2fe2e5f4dbae7f30d4677208cbdcf4444

Executive Summary

Last scanned:

Threat Score
50/100CAUTION
Reputation
RELIABLE

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker could cause denial of service via CVE-2026-40355 in krb5 or memory exhaustion via CVE-2026-39882 in OpenTelemetry HTTP exporter. Disabling the NegoEx mechanism in /etc/gss/mech would fully mitigate the krb5 vulnerabilities. Upgrading the OTLP HTTP exporter to v1.43.0 resolves CVE-2026-39882. Overall, the image has 74 exposed vulnerabilities, 24 of which are medium severity, but no critical or post-exploit issues.

Hardening plan for this image · 3 steps

Included in Pro

Scanning procedure

  1. Vulnerability scan
    Full CVE sweep across OS packages and app dependencies
  2. Exploitability check
    CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
  3. Reachability analysis
    Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
  4. Runtime verification
    Live-container probes: exposed endpoints, feature flags, real defaults
  5. Supply chain analysis
    Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
  6. Hardening recommendations
    A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

125 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-40355MEDIUM6.38
libgssapi-krb5-2
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40356MEDIUM6.38
libgssapi-krb5-2
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40355MEDIUM6.38
libk5crypto3
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40356MEDIUM6.38
libk5crypto3
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40355MEDIUM6.38
libkrb5-3
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40356MEDIUM6.38
libkrb5-3
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40355MEDIUM6.38
libkrb5support0
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40356MEDIUM6.38
libkrb5support0
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-39882MEDIUM6.38
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
v1.20.0
fixed in 1.43.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-39830MEDIUM6.38
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-39835MEDIUM6.38
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-46597MEDIUM6.38
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-33814MEDIUM6.38
golang.org/x/net
v0.48.0
fixed in 0.53.0
0.8%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-27145MEDIUM6.38
stdlib
v1.25.8
fixed in 1.25.11, 1.26.4
0.9%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-32280MEDIUM6.38
stdlib
v1.25.8
fixed in 1.25.9, 1.26.2
0.6%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-32281MEDIUM6.38
stdlib
v1.25.8
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-32283MEDIUM6.38
stdlib
v1.25.8
fixed in 1.25.9, 1.26.2
0.6%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-33814MEDIUM6.38
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.8%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-39836MEDIUM6.38
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-42499MEDIUM6.38
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.8%
Theoretical Threat
Directly Exposed
CVE-2026-42504MEDIUM6.38
stdlib
v1.25.8
fixed in 1.25.11, 1.26.4
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-42508MEDIUM6.29
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-46595MEDIUM6.03
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-41602MEDIUM6
github.com/apache/thrift
v0.20.0
fixed in 0.23.0
1.2%
Low-Moderate Risk
Directly ExposedContext importance: MEDIUM
CVE-2026-39883MEDIUM5.95
go.opentelemetry.io/otel/sdk
v1.40.0
fixed in 1.43.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2024-2236MEDIUM5.9
libgcrypt20
1.9.4-3ubuntu3.2
No fix yet
1.1%
Low-Moderate Risk
Directly Exposed
CVE-2026-39821MEDIUM5.58
golang.org/x/net
v0.48.0
fixed in 0.55.0
0.5%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-6238MEDIUM5.52
libc-bin
2.35-0ubuntu3.13
No fix yet
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-6238MEDIUM5.52
libc6
2.35-0ubuntu3.13
No fix yet
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-39827MEDIUM5.52
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-39834MEDIUM5.52
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-25680MEDIUM5.52
golang.org/x/net
v0.48.0
fixed in 0.55.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-39825MEDIUM5.52
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-32282MEDIUM5.44
stdlib
v1.25.8
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-13757MEDIUM5.27
libp11-kit0
0.24.0-6build1
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-42502MEDIUM5.18
golang.org/x/net
v0.48.0
fixed in 0.55.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-32289MEDIUM5.18
stdlib
v1.25.8
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-29181MEDIUM5.1
go.opentelemetry.io/otel
v1.40.0
fixed in 1.41.0
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-33811MEDIUM5.1
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.8%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-5435MEDIUM5.02
libc-bin
2.35-0ubuntu3.13
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-5435MEDIUM5.02
libc6
2.35-0ubuntu3.13
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2022-27943MEDIUM4.67
libgcc-s1
12.3.0-1ubuntu1~22.04.3
No fix yet
0.9%
Theoretical Threat
Directly Exposed
CVE-2022-27943MEDIUM4.67
libgfortran5
12.3.0-1ubuntu1~22.04.3
No fix yet
0.9%
Theoretical Threat
Directly Exposed
CVE-2022-27943MEDIUM4.67
libgomp1
12.3.0-1ubuntu1~22.04.3
No fix yet
0.9%
Theoretical Threat
Directly Exposed
CVE-2022-27943MEDIUM4.67
libquadmath0
12.3.0-1ubuntu1~22.04.3
No fix yet
0.9%
Theoretical Threat
Directly Exposed
CVE-2022-27943MEDIUM4.67
libstdc++6
12.3.0-1ubuntu1~22.04.3
No fix yet
0.9%
Theoretical Threat
Directly Exposed
CVE-2026-39833MEDIUM4.67
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-32288MEDIUM4.67
stdlib
v1.25.8
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-58055MEDIUM4.59
libnghttp2-14
1.43.0-1ubuntu0.3
fixed in 1.43.0-1ubuntu0.4
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-42506MEDIUM4.59
golang.org/x/net
v0.48.0
fixed in 0.55.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-39823MEDIUM4.59
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-39826MEDIUM4.59
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-4046MEDIUM4.5
libc-bin
2.35-0ubuntu3.13
No fix yet
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-4046MEDIUM4.5
libc6
2.35-0ubuntu3.13
No fix yet
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-46598MEDIUM4.5
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-42505MEDIUM4.5
stdlib
v1.25.8
fixed in 1.25.12, 1.26.5, 1.27.0-rc.2
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-42507MEDIUM4.5
stdlib
v1.25.8
fixed in 1.25.11, 1.26.4
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-11850MEDIUM4.25
libgssapi-krb5-2
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-11850MEDIUM4.25
libk5crypto3
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-11850MEDIUM4.25
libkrb5-3
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-11850MEDIUM4.25
libkrb5support0
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-27456MEDIUM4
libblkid1
2.37.2-4ubuntu3.5
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-27456MEDIUM4
libmount1
2.37.2-4ubuntu3.5
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-27456MEDIUM4
libsmartcols1
2.37.2-4ubuntu3.5
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-27456MEDIUM4
libuuid1
2.37.2-4ubuntu3.5
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-9547LOW3.77
libcurl4
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-8924LOW3.31
curl
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-8924LOW3.31
libcurl4
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-8376LOW3
perl-base
5.34.0-3ubuntu1.5
fixed in 5.34.0-3ubuntu1.7
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-8925LOW2.92
curl
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
1.1%
Low-Moderate Risk
Post-Exploit
CVE-2026-8925LOW2.92
libcurl4
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
1.1%
Low-Moderate Risk
Post-Exploit
CVE-2025-45582LOW2.86
tar
1.34+dfsg-1ubuntu0.1.22.04.2
fixed in 1.34+dfsg-1ubuntu0.1.22.04.4
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-5704LOW2.8
tar
1.34+dfsg-1ubuntu0.1.22.04.2
fixed in 1.34+dfsg-1ubuntu0.1.22.04.6
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-40228LOW2.8
libsystemd0
249.11-0ubuntu3.21
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-42496LOW2.78
perl-base
5.34.0-3ubuntu1.5
fixed in 5.34.0-3ubuntu1.7
0.4%
Theoretical Threat
Post-Exploit
CVE-2022-4899LOW2.7
libzstd1
1.4.8+dfsg-3build1
No fix yet
1.6%
Low-Moderate Risk
Post-Exploit
CVE-2026-39828LOW2.69
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-39832LOW2.66
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-8286LOW2.48
curl
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-8286LOW2.48
libcurl4
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-39831LOW2.48
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-25681LOW2.48
golang.org/x/net
v0.48.0
fixed in 0.55.0
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-27136LOW2.48
golang.org/x/net
v0.48.0
fixed in 0.55.0
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-27456LOW2.4
bsdutils
1:2.37.2-4ubuntu3.5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-41991LOW2.4
gzip
1.10-4ubuntu4.1
fixed in 1.10-4ubuntu4.2
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-27456LOW2.4
mount
2.37.2-4ubuntu3.5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-27456LOW2.4
util-linux
2.37.2-4ubuntu3.5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-39822LOW2.39
stdlib
v1.25.8
fixed in 1.25.12, 1.26.5, 1.27.0-rc.2
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-8927LOW2.29
curl
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-41992LOW2.29
gzip
1.10-4ubuntu4.1
fixed in 1.10-4ubuntu4.2
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-8927LOW2.29
libcurl4
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.8%
Theoretical Threat
Post-Exploit
CVE-2022-41409LOW2.29
libpcre2-8-0
10.39-3ubuntu0.1
No fix yet
1.0%
Theoretical Threat
Post-Exploit
CVE-2026-39829LOW2.29
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-39820LOW2.29
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-9547LOW2.26
curl
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.5%
Theoretical Threat
Post-Exploit
CVE-2024-56433LOW1.84
passwd
1:4.8.1-2ubuntu2.2
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2023-29383LOW1.68
passwd
1:4.8.1-2ubuntu2.2
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2025-69720NONE0
libncurses6
6.3-2ubuntu0.1
fixed in 6.3-2ubuntu0.2
0.4%
Theoretical Threat
Not Applicable
CVE-2025-69720NONE0
libncursesw6
6.3-2ubuntu0.1
fixed in 6.3-2ubuntu0.2
0.4%
Theoretical Threat
Not Applicable
CVE-2025-69720NONE0
libtinfo6
6.3-2ubuntu0.1
fixed in 6.3-2ubuntu0.2
0.4%
Theoretical Threat
Not Applicable
CVE-2025-69720NONE0
ncurses-base
6.3-2ubuntu0.1
fixed in 6.3-2ubuntu0.2
0.4%
Theoretical Threat
Not Applicable
CVE-2025-69720NONE0
ncurses-bin
6.3-2ubuntu0.1
fixed in 6.3-2ubuntu0.2
0.4%
Theoretical Threat
Not Applicable
CVE-2023-50495NONE0
libncurses6
6.3-2ubuntu0.1
No fix yet
1.0%
Theoretical Threat
Not Applicable
CVE-2023-50495NONE0
libncursesw6
6.3-2ubuntu0.1
No fix yet
1.0%
Theoretical Threat
Not Applicable
CVE-2023-50495NONE0
libtinfo6
6.3-2ubuntu0.1
No fix yet
1.0%
Theoretical Threat
Not Applicable
CVE-2023-50495NONE0
ncurses-base
6.3-2ubuntu0.1
No fix yet
1.0%
Theoretical Threat
Not Applicable
CVE-2023-50495NONE0
ncurses-bin
6.3-2ubuntu0.1
No fix yet
1.0%
Theoretical Threat
Not Applicable
CVE-2022-27943NONE0
gcc-12-base
12.3.0-1ubuntu1~22.04.3
No fix yet
0.9%
Theoretical Threat
Not Applicable
CVE-2026-54411NONE0
libpam-modules
1.4.0-11ubuntu2.6
fixed in 1.4.0-11ubuntu2.7
0.3%
Theoretical Threat
Not Applicable
CVE-2026-54411NONE0
libpam-modules-bin
1.4.0-11ubuntu2.6
fixed in 1.4.0-11ubuntu2.7
0.3%
Theoretical Threat
Not Applicable
CVE-2026-54411NONE0
libpam-runtime
1.4.0-11ubuntu2.6
fixed in 1.4.0-11ubuntu2.7
0.3%
Theoretical Threat
Not Applicable
CVE-2026-54411NONE0
libpam0g
1.4.0-11ubuntu2.6
fixed in 1.4.0-11ubuntu2.7
0.3%
Theoretical Threat
Not Applicable
CVE-2024-56433NONE0
login
1:4.8.1-2ubuntu2.2
No fix yet
0.4%
Theoretical Threat
Not Applicable
CVE-2026-40228NONE0
libudev1
249.11-0ubuntu3.21
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2023-29383NONE0
login
1:4.8.1-2ubuntu2.2
No fix yet
0.4%
Theoretical Threat
Not Applicable
CVE-2026-8458NONE0
curl
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.5%
Theoretical Threat
Not Applicable
CVE-2026-8458NONE0
libcurl4
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.5%
Theoretical Threat
Not Applicable
GHSA-xmrv-pmrh-hhx2NONE0
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
v1.6.7
fixed in 1.7.8
—
Not Applicable
GHSA-xmrv-pmrh-hhx2NONE0
github.com/aws/aws-sdk-go-v2/service/bedrockruntime
v1.23.0
fixed in 1.50.4
—
Not Applicable
CVE-2026-2303NONE0
go.mongodb.org/mongo-driver
v1.13.1
fixed in 1.17.7
0.2%
Theoretical Threat
Not Applicable
GO-2026-5932NONE0
golang.org/x/crypto
v0.46.0
No fix yet
—
Not Applicable
CVE-2026-46600NONE0
golang.org/x/net
v0.48.0
fixed in 0.56.0
—
Not Applicable
CVE-2026-39824NONE0
golang.org/x/sys
v0.40.0
fixed in 0.44.0
0.1%
Theoretical Threat
Not Applicable
CVE-2026-56852NONE0
golang.org/x/text
v0.32.0
fixed in 0.39.0
—
Not Applicable
GHSA-hrxh-6v49-42gfNONE0
google.golang.org/grpc
v1.79.3
fixed in 1.82.1
—
Not Applicable

Want to check another image? Run a full scan with the Docker Security Scanner.