Vulnerability Reportmilvusdb/milvus:2.6-20260618-5074b358-amd64

milvusdb/milvus:2.6-20260618-5074b358-amd64
digestsha256:938d5b40563973641d3787ae71febdc2fe2e5f4dbae7f30d4677208cbdcf4444

Executive Summary

Last scanned:

Threat Score
50/100CAUTION
Reputation
RELIABLE

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. The most severe real-world consequence an attacker could achieve is denial of service against the Milvus service, potentially causing downtime, by exploiting DoS vulnerabilities in krb5 (CVE-2026-40355) and OpenTelemetry (CVE-2026-29181). These vulnerabilities are remotely exploitable with no authentication. Mitigations include ensuring no NegoEx mechanism is registered on the system (eliminating krb5 risk) and restricting the number of baggage headers via a WAF or proxy to protect against the OpenTelemetry DoS.

Hardening plan for this image · 3 steps

Included in Pro

Scanning procedure

  1. Vulnerability scan
    Full CVE sweep across OS packages and app dependencies
  2. Exploitability check
    CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
  3. Reachability analysis
    Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
  4. Runtime verification
    Live-container probes: exposed endpoints, feature flags, real defaults
  5. Supply chain analysis
    Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
  6. Hardening recommendations
    A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

125 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-40355MEDIUM6.38
libgssapi-krb5-2
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40356MEDIUM6.38
libgssapi-krb5-2
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40355MEDIUM6.38
libk5crypto3
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40356MEDIUM6.38
libk5crypto3
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40355MEDIUM6.38
libkrb5-3
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40356MEDIUM6.38
libkrb5-3
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40355MEDIUM6.38
libkrb5support0
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-40356MEDIUM6.38
libkrb5support0
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-29181MEDIUM6.38
go.opentelemetry.io/otel
v1.40.0
fixed in 1.41.0
0.4%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-39882MEDIUM6.38
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
v1.20.0
fixed in 1.43.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-39830MEDIUM6.38
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-39835MEDIUM6.38
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-46597MEDIUM6.38
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-33814MEDIUM6.38
golang.org/x/net
v0.48.0
fixed in 0.53.0
0.8%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-32283MEDIUM6.38
stdlib
v1.25.8
fixed in 1.25.9, 1.26.2
0.6%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-33814MEDIUM6.38
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.8%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-39836MEDIUM6.38
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-42499MEDIUM6.38
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.8%
Theoretical Threat
Directly Exposed
CVE-2026-42504MEDIUM6.38
stdlib
v1.25.8
fixed in 1.25.11, 1.26.4
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-42508MEDIUM6.29
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-46595MEDIUM6.03
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-39883MEDIUM5.95
go.opentelemetry.io/otel/sdk
v1.40.0
fixed in 1.43.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2024-2236MEDIUM5.9
libgcrypt20
1.9.4-3ubuntu3.2
No fix yet
1.1%
Low-Moderate Risk
Directly Exposed
CVE-2026-39821MEDIUM5.58
golang.org/x/net
v0.48.0
fixed in 0.55.0
0.5%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-6238MEDIUM5.52
libc-bin
2.35-0ubuntu3.13
No fix yet
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-6238MEDIUM5.52
libc6
2.35-0ubuntu3.13
No fix yet
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-39827MEDIUM5.52
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-39834MEDIUM5.52
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-25680MEDIUM5.52
golang.org/x/net
v0.48.0
fixed in 0.55.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-39825MEDIUM5.52
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-32282MEDIUM5.44
stdlib
v1.25.8
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-42502MEDIUM5.18
golang.org/x/net
v0.48.0
fixed in 0.55.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-32289MEDIUM5.18
stdlib
v1.25.8
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-27145MEDIUM5.1
stdlib
v1.25.8
fixed in 1.25.11, 1.26.4
0.9%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-32280MEDIUM5.1
stdlib
v1.25.8
fixed in 1.25.9, 1.26.2
0.6%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-32281MEDIUM5.1
stdlib
v1.25.8
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-33811MEDIUM5.1
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.8%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-5435MEDIUM5.02
libc-bin
2.35-0ubuntu3.13
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-5435MEDIUM5.02
libc6
2.35-0ubuntu3.13
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2022-27943MEDIUM4.67
libgcc-s1
12.3.0-1ubuntu1~22.04.3
No fix yet
0.9%
Theoretical Threat
Directly Exposed
CVE-2022-27943MEDIUM4.67
libgfortran5
12.3.0-1ubuntu1~22.04.3
No fix yet
0.9%
Theoretical Threat
Directly Exposed
CVE-2022-27943MEDIUM4.67
libgomp1
12.3.0-1ubuntu1~22.04.3
No fix yet
0.9%
Theoretical Threat
Directly Exposed
CVE-2022-27943MEDIUM4.67
libquadmath0
12.3.0-1ubuntu1~22.04.3
No fix yet
0.9%
Theoretical Threat
Directly Exposed
CVE-2022-27943MEDIUM4.67
libstdc++6
12.3.0-1ubuntu1~22.04.3
No fix yet
0.9%
Theoretical Threat
Directly Exposed
CVE-2026-39833MEDIUM4.67
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-32288MEDIUM4.67
stdlib
v1.25.8
fixed in 1.25.9, 1.26.2
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-58055MEDIUM4.59
libnghttp2-14
1.43.0-1ubuntu0.3
fixed in 1.43.0-1ubuntu0.4
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-42506MEDIUM4.59
golang.org/x/net
v0.48.0
fixed in 0.55.0
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-39823MEDIUM4.59
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-39826MEDIUM4.59
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-4046MEDIUM4.5
libc-bin
2.35-0ubuntu3.13
No fix yet
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-4046MEDIUM4.5
libc6
2.35-0ubuntu3.13
No fix yet
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-46598MEDIUM4.5
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-42505MEDIUM4.5
stdlib
v1.25.8
fixed in 1.25.12, 1.26.5, 1.27.0-rc.2
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-42507MEDIUM4.5
stdlib
v1.25.8
fixed in 1.25.11, 1.26.4
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-11850MEDIUM4.25
libgssapi-krb5-2
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-11850MEDIUM4.25
libk5crypto3
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-11850MEDIUM4.25
libkrb5-3
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-11850MEDIUM4.25
libkrb5support0
1.19.2-2ubuntu0.7
fixed in 1.19.2-2ubuntu0.8
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-27456MEDIUM4
libblkid1
2.37.2-4ubuntu3.5
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-27456MEDIUM4
libmount1
2.37.2-4ubuntu3.5
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-27456MEDIUM4
libsmartcols1
2.37.2-4ubuntu3.5
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-27456MEDIUM4
libuuid1
2.37.2-4ubuntu3.5
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-9547LOW3.77
libcurl4
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-8924LOW3.31
curl
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-8924LOW3.31
libcurl4
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-8376LOW3
perl-base
5.34.0-3ubuntu1.5
fixed in 5.34.0-3ubuntu1.7
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-8925LOW2.92
curl
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
1.1%
Low-Moderate Risk
Post-Exploit
CVE-2026-8925LOW2.92
libcurl4
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
1.1%
Low-Moderate Risk
Post-Exploit
CVE-2025-45582LOW2.86
tar
1.34+dfsg-1ubuntu0.1.22.04.2
fixed in 1.34+dfsg-1ubuntu0.1.22.04.4
0.4%
Theoretical Threat
Post-Exploit
CVE-2022-27943LOW2.8
gcc-12-base
12.3.0-1ubuntu1~22.04.3
No fix yet
0.9%
Theoretical Threat
Post-Exploit
CVE-2026-5704LOW2.8
tar
1.34+dfsg-1ubuntu0.1.22.04.2
fixed in 1.34+dfsg-1ubuntu0.1.22.04.6
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-40228LOW2.8
libsystemd0
249.11-0ubuntu3.21
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-40228LOW2.8
libudev1
249.11-0ubuntu3.21
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-42496LOW2.78
perl-base
5.34.0-3ubuntu1.5
fixed in 5.34.0-3ubuntu1.7
0.4%
Theoretical Threat
Post-Exploit
CVE-2022-4899LOW2.7
libzstd1
1.4.8+dfsg-3build1
No fix yet
1.6%
Low-Moderate Risk
Post-Exploit
CVE-2026-41602LOW2.7
github.com/apache/thrift
v0.20.0
fixed in 0.23.0
1.2%
Low-Moderate Risk
Post-Exploit
CVE-2026-39828LOW2.69
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-39832LOW2.66
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-8286LOW2.48
curl
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-8286LOW2.48
libcurl4
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-39831LOW2.48
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-25681LOW2.48
golang.org/x/net
v0.48.0
fixed in 0.55.0
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-27136LOW2.48
golang.org/x/net
v0.48.0
fixed in 0.55.0
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-27456LOW2.4
bsdutils
1:2.37.2-4ubuntu3.5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-41991LOW2.4
gzip
1.10-4ubuntu4.1
fixed in 1.10-4ubuntu4.2
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-27456LOW2.4
mount
2.37.2-4ubuntu3.5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-27456LOW2.4
util-linux
2.37.2-4ubuntu3.5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-39822LOW2.39
stdlib
v1.25.8
fixed in 1.25.12, 1.26.5, 1.27.0-rc.2
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-8927LOW2.29
curl
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-41992LOW2.29
gzip
1.10-4ubuntu4.1
fixed in 1.10-4ubuntu4.2
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-8927LOW2.29
libcurl4
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.8%
Theoretical Threat
Post-Exploit
CVE-2022-41409LOW2.29
libpcre2-8-0
10.39-3ubuntu0.1
No fix yet
1.0%
Theoretical Threat
Post-Exploit
CVE-2026-39829LOW2.29
golang.org/x/crypto
v0.46.0
fixed in 0.52.0
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-39820LOW2.29
stdlib
v1.25.8
fixed in 1.25.10, 1.26.3
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-9547LOW2.26
curl
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.5%
Theoretical Threat
Post-Exploit
CVE-2024-56433LOW1.84
login
1:4.8.1-2ubuntu2.2
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2024-56433LOW1.84
passwd
1:4.8.1-2ubuntu2.2
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2023-29383LOW1.68
login
1:4.8.1-2ubuntu2.2
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2023-29383LOW1.68
passwd
1:4.8.1-2ubuntu2.2
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2025-69720NONE0
libncurses6
6.3-2ubuntu0.1
fixed in 6.3-2ubuntu0.2
0.4%
Theoretical Threat
Not Applicable
CVE-2025-69720NONE0
libncursesw6
6.3-2ubuntu0.1
fixed in 6.3-2ubuntu0.2
0.4%
Theoretical Threat
Not Applicable
CVE-2025-69720NONE0
libtinfo6
6.3-2ubuntu0.1
fixed in 6.3-2ubuntu0.2
0.4%
Theoretical Threat
Not Applicable
CVE-2025-69720NONE0
ncurses-base
6.3-2ubuntu0.1
fixed in 6.3-2ubuntu0.2
0.4%
Theoretical Threat
Not Applicable
CVE-2025-69720NONE0
ncurses-bin
6.3-2ubuntu0.1
fixed in 6.3-2ubuntu0.2
0.4%
Theoretical Threat
Not Applicable
CVE-2023-50495NONE0
libncurses6
6.3-2ubuntu0.1
No fix yet
1.0%
Theoretical Threat
Not Applicable
CVE-2023-50495NONE0
libncursesw6
6.3-2ubuntu0.1
No fix yet
1.0%
Theoretical Threat
Not Applicable
CVE-2023-50495NONE0
libtinfo6
6.3-2ubuntu0.1
No fix yet
1.0%
Theoretical Threat
Not Applicable
CVE-2023-50495NONE0
ncurses-base
6.3-2ubuntu0.1
No fix yet
1.0%
Theoretical Threat
Not Applicable
CVE-2023-50495NONE0
ncurses-bin
6.3-2ubuntu0.1
No fix yet
1.0%
Theoretical Threat
Not Applicable
CVE-2026-13757NONE0
libp11-kit0
0.24.0-6build1
No fix yet
0.1%
Theoretical Threat
Not Applicable
CVE-2026-54411NONE0
libpam-modules
1.4.0-11ubuntu2.6
fixed in 1.4.0-11ubuntu2.7
0.3%
Theoretical Threat
Not Applicable
CVE-2026-54411NONE0
libpam-modules-bin
1.4.0-11ubuntu2.6
fixed in 1.4.0-11ubuntu2.7
0.3%
Theoretical Threat
Not Applicable
CVE-2026-54411NONE0
libpam-runtime
1.4.0-11ubuntu2.6
fixed in 1.4.0-11ubuntu2.7
0.3%
Theoretical Threat
Not Applicable
CVE-2026-54411NONE0
libpam0g
1.4.0-11ubuntu2.6
fixed in 1.4.0-11ubuntu2.7
0.3%
Theoretical Threat
Not Applicable
CVE-2026-8458NONE0
curl
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.5%
Theoretical Threat
Not Applicable
CVE-2026-8458NONE0
libcurl4
7.81.0-1ubuntu1.24
fixed in 7.81.0-1ubuntu1.25
0.5%
Theoretical Threat
Not Applicable
GHSA-xmrv-pmrh-hhx2NONE0
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
v1.6.7
fixed in 1.7.8
—
Not Applicable
GHSA-xmrv-pmrh-hhx2NONE0
github.com/aws/aws-sdk-go-v2/service/bedrockruntime
v1.23.0
fixed in 1.50.4
—
Not Applicable
CVE-2026-2303NONE0
go.mongodb.org/mongo-driver
v1.13.1
fixed in 1.17.7
0.2%
Theoretical Threat
Not Applicable
GO-2026-5932NONE0
golang.org/x/crypto
v0.46.0
No fix yet
—
Not Applicable
CVE-2026-46600NONE0
golang.org/x/net
v0.48.0
fixed in 0.56.0
—
Not Applicable
CVE-2026-39824NONE0
golang.org/x/sys
v0.40.0
fixed in 0.44.0
0.1%
Theoretical Threat
Not Applicable
CVE-2026-56852NONE0
golang.org/x/text
v0.32.0
fixed in 0.39.0
—
Not Applicable
GHSA-hrxh-6v49-42gfNONE0
google.golang.org/grpc
v1.79.3
fixed in 1.82.1
—
Not Applicable

Want to check another image? Run a full scan with the Docker Security Scanner.