Last scanned:
This image poses a critical security risk and must not be used in production, especially as an internet-facing service. An attacker who supplies crafted compressed or archive content to this build daemon could crash it, corrupt build data, write files as root, or potentially execute code. Because the brotli-libs flaw CVE-2026-111497 is known to be actively exploited, it must be resolved by updating the affected packages before any production use. Disabling network access to the daemon would remove the network path for the denial-of-service findings, but it does not address CVE-2026-111497 or CVE-2026-17106.
Hardening plan for this image · 4 steps. The first closes an actively exploited CVE.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-111497 | CRITICAL10 | brotli-libs 1.2.0-r0 fixed in 1.2.1-r0 | 82.6% Actively Exploited | Directly ExposedContext importance: HIGH |
| CVE-2026-17106 | HIGH7.8 | github.com/moby/go-archive v0.2.0 fixed in 0.3.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-39822 | MEDIUM6.24 | stdlib v1.25.7 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78669 | MEDIUM6 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78659 | MEDIUM6 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78667 | MEDIUM6 | stdlib v1.26.8 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78669 | MEDIUM6 | stdlib v1.26.8 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97031 | MEDIUM6 | stdlib v1.26.8 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78659 | MEDIUM6 | stdlib v1.26.8 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-94440 | MEDIUM6 | stdlib v1.26.8 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-27145 | MEDIUM6 | stdlib v1.25.7 fixed in 1.25.11, 1.26.4 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-32280 | MEDIUM6 | stdlib v1.25.7 fixed in 1.25.9, 1.26.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-32283 | MEDIUM6 | stdlib v1.25.7 fixed in 1.25.9, 1.26.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-33811 | MEDIUM6 | stdlib v1.25.7 fixed in 1.25.10, 1.26.3 | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-33814 | MEDIUM6 | stdlib v1.25.7 fixed in 1.25.10, 1.26.3 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-33818 | MEDIUM6 | stdlib v1.25.7 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56853 | MEDIUM6 | stdlib v1.25.7 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56860 | MEDIUM6 | stdlib v1.25.7 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56862 | MEDIUM6 | stdlib v1.25.7 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78667 | MEDIUM6 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78669 | MEDIUM6 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97031 | MEDIUM6 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78659 | MEDIUM6 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-94440 | MEDIUM6 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-33814 | MEDIUM6 | golang.org/x/net v0.43.0 fixed in 0.53.0 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-46600 | MEDIUM6 | golang.org/x/net v0.43.0 fixed in 0.56.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78669 | MEDIUM6 | golang.org/x/net v0.43.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78659 | MEDIUM6 | golang.org/x/net v0.43.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97032 | MEDIUM5.9 | stdlib v1.26.8 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-97032 | MEDIUM5.9 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-32288 | MEDIUM5.5 | stdlib v1.25.7 fixed in 1.25.9, 1.26.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-10722 | MEDIUM5.5 | github.com/cilium/ebpf v0.17.3 fixed in 0.22.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-61801 | MEDIUM5.5 | github.com/moby/sys/user v0.4.0 fixed in 0.4.1 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-111943 | MEDIUM5.44 | stdlib v1.26.8 fixed in 1.26.10, 1.27.3 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-111943 | MEDIUM5.44 | stdlib v1.25.7 fixed in 1.26.10, 1.27.3 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-27142 | MEDIUM5.4 | stdlib v1.25.7 fixed in 1.25.8, 1.26.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-39823 | MEDIUM5.4 | stdlib v1.25.7 fixed in 1.25.10, 1.26.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-39826 | MEDIUM5.4 | stdlib v1.25.7 fixed in 1.25.10, 1.26.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-78663 | MEDIUM5.3 | stdlib v1.26.8 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42505 | MEDIUM5.3 | stdlib v1.25.7 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42507 | MEDIUM5.3 | stdlib v1.25.7 fixed in 1.25.11, 1.26.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-78663 | MEDIUM5.3 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-25680 | MEDIUM5.2 | golang.org/x/net v0.43.0 fixed in 0.55.0 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-85091 | MEDIUM5 | zlib 1.3.2-r0 fixed in 1.3.2-r1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-42502 | MEDIUM4.88 | golang.org/x/net v0.43.0 fixed in 0.55.0 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56858 | MEDIUM4.86 | stdlib v1.25.7 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-25681 | MEDIUM4.86 | golang.org/x/net v0.43.0 fixed in 0.55.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-27136 | MEDIUM4.86 | golang.org/x/net v0.43.0 fixed in 0.55.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-97032 | MEDIUM4.72 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97032 | MEDIUM4.72 | golang.org/x/net v0.43.0 fixed in 0.60.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-103111 | MEDIUM4.56 | pcre2 10.48-r0 fixed in 10.49-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-78660 | MEDIUM4.5 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-78660 | MEDIUM4.5 | stdlib v1.26.8 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-25679 | MEDIUM4.5 | stdlib v1.25.7 fixed in 1.25.8, 1.26.1 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-32281 | MEDIUM4.5 | stdlib v1.25.7 fixed in 1.25.9, 1.26.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-39836 | MEDIUM4.5 | stdlib v1.25.7 fixed in 1.25.10, 1.26.3 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42499 | MEDIUM4.5 | stdlib v1.25.7 fixed in 1.25.10, 1.26.3 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-42504 | MEDIUM4.5 | stdlib v1.25.7 fixed in 1.25.11, 1.26.4 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-56859 | MEDIUM4.5 | stdlib v1.25.7 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78660 | MEDIUM4.5 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-78660 | MEDIUM4.5 | golang.org/x/net v0.43.0 fixed in 0.60.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42506 | MEDIUM4.32 | golang.org/x/net v0.43.0 fixed in 0.55.0 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78663 | MEDIUM4.24 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2025-47911 | MEDIUM4.24 | golang.org/x/net v0.43.0 fixed in 0.45.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2025-58190 | MEDIUM4.24 | golang.org/x/net v0.43.0 fixed in 0.45.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78663 | MEDIUM4.24 | golang.org/x/net v0.43.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-107891 | MEDIUM4 | musl 1.2.5-r23 fixed in 1.2.5-r24 | — | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl-utils 1.2.5-r23 fixed in 1.2.5-r24 | — | Directly Exposed |
| GO-2026-5932 | MEDIUM4 | golang.org/x/crypto v0.56.0 No fix yet | — | Directly Exposed |
| CVE-2026-39824 | MEDIUM4 | golang.org/x/sys v0.35.0 fixed in 0.44.0 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-39824 | MEDIUM4 | golang.org/x/sys v0.38.0 fixed in 0.44.0 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-56866 | LOW3.9 | stdlib v1.26.8 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-94439 | LOW3.9 | stdlib v1.26.8 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-39825 | LOW3.9 | stdlib v1.25.7 fixed in 1.25.10, 1.26.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-56866 | LOW3.9 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-94439 | LOW3.9 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-94448 | LOW3.66 | stdlib v1.26.8 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-97030 | LOW3.66 | stdlib v1.26.8 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-32289 | LOW3.66 | stdlib v1.25.7 fixed in 1.25.9, 1.26.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-94448 | LOW3.66 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-97030 | LOW3.66 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-56857 | LOW3.3 | stdlib v1.26.8 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-56857 | LOW3.3 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-77214 | LOW2.95 | libexpat 2.8.5-r0 fixed in 2.9.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-39821 | LOW2.95 | stdlib v1.25.7 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 1.8% Low-Moderate Risk | Post-Exploit |
| CVE-2026-39821 | LOW2.95 | golang.org/x/net v0.43.0 fixed in 0.55.0 | 1.8% Low-Moderate Risk | Post-Exploit |
| CVE-2026-92392 | LOW2.92 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-107928 | LOW2.88 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-39820 | LOW2.7 | stdlib v1.25.7 fixed in 1.25.10, 1.26.3 | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2026-92386 | LOW2.58 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-27139 | LOW2.5 | stdlib v1.25.7 fixed in 1.25.8, 1.26.1 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-86410 | LOW2.45 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-92390 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-32282 | LOW2.3 | stdlib v1.25.7 fixed in 1.25.9, 1.26.2 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-107929 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-86415 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-87861 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-87862 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-87863 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-87864 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-87865 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-87866 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-92387 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-92389 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-92391 | LOW2.22 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-86411 | LOW2.12 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-102633 | LOW2.12 | libexpat 2.8.5-r0 fixed in 2.9.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-94266 | LOW1.98 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-86409 | LOW1.91 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2026-86412 | LOW1.91 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2026-86413 | LOW1.91 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-94265 | LOW1.86 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Directly Exposed |
Want to check another image? Run a full scan with the Docker Security Scanner.