Last scanned:
This image poses a critical security risk and must not be used in production, especially as an internet-facing service. An attacker controlling a malicious registry or remote server could crash the build daemon, run code on the host, or overwrite host files as root, leading to full host compromise. The most serious issues are CVE-2026-111497 and CVE-2026-17106, and neither requires a non-default setting to be exploitable in normal operation. Remediation of these findings must be completed before any production use.
Hardening plan for this image · 4 steps. The first closes an actively exploited CVE.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-111497 | CRITICAL10 | brotli-libs 1.2.0-r0 fixed in 1.2.1-r0 | 82.6% Actively Exploited | Directly ExposedContext importance: HIGH |
| CVE-2026-17106 | HIGH7.8 | github.com/moby/go-archive v0.2.0 fixed in 0.3.0 | 0.4% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-78669 | MEDIUM6 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78659 | MEDIUM6 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-27145 | MEDIUM6 | stdlib v1.25.7 fixed in 1.25.11, 1.26.4 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-32280 | MEDIUM6 | stdlib v1.25.7 fixed in 1.25.9, 1.26.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-32283 | MEDIUM6 | stdlib v1.25.7 fixed in 1.25.9, 1.26.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-33811 | MEDIUM6 | stdlib v1.25.7 fixed in 1.25.10, 1.26.3 | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-33814 | MEDIUM6 | stdlib v1.25.7 fixed in 1.25.10, 1.26.3 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56853 | MEDIUM6 | stdlib v1.25.7 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56860 | MEDIUM6 | stdlib v1.25.7 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56862 | MEDIUM6 | stdlib v1.25.7 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78669 | MEDIUM6 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97031 | MEDIUM6 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78659 | MEDIUM6 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-46600 | MEDIUM6 | golang.org/x/net v0.55.0 fixed in 0.56.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78669 | MEDIUM6 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78659 | MEDIUM6 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97032 | MEDIUM5.9 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-32288 | MEDIUM5.5 | stdlib v1.25.7 fixed in 1.25.9, 1.26.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-10722 | MEDIUM5.5 | github.com/cilium/ebpf v0.17.3 fixed in 0.22.0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-61801 | MEDIUM5.5 | github.com/moby/sys/user v0.4.0 fixed in 0.4.1 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-111943 | MEDIUM5.44 | stdlib v1.25.7 fixed in 1.26.10, 1.27.3 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-27142 | MEDIUM5.4 | stdlib v1.25.7 fixed in 1.25.8, 1.26.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-39823 | MEDIUM5.4 | stdlib v1.25.7 fixed in 1.25.10, 1.26.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-39826 | MEDIUM5.4 | stdlib v1.25.7 fixed in 1.25.10, 1.26.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42505 | MEDIUM5.3 | stdlib v1.25.7 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42507 | MEDIUM5.3 | stdlib v1.25.7 fixed in 1.25.11, 1.26.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-78663 | MEDIUM5.3 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-85091 | MEDIUM5 | zlib 1.3.2-r0 fixed in 1.3.2-r1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-97032 | MEDIUM4.72 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97032 | MEDIUM4.72 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78660 | MEDIUM4.5 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-25679 | MEDIUM4.5 | stdlib v1.25.7 fixed in 1.25.8, 1.26.1 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-32281 | MEDIUM4.5 | stdlib v1.25.7 fixed in 1.25.9, 1.26.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-33818 | MEDIUM4.5 | stdlib v1.25.7 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78667 | MEDIUM4.5 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-78660 | MEDIUM4.5 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-94440 | MEDIUM4.5 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-78660 | MEDIUM4.5 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-78663 | MEDIUM4.24 | golang.org/x/net v0.59.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78663 | MEDIUM4.24 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-107891 | MEDIUM4 | musl 1.2.5-r23 fixed in 1.2.5-r24 | — | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl-utils 1.2.5-r23 fixed in 1.2.5-r24 | — | Directly Exposed |
| GO-2026-5932 | MEDIUM4 | golang.org/x/crypto v0.57.0 No fix yet | — | Directly Exposed |
| CVE-2026-39824 | MEDIUM4 | golang.org/x/sys v0.35.0 fixed in 0.44.0 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-39825 | LOW3.9 | stdlib v1.25.7 fixed in 1.25.10, 1.26.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-56866 | LOW3.9 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-94439 | LOW3.9 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-32282 | LOW3.84 | stdlib v1.25.7 fixed in 1.25.9, 1.26.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-32289 | LOW3.66 | stdlib v1.25.7 fixed in 1.25.9, 1.26.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-94448 | LOW3.66 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-97030 | LOW3.66 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-56857 | LOW3.3 | stdlib v1.25.7 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-39821 | LOW2.95 | stdlib v1.25.7 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 1.8% Low-Moderate Risk | Post-Exploit |
| CVE-2026-92392 | LOW2.92 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 1.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-56858 | LOW2.92 | stdlib v1.25.7 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-39822 | LOW2.81 | stdlib v1.25.7 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-39820 | LOW2.7 | stdlib v1.25.7 fixed in 1.25.10, 1.26.3 | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2026-39836 | LOW2.7 | stdlib v1.25.7 fixed in 1.25.10, 1.26.3 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-42499 | LOW2.7 | stdlib v1.25.7 fixed in 1.25.10, 1.26.3 | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2026-42504 | LOW2.7 | stdlib v1.25.7 fixed in 1.25.11, 1.26.4 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-56859 | LOW2.7 | stdlib v1.25.7 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-27139 | LOW2.5 | stdlib v1.25.7 fixed in 1.25.8, 1.26.1 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-86410 | LOW2.45 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2026-92388 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-86414 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-92390 | LOW2.34 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-86411 | LOW2.12 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-86409 | LOW1.91 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2026-86412 | LOW1.91 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2026-86413 | LOW1.91 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-107928 | LOW1.73 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-92386 | LOW1.55 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2026-107929 | LOW1.33 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-86415 | LOW1.33 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-87861 | LOW1.33 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-87862 | LOW1.33 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 1.0% Theoretical Threat | Post-Exploit |
| CVE-2026-87863 | LOW1.33 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2026-87864 | LOW1.33 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2026-87865 | LOW1.33 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-87866 | LOW1.33 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-92387 | LOW1.33 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2026-92389 | LOW1.33 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-92391 | LOW1.33 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 1.2% Low-Moderate Risk | Post-Exploit |
| CVE-2026-94266 | LOW1.19 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-94265 | LOW1.12 | libcurl 8.22.0-r0 fixed in 8.23.0-r0 | 0.8% Theoretical Threat | Post-Exploit |
Want to check another image? Run a full scan with the Docker Security Scanner.