Vulnerability Reportnode:24

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. If an application built on it decompresses untrusted Brotli data through the system library, an attacker could crash that application or possibly run code, and a malicious ImageMagick MSL file could crash it through stack exhaustion. Note: CVE-2026-111497 only applies when an application uses the system Brotli library for untrusted input, and CVE-2026-25971 only applies when untrusted MSL scripts reach ImageMagick, so images that never do this are far less exposed. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.