Vulnerability Reportoliver006/redis_exporter:v1.45.0-alpine

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. The primary exposure is a set of high-severity denial-of-service vulnerabilities in the Go standard library (e.g., CVE-2023-45288, CVE-2023-24534) that can let remote attackers exhaust CPU or memory on the metrics endpoint, disrupting Redis monitoring. CVE-2023-45288 only applies if HTTP/2 is enabled on the exporter; disabling HTTP/2 would fully eliminate that particular issue. Post-exploitation findings are low severity (none above 3.53), so the main risk is availability rather than data compromise. The image itself is well-trusted and immutable, so supply-chain risk is low.