Vulnerability Reportoliver006/redis_exporter:v1.49.0-alpine

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. The most exposed risk is CVE-2023-24534, a denial-of-service vulnerability in Go's net/http that allows a remote attacker to exhaust memory via specially crafted HTTP headers, which is directly reachable on the metrics endpoint. Template injection in Go's html/template (CVE-2023-29400) could allow HTML injection if untrusted template input is used. Many of the other exposed vulnerabilities are lower severity or require unusual conditions (e.g., PowerPC, setuid binaries, or PKCS#12 parsing). Restricting network access to the metrics endpoint would fully mitigate the remote DoS and significantly reduce the practical attack surface. The post-exploitation findings are all low severity (max 4.06) and require special configurations that are not present in this context.