Vulnerability Reportopenjdk:28-ea-20-jdk-bookworm

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. The most severe exposed issue is CVE-2026-16742, a systemd-homed local privilege-escalation flaw, while CVE-2026-77214 can disclose heap memory through expat parsing; an attacker with the required access could escalate privileges locally or leak sensitive memory contents in derived workloads. Post-exploit-only findings are present but have max severity 4.13 and no findings at severity >=6, so they do not drive the CAUTION rating. A util-linux nsenter finding only applies when nsenter --join-cgroup is used, so avoiding that option eliminates that specific exposure; otherwise, rebuild on patched base packages before production. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.