Last scanned:
This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. It has 20 exposed findings, with four at severity 6.0 and none at 7.0 or higher, plus two low-severity post-exploit findings. The notable exposed issues are CVE-2026-18798 and CVE-2026-14457, both OpenSSL denial-of-service cases that require non-default configurations such as QUIC/HTTP3 or key-only raw public keys. Disabling QUIC/HTTP3 and avoiding key-only raw public key mode would fully eliminate the associated risks, so practical exposure is limited if this OpenResty deployment uses default TLS and no QUIC.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-18798 | MEDIUM6 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 1.5% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-14457 | MEDIUM6 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 1.0% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-18798 | MEDIUM6 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 1.5% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-14457 | MEDIUM6 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 1.0% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-14456 | MEDIUM5.1 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-63075 | MEDIUM5.1 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-14456 | MEDIUM5.1 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-63075 | MEDIUM5.1 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-63076 | MEDIUM4.5 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63076 | MEDIUM4.5 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-77214 | MEDIUM4.18 | libexpat 2.8.5-r0 fixed in 2.9.0-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-63072 | LOW3.83 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-54874 | LOW3.83 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63074 | LOW3.83 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63072 | LOW3.83 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-54874 | LOW3.83 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63074 | LOW3.83 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.15 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.15 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-102633 | LOW3.01 | libexpat 2.8.5-r0 fixed in 2.9.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-63073 | LOW2.12 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Post-Exploit |
| CVE-2026-63073 | LOW2.12 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Post-Exploit |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.