Last scanned:
This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The main exposed issue is CVE-2026-18798 in libcrypto3/libssl3, which can cause remote denial of service of an OpenSSL QUIC listener, but it only applies if QUIC/HTTP3 is enabled and is not part of the default OpenResty configuration. No exposed findings reach severity 7.0, and the post-exploit findings are all below severity 6.0. This risk is fully avoidable by not enabling OpenSSL QUIC/HTTP3 listeners.
Hardening plan for this image · 3 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-18798 | MEDIUM6 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 1.5% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-18798 | MEDIUM6 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 1.5% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-14456 | MEDIUM5.1 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-63075 | MEDIUM5.1 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-14456 | MEDIUM5.1 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-63075 | MEDIUM5.1 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-14457 | MEDIUM4.5 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-14457 | MEDIUM4.5 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-75803 | LOW3.15 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.15 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-63076 | LOW2.7 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 1.6% Low-Moderate Risk | Post-Exploit |
| CVE-2026-63076 | LOW2.7 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 1.6% Low-Moderate Risk | Post-Exploit |
| CVE-2026-77214 | LOW2.51 | libexpat 2.8.5-r0 fixed in 2.9.0-r0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-63072 | LOW2.29 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.9% Theoretical Threat | Post-Exploit |
| CVE-2026-54874 | LOW2.29 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-63074 | LOW2.29 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-63072 | LOW2.29 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.9% Theoretical Threat | Post-Exploit |
| CVE-2026-54874 | LOW2.29 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-63074 | LOW2.29 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-63073 | LOW2.12 | libcrypto3 3.5.7-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Post-Exploit |
| CVE-2026-63073 | LOW2.12 | libssl3 3.5.7-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Post-Exploit |
| CVE-2026-102633 | LOW1.81 | libexpat 2.8.5-r0 fixed in 2.9.0-r0 | 0.3% Theoretical Threat | Post-Exploit |
Want to check another image? Run a full scan with the Docker Security Scanner.