Last scanned:
This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The scan shows 41 exposed-surface findings and 4 post-exploit-only findings, but only one exposed issue reaches 6.21 severity and none reach 7.0, while the post-exploit-only maximum is 3.57. The main exposed item is CVE-2026-86143 in libxml2, an integer overflow in write callbacks that can affect data integrity. Trust signals are strong because the image is from the verified opensearchproject publisher and is pinned by digest. Remediating libxml2 would reduce the remaining attack surface, but the current risk does not justify blocking production use.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-86143 | MEDIUM6.21 | libxml2 2.10.4-1.amzn2023.0.20 fixed in 2.10.4-1.amzn2023.0.21 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-106451 | MEDIUM5.95 | at.yawk.lz4:lz4-java 1.11.2 fixed in 1.11.4 | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-86138 | MEDIUM5.3 | libxml2 2.10.4-1.amzn2023.0.20 fixed in 2.10.4-1.amzn2023.0.21 | 0.1% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-86140 | MEDIUM5.3 | libxml2 2.10.4-1.amzn2023.0.20 fixed in 2.10.4-1.amzn2023.0.21 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-86142 | MEDIUM5.3 | libxml2 2.10.4-1.amzn2023.0.20 fixed in 2.10.4-1.amzn2023.0.21 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-86144 | MEDIUM5.3 | libxml2 2.10.4-1.amzn2023.0.20 fixed in 2.10.4-1.amzn2023.0.21 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89161 | MEDIUM5.3 | pcre2 10.40-1.amzn2023.0.3 fixed in 10.40-1.amzn2023.0.4 | 0.1% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-86137 | MEDIUM5.18 | libxml2 2.10.4-1.amzn2023.0.20 fixed in 2.10.4-1.amzn2023.0.21 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM5.1 | com.fasterxml.jackson.core:jackson-core 2.22.2 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-91776 | MEDIUM5.1 | com.fasterxml.jackson.core:jackson-databind 2.22.2 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-91777 | MEDIUM5.1 | com.fasterxml.jackson.core:jackson-databind 2.22.2 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-75140 | MEDIUM5.1 | org.jsoup:jsoup 1.23.1 fixed in 1.23.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89425 | MEDIUM5.1 | tools.jackson.core:jackson-core 3.2.2 fixed in 3.1.7, 3.2.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-91776 | MEDIUM5.1 | tools.jackson.core:jackson-databind 3.2.2 fixed in 3.1.7, 3.2.3 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-91777 | MEDIUM5.1 | tools.jackson.core:jackson-databind 3.2.2 fixed in 3.1.7, 3.2.3 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-75805 | MEDIUM5.02 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-75805 | MEDIUM5.02 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89407 | MEDIUM5.02 | com.fasterxml.jackson.core:jackson-core 2.22.2 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-42772 | MEDIUM4.5 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-54873 | MEDIUM4.5 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-75804 | MEDIUM4.5 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75806 | MEDIUM4.5 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-84784 | MEDIUM4.5 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42772 | MEDIUM4.5 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-54873 | MEDIUM4.5 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-75804 | MEDIUM4.5 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75806 | MEDIUM4.5 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-84784 | MEDIUM4.5 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-106450 | MEDIUM4.5 | at.yawk.lz4:lz4-java 1.11.2 fixed in 1.11.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-74860 | MEDIUM4.33 | libxml2 2.10.4-1.amzn2023.0.20 fixed in 2.10.4-1.amzn2023.0.21 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-84782 | LOW3.77 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-84782 | LOW3.77 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-78367 | LOW3.57 | rpm 4.16.1.3-29.amzn2023.0.7 fixed in 4.16.1.3-29.amzn2023.0.8 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-84233 | LOW3.57 | rpm 4.16.1.3-29.amzn2023.0.7 fixed in 4.16.1.3-29.amzn2023.0.8 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-35189 | LOW3.15 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-35191 | LOW3.15 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-35189 | LOW3.15 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-35191 | LOW3.15 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-106449 | LOW3.15 | at.yawk.lz4:lz4-java 1.11.2 fixed in 1.11.4 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-54872 | LOW3.01 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-72897 | LOW3.01 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-54872 | LOW3.01 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-72897 | LOW3.01 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-80230 | LOW1.89 | curl-minimal 8.21.0-5.amzn2023.0.1 fixed in 8.21.0-5.amzn2023.0.2 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-80230 | LOW1.89 | libcurl-minimal 8.21.0-5.amzn2023.0.1 fixed in 8.21.0-5.amzn2023.0.2 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-89161 | NONE0 | pcre2-syntax 10.40-1.amzn2023.0.3 fixed in 10.40-1.amzn2023.0.4 | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-97689 | NONE0 | python3-pip-wheel 21.3.1-2.amzn2023.0.21 fixed in 21.3.1-2.amzn2023.0.22 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-77422 | NONE0 | org.jline:jline-builtins 3.21.0 fixed in 4.3.1, 3.30.15 | 0.5% Theoretical Threat | Not Applicable |
| CVE-2026-78367 | NONE0 | python3-rpm 4.16.1.3-29.amzn2023.0.7 fixed in 4.16.1.3-29.amzn2023.0.8 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-84233 | NONE0 | python3-rpm 4.16.1.3-29.amzn2023.0.7 fixed in 4.16.1.3-29.amzn2023.0.8 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-78367 | NONE0 | rpm-build-libs 4.16.1.3-29.amzn2023.0.7 fixed in 4.16.1.3-29.amzn2023.0.8 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-84233 | NONE0 | rpm-build-libs 4.16.1.3-29.amzn2023.0.7 fixed in 4.16.1.3-29.amzn2023.0.8 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-78367 | NONE0 | rpm-libs 4.16.1.3-29.amzn2023.0.7 fixed in 4.16.1.3-29.amzn2023.0.8 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-84233 | NONE0 | rpm-libs 4.16.1.3-29.amzn2023.0.7 fixed in 4.16.1.3-29.amzn2023.0.8 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-78367 | NONE0 | rpm-sign-libs 4.16.1.3-29.amzn2023.0.7 fixed in 4.16.1.3-29.amzn2023.0.8 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-84233 | NONE0 | rpm-sign-libs 4.16.1.3-29.amzn2023.0.7 fixed in 4.16.1.3-29.amzn2023.0.8 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-77421 | NONE0 | org.jline:jline-builtins 3.21.0 fixed in 4.3.1, 3.30.15 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-77420 | NONE0 | org.jline:jline-reader 3.21.0 fixed in 4.3.1, 3.30.15 | 0.1% Theoretical Threat | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.