Last scanned:
This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker could exploit CVE-2026-44249 to bypass configured IPv6 subnet restrictions or exploit CVE-2026-68497 to consume CPU through malformed numeric input, disrupting service availability. Upgrading Netty and Jackson to the patched versions named in the findings would fully eliminate the cited CVEs. Note: CVE-2026-44249 only applies if IPv6 subnet-based access rules are configured.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-44249 | MEDIUM6.48 | io.netty:netty-handler 4.1.133.Final fixed in 4.2.15.Final, 4.1.135.Final | 1.3% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89425 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.21.4 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-core 2.22.1 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-68497 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.21.4 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.21.4 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-91777 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.21.4 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-68497 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.22.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.22.1 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-91777 | MEDIUM6.38 | com.fasterxml.jackson.core:jackson-databind 2.22.1 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59901 | MEDIUM6.38 | io.netty:netty-codec 4.1.133.Final fixed in 4.1.136.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-59899 | MEDIUM6.38 | io.netty:netty-codec-http 4.1.133.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-59903 | MEDIUM6.38 | io.netty:netty-codec-http 4.1.133.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-59903 | MEDIUM6.38 | io.netty:netty-codec-http 4.2.16.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-75596 | MEDIUM6.38 | io.netty:netty-handler 4.1.133.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75596 | MEDIUM6.38 | io.netty:netty-handler 4.2.16.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-64607 | MEDIUM6.38 | org.apache.httpcomponents.client5:httpclient5 5.6.1 fixed in 5.6.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-75140 | MEDIUM6.38 | org.jsoup:jsoup 1.15.3 fixed in 1.23.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-75140 | MEDIUM6.38 | org.jsoup:jsoup 1.19.1 fixed in 1.23.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM6.38 | tools.jackson.core:jackson-core 3.2.1 fixed in 3.1.7, 3.2.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-68497 | MEDIUM6.38 | tools.jackson.core:jackson-databind 3.2.1 fixed in 3.2.2, 3.1.6 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | MEDIUM6.38 | tools.jackson.core:jackson-databind 3.2.1 fixed in 3.1.7, 3.2.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-91777 | MEDIUM6.38 | tools.jackson.core:jackson-databind 3.2.1 fixed in 3.1.7, 3.2.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-84782 | MEDIUM6.29 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-84782 | MEDIUM6.29 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-86143 | MEDIUM6.21 | libxml2 2.10.4-1.amzn2023.0.20 fixed in 2.10.4-1.amzn2023.0.21 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-75595 | MEDIUM6.18 | io.netty:netty-handler 4.1.133.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-75595 | MEDIUM6.18 | io.netty:netty-handler 4.2.16.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-45416 | MEDIUM6 | io.netty:netty-handler 4.1.133.Final fixed in 4.2.15.Final, 4.1.135.Final | 1.6% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-106451 | MEDIUM5.95 | at.yawk.lz4:lz4-java 1.11.1 fixed in 1.11.4 | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-59889 | MEDIUM5.52 | com.fasterxml.jackson.core:jackson-databind 2.21.4 fixed in 2.21.5, 2.18.9, 2.22.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59921 | MEDIUM5.52 | io.netty:netty-codec-http 4.1.133.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-86137 | MEDIUM5.18 | libxml2 2.10.4-1.amzn2023.0.20 fixed in 2.10.4-1.amzn2023.0.21 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-56746 | MEDIUM5.1 | io.netty:netty-codec-http 4.1.133.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56819 | MEDIUM5.1 | io.netty:netty-codec-http2 4.1.133.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-48043 | MEDIUM5.1 | io.netty:netty-codec-http2 4.1.133.Final fixed in 4.1.135.Final, 4.2.15.Final | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-50010 | MEDIUM5.1 | io.netty:netty-handler 4.1.133.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54872 | MEDIUM5.02 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-72897 | MEDIUM5.02 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-75805 | MEDIUM5.02 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-54872 | MEDIUM5.02 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-72897 | MEDIUM5.02 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-75805 | MEDIUM5.02 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89407 | MEDIUM5.02 | com.fasterxml.jackson.core:jackson-core 2.21.4 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89407 | MEDIUM5.02 | com.fasterxml.jackson.core:jackson-core 2.22.1 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-49844 | MEDIUM5.02 | org.apache.logging.log4j:log4j-api 2.25.4 fixed in 2.25.5, 2.26.1 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-89407 | MEDIUM5.02 | tools.jackson.core:jackson-core 3.2.1 fixed in 3.1.7, 3.2.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-83557 | MEDIUM4.76 | com.fasterxml.jackson.core:jackson-databind 2.21.4 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-83557 | MEDIUM4.76 | com.fasterxml.jackson.core:jackson-databind 2.22.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-83557 | MEDIUM4.76 | tools.jackson.core:jackson-databind 3.2.1 fixed in 3.1.6, 3.2.2 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-42772 | MEDIUM4.5 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-54873 | MEDIUM4.5 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-75804 | MEDIUM4.5 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75806 | MEDIUM4.5 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-84784 | MEDIUM4.5 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42772 | MEDIUM4.5 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-54873 | MEDIUM4.5 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-75804 | MEDIUM4.5 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75806 | MEDIUM4.5 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-84784 | MEDIUM4.5 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-106450 | MEDIUM4.5 | at.yawk.lz4:lz4-java 1.11.1 fixed in 1.11.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-106452 | MEDIUM4.5 | at.yawk.lz4:lz4-java 1.11.1 fixed in 1.11.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-106453 | MEDIUM4.5 | at.yawk.lz4:lz4-java 1.11.1 fixed in 1.11.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-19032 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.21.4 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-54515 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.21.4 fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-77310 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.21.4 fixed in 2.18.9, 2.21.5, 2.22.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-19032 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.22.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-50020 | MEDIUM4.5 | io.netty:netty-codec-http 4.1.133.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-47244 | MEDIUM4.5 | io.netty:netty-codec-http2 4.1.133.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-50560 | MEDIUM4.5 | io.netty:netty-codec-http2 4.1.133.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-59900 | MEDIUM4.5 | io.netty:netty-codec-http2 4.1.133.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-19032 | MEDIUM4.5 | tools.jackson.core:jackson-databind 3.2.1 fixed in 3.1.6, 3.2.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-71497 | MEDIUM4 | org.jsoup:jsoup 1.15.3 fixed in 1.23.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-71497 | MEDIUM4 | org.jsoup:jsoup 1.19.1 fixed in 1.23.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-78367 | LOW3.57 | rpm 4.16.1.3-29.amzn2023.0.7 fixed in 4.16.1.3-29.amzn2023.0.8 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-84233 | LOW3.57 | rpm 4.16.1.3-29.amzn2023.0.7 fixed in 4.16.1.3-29.amzn2023.0.8 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-35189 | LOW3.15 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-35191 | LOW3.15 | openssl-fips-provider-latest 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-35189 | LOW3.15 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-35191 | LOW3.15 | openssl-libs 1:3.5.8-1.amzn2023.0.1 fixed in 1:3.5.8-1.amzn2023.0.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-106449 | LOW3.15 | at.yawk.lz4:lz4-java 1.11.1 fixed in 1.11.4 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-10050 | LOW2.78 | org.eclipse.jetty:jetty-security 9.4.58.v20250814 fixed in 9.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-74860 | LOW2.6 | libxml2 2.10.4-1.amzn2023.0.20 fixed in 2.10.4-1.amzn2023.0.21 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-86138 | LOW2.39 | libxml2 2.10.4-1.amzn2023.0.20 fixed in 2.10.4-1.amzn2023.0.21 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-86140 | LOW2.39 | libxml2 2.10.4-1.amzn2023.0.20 fixed in 2.10.4-1.amzn2023.0.21 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86142 | LOW2.39 | libxml2 2.10.4-1.amzn2023.0.20 fixed in 2.10.4-1.amzn2023.0.21 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-86144 | LOW2.39 | libxml2 2.10.4-1.amzn2023.0.20 fixed in 2.10.4-1.amzn2023.0.21 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-89161 | LOW2.39 | pcre2 10.40-1.amzn2023.0.3 fixed in 10.40-1.amzn2023.0.4 | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-55831 | LOW2.29 | io.netty:netty-codec-http 4.1.133.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-55833 | LOW2.29 | io.netty:netty-codec-http 4.1.133.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-56745 | LOW2.29 | io.netty:netty-codec-http 4.1.133.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-59898 | LOW2.29 | io.netty:netty-codec-http 4.1.133.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-54399 | LOW2.29 | org.apache.httpcomponents.core5:httpcore5 5.4 fixed in 5.4.3, 5.5-beta2 | 0.9% Theoretical Threat | Post-Exploit |
| CVE-2026-54428 | LOW2.29 | org.apache.httpcomponents.core5:httpcore5-h2 5.4 fixed in 5.4.3, 5.5-beta2 | 0.9% Theoretical Threat | Post-Exploit |
| CVE-2026-80230 | LOW1.89 | curl-minimal 8.21.0-5.amzn2023.0.1 fixed in 8.21.0-5.amzn2023.0.2 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-80230 | LOW1.89 | libcurl-minimal 8.21.0-5.amzn2023.0.1 fixed in 8.21.0-5.amzn2023.0.2 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-89161 | NONE0 | pcre2-syntax 10.40-1.amzn2023.0.3 fixed in 10.40-1.amzn2023.0.4 | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-97689 | NONE0 | python3-pip-wheel 21.3.1-2.amzn2023.0.21 fixed in 21.3.1-2.amzn2023.0.22 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-77422 | NONE0 | org.jline:jline-builtins 3.21.0 fixed in 4.3.1, 3.30.15 | 0.5% Theoretical Threat | Not Applicable |
| CVE-2026-78367 | NONE0 | python3-rpm 4.16.1.3-29.amzn2023.0.7 fixed in 4.16.1.3-29.amzn2023.0.8 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-84233 | NONE0 | python3-rpm 4.16.1.3-29.amzn2023.0.7 fixed in 4.16.1.3-29.amzn2023.0.8 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-78367 | NONE0 | rpm-build-libs 4.16.1.3-29.amzn2023.0.7 fixed in 4.16.1.3-29.amzn2023.0.8 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-84233 | NONE0 | rpm-build-libs 4.16.1.3-29.amzn2023.0.7 fixed in 4.16.1.3-29.amzn2023.0.8 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-78367 | NONE0 | rpm-libs 4.16.1.3-29.amzn2023.0.7 fixed in 4.16.1.3-29.amzn2023.0.8 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-84233 | NONE0 | rpm-libs 4.16.1.3-29.amzn2023.0.7 fixed in 4.16.1.3-29.amzn2023.0.8 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-78367 | NONE0 | rpm-sign-libs 4.16.1.3-29.amzn2023.0.7 fixed in 4.16.1.3-29.amzn2023.0.8 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-84233 | NONE0 | rpm-sign-libs 4.16.1.3-29.amzn2023.0.7 fixed in 4.16.1.3-29.amzn2023.0.8 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-77421 | NONE0 | org.jline:jline-builtins 3.21.0 fixed in 4.3.1, 3.30.15 | 0.4% Theoretical Threat | Not Applicable |
| CVE-2026-77420 | NONE0 | org.jline:jline-reader 3.21.0 fixed in 4.3.1, 3.30.15 | 0.1% Theoretical Threat | Not Applicable |
| GHSA-mhm7-754m-9p8w | NONE0 | com.fasterxml.jackson.core:jackson-databind 2.21.4 fixed in 2.18.9, 2.21.5 | — | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.