Last scanned:
This image carries significant risk; production deployment is highly discouraged without strict compensating controls. If an application running in this container parses untrusted CMS data, an attacker could crash the service or possibly execute code inside the process, and running as root by default would make that code execution more damaging. The main driver is CVE-2025-15467 in libcrypto3, which only applies if such CMS parsing is enabled, since the Bun runtime does not normally do this. The image's Alpine base is past end of support, so the OpenSSL packages will not receive fixes and the image should be rebuilt on a supported base with patched libraries, and run as a non-root user, before production use.
Hardening plan for this image · 5 steps. The first cuts risk from 57 to 0.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2025-15467 | HIGH8 | libcrypto3 3.3.3-r0 fixed in 3.3.6-r0 | 74.8% Actively Exploited | Directly ExposedContext importance: MEDIUM |
| CVE-2025-15467 | HIGH8 | libssl3 3.3.3-r0 fixed in 3.3.6-r0 | 74.8% Actively Exploited | Directly ExposedContext importance: MEDIUM |
| CVE-2026-31789 | MEDIUM5.88 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-31789 | MEDIUM5.88 | libssl3 3.3.3-r0 fixed in 3.3.7-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-22795 | MEDIUM5.5 | libcrypto3 3.3.3-r0 fixed in 3.3.6-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-22795 | MEDIUM5.5 | libssl3 3.3.3-r0 fixed in 3.3.6-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-6042 | MEDIUM5.5 | musl 1.2.5-r1 fixed in 1.2.5-r2 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-6042 | MEDIUM5.5 | musl-utils 1.2.5-r1 fixed in 1.2.5-r2 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-28387 | MEDIUM4.86 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-28387 | MEDIUM4.86 | libssl3 3.3.3-r0 fixed in 3.3.7-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2025-68160 | MEDIUM4.7 | libcrypto3 3.3.3-r0 fixed in 3.3.6-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-68160 | MEDIUM4.7 | libssl3 3.3.3-r0 fixed in 3.3.6-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-40200 | MEDIUM4.68 | musl 1.2.5-r1 fixed in 1.2.5-r3 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-40200 | MEDIUM4.68 | musl-utils 1.2.5-r1 fixed in 1.2.5-r3 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-22184 | MEDIUM4.68 | zlib 1.3.1-r1 fixed in 1.3.2-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-69421 | MEDIUM4.5 | libcrypto3 3.3.3-r0 fixed in 3.3.6-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-28388 | MEDIUM4.5 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-28389 | MEDIUM4.5 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-28390 | MEDIUM4.5 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2025-69421 | MEDIUM4.5 | libssl3 3.3.3-r0 fixed in 3.3.6-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-28388 | MEDIUM4.5 | libssl3 3.3.3-r0 fixed in 3.3.7-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-28389 | MEDIUM4.5 | libssl3 3.3.3-r0 fixed in 3.3.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-28390 | MEDIUM4.5 | libssl3 3.3.3-r0 fixed in 3.3.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2025-69419 | MEDIUM4.44 | libcrypto3 3.3.3-r0 fixed in 3.3.6-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2025-69419 | MEDIUM4.44 | libssl3 3.3.3-r0 fixed in 3.3.6-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2025-69418 | MEDIUM4 | libcrypto3 3.3.3-r0 fixed in 3.3.6-r0 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-69418 | MEDIUM4 | libssl3 3.3.3-r0 fixed in 3.3.6-r0 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl 1.2.5-r1 fixed in 1.2.5-r4 | — | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl-utils 1.2.5-r1 fixed in 1.2.5-r4 | — | Directly Exposed |
| CVE-2025-9231 | LOW3.54 | libcrypto3 3.3.3-r0 fixed in 3.3.5-r0 | 2.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-31790 | LOW3.54 | libcrypto3 3.3.3-r0 fixed in 3.3.7-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2025-15468 | LOW3.54 | libcrypto3 3.3.3-r0 fixed in 3.3.6-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2025-66199 | LOW3.54 | libcrypto3 3.3.3-r0 fixed in 3.3.6-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2025-69420 | LOW3.54 | libcrypto3 3.3.3-r0 fixed in 3.3.6-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-22796 | LOW3.54 | libcrypto3 3.3.3-r0 fixed in 3.3.6-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2025-9231 | LOW3.54 | libssl3 3.3.3-r0 fixed in 3.3.5-r0 | 2.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-31790 | LOW3.54 | libssl3 3.3.3-r0 fixed in 3.3.7-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2025-15468 | LOW3.54 | libssl3 3.3.3-r0 fixed in 3.3.6-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2025-66199 | LOW3.54 | libssl3 3.3.3-r0 fixed in 3.3.6-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2025-69420 | LOW3.54 | libssl3 3.3.3-r0 fixed in 3.3.6-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-22796 | LOW3.54 | libssl3 3.3.3-r0 fixed in 3.3.6-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2025-9230 | LOW3.36 | libcrypto3 3.3.3-r0 fixed in 3.3.5-r0 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2025-9230 | LOW3.36 | libssl3 3.3.3-r0 fixed in 3.3.5-r0 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-27171 | LOW3.3 | zlib 1.3.1-r1 fixed in 1.3.2-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-9232 | LOW3.1 | libcrypto3 3.3.3-r0 fixed in 3.3.5-r0 | 2.0% Low-Moderate Risk | Directly Exposed |
| CVE-2025-9232 | LOW3.1 | libssl3 3.3.3-r0 fixed in 3.3.5-r0 | 2.0% Low-Moderate Risk | Directly Exposed |
| CVE-2024-58251 | LOW2.55 | busybox 1.36.1-r29 fixed in 1.36.1-r31 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2024-58251 | LOW2.55 | busybox-binsh 1.36.1-r29 fixed in 1.36.1-r31 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2024-58251 | LOW2.55 | ssl_client 1.36.1-r29 fixed in 1.36.1-r31 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-46394 | LOW1.68 | busybox 1.36.1-r29 fixed in 1.36.1-r31 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-46394 | LOW1.68 | busybox-binsh 1.36.1-r29 fixed in 1.36.1-r31 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-46394 | LOW1.68 | ssl_client 1.36.1-r29 fixed in 1.36.1-r31 | 0.2% Theoretical Threat | Post-Exploit |
Want to check another image? Run a full scan with the Docker Security Scanner.