Vulnerability Reportoven/bun:1.3.13-distroless

oven/bun:1.3.13-distroless

digestsha256:fc372e3e810dff25356602172cc97423c6991a15bca22d191abc500d3f1a9eb8

Executive Summary

Last scanned: Aug 1, 2026

Threat ScoreSAFE• Threat score is 0 (SAFE band).• No exposed-surface or post-exploit findings reach severity 6.0; highest exposed severity is 4.5 and post-exploit max is 3.53.• All 8 exposed and 6 post-exploit vulnerabilities are low severity (none >= 6.0).• Image is published by a popular community publisher (oven) with a reliability verdict and pinned by digest.

0/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (37M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. The vulnerability scan shows 8 exposed and 6 post-exploit findings, but all are low severity, with the highest exposed severity at 4.5 and the highest post-exploit at 3.53. None of these findings meet the threshold for concern (severity >= 6.0), and the pre-calculated threat score is 0. The image is also published by a well-regarded community source and pinned by digest, reducing supply-chain risk.

Already in good shape · 3 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

14 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2018-20796	MEDIUM4.5	libc6 2.41-12+deb13u2 No fix yet	5.8% Low-Moderate Risk	Directly Exposed
CVE-2019-9192	MEDIUM4.5	libc6 2.41-12+deb13u2 No fix yet	2.4% Low-Moderate Risk	Directly Exposed
CVE-2026-4437	MEDIUM4.42	libc6 2.41-12+deb13u2 fixed in 2.41-12+deb13u3	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-5450	MEDIUM4.25	libc6 2.41-12+deb13u2 No fix yet	0.5% Theoretical Threat	Directly Exposed
CVE-2026-5928	MEDIUM4.25	libc6 2.41-12+deb13u2 No fix yet	0.4% Theoretical Threat	Directly Exposed
CVE-2019-1010022	LOW3.53	libc6 2.41-12+deb13u2 No fix yet	3.2% Low-Moderate Risk	Post-Exploit
CVE-2026-4438	LOW3.4	libc6 2.41-12+deb13u2 fixed in 2.41-12+deb13u3	0.3% Theoretical Threat	Directly Exposed
CVE-2019-1010023	LOW3.17	libc6 2.41-12+deb13u2 No fix yet	3.1% Low-Moderate Risk	Post-Exploit
CVE-2026-4046	LOW2.7	libc6 2.41-12+deb13u2 fixed in 2.41-12+deb13u3	0.4% Theoretical Threat	Directly Exposed
CVE-2010-4756	LOW2.4	libc6 2.41-12+deb13u2 No fix yet	2.6% Low-Moderate Risk	Directly Exposed
CVE-2026-6238	LOW1.99	libc6 2.41-12+deb13u2 No fix yet	0.4% Theoretical Threat	Post-Exploit
CVE-2019-1010024	LOW1.91	libc6 2.41-12+deb13u2 No fix yet	3.2% Low-Moderate Risk	Post-Exploit
CVE-2019-1010025	LOW1.91	libc6 2.41-12+deb13u2 No fix yet	2.3% Low-Moderate Risk	Post-Exploit
CVE-2026-5435	LOW1.81	libc6 2.41-12+deb13u2 No fix yet	0.2% Theoretical Threat	Post-Exploit

Want to check another image? Run a full scan with the Docker Security Scanner.