Last scanned:
This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The scan does report exposed findings, including CVE-2025-15467 in the OpenSSL libraries, but it is only a risk if application code parses untrusted CMS or S/MIME data with AES-GCM, which this Bun runtime does not do in normal operation. Updating the OpenSSL packages would remove this finding, and running the container as a non-root user would reduce the impact of any future compromise.
Hardening plan for this image · 4 steps. The first cuts risk from 27 to 0.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2025-15467 | MEDIUM6 | libcrypto3 3.5.4-r0 fixed in 3.5.5-r0 | 74.8% Actively Exploited | Directly Exposed |
| CVE-2025-15467 | MEDIUM6 | libssl3 3.5.4-r0 fixed in 3.5.5-r0 | 74.8% Actively Exploited | Directly Exposed |
| CVE-2026-31790 | MEDIUM5.9 | libcrypto3 3.5.4-r0 fixed in 3.5.6-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42764 | MEDIUM5.9 | libcrypto3 3.5.4-r0 fixed in 3.5.7-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2025-15468 | MEDIUM5.9 | libcrypto3 3.5.4-r0 fixed in 3.5.5-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2025-66199 | MEDIUM5.9 | libcrypto3 3.5.4-r0 fixed in 3.5.5-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2025-69420 | MEDIUM5.9 | libcrypto3 3.5.4-r0 fixed in 3.5.5-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-22796 | MEDIUM5.9 | libcrypto3 3.5.4-r0 fixed in 3.5.5-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42769 | MEDIUM5.9 | libcrypto3 3.5.4-r0 fixed in 3.5.7-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-42770 | MEDIUM5.9 | libcrypto3 3.5.4-r0 fixed in 3.5.7-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-63073 | MEDIUM5.9 | libcrypto3 3.5.4-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-9076 | MEDIUM5.9 | libcrypto3 3.5.4-r0 fixed in 3.5.7-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-31790 | MEDIUM5.9 | libssl3 3.5.4-r0 fixed in 3.5.6-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42764 | MEDIUM5.9 | libssl3 3.5.4-r0 fixed in 3.5.7-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2025-15468 | MEDIUM5.9 | libssl3 3.5.4-r0 fixed in 3.5.5-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2025-66199 | MEDIUM5.9 | libssl3 3.5.4-r0 fixed in 3.5.5-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2025-69420 | MEDIUM5.9 | libssl3 3.5.4-r0 fixed in 3.5.5-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-22796 | MEDIUM5.9 | libssl3 3.5.4-r0 fixed in 3.5.5-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42769 | MEDIUM5.9 | libssl3 3.5.4-r0 fixed in 3.5.7-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-42770 | MEDIUM5.9 | libssl3 3.5.4-r0 fixed in 3.5.7-r0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-63073 | MEDIUM5.9 | libssl3 3.5.4-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-9076 | MEDIUM5.9 | libssl3 3.5.4-r0 fixed in 3.5.7-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-31789 | MEDIUM5.88 | libcrypto3 3.5.4-r0 fixed in 3.5.6-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-31789 | MEDIUM5.88 | libssl3 3.5.4-r0 fixed in 3.5.6-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-15469 | MEDIUM5.5 | libcrypto3 3.5.4-r0 fixed in 3.5.5-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-22795 | MEDIUM5.5 | libcrypto3 3.5.4-r0 fixed in 3.5.5-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-7383 | MEDIUM5.5 | libcrypto3 3.5.4-r0 fixed in 3.5.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2025-15469 | MEDIUM5.5 | libssl3 3.5.4-r0 fixed in 3.5.5-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-22795 | MEDIUM5.5 | libssl3 3.5.4-r0 fixed in 3.5.5-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-7383 | MEDIUM5.5 | libssl3 3.5.4-r0 fixed in 3.5.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-6042 | MEDIUM5.5 | musl 1.2.5-r10 fixed in 1.2.5-r11 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-6042 | MEDIUM5.5 | musl-utils 1.2.5-r10 fixed in 1.2.5-r11 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-45445 | MEDIUM5.46 | libcrypto3 3.5.4-r0 fixed in 3.5.7-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-45445 | MEDIUM5.46 | libssl3 3.5.4-r0 fixed in 3.5.7-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-42766 | MEDIUM5.3 | libcrypto3 3.5.4-r0 fixed in 3.5.7-r0 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42767 | MEDIUM5.3 | libcrypto3 3.5.4-r0 fixed in 3.5.7-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42766 | MEDIUM5.3 | libssl3 3.5.4-r0 fixed in 3.5.7-r0 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42767 | MEDIUM5.3 | libssl3 3.5.4-r0 fixed in 3.5.7-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-34180 | MEDIUM5 | libcrypto3 3.5.4-r0 fixed in 3.5.7-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-34180 | MEDIUM5 | libssl3 3.5.4-r0 fixed in 3.5.7-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-28387 | MEDIUM4.86 | libcrypto3 3.5.4-r0 fixed in 3.5.6-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-45447 | MEDIUM4.86 | libcrypto3 3.5.4-r0 fixed in 3.5.7-r0 | 4.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-28387 | MEDIUM4.86 | libssl3 3.5.4-r0 fixed in 3.5.6-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-45447 | MEDIUM4.86 | libssl3 3.5.4-r0 fixed in 3.5.7-r0 | 4.0% Low-Moderate Risk | Directly Exposed |
| CVE-2025-68160 | MEDIUM4.7 | libcrypto3 3.5.4-r0 fixed in 3.5.5-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-68160 | MEDIUM4.7 | libssl3 3.5.4-r0 fixed in 3.5.5-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-40200 | MEDIUM4.68 | musl 1.2.5-r10 fixed in 1.2.5-r12 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-40200 | MEDIUM4.68 | musl-utils 1.2.5-r10 fixed in 1.2.5-r12 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-22184 | MEDIUM4.68 | zlib 1.3.1-r2 fixed in 1.3.2-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-69421 | MEDIUM4.5 | libcrypto3 3.5.4-r0 fixed in 3.5.5-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-14456 | MEDIUM4.5 | libcrypto3 3.5.4-r0 fixed in 3.5.8-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-28388 | MEDIUM4.5 | libcrypto3 3.5.4-r0 fixed in 3.5.6-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-28389 | MEDIUM4.5 | libcrypto3 3.5.4-r0 fixed in 3.5.6-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-28390 | MEDIUM4.5 | libcrypto3 3.5.4-r0 fixed in 3.5.6-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-18798 | MEDIUM4.5 | libcrypto3 3.5.4-r0 fixed in 3.5.8-r0 | 1.7% Low-Moderate Risk | Directly Exposed |
| CVE-2026-34183 | MEDIUM4.5 | libcrypto3 3.5.4-r0 fixed in 3.5.7-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63072 | MEDIUM4.5 | libcrypto3 3.5.4-r0 fixed in 3.5.8-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-63076 | MEDIUM4.5 | libcrypto3 3.5.4-r0 fixed in 3.5.8-r0 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-14457 | MEDIUM4.5 | libcrypto3 3.5.4-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-54874 | MEDIUM4.5 | libcrypto3 3.5.4-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63074 | MEDIUM4.5 | libcrypto3 3.5.4-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63075 | MEDIUM4.5 | libcrypto3 3.5.4-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2025-69421 | MEDIUM4.5 | libssl3 3.5.4-r0 fixed in 3.5.5-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-14456 | MEDIUM4.5 | libssl3 3.5.4-r0 fixed in 3.5.8-r0 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-28388 | MEDIUM4.5 | libssl3 3.5.4-r0 fixed in 3.5.6-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-28389 | MEDIUM4.5 | libssl3 3.5.4-r0 fixed in 3.5.6-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-28390 | MEDIUM4.5 | libssl3 3.5.4-r0 fixed in 3.5.6-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-18798 | MEDIUM4.5 | libssl3 3.5.4-r0 fixed in 3.5.8-r0 | 1.7% Low-Moderate Risk | Directly Exposed |
| CVE-2026-34183 | MEDIUM4.5 | libssl3 3.5.4-r0 fixed in 3.5.7-r0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-63072 | MEDIUM4.5 | libssl3 3.5.4-r0 fixed in 3.5.8-r0 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-63076 | MEDIUM4.5 | libssl3 3.5.4-r0 fixed in 3.5.8-r0 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-14457 | MEDIUM4.5 | libssl3 3.5.4-r0 fixed in 3.5.8-r0 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-54874 | MEDIUM4.5 | libssl3 3.5.4-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63074 | MEDIUM4.5 | libssl3 3.5.4-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63075 | MEDIUM4.5 | libssl3 3.5.4-r0 fixed in 3.5.8-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2025-69419 | MEDIUM4.44 | libcrypto3 3.5.4-r0 fixed in 3.5.5-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-34182 | MEDIUM4.44 | libcrypto3 3.5.4-r0 fixed in 3.5.7-r0 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2025-69419 | MEDIUM4.44 | libssl3 3.5.4-r0 fixed in 3.5.5-r0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-34182 | MEDIUM4.44 | libssl3 3.5.4-r0 fixed in 3.5.7-r0 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2025-69418 | MEDIUM4 | libcrypto3 3.5.4-r0 fixed in 3.5.5-r0 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2025-69418 | MEDIUM4 | libssl3 3.5.4-r0 fixed in 3.5.5-r0 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl 1.2.5-r10 fixed in 1.2.5-r13 | — | Directly Exposed |
| CVE-2026-107891 | MEDIUM4 | musl-utils 1.2.5-r10 fixed in 1.2.5-r13 | — | Directly Exposed |
| CVE-2026-2673 | LOW3.9 | libcrypto3 3.5.4-r0 fixed in 3.5.6-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-2673 | LOW3.9 | libssl3 3.5.4-r0 fixed in 3.5.6-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-34181 | LOW3.78 | libcrypto3 3.5.4-r0 fixed in 3.5.7-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42768 | LOW3.78 | libcrypto3 3.5.4-r0 fixed in 3.5.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-34181 | LOW3.78 | libssl3 3.5.4-r0 fixed in 3.5.7-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42768 | LOW3.78 | libssl3 3.5.4-r0 fixed in 3.5.7-r0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-45446 | LOW3.7 | libcrypto3 3.5.4-r0 fixed in 3.5.7-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.7 | libcrypto3 3.5.4-r0 fixed in 3.5.8-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-45446 | LOW3.7 | libssl3 3.5.4-r0 fixed in 3.5.7-r0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.7 | libssl3 3.5.4-r0 fixed in 3.5.8-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2025-11187 | LOW3.66 | libcrypto3 3.5.4-r0 fixed in 3.5.5-r0 | 5.2% Low-Moderate Risk | Directly Exposed |
| CVE-2025-11187 | LOW3.66 | libssl3 3.5.4-r0 fixed in 3.5.5-r0 | 5.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-27171 | LOW3.3 | zlib 1.3.1-r2 fixed in 1.3.2-r0 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-85091 | LOW3 | zlib 1.3.1-r2 fixed in 1.3.2-r1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2024-58251 | LOW2.55 | busybox 1.37.0-r19 fixed in 1.37.0-r20 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2024-58251 | LOW2.55 | busybox-binsh 1.37.0-r19 fixed in 1.37.0-r20 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2024-58251 | LOW2.55 | ssl_client 1.37.0-r19 fixed in 1.37.0-r20 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-46394 | LOW1.68 | busybox 1.37.0-r19 fixed in 1.37.0-r20 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-46394 | LOW1.68 | busybox-binsh 1.37.0-r19 fixed in 1.37.0-r20 | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2025-46394 | LOW1.68 | ssl_client 1.37.0-r19 fixed in 1.37.0-r20 | 0.2% Theoretical Threat | Post-Exploit |
Want to check another image? Run a full scan with the Docker Security Scanner.