Vulnerability Reportoven/bun:1.3.4-distroless

oven/bun:1.3.4-distroless
digestsha256:075c8afbb06ba430a896bf059de4a758d422a68e7280b9929bd572c4039626dc

Executive Summary

Last scanned:

Threat Score
0/100SAFE
Reputation
RELIABLE

This image is safe for production use. Although the scan reports 3 exposed and 14 post-exploit findings, the maximum severity for any exposed finding is 4.25 and for post-exploit is 3.53, both in the low range. No CVE IDs or specific findings were provided, so there is no evidence of exploitable vulnerabilities in this context. The image is from a reliable publisher and is pinned by digest, which further reduces supply-chain risk.

Vulnerabilities

Vulnerability Log

17 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-5450MEDIUM4.25
libc6
2.41-12
No fix yet
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-5928MEDIUM4.25
libc6
2.41-12
No fix yet
0.4%
Theoretical Threat
Directly Exposed
CVE-2019-1010022LOW3.53
libc6
2.41-12
No fix yet
3.2%
Low-Moderate Risk
Post-Exploit
CVE-2026-4438LOW3.4
libc6
2.41-12
fixed in 2.41-12+deb13u3
0.3%
Theoretical Threat
Directly Exposed
CVE-2019-1010023LOW3.17
libc6
2.41-12
No fix yet
3.1%
Low-Moderate Risk
Post-Exploit
CVE-2018-20796LOW2.7
libc6
2.41-12
No fix yet
5.8%
Low-Moderate Risk
Post-Exploit
CVE-2019-9192LOW2.7
libc6
2.41-12
No fix yet
2.4%
Low-Moderate Risk
Post-Exploit
CVE-2026-0861LOW2.48
libc6
2.41-12
fixed in 2.41-12+deb13u2
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-4437LOW1.99
libc6
2.41-12
fixed in 2.41-12+deb13u3
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-6238LOW1.99
libc6
2.41-12
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2019-1010024LOW1.91
libc6
2.41-12
No fix yet
3.2%
Low-Moderate Risk
Post-Exploit
CVE-2019-1010025LOW1.91
libc6
2.41-12
No fix yet
2.3%
Low-Moderate Risk
Post-Exploit
CVE-2026-5435LOW1.81
libc6
2.41-12
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-15281LOW1.81
libc6
2.41-12
fixed in 2.41-12+deb13u2
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-0915LOW1.62
libc6
2.41-12
fixed in 2.41-12+deb13u2
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-4046LOW1.62
libc6
2.41-12
fixed in 2.41-12+deb13u3
0.4%
Theoretical Threat
Post-Exploit
CVE-2010-4756LOW1.44
libc6
2.41-12
No fix yet
2.6%
Low-Moderate Risk
Post-Exploit

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.