Vulnerability Reportoven/bun:1.3.5-distroless

oven/bun:1.3.5-distroless

digestsha256:1f24d26e134e3bafa14fe5fc8fc630473f86b3a5c660b8049534c0948a9adbe4

Executive Summary

Last scanned: Aug 1, 2026

Threat ScoreSAFE• Max exposed severity is 4.5 across 9 findings, with no severity above 4.5.• Max post-exploit severity is 3.53 across 8 findings, indicating no notable post-exploit risk.• Trust check reports a reliable popular community image (score 90) with 37M+ pulls and pinned by digest.• No specific CVE findings were listed in the exposed surface or post-exploit analysis.

0/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (37M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. The scanner identified 9 exposed and 8 post-exploit findings, but all are low severity (max 4.5 and 3.53) and do not present practical risk. The image is a popular, reliable community image pinned by digest, and the threat score is 0. No high-impact CVE findings were reported.

Already in good shape · 2 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

17 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2018-20796	MEDIUM4.5	libc6 2.41-12 No fix yet	5.8% Low-Moderate Risk	Directly Exposed
CVE-2019-9192	MEDIUM4.5	libc6 2.41-12 No fix yet	2.4% Low-Moderate Risk	Directly Exposed
CVE-2026-5450	MEDIUM4.25	libc6 2.41-12 No fix yet	0.5% Theoretical Threat	Directly Exposed
CVE-2026-5928	MEDIUM4.25	libc6 2.41-12 No fix yet	0.4% Theoretical Threat	Directly Exposed
CVE-2019-1010022	LOW3.53	libc6 2.41-12 No fix yet	3.2% Low-Moderate Risk	Post-Exploit
CVE-2026-4438	LOW3.4	libc6 2.41-12 fixed in 2.41-12+deb13u3	0.3% Theoretical Threat	Directly Exposed
CVE-2026-4437	LOW3.31	libc6 2.41-12 fixed in 2.41-12+deb13u3	0.3% Theoretical Threat	Directly Exposed
CVE-2019-1010023	LOW3.17	libc6 2.41-12 No fix yet	3.1% Low-Moderate Risk	Post-Exploit
CVE-2026-0915	LOW2.7	libc6 2.41-12 fixed in 2.41-12+deb13u2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-4046	LOW2.7	libc6 2.41-12 fixed in 2.41-12+deb13u3	0.4% Theoretical Threat	Directly Exposed
CVE-2026-0861	LOW2.48	libc6 2.41-12 fixed in 2.41-12+deb13u2	0.4% Theoretical Threat	Post-Exploit
CVE-2010-4756	LOW2.4	libc6 2.41-12 No fix yet	2.6% Low-Moderate Risk	Directly Exposed
CVE-2026-6238	LOW1.99	libc6 2.41-12 No fix yet	0.4% Theoretical Threat	Post-Exploit
CVE-2019-1010024	LOW1.91	libc6 2.41-12 No fix yet	3.2% Low-Moderate Risk	Post-Exploit
CVE-2019-1010025	LOW1.91	libc6 2.41-12 No fix yet	2.3% Low-Moderate Risk	Post-Exploit
CVE-2026-5435	LOW1.81	libc6 2.41-12 No fix yet	0.2% Theoretical Threat	Post-Exploit
CVE-2025-15281	LOW1.81	libc6 2.41-12 fixed in 2.41-12+deb13u2	0.4% Theoretical Threat	Post-Exploit

Want to check another image? Run a full scan with the Docker Security Scanner.