Vulnerability Reportoven/bun:1.3.6-distroless

oven/bun:1.3.6-distroless
digestsha256:b1f614616c1b826e33ccffa81b277706bcb50b67239f418cc2432c1abaa559a9

Executive Summary

Last scanned:

Threat Score
0/100SAFE
Reputation
RELIABLE

This image is safe for production use. Although 4 exposed and 13 post-exploit findings exist, all are low severity (max 4.25 and 3.53 respectively) and none appear in the top findings list. The image is from a reliable community publisher with high trust, and the pre-calculated threat score of 0 confirms a minimal risk profile.

Vulnerabilities

Vulnerability Log

17 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-5450MEDIUM4.25
libc6
2.41-12+deb13u1
No fix yet
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-5928MEDIUM4.25
libc6
2.41-12+deb13u1
No fix yet
0.4%
Theoretical Threat
Directly Exposed
CVE-2019-1010022LOW3.53
libc6
2.41-12+deb13u1
No fix yet
3.2%
Low-Moderate Risk
Post-Exploit
CVE-2026-4438LOW3.4
libc6
2.41-12+deb13u1
fixed in 2.41-12+deb13u3
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-4437LOW3.31
libc6
2.41-12+deb13u1
fixed in 2.41-12+deb13u3
0.3%
Theoretical Threat
Directly Exposed
CVE-2019-1010023LOW3.17
libc6
2.41-12+deb13u1
No fix yet
3.1%
Low-Moderate Risk
Post-Exploit
CVE-2018-20796LOW2.7
libc6
2.41-12+deb13u1
No fix yet
5.8%
Low-Moderate Risk
Post-Exploit
CVE-2019-9192LOW2.7
libc6
2.41-12+deb13u1
No fix yet
2.4%
Low-Moderate Risk
Post-Exploit
CVE-2026-0861LOW2.48
libc6
2.41-12+deb13u1
fixed in 2.41-12+deb13u2
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-6238LOW1.99
libc6
2.41-12+deb13u1
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2019-1010024LOW1.91
libc6
2.41-12+deb13u1
No fix yet
3.2%
Low-Moderate Risk
Post-Exploit
CVE-2019-1010025LOW1.91
libc6
2.41-12+deb13u1
No fix yet
2.3%
Low-Moderate Risk
Post-Exploit
CVE-2026-5435LOW1.81
libc6
2.41-12+deb13u1
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-15281LOW1.81
libc6
2.41-12+deb13u1
fixed in 2.41-12+deb13u2
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-0915LOW1.62
libc6
2.41-12+deb13u1
fixed in 2.41-12+deb13u2
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-4046LOW1.62
libc6
2.41-12+deb13u1
fixed in 2.41-12+deb13u3
0.4%
Theoretical Threat
Post-Exploit
CVE-2010-4756LOW1.44
libc6
2.41-12+deb13u1
No fix yet
2.6%
Low-Moderate Risk
Post-Exploit

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.