Vulnerability Reportoven/bun:1.3.6-distroless

oven/bun:1.3.6-distroless

digestsha256:b1f614616c1b826e33ccffa81b277706bcb50b67239f418cc2432c1abaa559a9

Executive Summary

Last scanned: Aug 1, 2026

Threat ScoreSAFE• Pre-calculated threat score is 0, placing the image in the SAFE band.• All 4 exposed and 13 post-exploit vulnerabilities are low severity (max 4.25 and 3.53); none reach the CAUTION or DANGEROUS threshold.• Trust verdict is RELIABLE (score 90) with strong community reputation (37M+ pulls) and immutable digest pinning.• No top exposed-surface or post-exploit findings were provided, meaning no specific CVE IDs are available to cite.

0/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (37M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. Although 4 exposed and 13 post-exploit findings exist, all are low severity (max 4.25 and 3.53 respectively) and none appear in the top findings list. The image is from a reliable community publisher with high trust, and the pre-calculated threat score of 0 confirms a minimal risk profile.

Already in good shape · 2 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

17 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-5450	MEDIUM4.25	libc6 2.41-12+deb13u1 No fix yet	0.5% Theoretical Threat	Directly Exposed
CVE-2026-5928	MEDIUM4.25	libc6 2.41-12+deb13u1 No fix yet	0.4% Theoretical Threat	Directly Exposed
CVE-2019-1010022	LOW3.53	libc6 2.41-12+deb13u1 No fix yet	3.2% Low-Moderate Risk	Post-Exploit
CVE-2026-4438	LOW3.4	libc6 2.41-12+deb13u1 fixed in 2.41-12+deb13u3	0.3% Theoretical Threat	Directly Exposed
CVE-2026-4437	LOW3.31	libc6 2.41-12+deb13u1 fixed in 2.41-12+deb13u3	0.3% Theoretical Threat	Directly Exposed
CVE-2019-1010023	LOW3.17	libc6 2.41-12+deb13u1 No fix yet	3.1% Low-Moderate Risk	Post-Exploit
CVE-2018-20796	LOW2.7	libc6 2.41-12+deb13u1 No fix yet	5.8% Low-Moderate Risk	Post-Exploit
CVE-2019-9192	LOW2.7	libc6 2.41-12+deb13u1 No fix yet	2.4% Low-Moderate Risk	Post-Exploit
CVE-2026-0861	LOW2.48	libc6 2.41-12+deb13u1 fixed in 2.41-12+deb13u2	0.4% Theoretical Threat	Post-Exploit
CVE-2026-6238	LOW1.99	libc6 2.41-12+deb13u1 No fix yet	0.4% Theoretical Threat	Post-Exploit
CVE-2019-1010024	LOW1.91	libc6 2.41-12+deb13u1 No fix yet	3.2% Low-Moderate Risk	Post-Exploit
CVE-2019-1010025	LOW1.91	libc6 2.41-12+deb13u1 No fix yet	2.3% Low-Moderate Risk	Post-Exploit
CVE-2026-5435	LOW1.81	libc6 2.41-12+deb13u1 No fix yet	0.2% Theoretical Threat	Post-Exploit
CVE-2025-15281	LOW1.81	libc6 2.41-12+deb13u1 fixed in 2.41-12+deb13u2	0.4% Theoretical Threat	Post-Exploit
CVE-2026-0915	LOW1.62	libc6 2.41-12+deb13u1 fixed in 2.41-12+deb13u2	0.6% Theoretical Threat	Post-Exploit
CVE-2026-4046	LOW1.62	libc6 2.41-12+deb13u1 fixed in 2.41-12+deb13u3	0.4% Theoretical Threat	Post-Exploit
CVE-2010-4756	LOW1.44	libc6 2.41-12+deb13u1 No fix yet	2.6% Low-Moderate Risk	Post-Exploit

Want to check another image? Run a full scan with the Docker Security Scanner.