Vulnerability Reportoven/bun:1.3.7-distroless

oven/bun:1.3.7-distroless

digestsha256:7fb18c466d606ded1b507a5349c0ae7b1d1b67b26dab5cba988d0b96aae9dea4

Executive Summary

Last scanned: Aug 1, 2026

Threat ScoreSAFE• Overall threat score is 0, indicating no elevated risk factors.• No exposed-surface or post-exploit findings were reported (INPUT 4 and INPUT 5 are empty).• The image is pinned by digest and is a popular community image with 37M+ pulls, reducing supply-chain risk.• Maximum exposed severity is 4.25; maximum post-exploit severity is 3.53, both below the 6.0 action threshold.• Exposed surface count is 3, but all are low severity and none require attention.

0/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (37M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. Although 3 exposed vulnerabilities and 14 post-exploit issues are present, none exceed a severity of 4.25 and no exploitable findings were identified. The image is widely used and pinned by digest, adding supply-chain assurance. No compensating controls are necessary.

Already in good shape · 2 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

17 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-5450	MEDIUM4.25	libc6 2.41-12+deb13u1 No fix yet	0.5% Theoretical Threat	Directly Exposed
CVE-2026-5928	MEDIUM4.25	libc6 2.41-12+deb13u1 No fix yet	0.4% Theoretical Threat	Directly Exposed
CVE-2019-1010022	LOW3.53	libc6 2.41-12+deb13u1 No fix yet	3.2% Low-Moderate Risk	Post-Exploit
CVE-2026-4438	LOW3.4	libc6 2.41-12+deb13u1 fixed in 2.41-12+deb13u3	0.3% Theoretical Threat	Directly Exposed
CVE-2019-1010023	LOW3.17	libc6 2.41-12+deb13u1 No fix yet	3.1% Low-Moderate Risk	Post-Exploit
CVE-2018-20796	LOW2.7	libc6 2.41-12+deb13u1 No fix yet	5.8% Low-Moderate Risk	Post-Exploit
CVE-2019-9192	LOW2.7	libc6 2.41-12+deb13u1 No fix yet	2.4% Low-Moderate Risk	Post-Exploit
CVE-2026-0861	LOW2.48	libc6 2.41-12+deb13u1 fixed in 2.41-12+deb13u2	0.4% Theoretical Threat	Post-Exploit
CVE-2026-4437	LOW1.99	libc6 2.41-12+deb13u1 fixed in 2.41-12+deb13u3	0.3% Theoretical Threat	Post-Exploit
CVE-2026-6238	LOW1.99	libc6 2.41-12+deb13u1 No fix yet	0.4% Theoretical Threat	Post-Exploit
CVE-2019-1010024	LOW1.91	libc6 2.41-12+deb13u1 No fix yet	3.2% Low-Moderate Risk	Post-Exploit
CVE-2019-1010025	LOW1.91	libc6 2.41-12+deb13u1 No fix yet	2.3% Low-Moderate Risk	Post-Exploit
CVE-2026-5435	LOW1.81	libc6 2.41-12+deb13u1 No fix yet	0.2% Theoretical Threat	Post-Exploit
CVE-2025-15281	LOW1.81	libc6 2.41-12+deb13u1 fixed in 2.41-12+deb13u2	0.4% Theoretical Threat	Post-Exploit
CVE-2026-0915	LOW1.62	libc6 2.41-12+deb13u1 fixed in 2.41-12+deb13u2	0.6% Theoretical Threat	Post-Exploit
CVE-2026-4046	LOW1.62	libc6 2.41-12+deb13u1 fixed in 2.41-12+deb13u3	0.4% Theoretical Threat	Post-Exploit
CVE-2010-4756	LOW1.44	libc6 2.41-12+deb13u1 No fix yet	2.6% Low-Moderate Risk	Post-Exploit

Want to check another image? Run a full scan with the Docker Security Scanner.