Vulnerability Reportoven/bun:1.3.8-distroless

oven/bun:1.3.8-distroless

digestsha256:67d7c1ad66f397c2599759b13c53fe4883247ddeb1c49315d062c67f19731d84

Executive Summary

Last scanned: Aug 1, 2026

Threat ScoreSAFE• No exposed-surface vulnerabilities above trivial severity; max severity is 4.42 across 7 exposed items.• Post-exploit findings are similarly low (max 3.53 across 10 items), indicating no meaningful residual risk.• Image is a popular community build (37M+ pulls) pinned by digest, published by oven, with a reliable trust score of 90.• No CVE IDs were listed in the provided finding data, so none could be cited.

0/100SAFE

ReputationPOPULAR COMMUNITY• High Reputation Community Image (37M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is safe for production use. It contains 7 exposed and 10 post-exploit findings, but their maximum severity is 4.42 and 3.53 respectively, which are well below actionable thresholds. No specific CVE IDs were provided for the top findings, so no concrete exploits are known to apply. The image is trusted from a popular community publisher and pinned by digest, further reducing risk.

Already in good shape · 3 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

17 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-4437	MEDIUM4.42	libc6 2.41-12+deb13u1 fixed in 2.41-12+deb13u3	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-5450	MEDIUM4.25	libc6 2.41-12+deb13u1 No fix yet	0.5% Theoretical Threat	Directly Exposed
CVE-2026-5928	MEDIUM4.25	libc6 2.41-12+deb13u1 No fix yet	0.4% Theoretical Threat	Directly Exposed
CVE-2019-1010022	LOW3.53	libc6 2.41-12+deb13u1 No fix yet	3.2% Low-Moderate Risk	Post-Exploit
CVE-2026-4438	LOW3.4	libc6 2.41-12+deb13u1 fixed in 2.41-12+deb13u3	0.3% Theoretical Threat	Directly Exposed
CVE-2019-1010023	LOW3.17	libc6 2.41-12+deb13u1 No fix yet	3.1% Low-Moderate Risk	Post-Exploit
CVE-2018-20796	LOW2.7	libc6 2.41-12+deb13u1 No fix yet	5.8% Low-Moderate Risk	Post-Exploit
CVE-2019-9192	LOW2.7	libc6 2.41-12+deb13u1 No fix yet	2.4% Low-Moderate Risk	Post-Exploit
CVE-2026-0915	LOW2.7	libc6 2.41-12+deb13u1 fixed in 2.41-12+deb13u2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-4046	LOW2.7	libc6 2.41-12+deb13u1 fixed in 2.41-12+deb13u3	0.4% Theoretical Threat	Directly Exposed
CVE-2026-0861	LOW2.48	libc6 2.41-12+deb13u1 fixed in 2.41-12+deb13u2	0.4% Theoretical Threat	Post-Exploit
CVE-2010-4756	LOW2.4	libc6 2.41-12+deb13u1 No fix yet	2.6% Low-Moderate Risk	Directly Exposed
CVE-2026-6238	LOW1.99	libc6 2.41-12+deb13u1 No fix yet	0.4% Theoretical Threat	Post-Exploit
CVE-2019-1010024	LOW1.91	libc6 2.41-12+deb13u1 No fix yet	3.2% Low-Moderate Risk	Post-Exploit
CVE-2019-1010025	LOW1.91	libc6 2.41-12+deb13u1 No fix yet	2.3% Low-Moderate Risk	Post-Exploit
CVE-2026-5435	LOW1.81	libc6 2.41-12+deb13u1 No fix yet	0.2% Theoretical Threat	Post-Exploit
CVE-2025-15281	LOW1.81	libc6 2.41-12+deb13u1 fixed in 2.41-12+deb13u2	0.4% Theoretical Threat	Post-Exploit

Want to check another image? Run a full scan with the Docker Security Scanner.