Vulnerability Reportoven/bun:1.3.8-distroless

oven/bun:1.3.8-distroless
digestsha256:67d7c1ad66f397c2599759b13c53fe4883247ddeb1c49315d062c67f19731d84

Executive Summary

Last scanned:

Threat Score
0/100SAFE
Reputation
RELIABLE

This image is safe for production use. It contains 7 exposed and 10 post-exploit findings, but their maximum severity is 4.42 and 3.53 respectively, which are well below actionable thresholds. No specific CVE IDs were provided for the top findings, so no concrete exploits are known to apply. The image is trusted from a popular community publisher and pinned by digest, further reducing risk.

Vulnerabilities

Vulnerability Log

17 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-4437MEDIUM4.42
libc6
2.41-12+deb13u1
fixed in 2.41-12+deb13u3
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-5450MEDIUM4.25
libc6
2.41-12+deb13u1
No fix yet
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-5928MEDIUM4.25
libc6
2.41-12+deb13u1
No fix yet
0.4%
Theoretical Threat
Directly Exposed
CVE-2019-1010022LOW3.53
libc6
2.41-12+deb13u1
No fix yet
3.2%
Low-Moderate Risk
Post-Exploit
CVE-2026-4438LOW3.4
libc6
2.41-12+deb13u1
fixed in 2.41-12+deb13u3
0.3%
Theoretical Threat
Directly Exposed
CVE-2019-1010023LOW3.17
libc6
2.41-12+deb13u1
No fix yet
3.1%
Low-Moderate Risk
Post-Exploit
CVE-2018-20796LOW2.7
libc6
2.41-12+deb13u1
No fix yet
5.8%
Low-Moderate Risk
Post-Exploit
CVE-2019-9192LOW2.7
libc6
2.41-12+deb13u1
No fix yet
2.4%
Low-Moderate Risk
Post-Exploit
CVE-2026-0915LOW2.7
libc6
2.41-12+deb13u1
fixed in 2.41-12+deb13u2
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-4046LOW2.7
libc6
2.41-12+deb13u1
fixed in 2.41-12+deb13u3
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-0861LOW2.48
libc6
2.41-12+deb13u1
fixed in 2.41-12+deb13u2
0.4%
Theoretical Threat
Post-Exploit
CVE-2010-4756LOW2.4
libc6
2.41-12+deb13u1
No fix yet
2.6%
Low-Moderate Risk
Directly Exposed
CVE-2026-6238LOW1.99
libc6
2.41-12+deb13u1
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2019-1010024LOW1.91
libc6
2.41-12+deb13u1
No fix yet
3.2%
Low-Moderate Risk
Post-Exploit
CVE-2019-1010025LOW1.91
libc6
2.41-12+deb13u1
No fix yet
2.3%
Low-Moderate Risk
Post-Exploit
CVE-2026-5435LOW1.81
libc6
2.41-12+deb13u1
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-15281LOW1.81
libc6
2.41-12+deb13u1
fixed in 2.41-12+deb13u2
0.4%
Theoretical Threat
Post-Exploit

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.