Vulnerability Reportoven/bun:1.4.0-distroless

oven/bun:1.4.0-distroless
digestsha256:a8919d4a092a234f7184ac6d3960a2d860fea73e034709e1752a7d0de09913f8

Executive Summary

Last scanned:

Threat Score
0/100SAFE
Reputation
RELIABLE

This image is safe for production use. It does have 11 exposed and 12 post-exploit findings, but exposed_count_ge6 is 0 and post_count_ge6 is 0, with maximum exposed severity 5.95 and maximum post-exploit severity 3.53, so they do not change the SAFE verdict. The image also has favorable trust context: POPULAR COMMUNITY, RELIABLE, and digest-pinned. No CVE IDs were provided in the top findings, and no compensating controls are required by the supplied data.

Relevant for oven/bun:1.4.0-distroless

How to fix CVEs in runtime Docker images

Only a handful of these findings are real. Five steps that cut the count — and VEX for the rest.

Read the article

Vulnerabilities

Vulnerability Log

23 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-86805MEDIUM5.95
libc6
2.41-12+deb13u3
No fix yet
<0.1%
Theoretical Threat
Directly Exposed
CVE-2026-95818MEDIUM5.95
libc6
2.41-12+deb13u3
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-19499MEDIUM5.78
libc6
2.41-12+deb13u3
No fix yet
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-6368MEDIUM4.67
libc6
2.41-12+deb13u3
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-8674MEDIUM4.5
libc6
2.41-12+deb13u3
No fix yet
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-5450MEDIUM4.25
libc6
2.41-12+deb13u3
fixed in 2.41-12+deb13u4
0.7%
Theoretical Threat
Directly Exposed
CVE-2026-5928MEDIUM4.25
libc6
2.41-12+deb13u3
fixed in 2.41-12+deb13u4
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-18374MEDIUM4.17
libc6
2.41-12+deb13u3
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-19542LOW3.57
libc6
2.41-12+deb13u3
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-89092LOW3.57
libc6
2.41-12+deb13u3
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2019-1010022LOW3.53
libc6
2.41-12+deb13u3
No fix yet
3.2%
Low-Moderate Risk
Post-Exploit
CVE-2019-1010023LOW3.17
libc6
2.41-12+deb13u3
No fix yet
3.1%
Low-Moderate Risk
Post-Exploit
CVE-2026-97399LOW3.15
libc6
2.41-12+deb13u3
No fix yet
0.3%
Theoretical Threat
Directly Exposed
CVE-2018-20796LOW2.7
libc6
2.41-12+deb13u3
No fix yet
5.8%
Low-Moderate Risk
Post-Exploit
CVE-2019-9192LOW2.7
libc6
2.41-12+deb13u3
No fix yet
2.4%
Low-Moderate Risk
Post-Exploit
CVE-2026-6238LOW1.99
libc6
2.41-12+deb13u3
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2019-1010024LOW1.91
libc6
2.41-12+deb13u3
No fix yet
3.2%
Low-Moderate Risk
Post-Exploit
CVE-2019-1010025LOW1.91
libc6
2.41-12+deb13u3
No fix yet
2.5%
Low-Moderate Risk
Post-Exploit
CVE-2026-5435LOW1.81
libc6
2.41-12+deb13u3
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-6791LOW1.81
libc6
2.41-12+deb13u3
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-77117LOW1.81
libc6
2.41-12+deb13u3
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-80489LOW1.81
libc6
2.41-12+deb13u3
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2010-4756LOW1.44
libc6
2.41-12+deb13u3
No fix yet
2.6%
Low-Moderate Risk
Post-Exploit

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.