Vulnerability Reportphp:8.2.35-fpm-alpine3.23

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. The main concern is CVE-2026-111497, a Brotli decoder out-of-bounds write, where a crafted response from a malicious server could crash or compromise PHP. Note: CVE-2026-111497 only applies if the application fetches remote content over HTTP through libcurl, so images that never make such requests face much less practical risk. The remaining exposed findings are lower in severity and none are known to be actively exploited, and the post-exploit-only findings do not change the verdict. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.