Vulnerability Reportphp:8.3.36-alpine

This base/runtime image is a reasonable foundation, but it ships vulnerabilities worth remediating in the images built on top of it. The most notable item is CVE-2026-111497 in brotli-libs, a memory-corruption flaw that could allow code execution if an application decodes untrusted Brotli data. Note: CVE-2026-111497 only applies if PHP code is written to fetch or decode Brotli-compressed data from untrusted sources. The image starts only an interactive PHP shell with no listening ports, so the risk is limited to the specific code paths that use this decoder. Images built on this base should be checked for such code and the brotli-libs package updated in the final image. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.