Vulnerability Reportphp:8.5.12-alpine

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. If a PHP application decodes attacker-supplied Brotli data, an attacker could trigger memory corruption or a crash, and possibly execute code, through CVE-2026-111497. Note: CVE-2026-111497 only applies when PHP scripts or extensions decode untrusted Brotli-compressed input, which is not part of default usage. The 48 post-exploit findings are low severity (maximum 2.92) and do not change this verdict, but they still exist and should be tracked in the final image. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.