Vulnerability Reportpython:3.13-trixie

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. The most severe exposed-surface issues are in system libraries: CVE-2026-50252 can lead to DNS cache poisoning, and CVE-2026-78408 allows an unprivileged user to migrate or terminate host root processes if a privileged operator previously used nsenter --join-cgroup. Other mount-helper flaws can escalate privileges when mount helpers fail. With 843 exposed findings, the image is a poor base without patching, though post-exploit-only issues are low severity (max 4.69) and do not add immediate risk. Avoid exposing nsenter --join-cgroup in downstream images and patch the base before using it for production builds. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.