Last scanned:
This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The two top findings, CVE-2026-33818 and CVE-2026-56859, are denial-of-service issues in Go standard library components that can crash the client when it talks to a malicious server. Note: both apply only when the client parses ASN.1 or XML data from a remote peer it connects to, which depends on how the client is used in your deployment. The image exposes no ports and runs as a non-root user, which limits the practical impact. Updating the Go toolchain to a release that fixes these flaws is the practical next step.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-33818 | MEDIUM6 | stdlib v1.26.4 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56859 | MEDIUM6 | stdlib v1.26.4 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97032 | MEDIUM5.9 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-111943 | MEDIUM5.44 | stdlib v1.26.4 fixed in 1.26.10, 1.27.3 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-8674 | MEDIUM5.3 | glibc 2.34-283.el9_8 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-8674 | MEDIUM5.3 | glibc-common 2.34-283.el9_8 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-8674 | MEDIUM5.3 | glibc-minimal-langpack 2.34-283.el9_8 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-42505 | MEDIUM5.3 | stdlib v1.26.4 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-78663 | MEDIUM5.3 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-39821 | MEDIUM4.92 | stdlib v1.26.4 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 1.8% Low-Moderate Risk | Directly Exposed |
| CVE-2026-56858 | MEDIUM4.86 | stdlib v1.26.4 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.3% Theoretical Threat | Directly Exposed |
| GHSA-xmrv-pmrh-hhx2 | MEDIUM4.72 | github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.4 fixed in 1.7.8 | — | Directly ExposedContext importance: MEDIUM |
| GHSA-xmrv-pmrh-hhx2 | MEDIUM4.72 | github.com/aws/aws-sdk-go-v2/service/s3 v1.95.1 fixed in 1.97.3 | — | Directly ExposedContext importance: MEDIUM |
| CVE-2026-39822 | MEDIUM4.68 | stdlib v1.26.4 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-46600 | MEDIUM4.5 | stdlib v1.26.4 fixed in 1.26.6, 1.27.0-rc.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-56853 | MEDIUM4.5 | stdlib v1.26.4 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-56860 | MEDIUM4.5 | stdlib v1.26.4 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-56862 | MEDIUM4.5 | stdlib v1.26.4 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78667 | MEDIUM4.5 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-78669 | MEDIUM4.5 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-97031 | MEDIUM4.5 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-78659 | MEDIUM4.5 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78660 | MEDIUM4.5 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-94440 | MEDIUM4.5 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | glibc 2.34-283.el9_8 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | glibc-common 2.34-283.el9_8 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | glibc-minimal-langpack 2.34-283.el9_8 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-86805 | MEDIUM4.14 | glibc 2.34-283.el9_8 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-86805 | MEDIUM4.14 | glibc-common 2.34-283.el9_8 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-86805 | MEDIUM4.14 | glibc-minimal-langpack 2.34-283.el9_8 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-102010 | MEDIUM4.14 | libgcc 11.5.0-14.el9 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-95619 | MEDIUM4.14 | libgcc 11.5.0-14.el9 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-39824 | MEDIUM4 | golang.org/x/sys v0.34.0 fixed in 0.44.0 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2022-41409 | LOW3.9 | pcre2 10.40-7.el9_8 No fix yet | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2022-41409 | LOW3.9 | pcre2-syntax 10.40-7.el9_8 No fix yet | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-97399 | LOW3.7 | glibc 2.34-283.el9_8 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-97399 | LOW3.7 | glibc-common 2.34-283.el9_8 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-97399 | LOW3.7 | glibc-minimal-langpack 2.34-283.el9_8 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-56391 | LOW3.66 | coreutils-single 8.32-41.el9_8.1 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-56857 | LOW3.3 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-95818 | LOW2.48 | glibc 2.34-283.el9_8 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-95818 | LOW2.48 | glibc-common 2.34-283.el9_8 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-95818 | LOW2.48 | glibc-minimal-langpack 2.34-283.el9_8 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-56866 | LOW2.34 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-94439 | LOW2.34 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | ncurses-base 6.2-12.20210508.el9 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | ncurses-libs 6.2-12.20210508.el9 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2026-94448 | LOW2.2 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-97030 | LOW2.2 | stdlib v1.26.4 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2021-46195 | LOW1.99 | libgcc 11.5.0-14.el9 No fix yet | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | LOW1.99 | libgcc 11.5.0-14.el9 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.