Vulnerability Reportruby:3.3.13-alpine

ruby:3.3.13-alpine3.24ruby:3.3.13-alpineruby:3.3-alpine3.24ruby:3.3-alpine

digestsha256:fee49593bed1f98411e8dd556b72fbf4320c46101665ceeeac172417d4981bb1

Executive Summary

Last scanned: Nov 2, 2026

Threat ScoreSAFE• The scan found 3 exposed findings, and the highest severity among them is 4.38, which is low and does not reach any verdict-setting threshold.• No known-exploited vulnerabilities were reported, and no findings were flagged as reachable through the network in normal operation.• No post-exploit-only findings were reported, so nothing extra is exposed if the container is already compromised.• The image is an official, digest-pinned Docker Hub image with a TRUSTED reputation verdict.• The image runs as root by default, which is worth tightening in the images built on top of it, though this is a configuration matter rather than a scan finding.

0/100SAFE

ReputationOFFICIAL• Official Docker Hub Image• Pinned by digest (Immutable)

TRUSTED

This base/runtime image is a clean foundation for building production images. The scan found 3 low-severity exposed findings, with a highest severity of 4.38, none of which are known to be actively exploited or reachable as a practical attack path in normal operation. Images built on top of it should still run as a non-root user, since the base currently defaults to root. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.

Already in good shape · 2 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

3 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-47242	MEDIUM4.38	net-imap 0.4.25 fixed in ~> 0.5.15, >= 0.6.4.1	0.2% Theoretical Threat	Directly Exposed
CVE-2026-47240	LOW3.66	net-imap 0.4.25 fixed in ~> 0.5.15, >= 0.6.4.1	0.8% Theoretical Threat	Directly Exposed
CVE-2026-47241	LOW3.54	net-imap 0.4.25 fixed in ~> 0.5.15, >= 0.6.4.1	0.4% Theoretical Threat	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.