Vulnerability Reportruby:4.0.9

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. Any application built on this image that parses untrusted JSON with allow_duplicate_key set to false could leak memory contents or crash, which exposes sensitive data or disrupts service. Note: CVE-2026-33210 only applies if an application uses that non-default JSON option, so teams should check whether their workloads use it before treating it as relevant. The remaining exposed findings have lower severity and are not known to be exploited, so they do not change this verdict, but they still need routine patching in the final image. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.