Vulnerability Reportrust:1.93.1-slim-bookworm

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. The most critical include a kernel local privilege escalation (CVE-2026-46300) that could let an unprivileged user compromise the host, and a remotely exploitable GnuTLS flaw (CVE-2026-33845) causing denial of service or information disclosure. While this is an official Docker image pinned by digest, it exposes 2945 findings (32 at severity >= 7.0), so patching before building is essential. Using the OpenSSL streaming API avoids the AES-OCB one-shot bug, and disabling DTLS eliminates the GnuTLS issue. The 224 post-exploit-only findings are low severity (max 4.5) and do not change the verdict. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.