Last scanned:
This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker reaching the Solr port could read data belonging to other clients through the leaked request trailers from CVE-2026-10051 and, depending on configuration, bypass authentication. CVE-2026-10050 only applies if HTTP Digest authentication is enabled, so confirm that setting before deciding how much it matters. Other findings in the scan are lower severity and mostly affect denial of service, but the Jetty flaws should be patched or the Jetty version upgraded before production use.
Hardening plan for this image · 3 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-10051 | HIGH7.5 | org.eclipse.jetty:jetty-server 12.0.34 fixed in 12.0.36, 12.1.10 | 0.4% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-10050 | HIGH7.28 | org.eclipse.jetty:jetty-security 12.0.34 fixed in 9.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54399 | MEDIUM6 | org.apache.httpcomponents.core5:httpcore5 5.3.5 fixed in 5.4.3, 5.5-beta2 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2025-66382 | MEDIUM5.5 | libexpat1 2.6.1-2ubuntu0.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-6790 | MEDIUM5.3 | org.eclipse.jetty:jetty-server 12.0.34 fixed in 12.0.35, 12.1.9 | 0.3% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-18374 | MEDIUM4.9 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc6 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-54428 | MEDIUM4.5 | org.apache.httpcomponents.core5:httpcore5-h2 5.3.4 fixed in 5.4.3, 5.5-beta2 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-64607 | MEDIUM4.24 | org.apache.httpcomponents.client5:httpclient5 5.5 fixed in 5.6.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-106451 | MEDIUM4.2 | at.yawk.lz4:lz4-java 1.10.2 fixed in 1.11.4 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc-bin 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc6 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-88647 | MEDIUM4.14 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-88648 | MEDIUM4.14 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-103111 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-86145 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89157 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89161 | MEDIUM4.14 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-107161 | MEDIUM4.14 | libsasl2-2 2.1.28+dfsg1-5ubuntu3.1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-107161 | MEDIUM4.14 | libsasl2-modules-db 2.1.28+dfsg1-5ubuntu3.1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89158 | LOW3.9 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89160 | LOW3.9 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-59949 | LOW3.9 | at.yawk.lz4:lz4-java 1.10.2 fixed in 1.11.1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-67693 | LOW3.54 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | LOW3.54 | libpcre2-8-0 10.42-4ubuntu2.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-102473 | LOW3.3 | dash 0.5.12-6ubuntu5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-40228 | LOW3.3 | libsystemd0 255.4-1ubuntu8.18 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-40228 | LOW3.3 | libudev1 255.4-1ubuntu8.18 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95184 | LOW3.18 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-106450 | LOW3.18 | at.yawk.lz4:lz4-java 1.10.2 fixed in 1.11.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-106452 | LOW3.18 | at.yawk.lz4:lz4-java 1.10.2 fixed in 1.11.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-106453 | LOW3.18 | at.yawk.lz4:lz4-java 1.10.2 fixed in 1.11.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-8384 | LOW3.18 | org.eclipse.jetty:jetty-util 12.0.34 fixed in 12.0.35, 12.1.9 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-95209 | LOW3 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95210 | LOW3 | libgnutls30t64 3.8.3-1.1ubuntu3.6 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-18477 | LOW2.64 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | <0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-18508 | LOW2.64 | tar 1.35+dfsg-3ubuntu0.4 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-102474 | LOW2.4 | dash 0.5.12-6ubuntu5 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-106449 | LOW2.22 | at.yawk.lz4:lz4-java 1.10.2 fixed in 1.11.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2021-31879 | LOW2.2 | wget 1.21.4-1ubuntu4.5 No fix yet | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | login 1:4.13+dfsg1-4ubuntu3.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | passwd 1:4.13+dfsg1-4ubuntu3.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-18374 | NONE0 | locales 2.39-0ubuntu8.9 No fix yet | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-89092 | NONE0 | locales 2.39-0ubuntu8.9 No fix yet | 0.2% Theoretical Threat | Not Applicable |
Want to check another image? Run a full scan with the Docker Security Scanner.