Last scanned:
··This image poses a critical security risk and must not be used in production, especially as an internet-facing service. The most serious issue is CVE-2026-2332 in the Jetty HTTP parser, which is reachable on port 8983 in normal operation, so an attacker could smuggle requests to bypass access rules or proxy controls and reach Solr functions they should not. Note: CVE-2026-10050 only applies if HTTP Digest authentication is enabled for Solr, which this image does not enable by default. Remediate the Jetty HTTP parser exposure before any production deployment.
Hardening plan for this image · 4 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-2332 | CRITICAL9.1 | org.eclipse.jetty:jetty-http 10.0.26 fixed in 12.1.7, 12.0.33, 11.0.29, 10.0.28, 9.4.60 | 1.3% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2026-2332 | CRITICAL9.1 | org.eclipse.jetty:jetty-http 9.4.57.v20241219 fixed in 12.1.7, 12.0.33, 11.0.29, 10.0.28, 9.4.60 | 1.3% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2026-10050 | HIGH7.28 | org.eclipse.jetty:jetty-security 10.0.26 fixed in 9.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2025-11143 | MEDIUM6.5 | org.eclipse.jetty:jetty-http 10.0.26 fixed in 12.0.31, 12.1.5 | 0.2% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2025-11143 | MEDIUM6.5 | org.eclipse.jetty:jetty-http 9.4.57.v20241219 fixed in 12.0.31, 12.1.5 | 0.2% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-54512 | MEDIUM6.48 | com.fasterxml.jackson.core:jackson-databind 2.12.7.1 fixed in 2.18.8, 3.1.4, 2.21.4 | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54513 | MEDIUM6.48 | com.fasterxml.jackson.core:jackson-databind 2.12.7.1 fixed in 2.18.8, 2.21.4, 3.1.4 | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-50193 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.12.7.1 fixed in 2.14.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-88647 | MEDIUM5.52 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-88648 | MEDIUM5.52 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2025-66382 | MEDIUM5.5 | libexpat1 2.4.7-1ubuntu0.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-77420 | MEDIUM5.5 | org.jline:jline-reader 3.9.0 fixed in 4.3.1, 3.30.15 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-75595 | MEDIUM5.46 | io.netty:netty-handler 4.2.15.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-59889 | MEDIUM5.2 | com.fasterxml.jackson.core:jackson-databind 2.12.7.1 fixed in 2.21.5, 2.18.9, 2.22.1 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-18374 | MEDIUM4.9 | libc-bin 2.35-0ubuntu3.15 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc6 2.35-0ubuntu3.15 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-67693 | MEDIUM4.72 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-68494 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.12.7 fixed in 2.18.8, 2.21.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.12.7 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89407 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.22.2 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.22.2 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.12.7.1 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-91777 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.12.7.1 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.22.2 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-91777 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.22.2 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-59901 | MEDIUM4.5 | io.netty:netty-codec-compression 4.2.15.Final fixed in 4.2.16.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-55831 | MEDIUM4.5 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-55833 | MEDIUM4.5 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-56745 | MEDIUM4.5 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-59898 | MEDIUM4.5 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59899 | MEDIUM4.5 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-59903 | MEDIUM4.5 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-56819 | MEDIUM4.5 | io.netty:netty-codec-http2 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-75596 | MEDIUM4.5 | io.netty:netty-handler 4.2.15.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42440 | MEDIUM4.5 | org.apache.opennlp:opennlp-tools 1.9.5 fixed in 2.5.9, 3.0.0-M3 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-43871 | MEDIUM4.5 | org.apache.thrift:libthrift 0.15.0 fixed in 0.24.0 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-77422 | MEDIUM4.5 | org.jline:jline-builtins 3.9.0 fixed in 4.3.1, 3.30.15 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-56740 | MEDIUM4.5 | org.jline:jline-remote-telnet 3.9.0 fixed in 4.2.1, 4.0.16, 3.30.14 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-56741 | MEDIUM4.5 | org.jline:jline-remote-telnet 3.9.0 fixed in 4.2.1, 4.0.16, 3.30.14 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2024-6763 | MEDIUM4.5 | org.eclipse.jetty:jetty-http 10.0.26 fixed in 12.0.12 | 1.0% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2024-6763 | MEDIUM4.5 | org.eclipse.jetty:jetty-http 9.4.57.v20241219 fixed in 12.0.12 | 1.0% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-83557 | MEDIUM4.48 | com.fasterxml.jackson.core:jackson-databind 2.12.7.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-43869 | MEDIUM4.38 | org.apache.thrift:libthrift 0.15.0 fixed in 0.23.0 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-95184 | MEDIUM4.24 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-19032 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.12.7.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54514 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.12.7.1 fixed in 2.18.8, 2.21.4, 3.1.4 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54515 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.12.7.1 fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-77310 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.12.7.1 fixed in 2.18.9, 2.21.5, 2.22.1 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-6790 | MEDIUM4.24 | org.eclipse.jetty:jetty-server 10.0.26 fixed in 12.0.35, 12.1.9 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-106451 | MEDIUM4.2 | at.yawk.lz4:lz4-java 1.10.1 fixed in 1.11.4 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc-bin 2.35-0ubuntu3.15 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc6 2.35-0ubuntu3.15 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-103111 | MEDIUM4.14 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-86145 | MEDIUM4.14 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89157 | MEDIUM4.14 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89161 | MEDIUM4.14 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-107161 | MEDIUM4.14 | libsasl2-2 2.1.27+dfsg2-3ubuntu1.2 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-107161 | MEDIUM4.14 | libsasl2-modules-db 2.1.27+dfsg2-3ubuntu1.2 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-95209 | MEDIUM4 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-95210 | MEDIUM4 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89158 | LOW3.9 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89160 | LOW3.9 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-59949 | LOW3.9 | at.yawk.lz4:lz4-java 1.10.1 fixed in 1.11.1 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-56746 | LOW3.9 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59921 | LOW3.9 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-77421 | LOW3.9 | org.jline:jline-builtins 3.9.0 fixed in 4.3.1, 3.30.15 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2022-4899 | LOW3.9 | libzstd1 1.4.8+dfsg-3build1 No fix yet | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2025-52999 | LOW3.83 | com.fasterxml.jackson.core:jackson-core 2.12.7 fixed in 2.15.0 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | LOW3.54 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | LOW3.31 | gcc-12-base 12.3.0-1ubuntu1~22.04.3 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | LOW3.31 | libgcc-s1 12.3.0-1ubuntu1~22.04.3 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | LOW3.31 | libstdc++6 12.3.0-1ubuntu1~22.04.3 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-102473 | LOW3.3 | dash 0.5.11+git20210903+057cd650a4ed-3build1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-40228 | LOW3.3 | libsystemd0 249.11-0ubuntu3.23 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-40228 | LOW3.3 | libudev1 249.11-0ubuntu3.23 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-106450 | LOW3.18 | at.yawk.lz4:lz4-java 1.10.1 fixed in 1.11.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-106452 | LOW3.18 | at.yawk.lz4:lz4-java 1.10.1 fixed in 1.11.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-106453 | LOW3.18 | at.yawk.lz4:lz4-java 1.10.1 fixed in 1.11.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59900 | LOW3.18 | io.netty:netty-codec-http2 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-45205 | LOW3.18 | org.apache.commons:commons-configuration2 2.10.1 fixed in 2.15.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-18477 | LOW2.64 | tar 1.34+dfsg-1ubuntu0.1.22.04.6 No fix yet | <0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-18508 | LOW2.64 | tar 1.34+dfsg-1ubuntu0.1.22.04.6 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-102474 | LOW2.4 | dash 0.5.11+git20210903+057cd650a4ed-3build1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | libncurses6 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | libncursesw6 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2022-41409 | LOW2.34 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2023-50495 | LOW2.34 | libtinfo6 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | ncurses-base 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | ncurses-bin 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2026-106449 | LOW2.22 | at.yawk.lz4:lz4-java 1.10.1 fixed in 1.11.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2021-31879 | LOW2.2 | wget 1.21.2-2ubuntu1.5 No fix yet | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2025-49128 | LOW2.04 | com.fasterxml.jackson.core:jackson-core 2.12.7 fixed in 2.13.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2024-56433 | LOW1.84 | login 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | passwd 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-29383 | LOW1.68 | login 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-29383 | LOW1.68 | passwd 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-18374 | NONE0 | locales 2.35-0ubuntu3.15 No fix yet | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-89092 | NONE0 | locales 2.35-0ubuntu3.15 No fix yet | 0.2% Theoretical Threat | Not Applicable |
Want to check another image? Run a full scan with the Docker Security Scanner.