Last scanned:
This image poses a critical security risk and must not be used in production, especially as an internet-facing service. An attacker reaching port 8983 could smuggle requests past access rules to reach Solr administrative functions or disrupt the search service. Note: CVE-2026-44825 only applies if BasicAuth was bootstrapped with the bin/solr auth enable tool, and it is not a default setting. The Jetty issue, CVE-2026-2332, is reachable without any special configuration and must be fixed before this image is deployed.
Hardening plan for this image · 4 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-2332 | CRITICAL9.1 | org.eclipse.jetty:jetty-http 10.0.26 fixed in 12.1.7, 12.0.33, 11.0.29, 10.0.28, 9.4.60 | 1.3% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2026-44825 | HIGH7.84 | org.apache.solr:solr-core 9.10.1 No fix yet | 3.9% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2025-66382 | MEDIUM5.5 | libexpat1 2.4.7-1ubuntu0.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-75595 | MEDIUM5.46 | io.netty:netty-handler 4.2.6.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-10050 | MEDIUM5.46 | org.eclipse.jetty:jetty-security 10.0.26 fixed in 9.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2025-11143 | MEDIUM5.2 | org.eclipse.jetty:jetty-http 10.0.26 fixed in 12.0.31, 12.1.5 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-18374 | MEDIUM4.9 | libc-bin 2.35-0ubuntu3.15 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc6 2.35-0ubuntu3.15 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-54512 | MEDIUM4.86 | com.fasterxml.jackson.core:jackson-databind 2.18.0 fixed in 2.18.8, 3.1.4, 2.21.4 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-54513 | MEDIUM4.86 | com.fasterxml.jackson.core:jackson-databind 2.18.0 fixed in 2.18.8, 2.21.4, 3.1.4 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2026-44249 | MEDIUM4.86 | io.netty:netty-handler 4.2.6.Final fixed in 4.2.15.Final, 4.1.135.Final | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-68494 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.18.0 fixed in 2.18.8, 2.21.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89407 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.18.0 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.18.0 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-68497 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.18.0 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.18.0 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-91777 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.18.0 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-45416 | MEDIUM4.5 | io.netty:netty-handler 4.2.6.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-50010 | MEDIUM4.5 | io.netty:netty-handler 4.2.6.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-75596 | MEDIUM4.5 | io.netty:netty-handler 4.2.6.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42577 | MEDIUM4.5 | io.netty:netty-transport-classes-epoll 4.2.6.Final fixed in 4.2.13.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-34478 | MEDIUM4.5 | org.apache.logging.log4j:log4j-core 2.25.3 fixed in 2.25.4 | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-34479 | MEDIUM4.5 | org.apache.logging.log4j:log4j-core 2.25.3 fixed in 2.25.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-34480 | MEDIUM4.5 | org.apache.logging.log4j:log4j-core 2.25.3 fixed in 2.25.4 | 1.0% Low-Moderate Risk | Directly Exposed |
| CVE-2026-34481 | MEDIUM4.5 | org.apache.logging.log4j:log4j-layout-template-json 2.25.3 fixed in 2.25.4 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-24308 | MEDIUM4.5 | org.apache.zookeeper:zookeeper 3.9.4 fixed in 3.9.5, 3.8.6 | 1.2% Low-Moderate Risk | Directly Exposed |
| CVE-2024-6763 | MEDIUM4.5 | org.eclipse.jetty:jetty-http 10.0.26 fixed in 12.0.12 | 1.0% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-24281 | MEDIUM4.44 | org.apache.zookeeper:zookeeper 3.9.4 fixed in 3.8.6, 3.9.5 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-6790 | MEDIUM4.24 | org.eclipse.jetty:jetty-server 10.0.26 fixed in 12.0.35, 12.1.9 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89092 | MEDIUM4.2 | libc-bin 2.35-0ubuntu3.15 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc6 2.35-0ubuntu3.15 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-88647 | MEDIUM4.14 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-88648 | MEDIUM4.14 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-103111 | MEDIUM4.14 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-86145 | MEDIUM4.14 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89157 | MEDIUM4.14 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89161 | MEDIUM4.14 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-107161 | MEDIUM4.14 | libsasl2-2 2.1.27+dfsg2-3ubuntu1.2 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-107161 | MEDIUM4.14 | libsasl2-modules-db 2.1.27+dfsg2-3ubuntu1.2 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-45536 | MEDIUM4 | io.netty:netty-transport-native-epoll 4.2.6.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-89158 | LOW3.9 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89160 | LOW3.9 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-59888 | LOW3.9 | com.fasterxml.jackson.core:jackson-databind 2.18.0 fixed in 2.18.8, 2.21.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59889 | LOW3.9 | com.fasterxml.jackson.core:jackson-databind 2.18.0 fixed in 2.21.5, 2.18.9, 2.22.1 | 0.3% Theoretical Threat | Directly Exposed |
| GHSA-mhm7-754m-9p8w | LOW3.9 | com.fasterxml.jackson.core:jackson-databind 2.18.0 fixed in 2.18.9, 2.21.5 | — | Directly Exposed |
| CVE-2022-4899 | LOW3.9 | libzstd1 1.4.8+dfsg-3build1 No fix yet | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-67693 | LOW3.54 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | LOW3.54 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-49844 | LOW3.54 | org.apache.logging.log4j:log4j-api 2.25.3 fixed in 2.25.5, 2.26.1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-34477 | LOW3.54 | org.apache.logging.log4j:log4j-core 2.25.3 fixed in 2.25.4 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-83557 | LOW3.36 | com.fasterxml.jackson.core:jackson-databind 2.18.0 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | LOW3.31 | gcc-12-base 12.3.0-1ubuntu1~22.04.3 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | LOW3.31 | libgcc-s1 12.3.0-1ubuntu1~22.04.3 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | LOW3.31 | libstdc++6 12.3.0-1ubuntu1~22.04.3 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-102473 | LOW3.3 | dash 0.5.11+git20210903+057cd650a4ed-3build1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-40228 | LOW3.3 | libsystemd0 249.11-0ubuntu3.23 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-40228 | LOW3.3 | libudev1 249.11-0ubuntu3.23 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95184 | LOW3.18 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-18401 | LOW3.18 | com.fasterxml.jackson.core:jackson-core 2.18.0 fixed in 2.21.1, 2.18.6 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-19032 | LOW3.18 | com.fasterxml.jackson.core:jackson-databind 2.18.0 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-54514 | LOW3.18 | com.fasterxml.jackson.core:jackson-databind 2.18.0 fixed in 2.18.8, 2.21.4, 3.1.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-54515 | LOW3.18 | com.fasterxml.jackson.core:jackson-databind 2.18.0 fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-77310 | LOW3.18 | com.fasterxml.jackson.core:jackson-databind 2.18.0 fixed in 2.18.9, 2.21.5, 2.22.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-95209 | LOW3 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-95210 | LOW3 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-18477 | LOW2.64 | tar 1.34+dfsg-1ubuntu0.1.22.04.6 No fix yet | <0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-18508 | LOW2.64 | tar 1.34+dfsg-1ubuntu0.1.22.04.6 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-102474 | LOW2.4 | dash 0.5.11+git20210903+057cd650a4ed-3build1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | libncurses6 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | libncursesw6 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2022-41409 | LOW2.34 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2023-50495 | LOW2.34 | libtinfo6 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | ncurses-base 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | ncurses-bin 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2021-31879 | LOW2.2 | wget 1.21.2-2ubuntu1.5 No fix yet | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | login 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | passwd 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-29383 | LOW1.68 | login 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-29383 | LOW1.68 | passwd 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-18374 | NONE0 | locales 2.35-0ubuntu3.15 No fix yet | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-89092 | NONE0 | locales 2.35-0ubuntu3.15 No fix yet | 0.2% Theoretical Threat | Not Applicable |
Want to check another image? Run a full scan with the Docker Security Scanner.