Last scanned:
This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker who exploits the top findings could misdirect or poison outbound repository fetches, bypass a front proxy's access rules, or disrupt the repository service through crafted requests. Note: CVE-2026-45674 only applies if the Netty DNS resolver is used for outbound lookups, such as when proxying remote repositories, and CVE-2026-42581 only matters when a Netty HTTP stack and a Content-Length-trusting downstream proxy are in place. The publisher reputation verdict is TRUSTED, but the findings above still need to be reviewed against how this instance is configured before production use.
Hardening plan for this image · 4 steps. The first cuts risk from 64 to 0.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-45674 | HIGH8 | io.netty:netty-resolver-dns 4.2.12.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-47691 | HIGH8 | io.netty:netty-resolver-dns 4.2.12.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42581 | HIGH7.84 | io.netty:netty-codec-http 4.2.12.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89407 | HIGH7.5 | com.fasterxml.jackson.core:jackson-core 2.21.1 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-42579 | HIGH7.28 | io.netty:netty-codec-dns 4.2.12.Final fixed in 4.2.13.Final, 4.1.133.Final | 1.0% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-75595 | HIGH7.28 | io.netty:netty-handler 4.2.12.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-49268 | HIGH7.28 | org.apache.shiro:shiro-core 1.13.0 fixed in 2.2.1, 3.0.0-alpha-2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-10050 | HIGH7.28 | org.eclipse.jetty.ee8:jetty-ee8-security 12.0.33 fixed in 12.0.36, 12.1.10 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54512 | MEDIUM6.48 | com.fasterxml.jackson.core:jackson-databind 2.21.1 fixed in 2.18.8, 3.1.4, 2.21.4 | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54513 | MEDIUM6.48 | com.fasterxml.jackson.core:jackson-databind 2.21.1 fixed in 2.18.8, 2.21.4, 3.1.4 | 1.2% Low-Moderate Risk | Directly ExposedContext importance: MEDIUM |
| CVE-2026-47838 | MEDIUM6.48 | org.springframework.security:spring-security-web 6.5.10 fixed in 6.5.11 | 0.1% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-68497 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.21.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-91777 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.21.1 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42583 | MEDIUM6 | io.netty:netty-codec-compression 4.2.12.Final fixed in 4.2.13.Final | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42587 | MEDIUM6 | io.netty:netty-codec-http 4.2.12.Final fixed in 4.2.13.Final, 4.1.133.Final | 1.0% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42585 | MEDIUM6 | io.netty:netty-codec-http 4.2.12.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-59898 | MEDIUM6 | io.netty:netty-codec-http 4.2.12.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-59899 | MEDIUM6 | io.netty:netty-codec-http 4.2.12.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-59903 | MEDIUM6 | io.netty:netty-codec-http 4.2.12.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42587 | MEDIUM6 | io.netty:netty-codec-http2 4.2.12.Final fixed in 4.2.13.Final, 4.1.133.Final | 1.0% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56819 | MEDIUM6 | io.netty:netty-codec-http2 4.2.12.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-48043 | MEDIUM6 | io.netty:netty-codec-http2 4.2.12.Final fixed in 4.1.135.Final, 4.2.15.Final | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-45416 | MEDIUM6 | io.netty:netty-handler 4.2.12.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-50010 | MEDIUM6 | io.netty:netty-handler 4.2.12.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-75596 | MEDIUM6 | io.netty:netty-handler 4.2.12.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42577 | MEDIUM6 | io.netty:netty-transport-classes-epoll 4.2.12.Final fixed in 4.2.13.Final | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-75140 | MEDIUM6 | org.jsoup:jsoup 1.15.3 fixed in 1.23.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-40988 | MEDIUM6 | org.springframework.security:spring-security-saml2-service-provider 6.5.10 fixed in 7.0.6, 6.5.11 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-49844 | MEDIUM5.9 | org.apache.logging.log4j:log4j-api 2.19.0 fixed in 2.25.5, 2.26.1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-113730 | MEDIUM5.6 | ognl:ognl 3.4.2 fixed in 3.4.13 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42584 | MEDIUM5.46 | io.netty:netty-codec-http 4.2.12.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-8763 | MEDIUM5.46 | org.bouncycastle:bc-fips 2.1.2 fixed in 1.0.2.7, 2.0.2, 2.1.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-8763 | MEDIUM5.46 | org.bouncycastle:bcprov-jdk15to18 1.84 fixed in 1.85 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-8763 | MEDIUM5.46 | org.bouncycastle:bcprov-jdk18on 1.84 fixed in 1.85 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-84939 | MEDIUM5.46 | org.freemarker:freemarker 2.3.32 fixed in 2.3.35 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-45673 | MEDIUM5.44 | io.netty:netty-resolver-dns 4.2.12.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-45292 | MEDIUM5.3 | io.opentelemetry:opentelemetry-api 1.47.0 fixed in 1.62.0 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-23903 | MEDIUM5.3 | org.apache.shiro:shiro-spring 1.13.0 fixed in 2.1.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-8384 | MEDIUM5.3 | org.eclipse.jetty:jetty-util 12.0.33 fixed in 12.0.35, 12.1.9 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-41001 | MEDIUM5.3 | org.springframework.boot:spring-boot-autoconfigure 3.5.14 fixed in 4.0.7, 3.5.15 | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-8798 | MEDIUM5.22 | org.bouncycastle:bc-fips 2.1.2 fixed in 2.1.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-54518 | MEDIUM5.2 | com.fasterxml.jackson.core:jackson-databind 2.21.1 fixed in 2.21.4 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-59888 | MEDIUM5.2 | com.fasterxml.jackson.core:jackson-databind 2.21.1 fixed in 2.18.8, 2.21.4 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-59889 | MEDIUM5.2 | com.fasterxml.jackson.core:jackson-databind 2.21.1 fixed in 2.21.5, 2.18.9, 2.22.1 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| GHSA-mhm7-754m-9p8w | MEDIUM5.2 | com.fasterxml.jackson.core:jackson-databind 2.21.1 fixed in 2.18.9, 2.21.5 | — | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42580 | MEDIUM5.2 | io.netty:netty-codec-http 4.2.12.Final fixed in 4.2.13.Final, 4.1.133.Final | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56746 | MEDIUM5.2 | io.netty:netty-codec-http 4.2.12.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-59921 | MEDIUM5.2 | io.netty:netty-codec-http 4.2.12.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-43827 | MEDIUM5.2 | org.apache.shiro:shiro-core 1.13.0 fixed in 2.2.0, 3.0.0-alpha-2 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-43828 | MEDIUM5.2 | org.apache.shiro:shiro-web 1.13.0 fixed in 2.2.0, 3.0.0-alpha-2 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-1225 | MEDIUM5 | ch.qos.logback:logback-core 1.5.19 fixed in 1.5.25 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-41706 | MEDIUM4.88 | org.springframework.security:spring-security-web 6.5.10 fixed in 7.0.6, 6.5.11 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-44249 | MEDIUM4.86 | io.netty:netty-handler 4.2.12.Final fixed in 4.2.15.Final, 4.1.135.Final | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-68494 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.21.1 fixed in 2.18.8, 2.21.4 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.21.1 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.21.1 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-59901 | MEDIUM4.5 | io.netty:netty-codec-compression 4.2.12.Final fixed in 4.2.16.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-73508 | MEDIUM4.5 | io.netty:netty-codec-dns 4.2.12.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-55831 | MEDIUM4.5 | io.netty:netty-codec-http 4.2.12.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-55833 | MEDIUM4.5 | io.netty:netty-codec-http 4.2.12.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-56745 | MEDIUM4.5 | io.netty:netty-codec-http 4.2.12.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-42578 | MEDIUM4.5 | io.netty:netty-handler-proxy 4.2.12.Final fixed in 4.1.133.Final, 4.2.13.Final | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-13505 | MEDIUM4.5 | org.bouncycastle:bc-fips 2.1.2 fixed in 1.0.2.7, 2.0.2, 2.1.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-13506 | MEDIUM4.5 | org.bouncycastle:bc-fips 2.1.2 fixed in 1.0.2.7, 2.0.2, 2.1.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-13506 | MEDIUM4.5 | org.bouncycastle:bcprov-jdk15to18 1.84 fixed in 1.85 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-13506 | MEDIUM4.5 | org.bouncycastle:bcprov-jdk18on 1.84 fixed in 1.85 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-41848 | MEDIUM4.5 | org.springframework:spring-core 6.2.18 fixed in 7.0.8, 6.2.19 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-41850 | MEDIUM4.5 | org.springframework:spring-expression 6.2.18 fixed in 7.0.8, 6.2.19 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-41851 | MEDIUM4.5 | org.springframework:spring-expression 6.2.18 fixed in 7.0.8, 6.2.19 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-83557 | MEDIUM4.48 | com.fasterxml.jackson.core:jackson-databind 2.21.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-41003 | MEDIUM4.32 | org.springframework.security:spring-security-saml2-service-provider 6.5.10 fixed in 7.0.6, 6.5.11 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-19032 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.21.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54514 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.21.1 fixed in 2.18.8, 2.21.4, 3.1.4 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54515 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.21.1 fixed in 3.1.4, 2.18.9, 2.21.5, 2.22.1 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54516 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.21.1 fixed in 2.21.4, 3.1.4 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-54517 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.21.1 fixed in 2.21.4, 3.1.4 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-77310 | MEDIUM4.24 | com.fasterxml.jackson.core:jackson-databind 2.21.1 fixed in 2.18.9, 2.21.5, 2.22.1 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-41417 | MEDIUM4.24 | io.netty:netty-codec-http 4.2.12.Final fixed in 4.1.133.Final, 4.2.13.Final | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-50020 | MEDIUM4.24 | io.netty:netty-codec-http 4.2.12.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-47244 | MEDIUM4.24 | io.netty:netty-codec-http2 4.2.12.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-50560 | MEDIUM4.24 | io.netty:netty-codec-http2 4.2.12.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-59900 | MEDIUM4.24 | io.netty:netty-codec-http2 4.2.12.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-41694 | MEDIUM4.24 | org.springframework.security:spring-security-saml2-service-provider 6.5.10 fixed in 7.0.6, 6.5.11 | 0.1% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-45536 | MEDIUM4 | io.netty:netty-transport-native-epoll 4.2.12.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-45536 | MEDIUM4 | io.netty:netty-transport-native-kqueue 4.2.12.Final fixed in 4.2.15.Final, 4.1.135.Final | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-41854 | LOW3.9 | org.springframework:spring-web 6.2.18 fixed in 7.0.8, 6.2.19 | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-71497 | LOW3.76 | org.jsoup:jsoup 1.15.3 fixed in 1.23.1 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-41852 | LOW3.18 | org.springframework:spring-expression 6.2.18 fixed in 7.0.8, 6.2.19 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-10532 | LOW2.9 | ch.qos.logback:logback-core 1.5.19 fixed in 1.5.34 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42198 | LOW2.7 | org.postgresql:postgresql 42.7.2 fixed in 42.7.11 | 3.3% Low-Moderate Risk | Post-Exploit |
| CVE-2026-23901 | LOW2 | org.apache.shiro:shiro-core 1.13.0 fixed in 2.1.0 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-9828 | LOW1.2 | ch.qos.logback:logback-core 1.5.19 fixed in 1.5.33 | 0.4% Theoretical Threat | Directly Exposed |
Want to check another image? Run a full scan with the Docker Security Scanner.