Last scanned:
This image carries significant risk; production deployment is highly discouraged without strict compensating controls. The most serious findings, such as CVE-2026-89407 and CVE-2026-68497 in the Jackson JSON libraries, could let an attacker who can reach the Nexus port slow or stall the repository server by sending crafted JSON, disrupting builds and artifact access for every team that depends on it. Note: CVE-2026-49268 only applies if an LDAP login realm is configured, so its relevance depends on how this deployment handles authentication. None of the flagged issues are known to be actively exploited, and the publisher is verified, but the number of high-severity denial-of-service exposures still warrants strict controls and prompt patching before production use.
Hardening plan for this image · 4 steps. The first cuts risk from 61 to 0.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-89407 | HIGH7.5 | com.fasterxml.jackson.core:jackson-core 2.22.1 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-68497 | HIGH7.5 | com.fasterxml.jackson.core:jackson-databind 2.22.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-89407 | HIGH7.5 | tools.jackson.core:jackson-core 3.2.0 fixed in 3.1.7, 3.2.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-68497 | HIGH7.5 | tools.jackson.core:jackson-databind 3.2.0 fixed in 3.2.2, 3.1.6 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-49268 | HIGH7.28 | org.apache.shiro:shiro-core 1.13.0 fixed in 2.2.1, 3.0.0-alpha-2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-84939 | HIGH7.28 | org.freemarker:freemarker 2.3.32 fixed in 2.3.35 | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89425 | MEDIUM6 | com.fasterxml.jackson.core:jackson-core 2.22.1 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-91776 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.22.1 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-91777 | MEDIUM6 | com.fasterxml.jackson.core:jackson-databind 2.22.1 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-55831 | MEDIUM6 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56819 | MEDIUM6 | io.netty:netty-codec-http2 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-75140 | MEDIUM6 | org.jsoup:jsoup 1.15.3 fixed in 1.23.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89425 | MEDIUM6 | tools.jackson.core:jackson-core 3.2.0 fixed in 3.1.7, 3.2.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-91776 | MEDIUM6 | tools.jackson.core:jackson-databind 3.2.0 fixed in 3.1.7, 3.2.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-91777 | MEDIUM6 | tools.jackson.core:jackson-databind 3.2.0 fixed in 3.1.7, 3.2.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-83557 | MEDIUM5.6 | com.fasterxml.jackson.core:jackson-databind 2.22.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.7% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-83557 | MEDIUM5.6 | tools.jackson.core:jackson-databind 3.2.0 fixed in 3.1.6, 3.2.2 | 0.7% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-75595 | MEDIUM5.46 | io.netty:netty-handler 4.2.15.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-8763 | MEDIUM5.46 | org.bouncycastle:bc-fips 2.1.2 fixed in 1.0.2.7, 2.0.2, 2.1.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-8763 | MEDIUM5.46 | org.bouncycastle:bcprov-jdk18on 1.84 fixed in 1.85 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-19032 | MEDIUM5.3 | com.fasterxml.jackson.core:jackson-databind 2.22.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-19032 | MEDIUM5.3 | tools.jackson.core:jackson-databind 3.2.0 fixed in 3.1.6, 3.2.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-77310 | MEDIUM5.3 | tools.jackson.core:jackson-databind 3.2.0 fixed in 3.1.5, 3.2.1 | 0.3% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-8798 | MEDIUM5.22 | org.bouncycastle:bc-fips 2.1.2 fixed in 2.1.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-56746 | MEDIUM5.2 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-59921 | MEDIUM5.2 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-43827 | MEDIUM5.2 | org.apache.shiro:shiro-core 1.13.0 fixed in 2.2.0, 3.0.0-alpha-2 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-43828 | MEDIUM5.2 | org.apache.shiro:shiro-web 1.13.0 fixed in 2.2.0, 3.0.0-alpha-2 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-59889 | MEDIUM5.2 | tools.jackson.core:jackson-databind 3.2.0 fixed in 3.1.5, 3.2.1 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-59901 | MEDIUM4.5 | io.netty:netty-codec-compression 4.2.15.Final fixed in 4.2.16.Final | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-73508 | MEDIUM4.5 | io.netty:netty-codec-dns 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-55833 | MEDIUM4.5 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-56745 | MEDIUM4.5 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-59898 | MEDIUM4.5 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-59899 | MEDIUM4.5 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-59903 | MEDIUM4.5 | io.netty:netty-codec-http 4.2.15.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-56816 | MEDIUM4.5 | io.netty:netty-codec-http3 4.2.15.Final fixed in 4.2.16.Final | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-75596 | MEDIUM4.5 | io.netty:netty-handler 4.2.15.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-13505 | MEDIUM4.5 | org.bouncycastle:bc-fips 2.1.2 fixed in 1.0.2.7, 2.0.2, 2.1.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-13506 | MEDIUM4.5 | org.bouncycastle:bc-fips 2.1.2 fixed in 1.0.2.7, 2.0.2, 2.1.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-13506 | MEDIUM4.5 | org.bouncycastle:bcprov-jdk18on 1.84 fixed in 1.85 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-59900 | MEDIUM4.24 | io.netty:netty-codec-http2 4.2.15.Final fixed in 4.2.16.Final, 4.1.136.Final | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-71497 | LOW3.76 | org.jsoup:jsoup 1.15.3 fixed in 1.23.1 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-49844 | LOW3.54 | org.apache.logging.log4j:log4j-api 2.19.0 fixed in 2.25.5, 2.26.1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-113730 | LOW3.36 | ognl:ognl 3.4.4 fixed in 3.4.13 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-23903 | LOW3.18 | org.apache.shiro:shiro-spring 1.13.0 fixed in 2.1.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-8384 | LOW3.18 | org.eclipse.jetty:jetty-util 12.0.33 fixed in 12.0.35, 12.1.9 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-23901 | LOW2 | org.apache.shiro:shiro-core 1.13.0 fixed in 2.1.0 | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
Want to check another image? Run a full scan with the Docker Security Scanner.