Last scanned:
This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. It has 21 exposed findings, but only one is severity 6.18 and none are 7.0 or higher; post-exploit findings top out at 2.7. The main item is CVE-2026-75595, which could allow mTLS bypass and unauthorized access only if Netty terminates inbound TLS and non-default per-SNI mTLS with clientAuth=REQUIRE is the sole gate. Upgrading Netty to 4.2.17.Final or later would fully eliminate that CVE. The image is from a verified publisher and pinned by digest, so supply-chain trust is not the concern here.
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-75595 | MEDIUM6.18 | io.netty:netty-handler 4.2.16.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-68497 | MEDIUM5.1 | com.fasterxml.jackson.core:jackson-databind 2.22.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-75596 | MEDIUM5.1 | io.netty:netty-handler 4.2.16.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-84939 | MEDIUM5.1 | org.freemarker:freemarker 2.3.32 fixed in 2.3.35 | 0.9% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-68497 | MEDIUM5.1 | tools.jackson.core:jackson-databind 3.2.1 fixed in 3.2.2, 3.1.6 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-58055 | MEDIUM4.59 | nghttp2-libs 1.69.0-r0 fixed in 1.70.0-r0 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-19032 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.22.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-8384 | MEDIUM4.5 | org.eclipse.jetty:jetty-util 12.0.33 fixed in 12.0.35, 12.1.9 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-19032 | MEDIUM4.5 | tools.jackson.core:jackson-databind 3.2.1 fixed in 3.1.6, 3.2.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-89407 | MEDIUM4.02 | com.fasterxml.jackson.core:jackson-core 2.22.1 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89407 | MEDIUM4.02 | tools.jackson.core:jackson-core 3.2.1 fixed in 3.1.7, 3.2.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-71497 | MEDIUM4 | org.jsoup:jsoup 1.15.3 fixed in 1.23.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | LOW3.83 | com.fasterxml.jackson.core:jackson-core 2.22.1 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | LOW3.83 | com.fasterxml.jackson.core:jackson-databind 2.22.1 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-91777 | LOW3.83 | com.fasterxml.jackson.core:jackson-databind 2.22.1 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | LOW3.83 | tools.jackson.core:jackson-core 3.2.1 fixed in 3.1.7, 3.2.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | LOW3.83 | tools.jackson.core:jackson-databind 3.2.1 fixed in 3.1.7, 3.2.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-91777 | LOW3.83 | tools.jackson.core:jackson-databind 3.2.1 fixed in 3.1.7, 3.2.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-83557 | LOW2.86 | com.fasterxml.jackson.core:jackson-databind 2.22.1 fixed in 2.18.10, 2.21.6, 2.22.2 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-83557 | LOW2.86 | tools.jackson.core:jackson-databind 3.2.1 fixed in 3.1.6, 3.2.2 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-26740 | LOW2.7 | giflib 5.2.2-r1 fixed in 5.2.2-r2 | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2026-82208 | LOW2.45 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-82208 | LOW2.45 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-59903 | LOW2.29 | io.netty:netty-codec-http 4.2.16.Final fixed in 4.2.17.Final, 4.1.137.Final | 0.2% Theoretical Threat | Post-Exploit |
| CVE-2026-64607 | LOW2.29 | org.apache.httpcomponents.client5:httpclient5 5.6.2 fixed in 5.6.3 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-75140 | LOW2.29 | org.jsoup:jsoup 1.15.3 fixed in 1.23.2 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-46675 | LOW2.12 | libpng 1.6.58-r1 fixed in 1.6.59-r0 | — | Post-Exploit |
| CVE-2026-19931 | LOW1.99 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-19931 | LOW1.99 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.7% Theoretical Threat | Post-Exploit |
| CVE-2026-13608 | LOW1.89 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-18924 | LOW1.89 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-80229 | LOW1.89 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-80230 | LOW1.89 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-80231 | LOW1.89 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.9% Theoretical Threat | Post-Exploit |
| CVE-2026-80255 | LOW1.89 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-13608 | LOW1.89 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-18924 | LOW1.89 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-80229 | LOW1.89 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-80230 | LOW1.89 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-80231 | LOW1.89 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.9% Theoretical Threat | Post-Exploit |
| CVE-2026-80255 | LOW1.89 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-82209 | LOW1.58 | curl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-82209 | LOW1.58 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-88807 | NONE0 | libxrender 0.9.12-r0 fixed in 0.9.13-r0 | 0.3% Theoretical Threat | Not Applicable |
| CVE-2026-88806 | NONE0 | libx11 1.8.13-r0 fixed in 1.8.14-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-94286 | NONE0 | libxtst 1.2.5-r0 fixed in 1.2.6-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-94283 | NONE0 | libx11 1.8.13-r0 fixed in 1.8.14-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-93541 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-93542 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-93543 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-93544 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-93545 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-94281 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | 0.2% Theoretical Threat | Not Applicable |
| CVE-2026-94282 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-94284 | NONE0 | libx11 1.8.13-r0 fixed in 1.8.14-r0 | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-94285 | NONE0 | libx11 1.8.13-r0 fixed in 1.8.14-r0 | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-80256 | NONE0 | curl 8.21.0-r0 fixed in 8.22.0-r0 | — | Not Applicable |
| CVE-2026-80256 | NONE0 | libcurl 8.21.0-r0 fixed in 8.22.0-r0 | — | Not Applicable |
| CVE-2026-109089 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | — | Not Applicable |
| CVE-2026-109090 | NONE0 | libxi 1.8.3-r0 fixed in 1.8.4-r0 | — | Not Applicable |
| CVE-2026-109088 | NONE0 | libxtst 1.2.5-r0 fixed in 1.2.6-r0 | — | Not Applicable |
| CVE-2026-85091 | NONE0 | zlib 1.3.2-r0 fixed in 1.3.2-r1 | 0.4% Theoretical Threat | Not Applicable |
Which CVEs are actually reachable — is the vulnerable code even linked and callable.
Live-container probes: default user, writable paths, capabilities, exposed ports.
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.
A step-by-step hardened build plan, with parity tests proving nothing breaks.
Want to check another image? Run a full scan with the Docker Security Scanner.