Vulnerability Reporttimberio/vector:0.59.0-alpine

timberio/vector:0.59.0-alpine

digestsha256:0e36bc2a290039e9b6a5e92f04bd2f133223506f72d09682c1df16c015172b7a

Executive Summary

Last scanned: Nov 2, 2026

Threat ScoreSAFE• The scan found 23 low-severity findings in components reachable in normal operation, with a highest severity of 5.0, so none reach the threshold that would affect the verdict.• None of the findings are listed as known to be actively exploited in the wild, and none are flagged as exploitable after the container is already compromised.• The image is published by a verified publisher (TRUSTED) and is pinned by digest, so its contents are immutable and traceable.• The container runs as root by default, which is a hardening point worth reviewing even though it does not change the verdict.• The image exposes no network ports and defines no environment variables, which limits its reachable attack surface.

5/100SAFE

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image is safe for production use. The scan did find 23 vulnerabilities, but the most severe of them is rated 5.0, none are known to be actively exploited, and none matter once an attacker has already gained control of the container. They therefore do not change the verdict, though keeping the image updated is still good practice. The image comes from a verified publisher and is pinned by digest, which supports a stable and traceable deployment. Running as root by default is the one hardening point to review before production use.

Already in good shape · 3 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

23 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-85091	MEDIUM5	zlib 1.3.2-r0 fixed in 1.3.2-r1	0.5% Theoretical Threat	Directly Exposed
CVE-2026-14456	MEDIUM4.5	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.7% Theoretical Threat	Directly Exposed
CVE-2026-18798	MEDIUM4.5	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.7% Low-Moderate Risk	Directly Exposed
CVE-2026-63072	MEDIUM4.5	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.9% Theoretical Threat	Directly Exposed
CVE-2026-63076	MEDIUM4.5	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.6% Low-Moderate Risk	Directly Exposed
CVE-2026-14457	MEDIUM4.5	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.2% Low-Moderate Risk	Directly Exposed
CVE-2026-54874	MEDIUM4.5	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-63074	MEDIUM4.5	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-63075	MEDIUM4.5	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-14456	MEDIUM4.5	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.7% Theoretical Threat	Directly Exposed
CVE-2026-18798	MEDIUM4.5	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.7% Low-Moderate Risk	Directly Exposed
CVE-2026-63072	MEDIUM4.5	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.9% Theoretical Threat	Directly Exposed
CVE-2026-63076	MEDIUM4.5	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.6% Low-Moderate Risk	Directly Exposed
CVE-2026-14457	MEDIUM4.5	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.2% Low-Moderate Risk	Directly Exposed
CVE-2026-54874	MEDIUM4.5	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-63074	MEDIUM4.5	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-63075	MEDIUM4.5	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-107891	MEDIUM4	musl 1.2.6-r2 fixed in 1.2.6-r3	—	Directly Exposed
CVE-2026-107891	MEDIUM4	musl-utils 1.2.6-r2 fixed in 1.2.6-r3	—	Directly Exposed
CVE-2026-75803	LOW3.7	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-75803	LOW3.7	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-63073	LOW3.54	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.2% Low-Moderate Risk	Directly Exposed
CVE-2026-63073	LOW3.54	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.2% Low-Moderate Risk	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.