Vulnerability Reporttomcat:9.0.118-jdk8-corretto

tomcat:9.0.118-jdk8-corretto-al2tomcat:9.0.118-jdk8-correttotomcat:9.0-jdk8-corretto-al2tomcat:9.0-jdk8-correttotomcat:9-jdk8-corretto-al2tomcat:9-jdk8-corretto
digestsha256:06981b3d65bfe1de25060cd69f858d66c517908725a0fa348962ce163599ab39

Executive Summary

Last scanned:

Threat Score
74/100CAUTION
Reputation
TRUSTED

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. The most severe finding, CVE-2026-6653, allows remote code execution via XML inputs, which directly impacts Tomcat's web-facing functionality. The two OpenSSL CVEs (CVE-2026-45447) are less critical as they require processing PKCS#7 messages, which is non-default in Tomcat. Updating libxml2 is strongly recommended to eliminate the high-severity risk.

Vulnerabilities

Vulnerability Log

41 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-6653HIGH8.33
libxml2
2.9.1-6.amzn2.5.24
fixed in 2.9.1-6.amzn2.5.25
0.3%
Theoretical Threat
Directly ExposedContext importance: HIGH
CVE-2026-45447MEDIUM6.48
openssl-libs
1:1.0.2k-24.amzn2.0.20
fixed in 1:1.0.2k-24.amzn2.0.21
2.7%
Low-Moderate Risk
Directly ExposedContext importance: MEDIUM
CVE-2026-45447MEDIUM6.48
openssl11-libs
1:1.1.1zg-1.amzn2.0.1
fixed in 1:1.1.1zh-1.amzn2.0.1
2.7%
Low-Moderate Risk
Directly ExposedContext importance: MEDIUM
CVE-2026-56132MEDIUM5.87
expat
2.1.0-15.amzn2.0.6
fixed in 2.1.0-15.amzn2.0.7
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-56403MEDIUM5.87
expat
2.1.0-15.amzn2.0.6
fixed in 2.1.0-15.amzn2.0.8
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-56406MEDIUM5.87
expat
2.1.0-15.amzn2.0.6
fixed in 2.1.0-15.amzn2.0.8
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-7383MEDIUM4.67
openssl-libs
1:1.0.2k-24.amzn2.0.20
fixed in 1:1.0.2k-24.amzn2.0.21
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-7383MEDIUM4.67
openssl11-libs
1:1.1.1zg-1.amzn2.0.1
fixed in 1:1.1.1zh-1.amzn2.0.1
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-9076MEDIUM4.02
openssl-libs
1:1.0.2k-24.amzn2.0.20
fixed in 1:1.0.2k-24.amzn2.0.21
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-9076MEDIUM4.02
openssl11-libs
1:1.1.1zg-1.amzn2.0.1
fixed in 1:1.1.1zh-1.amzn2.0.1
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-52858LOW3.98
vim-minimal
2:9.0.2153-1.amzn2.0.6
fixed in 2:9.0.2153-1.amzn2.0.7
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-52860LOW3.98
vim-minimal
2:9.0.2153-1.amzn2.0.6
fixed in 2:9.0.2153-1.amzn2.0.7
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-55693LOW3.98
vim-minimal
2:9.0.2153-1.amzn2.0.6
fixed in 2:9.0.2153-1.amzn2.0.8
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-55895LOW3.98
vim-minimal
2:9.0.2153-1.amzn2.0.6
fixed in 2:9.0.2153-1.amzn2.0.8
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-57456LOW3.98
vim-minimal
2:9.0.2153-1.amzn2.0.6
fixed in 2:9.0.2153-1.amzn2.0.8
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-42766LOW3.6
openssl-libs
1:1.0.2k-24.amzn2.0.20
fixed in 1:1.0.2k-24.amzn2.0.21
0.6%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-42766LOW3.6
openssl11-libs
1:1.1.1zg-1.amzn2.0.1
fixed in 1:1.1.1zh-1.amzn2.0.1
0.6%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-34180LOW3.4
openssl-libs
1:1.0.2k-24.amzn2.0.20
fixed in 1:1.0.2k-24.amzn2.0.21
0.5%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-34180LOW3.4
openssl11-libs
1:1.1.1zg-1.amzn2.0.1
fixed in 1:1.1.1zh-1.amzn2.0.1
0.5%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-58016LOW2.78
glib2
2.56.1-9.amzn2.0.13
fixed in 2.56.1-9.amzn2.0.14
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-7598LOW2.78
libssh2
1.4.3-12.amzn2.2.6
fixed in 1.4.3-12.amzn2.2.7
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-47167LOW2.7
vim-minimal
2:9.0.2153-1.amzn2.0.6
fixed in 2:9.0.2153-1.amzn2.0.7
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-47162LOW2.69
vim-minimal
2:9.0.2153-1.amzn2.0.6
fixed in 2:9.0.2153-1.amzn2.0.7
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-58050LOW2.29
libssh2
1.4.3-12.amzn2.2.6
fixed in 1.4.3-12.amzn2.2.8
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-58051LOW1.99
libssh2
1.4.3-12.amzn2.2.6
fixed in 1.4.3-12.amzn2.2.8
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-11972LOW1.99
python
2.7.18-1.amzn2.0.19
fixed in 2.7.18-1.amzn2.0.21
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-11972LOW1.99
python-libs
2.7.18-1.amzn2.0.19
fixed in 2.7.18-1.amzn2.0.21
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-6019LOW1.87
python
2.7.18-1.amzn2.0.19
fixed in 2.7.18-1.amzn2.0.20
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-6019LOW1.87
python-libs
2.7.18-1.amzn2.0.19
fixed in 2.7.18-1.amzn2.0.20
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-11850LOW1.53
krb5-libs
1.15.1-55.amzn2.2.9
fixed in 1.15.1-55.amzn2.2.10
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-47162NONE0
vim-data
2:9.0.2153-1.amzn2.0.6
fixed in 2:9.0.2153-1.amzn2.0.7
0.2%
Theoretical Threat
Not Applicable
CVE-2026-52858NONE0
vim-data
2:9.0.2153-1.amzn2.0.6
fixed in 2:9.0.2153-1.amzn2.0.7
0.2%
Theoretical Threat
Not Applicable
CVE-2026-52860NONE0
vim-data
2:9.0.2153-1.amzn2.0.6
fixed in 2:9.0.2153-1.amzn2.0.7
0.2%
Theoretical Threat
Not Applicable
CVE-2026-55693NONE0
vim-data
2:9.0.2153-1.amzn2.0.6
fixed in 2:9.0.2153-1.amzn2.0.8
0.1%
Theoretical Threat
Not Applicable
CVE-2026-55895NONE0
vim-data
2:9.0.2153-1.amzn2.0.6
fixed in 2:9.0.2153-1.amzn2.0.8
0.2%
Theoretical Threat
Not Applicable
CVE-2026-57456NONE0
vim-data
2:9.0.2153-1.amzn2.0.6
fixed in 2:9.0.2153-1.amzn2.0.8
0.1%
Theoretical Threat
Not Applicable
CVE-2026-47167NONE0
vim-data
2:9.0.2153-1.amzn2.0.6
fixed in 2:9.0.2153-1.amzn2.0.7
0.1%
Theoretical Threat
Not Applicable
CVE-2026-56407NONE0
expat
2.1.0-15.amzn2.0.6
fixed in 2.1.0-15.amzn2.0.8
0.1%
Theoretical Threat
Not Applicable
CVE-2026-53615NONE0
libblkid
2.30.2-2.amzn2.0.13
fixed in 2.30.2-2.amzn2.0.14
—
Not Applicable
CVE-2026-53615NONE0
libmount
2.30.2-2.amzn2.0.13
fixed in 2.30.2-2.amzn2.0.14
—
Not Applicable
CVE-2026-53615NONE0
libuuid
2.30.2-2.amzn2.0.13
fixed in 2.30.2-2.amzn2.0.14
—
Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.