Vulnerability Reporttomcat:latest

tomcat:latest
DIGESTsha256:f8d2287df1bb2bf9b75a6acfc6d25a75b3a9044429906ff04e01533cfbafa028

Executive Summary

Threat Score
25/100NEEDS ATTENTION
Reputation
TRUSTED

This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. While 79 exposed vulnerabilities exist, only one (CVE-2026-42010) is medium severity (6.66) and requires a non-default RSA-PSK configuration to be exploitable. With Tomcat's default settings, this vulnerability is not applicable. The 45 post-exploit vulnerabilities are all low severity (max 3.3) and primarily affect local attack scenarios. Note: CVE-2026-42010 only applies if RSA-PSK authentication mode is enabled. Keeping the image updated is still recommended.

Vulnerabilities

Vulnerability Log

138 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-42010MEDIUM6.66
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.8%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-42014MEDIUM5.61
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-42013MEDIUM5.58
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.4%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-5260MEDIUM5.58
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.7%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2017-13716MEDIUM5.5
libbinutils
2.42-4ubuntu2.10
No fix yet
1.4%
Low-Moderate Risk
Directly Exposed
CVE-2017-13716MEDIUM5.5
libctf-nobfd0
2.42-4ubuntu2.10
No fix yet
1.4%
Low-Moderate Risk
Directly Exposed
CVE-2017-13716MEDIUM5.5
libctf0
2.42-4ubuntu2.10
No fix yet
1.4%
Low-Moderate Risk
Directly Exposed
CVE-2017-13716MEDIUM5.5
libgprofng0
2.42-4ubuntu2.10
No fix yet
1.4%
Low-Moderate Risk
Directly Exposed
CVE-2017-13716MEDIUM5.5
libsframe1
2.42-4ubuntu2.10
No fix yet
1.4%
Low-Moderate Risk
Directly Exposed
CVE-2026-40226MEDIUM5.44
libsystemd0
255.4-1ubuntu8.15
fixed in 255.4-1ubuntu8.16
<0.1%
Theoretical Threat
Directly Exposed
CVE-2026-40226MEDIUM5.44
libudev1
255.4-1ubuntu8.15
fixed in 255.4-1ubuntu8.16
<0.1%
Theoretical Threat
Directly Exposed
CVE-2026-3833MEDIUM5.03
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-42011MEDIUM5.03
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-5435MEDIUM5.02
libc6
2.39-0ubuntu8.7
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-9076MEDIUM5.02
libssl3t64
3.0.13-0ubuntu3.9
fixed in 3.0.13-0ubuntu3.11
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-42012MEDIUM4.82
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2024-2236MEDIUM4.72
libgcrypt20
1.10.3-2build1
No fix yet
1.1%
Low-Moderate Risk
Directly ExposedContext importance: MEDIUM
CVE-2025-69651MEDIUM4.67
libbinutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69651MEDIUM4.67
libctf-nobfd0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69651MEDIUM4.67
libctf0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-66382MEDIUM4.67
libexpat1
2.6.1-2ubuntu0.4
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69651MEDIUM4.67
libgprofng0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69651MEDIUM4.67
libsframe1
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-7383MEDIUM4.67
libssl3t64
3.0.13-0ubuntu3.9
fixed in 3.0.13-0ubuntu3.11
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-4046MEDIUM4.5
libc-bin
2.39-0ubuntu8.7
No fix yet
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-4046MEDIUM4.5
libc6
2.39-0ubuntu8.7
No fix yet
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-42015MEDIUM4.5
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.7%
Theoretical Threat
Directly Exposed
CVE-2026-34743MEDIUM4.5
liblzma5
5.6.1+really5.4.5-1ubuntu0.2
fixed in 5.6.1+really5.4.5-1ubuntu0.3
0.4%
Theoretical Threat
Directly Exposed
CVE-2026-42766MEDIUM4.5
libssl3t64
3.0.13-0ubuntu3.9
fixed in 3.0.13-0ubuntu3.11
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-42767MEDIUM4.5
libssl3t64
3.0.13-0ubuntu3.9
fixed in 3.0.13-0ubuntu3.11
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-4437MEDIUM4.42
libc-bin
2.39-0ubuntu8.7
No fix yet
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-4437MEDIUM4.42
libc6
2.39-0ubuntu8.7
No fix yet
0.3%
Theoretical Threat
Directly ExposedContext importance: MEDIUM
CVE-2026-34180MEDIUM4.25
libssl3t64
3.0.13-0ubuntu3.9
fixed in 3.0.13-0ubuntu3.11
0.5%
Theoretical Threat
Directly Exposed
CVE-2026-27456MEDIUM4
libblkid1
2.39.3-9ubuntu6.5
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-27456MEDIUM4
libmount1
2.39.3-9ubuntu6.5
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-27456MEDIUM4
libsmartcols1
2.39.3-9ubuntu6.5
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-27456MEDIUM4
libuuid1
2.39.3-9ubuntu6.5
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2026-4438LOW3.4
libc-bin
2.39-0ubuntu8.7
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-4438LOW3.4
libc6
2.39-0ubuntu8.7
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2017-13716LOW3.3
binutils
2.42-4ubuntu2.10
No fix yet
1.4%
Low-Moderate Risk
Post-Exploit
CVE-2017-13716LOW3.3
binutils-x86-64-linux-gnu
2.42-4ubuntu2.10
No fix yet
1.4%
Low-Moderate Risk
Post-Exploit
CVE-2025-1152LOW3.15
libbinutils
2.42-4ubuntu2.10
No fix yet
0.6%
Theoretical Threat
Directly Exposed
CVE-2025-1152LOW3.15
libctf-nobfd0
2.42-4ubuntu2.10
No fix yet
0.6%
Theoretical Threat
Directly Exposed
CVE-2025-1152LOW3.15
libctf0
2.42-4ubuntu2.10
No fix yet
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-3832LOW3.15
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.3%
Theoretical Threat
Directly Exposed
CVE-2026-5419LOW3.15
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.5%
Theoretical Threat
Directly Exposed
CVE-2025-1152LOW3.15
libgprofng0
2.42-4ubuntu2.10
No fix yet
0.6%
Theoretical Threat
Directly Exposed
CVE-2025-1152LOW3.15
libsframe1
2.42-4ubuntu2.10
No fix yet
0.6%
Theoretical Threat
Directly Exposed
CVE-2026-45446LOW3.15
libssl3t64
3.0.13-0ubuntu3.9
fixed in 3.0.13-0ubuntu3.11
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-45447LOW2.92
libssl3t64
3.0.13-0ubuntu3.9
fixed in 3.0.13-0ubuntu3.11
1.4%
Low-Moderate Risk
Post-Exploit
CVE-2026-45447LOW2.92
openssl
3.0.13-0ubuntu3.9
fixed in 3.0.13-0ubuntu3.11
1.4%
Low-Moderate Risk
Post-Exploit
CVE-2025-45582LOW2.86
tar
1.35+dfsg-3build1
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2025-69651LOW2.8
binutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69651LOW2.8
binutils-x86-64-linux-gnu
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-7383LOW2.8
openssl
3.0.13-0ubuntu3.9
fixed in 3.0.13-0ubuntu3.11
0.3%
Theoretical Threat
Post-Exploit
CVE-2025-69647LOW2.8
libbinutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69648LOW2.8
libbinutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69652LOW2.8
libbinutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69647LOW2.8
libctf-nobfd0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69648LOW2.8
libctf-nobfd0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69652LOW2.8
libctf-nobfd0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69647LOW2.8
libctf0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69648LOW2.8
libctf0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69652LOW2.8
libctf0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69647LOW2.8
libgprofng0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69648LOW2.8
libgprofng0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69652LOW2.8
libgprofng0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69647LOW2.8
libsframe1
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69648LOW2.8
libsframe1
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69652LOW2.8
libsframe1
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-40228LOW2.8
libsystemd0
255.4-1ubuntu8.15
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-40228LOW2.8
libudev1
255.4-1ubuntu8.15
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-33845LOW2.78
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-45445LOW2.78
libssl3t64
3.0.13-0ubuntu3.9
fixed in 3.0.13-0ubuntu3.11
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-45445LOW2.78
openssl
3.0.13-0ubuntu3.9
fixed in 3.0.13-0ubuntu3.11
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-42766LOW2.7
openssl
3.0.13-0ubuntu3.9
fixed in 3.0.13-0ubuntu3.11
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-42767LOW2.7
openssl
3.0.13-0ubuntu3.9
fixed in 3.0.13-0ubuntu3.11
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-34180LOW2.55
openssl
3.0.13-0ubuntu3.9
fixed in 3.0.13-0ubuntu3.11
0.5%
Theoretical Threat
Post-Exploit
CVE-2026-27456LOW2.4
bsdutils
1:2.39.3-9ubuntu6.5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-27456LOW2.4
mount
2.39.3-9ubuntu6.5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2026-27456LOW2.4
util-linux
2.39.3-9ubuntu6.5
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2025-69644LOW2.38
libbinutils
2.42-4ubuntu2.10
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2025-69645LOW2.38
libbinutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69646LOW2.38
libbinutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69644LOW2.38
libctf-nobfd0
2.42-4ubuntu2.10
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2025-69645LOW2.38
libctf-nobfd0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69646LOW2.38
libctf-nobfd0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69644LOW2.38
libctf0
2.42-4ubuntu2.10
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2025-69645LOW2.38
libctf0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69646LOW2.38
libctf0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69644LOW2.38
libgprofng0
2.42-4ubuntu2.10
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2025-69645LOW2.38
libgprofng0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69646LOW2.38
libgprofng0
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69644LOW2.38
libsframe1
2.42-4ubuntu2.10
No fix yet
0.1%
Theoretical Threat
Directly Exposed
CVE-2025-69645LOW2.38
libsframe1
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2025-69646LOW2.38
libsframe1
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Directly Exposed
CVE-2026-41989LOW2.29
libgcrypt20
1.10.3-2build1
fixed in 1.10.3-2ubuntu0.1
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-33846LOW2.29
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.9%
Theoretical Threat
Post-Exploit
CVE-2026-42009LOW2.29
libgnutls30t64
3.8.3-1.1ubuntu3.5
fixed in 3.8.3-1.1ubuntu3.6
0.8%
Theoretical Threat
Post-Exploit
CVE-2026-34182LOW2.26
libssl3t64
3.0.13-0ubuntu3.9
fixed in 3.0.13-0ubuntu3.11
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-34182LOW2.26
openssl
3.0.13-0ubuntu3.9
fixed in 3.0.13-0ubuntu3.11
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-6238LOW1.99
libc-bin
2.39-0ubuntu8.7
No fix yet
0.3%
Theoretical Threat
Post-Exploit
CVE-2026-6238LOW1.99
libc6
2.39-0ubuntu8.7
No fix yet
0.3%
Theoretical Threat
Post-Exploit
CVE-2025-1152LOW1.89
binutils
2.42-4ubuntu2.10
No fix yet
0.6%
Theoretical Threat
Post-Exploit
CVE-2025-1152LOW1.89
binutils-x86-64-linux-gnu
2.42-4ubuntu2.10
No fix yet
0.6%
Theoretical Threat
Post-Exploit
CVE-2026-45446LOW1.89
openssl
3.0.13-0ubuntu3.9
fixed in 3.0.13-0ubuntu3.11
0.2%
Theoretical Threat
Post-Exploit
CVE-2024-56433LOW1.84
login
1:4.13+dfsg1-4ubuntu3.2
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2024-56433LOW1.84
passwd
1:4.13+dfsg1-4ubuntu3.2
No fix yet
0.4%
Theoretical Threat
Post-Exploit
CVE-2026-5435LOW1.81
libc-bin
2.39-0ubuntu8.7
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-42770LOW1.81
libssl3t64
3.0.13-0ubuntu3.9
fixed in 3.0.13-0ubuntu3.11
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-42770LOW1.81
openssl
3.0.13-0ubuntu3.9
fixed in 3.0.13-0ubuntu3.11
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-9076LOW1.81
openssl
3.0.13-0ubuntu3.9
fixed in 3.0.13-0ubuntu3.11
0.3%
Theoretical Threat
Post-Exploit
CVE-2025-69647LOW1.68
binutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69648LOW1.68
binutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69652LOW1.68
binutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69647LOW1.68
binutils-x86-64-linux-gnu
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69648LOW1.68
binutils-x86-64-linux-gnu
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69652LOW1.68
binutils-x86-64-linux-gnu
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69644LOW1.43
binutils
2.42-4ubuntu2.10
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2025-69645LOW1.43
binutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69646LOW1.43
binutils
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69644LOW1.43
binutils-x86-64-linux-gnu
2.42-4ubuntu2.10
No fix yet
0.1%
Theoretical Threat
Post-Exploit
CVE-2025-69645LOW1.43
binutils-x86-64-linux-gnu
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2025-69646LOW1.43
binutils-x86-64-linux-gnu
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-4437NONE0
locales
2.39-0ubuntu8.7
No fix yet
0.3%
Theoretical Threat
Not Applicable
CVE-2026-6238NONE0
locales
2.39-0ubuntu8.7
No fix yet
0.3%
Theoretical Threat
Not Applicable
CVE-2026-5435NONE0
locales
2.39-0ubuntu8.7
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2025-69651NONE0
binutils-common
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2017-13716NONE0
binutils-common
2.42-4ubuntu2.10
No fix yet
1.4%
Low-Moderate Risk
Not Applicable
CVE-2026-4046NONE0
locales
2.39-0ubuntu8.7
No fix yet
0.4%
Theoretical Threat
Not Applicable
CVE-2026-4438NONE0
locales
2.39-0ubuntu8.7
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2025-1152NONE0
binutils-common
2.42-4ubuntu2.10
No fix yet
0.6%
Theoretical Threat
Not Applicable
CVE-2025-69647NONE0
binutils-common
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2025-69648NONE0
binutils-common
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2025-69652NONE0
binutils-common
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2025-69644NONE0
binutils-common
2.42-4ubuntu2.10
No fix yet
0.1%
Theoretical Threat
Not Applicable
CVE-2025-69645NONE0
binutils-common
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Not Applicable
CVE-2025-69646NONE0
binutils-common
2.42-4ubuntu2.10
No fix yet
0.2%
Theoretical Threat
Not Applicable