Vulnerability Reportubuntu:resolute-20261024.1

ubuntu:resolute-20261024.1

digestsha256:6a06111c3b0a8600feadb270aec771dc239bf407b25625f93f44ab00e11f4d3c

Executive Summary

Last scanned: Nov 12, 2026

Threat ScoreSAFE• No findings in the scan reach the verdict, so nothing flagged here changes the outcome for images built on this base.• The scan flagged 15 vulnerabilities on the exposed side, with the highest severity at 5.52, which is moderate and below the level that would raise concern.• None of the exposed findings are known to be actively exploited in the wild.• The scan flagged 27 issues that matter only after a container is already compromised, with the highest severity at 3.3, so they add little practical risk.• The publisher is TRUSTED, with an official Docker Hub listing and an image pinned by digest, which supports a stable and verifiable foundation.• The container runs as root by default, so images built on it should set a non-root user in their own configuration.

4/100SAFE

ReputationOFFICIAL• Official Docker Hub Image• Pinned by digest (Immutable)

TRUSTED

This base/runtime image is a clean foundation for building production images. The scan did report 15 lower-severity vulnerabilities that are reachable in normal operation, plus 27 that matter only after a container is already compromised, but none are severe, none are known to be actively exploited, and none change the overall verdict. Images built on top of it should still keep this base updated and run their own workloads as a non-root user. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.

Already in good shape · 3 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

42 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-103111	MEDIUM5.52	libpcre2-8-0 10.46-1build1 No fix yet	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-86145	MEDIUM5.52	libpcre2-8-0 10.46-1build1 No fix yet	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-89160	MEDIUM5.2	libpcre2-8-0 10.46-1build1 No fix yet	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-18374	MEDIUM4.9	libc-bin 2.43-2ubuntu2.4 No fix yet	0.1% Theoretical Threat	Directly Exposed
CVE-2026-18374	MEDIUM4.9	libc-gconv-modules-extra 2.43-2ubuntu2.4 No fix yet	0.1% Theoretical Threat	Directly Exposed
CVE-2026-18374	MEDIUM4.9	libc6 2.43-2ubuntu2.4 No fix yet	0.1% Theoretical Threat	Directly Exposed
CVE-2026-89156	MEDIUM4.72	libpcre2-8-0 10.46-1build1 No fix yet	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-89092	MEDIUM4.2	libc-bin 2.43-2ubuntu2.4 No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2026-89092	MEDIUM4.2	libc-gconv-modules-extra 2.43-2ubuntu2.4 No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2026-89092	MEDIUM4.2	libc6 2.43-2ubuntu2.4 No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2026-89157	MEDIUM4.14	libpcre2-8-0 10.46-1build1 No fix yet	0.3% Theoretical Threat	Directly Exposed
CVE-2026-89158	LOW3.9	libpcre2-8-0 10.46-1build1 No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2026-102473	LOW3.3	dash 0.5.12-12ubuntu3 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-40228	LOW3.3	libsystemd0 259.9-0ubuntu0.1 No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2026-40228	LOW3.3	libudev1 259.9-0ubuntu0.1 No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2026-18477	LOW2.64	tar 1.35+dfsg-4ubuntu0.4 No fix yet	<0.1% Theoretical Threat	Post-Exploit
CVE-2026-18508	LOW2.64	tar 1.35+dfsg-4ubuntu0.4 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-89162	LOW2.64	libpcre2-8-0 10.46-1build1 No fix yet	0.2% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-89161	LOW2.48	libpcre2-8-0 10.46-1build1 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-35341	LOW2.48	rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet	0.2% Theoretical Threat	Post-Exploit
CVE-2026-35352	LOW2.48	rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-35368	LOW2.48	rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-102474	LOW2.4	dash 0.5.12-12ubuntu3 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-35350	LOW2.38	rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-35360	LOW2.27	rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-35364	LOW2.27	rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet	<0.1% Theoretical Threat	Post-Exploit
CVE-2026-35374	LOW2.27	rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet	<0.1% Theoretical Threat	Post-Exploit
CVE-2026-35363	LOW2.02	rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet	0.2% Theoretical Threat	Post-Exploit
CVE-2026-35348	LOW1.98	rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-35373	LOW1.98	rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-35345	LOW1.91	rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet	<0.1% Theoretical Threat	Post-Exploit
CVE-2024-56433	LOW1.84	login.defs 1:4.17.4-2ubuntu3 No fix yet	0.4% Theoretical Threat	Post-Exploit
CVE-2024-56433	LOW1.84	passwd 1:4.17.4-2ubuntu3 No fix yet	0.4% Theoretical Threat	Post-Exploit
CVE-2026-35354	LOW1.69	rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-35357	LOW1.69	rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet	<0.1% Theoretical Threat	Post-Exploit
CVE-2026-35359	LOW1.69	rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-35370	LOW1.58	rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-35351	LOW1.51	rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-35344	LOW1.19	rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-35367	LOW1.19	rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-35371	LOW1.19	rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet	0.1% Theoretical Threat	Post-Exploit
CVE-2026-35377	LOW1.19	rust-coreutils 0.10.0-1ubuntu2~26.04.1 No fix yet	0.1% Theoretical Threat	Post-Exploit

Want to check another image? Run a full scan with the Docker Security Scanner.