Last scanned:
··This image poses a critical security risk and must not be used in production, especially as an internet-facing service. An attacker who reaches port 8080 could send crafted requests that bypass access checks and potentially reach admin endpoints, which could expose or alter the server's data and control functions. The container runs as root by default, so a successful exploit would carry elevated privileges within the container. The bypass flaw CVE-2026-2332 is exercised by default on that port, while CVE-2026-10050 matters only if Digest authentication is set up with non-Latin-1 passwords. Production use is prohibited until the Jetty libraries are upgraded to a version that fixes CVE-2026-2332.
Hardening plan for this image · 3 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-2332 | CRITICAL9.1 | org.eclipse.jetty:jetty-http 9.4.58.v20250814 fixed in 12.1.7, 12.0.33, 11.0.29, 10.0.28, 9.4.60 | 1.3% Low-Moderate Risk | Directly ExposedContext importance: HIGH |
| CVE-2026-10050 | HIGH7.28 | org.eclipse.jetty:jetty-security 9.4.58.v20250814 fixed in 9.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-88647 | MEDIUM5.52 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2025-66382 | MEDIUM5.5 | libexpat1 2.4.7-1ubuntu0.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-77420 | MEDIUM5.5 | org.jline:jline-reader 3.30.14 fixed in 4.3.1, 3.30.15 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2025-11226 | MEDIUM5.44 | ch.qos.logback:logback-core 1.3.15 fixed in 1.5.19, 1.3.16 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-1225 | MEDIUM5 | ch.qos.logback:logback-core 1.3.15 fixed in 1.5.25 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc-bin 2.35-0ubuntu3.15 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc6 2.35-0ubuntu3.15 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-89425 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-core 2.22.2 fixed in 2.21.7, 2.22.3, 2.18.11 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-91776 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.22.2 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-91777 | MEDIUM4.5 | com.fasterxml.jackson.core:jackson-databind 2.22.2 fixed in 2.21.7, 2.18.11, 2.22.3 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2024-6763 | MEDIUM4.5 | org.eclipse.jetty:jetty-http 9.4.58.v20250814 fixed in 12.0.12 | 1.0% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-95184 | MEDIUM4.24 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-6790 | MEDIUM4.24 | org.eclipse.jetty:jetty-server 9.4.58.v20250814 fixed in 12.0.35, 12.1.9 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89092 | MEDIUM4.2 | libc-bin 2.35-0ubuntu3.15 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc6 2.35-0ubuntu3.15 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-88648 | MEDIUM4.14 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-103111 | MEDIUM4.14 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-86145 | MEDIUM4.14 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89157 | MEDIUM4.14 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-89161 | MEDIUM4.14 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-107161 | MEDIUM4.14 | libsasl2-2 2.1.27+dfsg2-3ubuntu1.2 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-107161 | MEDIUM4.14 | libsasl2-modules-db 2.1.27+dfsg2-3ubuntu1.2 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-95209 | MEDIUM4 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-95210 | MEDIUM4 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-89158 | LOW3.9 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89160 | LOW3.9 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2022-4899 | LOW3.9 | libzstd1 1.4.8+dfsg-3build1 No fix yet | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-67693 | LOW3.54 | libgnutls30 3.7.3-4ubuntu1.9 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89156 | LOW3.54 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | LOW3.31 | gcc-12-base 12.3.0-1ubuntu1~22.04.3 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | LOW3.31 | libgcc-s1 12.3.0-1ubuntu1~22.04.3 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2022-27943 | LOW3.31 | libstdc++6 12.3.0-1ubuntu1~22.04.3 No fix yet | 1.0% Theoretical Threat | Directly Exposed |
| CVE-2026-102473 | LOW3.3 | dash 0.5.11+git20210903+057cd650a4ed-3build1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-40228 | LOW3.3 | libsystemd0 249.11-0ubuntu3.23 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-40228 | LOW3.3 | libudev1 249.11-0ubuntu3.23 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-10532 | LOW2.9 | ch.qos.logback:logback-core 1.3.15 fixed in 1.5.34 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-89407 | LOW2.7 | com.fasterxml.jackson.core:jackson-core 2.22.2 fixed in 2.18.11, 2.21.7, 2.22.3 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-77422 | LOW2.7 | org.jline:jline-builtins 3.30.14 fixed in 4.3.1, 3.30.15 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-18477 | LOW2.64 | tar 1.34+dfsg-1ubuntu0.1.22.04.6 No fix yet | <0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-18508 | LOW2.64 | tar 1.34+dfsg-1ubuntu0.1.22.04.6 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-102474 | LOW2.4 | dash 0.5.11+git20210903+057cd650a4ed-3build1 No fix yet | 0.1% Theoretical Threat | Post-Exploit |
| CVE-2026-77421 | LOW2.34 | org.jline:jline-builtins 3.30.14 fixed in 4.3.1, 3.30.15 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | libncurses6 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | libncursesw6 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2022-41409 | LOW2.34 | libpcre2-8-0 10.39-3ubuntu0.1 No fix yet | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2023-50495 | LOW2.34 | libtinfo6 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | ncurses-base 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2023-50495 | LOW2.34 | ncurses-bin 6.3-2ubuntu0.3 No fix yet | 1.0% Low-Moderate Risk | Post-Exploit |
| CVE-2021-31879 | LOW2.2 | wget 1.21.2-2ubuntu1.5 No fix yet | 1.1% Low-Moderate Risk | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | login 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2024-56433 | LOW1.84 | passwd 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-29383 | LOW1.68 | login 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2023-29383 | LOW1.68 | passwd 1:4.8.1-2ubuntu2.2 No fix yet | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-9828 | LOW1.2 | ch.qos.logback:logback-core 1.3.15 fixed in 1.5.33 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | NONE0 | locales 2.35-0ubuntu3.15 No fix yet | 0.1% Theoretical Threat | Not Applicable |
| CVE-2026-89092 | NONE0 | locales 2.35-0ubuntu3.15 No fix yet | 0.2% Theoretical Threat | Not Applicable |
Want to check another image? Run a full scan with the Docker Security Scanner.