apache/druid:37.0.0 container image
Docker HubScanned 14 Sept 2026
Deployed by 2 of 17,781 indexed charts (latest versions) at this tag.Docker Hub all tags of apache/druid
apache/druid:37.0.0 resolved to 0116fb802786, scanned 14 Sept 2026: 270 findings, 6 critical; deployed by 2 charts, among them druid and druid.
Radar Score
Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.
Medium findings
71 distinct on this digest
Medium: findings whose contribution to the Radar Score is 15–39. Show every band
Findings for digest 0116fb802786 as scanned on 14 Sept 2026 with syft 1.42.1 for linux/amd64, advisories as of 14 Sept 2026. Other architectures may differ.
| Severity | Advisory | Package | Fixed in |
|---|---|---|---|
| Medium | GHSA-3f7h-mf4q-vrm4 | woodstox-core | 5.4.0 |
| Medium | GHSA-wm47-8v5p-wjpj | netty | no fix listed |
| Medium | GHSA-rj7p-rfgp-852x | libthrift | 0.13.0 |
| Medium | GHSA-p979-4mfw-53vg | netty | no fix listed |
| Medium | GHSA-wjxj-f8rg-99wx | libthrift | 0.9.3-1 |
| Medium | GHSA-r7pg-v2c8-mfg3 | avro | 1.11.4 |
| Medium | DEBIAN-CVE-2019-1010022 | glibc | no fix listed |
| Medium | DEBIAN-CVE-2023-45853 | zlib | no fix listed |
| Medium | GHSA-g2fg-mr77-6vrm | libthrift | 0.14.0 |
| Medium | GHSA-9vjp-v76f-g363 | netty | no fix listed |
| Medium | GHSA-grg4-wf29-r9vv | netty | no fix listed |
| Medium | DEBIAN-CVE-2018-20796 | glibc | no fix listed |
| Medium | GHSA-p2v9-g2qv-p635 | netty | no fix listed |
| Medium | DEBIAN-CVE-2019-1010023 | glibc | no fix listed |
| Medium | GHSA-98qh-xjc8-98pq | postgresql | 42.7.11 |
| Medium | GHSA-7r82-7xv7-xcpj | httpclient | 4.5.13 |
| Medium | GHSA-vx85-mj8c-4qm6 | libthrift | 0.12.0 |
| Medium | GHSA-wxr5-93ph-8wr9 | commons-beanutils | 1.11.0 |
| Medium | GHSA-jjjh-jjxp-wpff | jackson-databind | 2.12.7.1 |
| Medium | GHSA-rgv9-q543-rqg4 | jackson-databind | 2.12.7.1 |
| Medium | GHSA-735f-pc8j-v9w8 | protobuf-java | 3.25.5 |
| Medium | GHSA-gwrp-pvrq-jmwv | commons-io | 2.7 |
| Medium | GHSA-mvr2-9pj6-7w5j | guava | 24.1.1-android |
| Medium | DEBIAN-CVE-2019-9192 | glibc | no fix listed |
| Medium | GHSA-f256-j965-7f32 | netty | no fix listed |
| Medium | GHSA-fg2v-w576-w4v3 | json-smart | 1.3.3 |
| Medium | GHSA-p93r-85wp-75v3 | bcprov-jdk18on | 1.84 |
| Medium | DEBIAN-CVE-2012-0039 | glib2.0 | no fix listed |
| Medium | DEBIAN-CVE-2024-28757 | expat | no fix listed |
| Medium | GHSA-vp98-w2p3-mv35 | log4j | 2.0 |
| Medium | DEBIAN-CVE-2023-25193 | harfbuzz | no fix listed |
| Medium | GHSA-rhrv-645h-fjfh | avro | 1.11.3 |
| Medium | GHSA-wx5j-54mm-rqqq | netty | no fix listed |
| Medium | GHSA-wrvw-hg22-4m67 | protobuf-java | 3.16.1 |
| Medium | GHSA-x27m-9w8j-5vcw | jettison | 1.5.2 |
| Medium | GHSA-wmcc-9vch-jmx4 | cassandra-all | 3.0.31 |
| Medium | GHSA-j288-q9x7-2f5v | commons-lang | no fix listed |
| Medium | GHSA-j288-q9x7-2f5v | commons-lang3 | 3.18.0 |
| Medium | GHSA-jr6h-r7vg-f9mc | ini4j | no fix listed |
| Medium | GHSA-7rf3-mqpx-h7xg | jettison | 1.5.2 |
| Medium | GHSA-grr4-wv38-f68w | jettison | 1.5.2 |
| Medium | GHSA-xjp4-hw94-mvp5 | commons-configuration2 | 2.10.1 |
| Medium | GHSA-cgp8-4m63-fhh5 | commons-net | 3.9.0 |
| Medium | DEBIAN-CVE-2025-59375 | expat | no fix listed |
| Medium | GHSA-78wr-2p64-hpwj | commons-io | 2.14.0 |
| Medium | GHSA-3qp7-7mw8-wx86 | netty-handler | 4.2.15.Final |
| Medium | GHSA-355h-qmc2-wpwf | jetty-http | 9.4.60 |
| Medium | DEBIAN-CVE-2019-1010024 | glibc | no fix listed |
| Medium | GHSA-9w38-p64v-xpmv | commons-configuration2 | 2.10.1 |
| Medium | GHSA-rmj7-2vxq-3g9f | jackson-databind | 2.21.4 |