apache/druid:37.0.0 container image
Docker HubScanned 14 Sept 2026
Deployed by 2 of 17,781 indexed charts (latest versions) at this tag.Docker Hub all tags of apache/druid
apache/druid:37.0.0 resolved to 0116fb802786, scanned 14 Sept 2026: 270 findings, 6 critical; deployed by 2 charts, among them druid and druid.
Radar Score
Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.
Vulnerabilities
270 distinct on this digest
Findings for digest 0116fb802786 as scanned on 14 Sept 2026 with syft 1.42.1 for linux/amd64, advisories as of 14 Sept 2026. Other architectures may differ.
| Severity | Advisory | Package | Fixed in |
|---|---|---|---|
| Medium | GHSA-cgp8-4m63-fhh5 | commons-net | 3.9.0 |
| Medium | DEBIAN-CVE-2025-59375 | expat | no fix listed |
| Medium | GHSA-78wr-2p64-hpwj | commons-io | 2.14.0 |
| Medium | GHSA-3qp7-7mw8-wx86 | netty-handler | 4.2.15.Final |
| Medium | GHSA-355h-qmc2-wpwf | jetty-http | 9.4.60 |
| Medium | DEBIAN-CVE-2019-1010024 | glibc | no fix listed |
| Medium | GHSA-9w38-p64v-xpmv | commons-configuration2 | 2.10.1 |
| Medium | GHSA-rmj7-2vxq-3g9f | jackson-databind | 2.21.4 |
| Medium | DEBIAN-CVE-2026-5450 | glibc | no fix listed |
| Medium | GHSA-493p-pfq6-5258 | json-smart | 2.4.9 |
| Medium | GHSA-j3rv-43j4-c7qm | jackson-databind | 2.21.4 |
| Medium | GHSA-56h3-78gp-v83r | jettison | 1.5.1 |
| Medium | DEBIAN-CVE-2026-33416 | libpng1.6 | 1.6.39-2+deb12u4 |
| Medium | GHSA-h46c-h94j-95f3 | jackson-core | 2.15.0 |
| Medium | GHSA-q6g2-g7f3-rr83 | jettison | 1.5.4 |
| Medium | GHSA-cm33-6792-r9fm | netty-codec-dns | 4.2.13.Final |
| Medium | GHSA-5mcr-gq6c-3hq2 | netty | no fix listed |
| Medium | GHSA-f6hv-jmp6-3vwv | netty-codec-http2 | 4.2.13.Final |
| Medium | GHSA-f6hv-jmp6-3vwv | netty-codec-http | 4.2.13.Final |
| Medium | DEBIAN-CVE-2026-58016 | glib2.0 | no fix listed |
| Medium | GHSA-jppx-w49h-x2qq | netty-codec-http | 4.2.16.Final |
| Medium | DEBIAN-CVE-2025-29070 | lcms2 | no fix listed |
| Medium | DEBIAN-CVE-2026-66046 | expat | no fix listed |
| Medium | GHSA-hf6x-8p5f-cgmf | httpcore5 | 5.4.3 |
| Medium | GHSA-v3jc-474w-2wm6 | httpcore5-h2 | 5.4.3 |
| Medium | GHSA-x4gw-5cx5-pgmh | netty-handler | 4.2.15.Final |
| Medium | GHSA-g5ww-5jh7-63cx | protobuf-java | 3.16.3 |
| Medium | GHSA-gvpg-vgmx-xg6w | nimbus-jose-jwt | 9.37.2 |
| Medium | DEBIAN-CVE-2019-1010025 | glibc | no fix listed |
| Low | DEBIAN-CVE-2026-33636 | libpng1.6 | 1.6.39-2+deb12u4 |
| Low | GHSA-3pxv-7cmr-fjr4 | log4j-core | 2.25.4 |
| Low | GHSA-445c-vh5m-36rj | log4j-core | 2.25.4 |
| Low | GHSA-2fvj-hgj9-j2gr | jetty-security | 12.1.10 |
| Low | GHSA-2fvj-hgj9-j2gr | jetty-ee8-security | 12.1.10 |
| Low | GHSA-57rv-r2g8-2cj3 | netty-codec-http | 4.2.13.Final |
| Low | GHSA-4gg5-vx3j-xwc7 | protobuf-java | 3.16.3 |
| Low | DEBIAN-CVE-2026-22016 | openjdk-17 | 17.0.19+10-1~deb12u2 |
| Low | GHSA-5qcv-4rpc-jp93 | kafka-clients | 3.9.2 |
| Low | DEBIAN-CVE-2026-58015 | glib2.0 | no fix listed |
| Low | GHSA-68mj-5wr7-6fgg | amqp-client | 5.33.1 |
| Low | GHSA-cfxw-4h78-h7fw | dnsjava | 3.6.0 |
| Low | DEBIAN-CVE-2026-58013 | glib2.0 | no fix listed |
| Low | DEBIAN-CVE-2026-58010 | glib2.0 | no fix listed |
| Low | DEBIAN-CVE-2026-58012 | glib2.0 | no fix listed |
| Low | DEBIAN-CVE-2026-34282 | openjdk-17 | 17.0.19+10-1~deb12u2 |
| Low | GHSA-45q3-82m4-75jr | netty-handler-proxy | 4.2.13.Final |
| Low | DEBIAN-CVE-2026-0915 | glibc | 2.36-9+deb12u14 |
| Low | DEBIAN-CVE-2026-58014 | glib2.0 | no fix listed |
| Low | GHSA-93j5-89vc-pph4 | amqp-client | 5.33.1 |
| Low | GHSA-3wrr-7qpf-2prh | jackson-databind | 2.14.0 |