apache/druid:38.0.0 container image

Docker Hub

Scanned 16 Oct 2026

Deployed by 1 of 18,137 indexed charts (latest versions) at this tag.Docker Hub all tags of apache/druid

apache/druid:38.0.0 resolved to 4156a8ca87b8, scanned 16 Oct 2026: 191 findings, 6 critical; deployed by 1 chart, among them druid.

Radar Score

2,9066252130

191 findings on digest 4156a8ca87b8 · scanned 16 Oct 2026

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Digests

1 digest

Tag	Digest	Used by	Last seen	Vulnerabilities	Radar Score
38.0.0resolves to	4156a8ca87b8	1 chart	today	6252130	2,906

Digests this tag resolved to in indexed charts’ default renders. A tag can move; the digest is what was scanned.

Vulnerabilities

191 distinct on this digest

Findings for digest 4156a8ca87b8 as scanned on 16 Oct 2026 with syft 1.42.1 for linux/amd64, advisories as of 16 Oct 2026. Other architectures may differ.

Severity	Advisory	Package	Fixed in
Low	GHSA-qx7j-jv8m-fppr	amqp-client@5.20.0	5.31.0
Low	GHSA-gx83-3vf8-gh7j	jackson-databind@2.19.2	2.21.6
Low	GHSA-337m-mw94-2v6g	commons-configuration2@2.13.0	2.15.0
Low	DEBIAN-CVE-2026-6238	glibc@2.36-9+deb12u13	no fix listed
Low	GHSA-ph9c-7hw9-vhhw	jline-builtins@3.9.0	3.30.15
Low	GHSA-3pjw-73gf-8qr5	jackson-databind@2.19.2	2.21.4
Low	GHSA-p2jm-6hj6-9rjg	async-http-client@3.0.2	3.0.14
Low	GHSA-5gvw-p9qm-jgwh	jackson-databind@2.18.6	2.18.9
Low	GHSA-7822-rcf6-97fx	amqp-client@5.20.0	5.36.0
Low	DEBIAN-CVE-2026-25210	expat@2.5.0-1+deb12u2	2.5.0-1+deb12u4
Low	GHSA-2jwh-9rmr-j4xf	async-http-client@3.0.2	3.0.14
Low	DEBIAN-CVE-2026-78408	util-linux@2.38.1-5+deb12u3	no fix listed
Low	DEBIAN-CVE-2026-53615	util-linux@2.38.1-5+deb12u3	no fix listed
Low	DEBIAN-CVE-2021-4214	libpng1.6@1.6.39-2+deb12u3	no fix listed
Low	DEBIAN-CVE-2026-102010	gcc-12@12.2.0-14+deb12u1	no fix listed
Low	GHSA-4q2v-9p7v-3v22	reactor-netty-http@1.0.48	1.2.8
Low	GHSA-f9m8-cv68-674w	async-http-client@3.0.2	3.0.13
Low	GHSA-wjgm-6hv5-3cvf	jackson-databind@2.19.2	2.21.6
Low	GHSA-v2j5-22fr-j62r	async-http-client@3.0.2	3.0.14
Low	DEBIAN-CVE-2026-78410	util-linux@2.38.1-5+deb12u3	no fix listed
Low	DEBIAN-CVE-2026-77117	glibc@2.36-9+deb12u13	no fix listed
Low	DEBIAN-CVE-2026-80489	glibc@2.36-9+deb12u13	no fix listed
Low	DEBIAN-CVE-2022-0563	util-linux@2.38.1-5+deb12u3	no fix listed
Low	DEBIAN-CVE-2026-102633	expat@2.5.0-1+deb12u2	no fix listed
Low	GHSA-hjcp-jmpx-g3qm	httpclient5@5.5.1	5.6.3
Low	DSA-6189-1	libpng1.6@1.6.39-2+deb12u3	1.6.39-2+deb12u4
Low	GHSA-5jmj-h7xm-6q6v	jackson-databind@2.19.2	2.21.5
Low	DEBIAN-CVE-2023-52426	expat@2.5.0-1+deb12u2	no fix listed
Low	DEBIAN-CVE-2026-3184	util-linux@2.38.1-5+deb12u3	no fix listed
Low	GHSA-cqgh-8p3p-mx4m	amqp-client@5.20.0	5.36.1
Low	DEBIAN-CVE-2026-56406	expat@2.5.0-1+deb12u2	2.5.0-1+deb12u3
Low	DEBIAN-CVE-2026-56407	expat@2.5.0-1+deb12u2	2.5.0-1+deb12u3
Low	GHSA-gm45-99xc-r7wv	lz4-java@1.11.2	1.11.4
Low	DEBIAN-CVE-2026-56403	expat@2.5.0-1+deb12u2	2.5.0-1+deb12u3
Low	GHSA-hgj6-7826-r7m5	jackson-databind@2.19.2	2.21.4
Low	GHSA-xr57-gcx8-52hf	async-http-client@3.0.2	3.0.12
Low	DEBIAN-CVE-2026-78409	util-linux@2.38.1-5+deb12u3	no fix listed
Low	DEBIAN-CVE-2026-8674	glibc@2.36-9+deb12u13	no fix listed
Low	DEBIAN-CVE-2026-76957	expat@2.5.0-1+deb12u2	2.5.0-1+deb12u3
Low	DEBIAN-CVE-2026-4438	glibc@2.36-9+deb12u13	2.36-9+deb12u14
Low	GHSA-qh8g-58pp-2wxh	jetty-http@9.4.58.v20250814	12.0.12
Low	GHSA-vvgp-rfg2-7rr6	jackson-databind@2.19.2	2.21.5
Low	GHSA-3g76-f9xq-8vp6	vertx-core@4.5.24	4.5.27
Low	DEBIAN-CVE-2026-72522	expat@2.5.0-1+deb12u2	2.5.0-1+deb12u3
Low	DEBIAN-CVE-2025-14104	util-linux@2.38.1-5+deb12u3	no fix listed
Low	DEBIAN-CVE-2026-53613	util-linux@2.38.1-5+deb12u3	no fix listed
Low	DEBIAN-CVE-2026-56404	expat@2.5.0-1+deb12u2	2.5.0-1+deb12u3
Low	DEBIAN-CVE-2026-56410	expat@2.5.0-1+deb12u2	2.5.0-1+deb12u3
Low	DEBIAN-CVE-2026-56411	expat@2.5.0-1+deb12u2	2.5.0-1+deb12u3
Low	GHSA-3wp9-xfwm-rjjf	async-http-client@3.0.2	3.0.12

Used by

1 chart

Chart	Version	Tag	Containers
druidhelmforgeVerified publisher	1.3.7	38.0.0	3

Counts are over the indexed charts’ latest versions, rendered with default values, and say nothing about images outside the indexed set.