docker.io/library/zookeeper:3.9.3
Base OS: ubuntu 22.04180 vulnerabilities fixed
Patched Image
ghcr.io/verity-org/library/zookeeper:3.9.3
Supply Chain
Full compliance detailsSignedSLSA L3SBOMRekor
Verify this artifact
Cosign signature
cosign verify \ --certificate-identity-regexp "https://github.com/verity-org/verity/.github/workflows/" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ ghcr.io/verity-org/library/zookeeper:3.9.3
Build provenance
gh attestation verify \ oci://ghcr.io/verity-org/library/zookeeper:3.9.3 \ --owner verity-org
Before patching
Found 251 vulnerabilities in the original image. 180 fixed by Copa. 71 remaining after patching.
24 HIGH127 MEDIUM100 LOW
Fix available — pending patch
These vulnerabilities have upstream fixes but could not be automatically patched. Manual remediation may be required.
- CVE-2026-54512HIGH
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.15.2
- Fixed
- 2.18.8, 3.1.4, 2.21.4
- CVE-2026-54513HIGH
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.15.2
- Fixed
- 2.18.8, 2.21.4, 3.1.4
- CVE-2026-42583HIGH
- Package
- io.netty:netty-codec
- Installed
- 4.1.113.Final
- Fixed
- 4.1.133.Final
- CVE-2025-24970HIGH
- Package
- io.netty:netty-handler
- Installed
- 4.1.113.Final
- Fixed
- 4.1.118.Final
- CVE-2026-44249HIGH
- Package
- io.netty:netty-handler
- Installed
- 4.1.113.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-45416HIGH
- Package
- io.netty:netty-handler
- Installed
- 4.1.113.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-50010HIGH
- Package
- io.netty:netty-handler
- Installed
- 4.1.113.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2026-24281HIGH
- Package
- org.apache.zookeeper:zookeeper
- Installed
- 3.9.3
- Fixed
- 3.8.6, 3.9.5
- CVE-2026-24308HIGH
- Package
- org.apache.zookeeper:zookeeper
- Installed
- 3.9.3
- Fixed
- 3.9.5, 3.8.6
- CVE-2026-2332HIGH
- Package
- org.eclipse.jetty:jetty-http
- Installed
- 9.4.56.v20240826
- Fixed
- 12.1.7, 12.0.33
- CVE-2024-13009HIGH
- Package
- org.eclipse.jetty:jetty-server
- Installed
- 9.4.56.v20240826
- Fixed
- 9.4.57.v20241219
- CVE-2024-12798MEDIUM
- Package
- ch.qos.logback:logback-core
- Installed
- 1.2.13
- Fixed
- 1.5.13, 1.3.15
- CVE-2025-11226MEDIUM
- Package
- ch.qos.logback:logback-core
- Installed
- 1.2.13
- Fixed
- 1.5.19, 1.3.16
- GHSA-72hv-8253-57qqMEDIUM
- Package
- com.fasterxml.jackson.core:jackson-core
- Installed
- 2.15.2
- Fixed
- 2.21.1, 2.18.6
- CVE-2026-54514MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.15.2
- Fixed
- 2.18.8, 2.21.4, 3.1.4
- CVE-2026-54515MEDIUM
- Package
- com.fasterxml.jackson.core:jackson-databind
- Installed
- 2.15.2
- Fixed
- 3.1.4, 2.18.9, 2.21.5, 2.22.1
- CVE-2025-58057MEDIUM
- Package
- io.netty:netty-codec
- Installed
- 4.1.113.Final
- Fixed
- 4.1.125.Final
- CVE-2024-47535MEDIUM
- Package
- io.netty:netty-common
- Installed
- 4.1.113.Final
- Fixed
- 4.1.115.Final
- CVE-2025-25193MEDIUM
- Package
- io.netty:netty-common
- Installed
- 4.1.113.Final
- Fixed
- 4.1.118.Final
- CVE-2026-45536MEDIUM
- Package
- io.netty:netty-transport-native-epoll
- Installed
- 4.1.113.Final
- Fixed
- 4.2.15.Final, 4.1.135.Final
- CVE-2025-58457MEDIUM
- Package
- org.apache.zookeeper:zookeeper
- Installed
- 3.9.3
- Fixed
- 3.9.4
- CVE-2024-6763MEDIUM
- Package
- org.eclipse.jetty:jetty-http
- Installed
- 9.4.56.v20240826
- Fixed
- 12.0.12
- CVE-2024-12801LOW
- Package
- ch.qos.logback:logback-core
- Installed
- 1.2.13
- Fixed
- 1.5.13, 1.3.15
- CVE-2026-10532LOW
- Package
- ch.qos.logback:logback-core
- Installed
- 1.2.13
- Fixed
- 1.5.35
- CVE-2026-1225LOW
- Package
- ch.qos.logback:logback-core
- Installed
- 1.2.13
- Fixed
- 1.5.25
- CVE-2026-9828LOW
- Package
- ch.qos.logback:logback-core
- Installed
- 1.2.13
- Fixed
- 1.5.33
- CVE-2025-11143LOW
- Package
- org.eclipse.jetty:jetty-http
- Installed
- 9.4.56.v20240826
- Fixed
- 12.0.31, 12.1.5
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2026-54512 | com.fasterxml.jackson.core:jackson-databind | 2.15.2 | 2.18.8, 3.1.4, 2.21.4 | HIGH |
| CVE-2026-54513 | com.fasterxml.jackson.core:jackson-databind | 2.15.2 | 2.18.8, 2.21.4, 3.1.4 | HIGH |
| CVE-2026-42583 | io.netty:netty-codec | 4.1.113.Final | 4.1.133.Final | HIGH |
| CVE-2025-24970 | io.netty:netty-handler | 4.1.113.Final | 4.1.118.Final | HIGH |
| CVE-2026-44249 | io.netty:netty-handler | 4.1.113.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-45416 | io.netty:netty-handler | 4.1.113.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-50010 | io.netty:netty-handler | 4.1.113.Final | 4.2.15.Final, 4.1.135.Final | HIGH |
| CVE-2026-24281 | org.apache.zookeeper:zookeeper | 3.9.3 | 3.8.6, 3.9.5 | HIGH |
| CVE-2026-24308 | org.apache.zookeeper:zookeeper | 3.9.3 | 3.9.5, 3.8.6 | HIGH |
| CVE-2026-2332 | org.eclipse.jetty:jetty-http | 9.4.56.v20240826 | 12.1.7, 12.0.33 | HIGH |
| CVE-2024-13009 | org.eclipse.jetty:jetty-server | 9.4.56.v20240826 | 9.4.57.v20241219 | HIGH |
| CVE-2024-12798 | ch.qos.logback:logback-core | 1.2.13 | 1.5.13, 1.3.15 | MEDIUM |
| CVE-2025-11226 | ch.qos.logback:logback-core | 1.2.13 | 1.5.19, 1.3.16 | MEDIUM |
| GHSA-72hv-8253-57qq | com.fasterxml.jackson.core:jackson-core | 2.15.2 | 2.21.1, 2.18.6 | MEDIUM |
| CVE-2026-54514 | com.fasterxml.jackson.core:jackson-databind | 2.15.2 | 2.18.8, 2.21.4, 3.1.4 | MEDIUM |
| CVE-2026-54515 | com.fasterxml.jackson.core:jackson-databind | 2.15.2 | 3.1.4, 2.18.9, 2.21.5, 2.22.1 | MEDIUM |
| CVE-2025-58057 | io.netty:netty-codec | 4.1.113.Final | 4.1.125.Final | MEDIUM |
| CVE-2024-47535 | io.netty:netty-common | 4.1.113.Final | 4.1.115.Final | MEDIUM |
| CVE-2025-25193 | io.netty:netty-common | 4.1.113.Final | 4.1.118.Final | MEDIUM |
| CVE-2026-45536 | io.netty:netty-transport-native-epoll | 4.1.113.Final | 4.2.15.Final, 4.1.135.Final | MEDIUM |
| CVE-2025-58457 | org.apache.zookeeper:zookeeper | 3.9.3 | 3.9.4 | MEDIUM |
| CVE-2024-6763 | org.eclipse.jetty:jetty-http | 9.4.56.v20240826 | 12.0.12 | MEDIUM |
| CVE-2024-12801 | ch.qos.logback:logback-core | 1.2.13 | 1.5.13, 1.3.15 | LOW |
| CVE-2026-10532 | ch.qos.logback:logback-core | 1.2.13 | 1.5.35 | LOW |
| CVE-2026-1225 | ch.qos.logback:logback-core | 1.2.13 | 1.5.25 | LOW |
| CVE-2026-9828 | ch.qos.logback:logback-core | 1.2.13 | 1.5.33 | LOW |
| CVE-2025-11143 | org.eclipse.jetty:jetty-http | 9.4.56.v20240826 | 12.0.31, 12.1.5 | LOW |
Awaiting upstream fix
No fix is available yet for these vulnerabilities. They can be suppressed in your compliance tooling until an upstream fix is released.
- CVE-2026-27456MEDIUM
- Package
- bsdutils
- Installed
- 1:2.37.2-4ubuntu3.4
- Fixed
- CVE-2026-27456MEDIUM
- Package
- libblkid1
- Installed
- 2.37.2-4ubuntu3.4
- Fixed
- CVE-2026-4046MEDIUM
- Package
- libc-bin
- Installed
- 2.35-0ubuntu3.13
- Fixed
- CVE-2026-5435MEDIUM
- Package
- libc-bin
- Installed
- 2.35-0ubuntu3.13
- Fixed
- CVE-2026-6238MEDIUM
- Package
- libc-bin
- Installed
- 2.35-0ubuntu3.13
- Fixed
- CVE-2026-4046MEDIUM
- Package
- libc6
- Installed
- 2.35-0ubuntu3.13
- Fixed
- CVE-2026-5435MEDIUM
- Package
- libc6
- Installed
- 2.35-0ubuntu3.13
- Fixed
- CVE-2026-6238MEDIUM
- Package
- libc6
- Installed
- 2.35-0ubuntu3.13
- Fixed
- CVE-2025-66382MEDIUM
- Package
- libexpat1
- Installed
- 2.4.7-1ubuntu0.7
- Fixed
- CVE-2026-27456MEDIUM
- Package
- libmount1
- Installed
- 2.37.2-4ubuntu3.4
- Fixed
- CVE-2026-13757MEDIUM
- Package
- libp11-kit0
- Installed
- 0.24.0-6build1
- Fixed
- CVE-2026-40930MEDIUM
- Package
- libpng16-16
- Installed
- 1.6.37-3ubuntu0.5
- Fixed
- CVE-2026-27456MEDIUM
- Package
- libsmartcols1
- Installed
- 2.37.2-4ubuntu3.4
- Fixed
- CVE-2026-27456MEDIUM
- Package
- libuuid1
- Installed
- 2.37.2-4ubuntu3.4
- Fixed
- CVE-2026-4046MEDIUM
- Package
- locales
- Installed
- 2.35-0ubuntu3.13
- Fixed
- CVE-2026-5435MEDIUM
- Package
- locales
- Installed
- 2.35-0ubuntu3.13
- Fixed
- CVE-2026-6238MEDIUM
- Package
- locales
- Installed
- 2.35-0ubuntu3.13
- Fixed
- CVE-2026-27456MEDIUM
- Package
- mount
- Installed
- 2.37.2-4ubuntu3.4
- Fixed
- CVE-2026-13757MEDIUM
- Package
- p11-kit
- Installed
- 0.24.0-6build1
- Fixed
- CVE-2026-13757MEDIUM
- Package
- p11-kit-modules
- Installed
- 0.24.0-6build1
- Fixed
- CVE-2026-27456MEDIUM
- Package
- util-linux
- Installed
- 2.37.2-4ubuntu3.4
- Fixed
- CVE-2021-31879MEDIUM
- Package
- wget
- Installed
- 1.21.2-2ubuntu1.1
- Fixed
- CVE-2026-58469MEDIUM
- Package
- wget
- Installed
- 1.21.2-2ubuntu1.1
- Fixed
- CVE-2026-58470MEDIUM
- Package
- wget
- Installed
- 1.21.2-2ubuntu1.1
- Fixed
- CVE-2026-58471MEDIUM
- Package
- wget
- Installed
- 1.21.2-2ubuntu1.1
- Fixed
- CVE-2026-58472MEDIUM
- Package
- wget
- Installed
- 1.21.2-2ubuntu1.1
- Fixed
- CVE-2022-27943LOW
- Package
- gcc-12-base
- Installed
- 12.3.0-1ubuntu1~22.04.2
- Fixed
- CVE-2022-27943LOW
- Package
- libgcc-s1
- Installed
- 12.3.0-1ubuntu1~22.04.2
- Fixed
- CVE-2024-2236LOW
- Package
- libgcrypt20
- Installed
- 1.9.4-3ubuntu3.2
- Fixed
- CVE-2023-50495LOW
- Package
- libncurses6
- Installed
- 6.3-2ubuntu0.2
- Fixed
- CVE-2023-50495LOW
- Package
- libncursesw6
- Installed
- 6.3-2ubuntu0.2
- Fixed
- CVE-2022-41409LOW
- Package
- libpcre2-8-0
- Installed
- 10.39-3ubuntu0.1
- Fixed
- CVE-2017-11164LOW
- Package
- libpcre3
- Installed
- 2:8.39-13ubuntu0.22.04.1
- Fixed
- CVE-2022-27943LOW
- Package
- libstdc++6
- Installed
- 12.3.0-1ubuntu1~22.04.2
- Fixed
- CVE-2026-40228LOW
- Package
- libsystemd0
- Installed
- 249.11-0ubuntu3.21
- Fixed
- CVE-2023-50495LOW
- Package
- libtinfo6
- Installed
- 6.3-2ubuntu0.2
- Fixed
- CVE-2026-40228LOW
- Package
- libudev1
- Installed
- 249.11-0ubuntu3.21
- Fixed
- CVE-2022-4899LOW
- Package
- libzstd1
- Installed
- 1.4.8+dfsg-3build1
- Fixed
- CVE-2023-29383LOW
- Package
- login
- Installed
- 1:4.8.1-2ubuntu2.2
- Fixed
- CVE-2024-56433LOW
- Package
- login
- Installed
- 1:4.8.1-2ubuntu2.2
- Fixed
- CVE-2023-50495LOW
- Package
- ncurses-base
- Installed
- 6.3-2ubuntu0.2
- Fixed
- CVE-2023-50495LOW
- Package
- ncurses-bin
- Installed
- 6.3-2ubuntu0.2
- Fixed
- CVE-2023-29383LOW
- Package
- passwd
- Installed
- 1:4.8.1-2ubuntu2.2
- Fixed
- CVE-2024-56433LOW
- Package
- passwd
- Installed
- 1:4.8.1-2ubuntu2.2
- Fixed
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2026-27456 | bsdutils | 1:2.37.2-4ubuntu3.4 | MEDIUM | |
| CVE-2026-27456 | libblkid1 | 2.37.2-4ubuntu3.4 | MEDIUM | |
| CVE-2026-4046 | libc-bin | 2.35-0ubuntu3.13 | MEDIUM | |
| CVE-2026-5435 | libc-bin | 2.35-0ubuntu3.13 | MEDIUM | |
| CVE-2026-6238 | libc-bin | 2.35-0ubuntu3.13 | MEDIUM | |
| CVE-2026-4046 | libc6 | 2.35-0ubuntu3.13 | MEDIUM | |
| CVE-2026-5435 | libc6 | 2.35-0ubuntu3.13 | MEDIUM | |
| CVE-2026-6238 | libc6 | 2.35-0ubuntu3.13 | MEDIUM | |
| CVE-2025-66382 | libexpat1 | 2.4.7-1ubuntu0.7 | MEDIUM | |
| CVE-2026-27456 | libmount1 | 2.37.2-4ubuntu3.4 | MEDIUM | |
| CVE-2026-13757 | libp11-kit0 | 0.24.0-6build1 | MEDIUM | |
| CVE-2026-40930 | libpng16-16 | 1.6.37-3ubuntu0.5 | MEDIUM | |
| CVE-2026-27456 | libsmartcols1 | 2.37.2-4ubuntu3.4 | MEDIUM | |
| CVE-2026-27456 | libuuid1 | 2.37.2-4ubuntu3.4 | MEDIUM | |
| CVE-2026-4046 | locales | 2.35-0ubuntu3.13 | MEDIUM | |
| CVE-2026-5435 | locales | 2.35-0ubuntu3.13 | MEDIUM | |
| CVE-2026-6238 | locales | 2.35-0ubuntu3.13 | MEDIUM | |
| CVE-2026-27456 | mount | 2.37.2-4ubuntu3.4 | MEDIUM | |
| CVE-2026-13757 | p11-kit | 0.24.0-6build1 | MEDIUM | |
| CVE-2026-13757 | p11-kit-modules | 0.24.0-6build1 | MEDIUM | |
| CVE-2026-27456 | util-linux | 2.37.2-4ubuntu3.4 | MEDIUM | |
| CVE-2021-31879 | wget | 1.21.2-2ubuntu1.1 | MEDIUM | |
| CVE-2026-58469 | wget | 1.21.2-2ubuntu1.1 | MEDIUM | |
| CVE-2026-58470 | wget | 1.21.2-2ubuntu1.1 | MEDIUM | |
| CVE-2026-58471 | wget | 1.21.2-2ubuntu1.1 | MEDIUM | |
| CVE-2026-58472 | wget | 1.21.2-2ubuntu1.1 | MEDIUM | |
| CVE-2022-27943 | gcc-12-base | 12.3.0-1ubuntu1~22.04.2 | LOW | |
| CVE-2022-27943 | libgcc-s1 | 12.3.0-1ubuntu1~22.04.2 | LOW | |
| CVE-2024-2236 | libgcrypt20 | 1.9.4-3ubuntu3.2 | LOW | |
| CVE-2023-50495 | libncurses6 | 6.3-2ubuntu0.2 | LOW | |
| CVE-2023-50495 | libncursesw6 | 6.3-2ubuntu0.2 | LOW | |
| CVE-2022-41409 | libpcre2-8-0 | 10.39-3ubuntu0.1 | LOW | |
| CVE-2017-11164 | libpcre3 | 2:8.39-13ubuntu0.22.04.1 | LOW | |
| CVE-2022-27943 | libstdc++6 | 12.3.0-1ubuntu1~22.04.2 | LOW | |
| CVE-2026-40228 | libsystemd0 | 249.11-0ubuntu3.21 | LOW | |
| CVE-2023-50495 | libtinfo6 | 6.3-2ubuntu0.2 | LOW | |
| CVE-2026-40228 | libudev1 | 249.11-0ubuntu3.21 | LOW | |
| CVE-2022-4899 | libzstd1 | 1.4.8+dfsg-3build1 | LOW | |
| CVE-2023-29383 | login | 1:4.8.1-2ubuntu2.2 | LOW | |
| CVE-2024-56433 | login | 1:4.8.1-2ubuntu2.2 | LOW | |
| CVE-2023-50495 | ncurses-base | 6.3-2ubuntu0.2 | LOW | |
| CVE-2023-50495 | ncurses-bin | 6.3-2ubuntu0.2 | LOW | |
| CVE-2023-29383 | passwd | 1:4.8.1-2ubuntu2.2 | LOW | |
| CVE-2024-56433 | passwd | 1:4.8.1-2ubuntu2.2 | LOW |
Original image reference
docker.io/library/zookeeper:3.9.3