almalinux:10 image size, layers and vulnerabilities (2026-11-01)

docker pull almalinux:10almalinux@sha256:5a4b41a427c9717be8f4ac2a32aa22efbae5f9124fbcb79a6765394f312acfe8

Size per platform

Compressed download size on Docker Hub for each architecture.

ppc64le75 MB
s390x69 MB
i38669 MB
amd6469 MB
arm6468 MB

Where the bytes go

Unpacked bytes by directory in the final amd64 filesystem.

/usr/lib6466 MB
/usr/lib64/python3.1243 MB
/usr/bin20 MB
/usr/share/misc10 MB
/usr/lib64/systemd7.5 MB
/usr/lib/sysimage7.3 MB
/var/lib4.5 MB
/usr/lib/python3.124.1 MB
/usr/lib/systemd3.7 MB
/usr/sbin3.0 MB

Layers

The 1 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.

1. ADD almalinux-10-default-amd64.tar.xz69 MB

Full build steps

69 MBADD almalinux-10-default-amd64.tar.xz / # buildkit

Known vulnerabilities

1Critical1 with a fix

21High21 with a fix

35Medium35 with a fix

0Low0 with a fix

0Unknown0 with a fix

57 findings across 136 packages; 57 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.

Severity	Vulnerability	Affected packages	Fixed in
Critical	CVE-2026-114406ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns	ca-certificatesinstalled 2025.2.80_v9.0.305-102.el10_1	2026.2.92_v9.0.319-100.3.el10_2
High	CVE-2026-103111pcre2: pcre2: Out-of-bounds write via crafted regular expression	pcre2, pcre2-syntaxinstalled 10.44-1.el10.3	10.44-1.5.el10_2
High	CVE-2026-19445python: Use-after-free of a server-side SSLContext when sni_callback switches contexts	python3, python3-libsinstalled 3.12.14-1.el10_2	3.12.15-1.el10_2
High	CVE-2026-19553python: python: Certificate verification bypass via missing server_hostname validation in SSLContext.wrap_bio()	python3, python3-libsinstalled 3.12.14-1.el10_2	3.12.15-1.el10_2
High	CVE-2026-42784sequoia-openpgp: sequoia-openpgp: Cryptographic integrity compromise via key flag confusion	rpm-sequoiainstalled 1.10.1.1-2.el10	1.10.2.1-1.el10_2
High	CVE-2026-73073vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion	vim-data, vim-minimalinstalled 2:9.1.083-9.el10_2.20	2:9.1.083-9.el10_2.22
High	CVE-2026-86145pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions	pcre2, pcre2-syntaxinstalled 10.44-1.el10.3	10.44-1.5.el10_2
High	CVE-2026-89156PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback	pcre2, pcre2-syntaxinstalled 10.44-1.el10.3	10.44-1.5.el10_2
High	CVE-2026-89157pcre2: PCRE2: Out-of-bounds write via large pattern input	pcre2, pcre2-syntaxinstalled 10.44-1.el10.3	10.44-1.5.el10_2
High	CVE-2026-89158PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms	pcre2, pcre2-syntaxinstalled 10.44-1.el10.3	10.44-1.5.el10_2
High	CVE-2026-89160pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching	pcre2, pcre2-syntaxinstalled 10.44-1.el10.3	10.44-1.5.el10_2
High	CVE-2026-89161pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match	pcre2, pcre2-syntaxinstalled 10.44-1.el10.3	10.44-1.5.el10_2
Medium	CVE-2026-10536libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service	curl, libcurl-minimalinstalled 8.12.1-4.el10_2.6	8.12.1-4.el10_2.7
Medium	CVE-2026-18374glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string	glibc, glibc-common, glibc-minimal-langpackinstalled 2.39-128.el10_2.alma.1	2.39-145.el10_2.alma.1
Medium	CVE-2026-19499glibc: Buffer Overflow in strfmon right-justification padding	glibc, glibc-common, glibc-minimal-langpackinstalled 2.39-128.el10_2.alma.1	2.39-142.el10_2.alma.1
Medium	CVE-2026-19542glibc: Fix out-of-bounds array write in tdelete	glibc, glibc-common, glibc-minimal-langpackinstalled 2.39-128.el10_2.alma.1	2.39-142.el10_2.alma.1
Medium	CVE-2026-5545curl: libcurl: Authentication bypass due to incorrect HTTP Negotiate connection reuse	curl, libcurl-minimalinstalled 8.12.1-4.el10_2.6	8.12.1-4.el10_2.7
Medium	CVE-2026-6253curl: curl: Proxy credential disclosure via redirects to unauthenticated proxies	curl, libcurl-minimalinstalled 8.12.1-4.el10_2.6	8.12.1-4.el10_2.7
Medium	CVE-2026-6368glibc: glibc: Process abort due to invalid memory in wordexp	glibc, glibc-common, glibc-minimal-langpackinstalled 2.39-128.el10_2.alma.1	2.39-142.el10_2.alma.1
Medium	CVE-2026-6429curl: libcurl: Credential leak via reused proxy connection during HTTP redirects	curl, libcurl-minimalinstalled 8.12.1-4.el10_2.6	8.12.1-4.el10_2.7
Medium	CVE-2026-6791glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion	glibc, glibc-common, glibc-minimal-langpackinstalled 2.39-128.el10_2.alma.1	2.39-142.el10_2.alma.1
Medium	CVE-2026-7168curl: libcurl: Information disclosure via incorrect Proxy-Authorization header reuse	curl, libcurl-minimalinstalled 8.12.1-4.el10_2.6	8.12.1-4.el10_2.7
Medium	CVE-2026-77117glibc: Non-progress DoS in SHIFT_JISX0213 -&gt	glibc, glibc-common, glibc-minimal-langpackinstalled 2.39-128.el10_2.alma.1	2.39-145.el10_2.alma.1
Medium	CVE-2026-80489glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state	glibc, glibc-common, glibc-minimal-langpackinstalled 2.39-128.el10_2.alma.1	2.39-145.el10_2.alma.1
Medium	CVE-2026-84782openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission	openssl-libsinstalled 1:3.5.8-1.el10_2.alma.1	1:3.5.8-2.el10_2.alma.1
Medium	CVE-2026-8674glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration	glibc, glibc-common, glibc-minimal-langpackinstalled 2.39-128.el10_2.alma.1	2.39-145.el10_2.alma.1

Packages

RPM packages: 136

Image configuration

Base OS: AlmaLinux 10.2
Default user: root (no USER set; the entrypoint may still drop privileges)
Entrypoint: —
Command: /bin/bash
Exposed ports: none
Image created: 2026-10-02
amd64 digest: sha256:ba31c3299856068f77bc10574cad51b0a4f6a3dafb882668656e1639bee63db6

Other AlmaLinux tags

almalinux:10-minimal76 MB unpacked · 31 MB downloadC 1H 15M 35

almalinux:10 vs almalinux:10-minimal

Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-26 from digest sha256:ba31c3299856. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.