docker pull debian:bookworm-slimdebian@sha256:99c0b25c46d0214d5a2091092e7908907dcaecd6a962cde0ac700acee222b6f3Size per platform
Compressed download size on Docker Hub for each architecture.
Where the bytes go
Unpacked bytes by directory in the final amd64 filesystem.
Layers
The 1 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.
Full build steps
- 28 MB
# debian.sh --arch 'amd64' out/ 'bookworm' '@1793059200'
Known vulnerabilities
1Critical0 with a fix
48High0 with a fix
89Medium0 with a fix
83Low0 with a fix
3Unknown2 with a fix
224 findings across 88 packages; 2 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.
| Severity | Vulnerability | Affected packages | Fixed in |
|---|---|---|---|
| Critical | CVE-2023-45853zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6 | zlib1ginstalled 1:1.2.13.dfsg-1 | no fix yet |
| High | CVE-2025-69720ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution. | libtinfo6, ncurses-base, ncurses-bininstalled 6.4-4 | no fix yet |
| High | CVE-2026-16742systemd: systemd-homed: Local privilege escalation via missing home-record signature verification | libsystemd0, libudev1installed 252.39-1~deb12u2 | no fix yet |
| High | CVE-2026-41992gzip: gzip: Information disclosure via global buffer overflow in LZH decompression | gzipinstalled 1.12-1 | no fix yet |
| High | CVE-2026-53613util-linux: TOCTOU in the mount program via ancestor directory swap on target path | bsdutils, libblkid1, libmount1, libsmartcols1 +4 moreinstalled 1:2.38.1-5+deb12u3 | no fix yet |
| High | CVE-2026-53615util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser | bsdutils, libblkid1, libmount1, libsmartcols1 +4 moreinstalled 1:2.38.1-5+deb12u3 | no fix yet |
| High | CVE-2026-54369acl: Symlink traversal privilege escalation via libacl functions | libacl1installed 2.3.1-3 | no fix yet |
| High | CVE-2026-76642util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks | bsdutils, libblkid1, libmount1, libsmartcols1 +4 moreinstalled 1:2.38.1-5+deb12u3 | no fix yet |
| High | CVE-2026-78408util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority | bsdutils, libblkid1, libmount1, libsmartcols1 +4 moreinstalled 1:2.38.1-5+deb12u3 | no fix yet |
| High | CVE-2026-78410util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection | bsdutils, libblkid1, libmount1, libsmartcols1 +4 moreinstalled 1:2.38.1-5+deb12u3 | no fix yet |
| High | CVE-2026-9538perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size | perl-baseinstalled 5.36.0-7+deb12u4 | no fix yet |
| Medium | CVE-2023-50495ncurses: segmentation fault via _nc_wrap_entry() | libtinfo6, ncurses-base, ncurses-bininstalled 6.4-4 | no fix yet |
| Medium | CVE-2024-10041pam: libpam: Libpam vulnerable to read hashed password | libpam-modules, libpam-modules-bin, libpam-runtime, libpam0ginstalled 1.5.2-6+deb12u2 | no fix yet |
| Medium | CVE-2025-30258gnupg: verification DoS due to a malicious subkey in the keyring | gpgvinstalled 2.2.40-1.1+deb12u2 | no fix yet |
| Medium | CVE-2025-68972gnupg: GnuPG: Signature bypass via form feed character in signed messages | gpgvinstalled 2.2.40-1.1+deb12u2 | no fix yet |
| Medium | CVE-2026-102010gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if | gcc-12-base, libgcc-s1, libstdc++6installed 12.2.0-14+deb12u1 | no fix yet |
| Medium | CVE-2026-13595util-linux: util-linux: heap use-after-free in libblkid nested partition probing | bsdutils, libblkid1, libmount1, libsmartcols1 +4 moreinstalled 1:2.38.1-5+deb12u3 | no fix yet |
| Medium | CVE-2026-13757p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing | libp11-kit0installed 0.24.1-2 | no fix yet |
| Medium | CVE-2026-15059systemd: systemd-oomd: Unprivileged users can terminate arbitrary processes via IPC API | libsystemd0, libudev1installed 252.39-1~deb12u2 | no fix yet |
| Medium | CVE-2026-15534perl: Perl: Arbitrary code execution via out-of-bounds memory access in regular expression engine. | perl-baseinstalled 5.36.0-7+deb12u4 | no fix yet |
| Medium | CVE-2026-18374glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string | libc-bin, libc6installed 2.36-9+deb12u14 | no fix yet |
| Medium | CVE-2026-18477tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape | tarinstalled 1.34+dfsg-1.2+deb12u1 | no fix yet |
| Medium | CVE-2026-18508tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite | tarinstalled 1.34+dfsg-1.2+deb12u1 | no fix yet |
| Medium | CVE-2026-18938p11-kit: Integer overflow in RPC attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems | libp11-kit0installed 0.24.1-2 | no fix yet |
| Medium | CVE-2026-19499glibc: Buffer Overflow in strfmon right-justification padding | libc-bin, libc6installed 2.36-9+deb12u14 | no fix yet |
| Medium | CVE-2026-19542glibc: Fix out-of-bounds array write in tdelete | libc-bin, libc6installed 2.36-9+deb12u14 | no fix yet |
| Medium | CVE-2026-27171zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions | zlib1ginstalled 1:1.2.13.dfsg-1 | no fix yet |
| Medium | CVE-2026-27456util-linux: TOCTOU in the mount program when setting up loop devices | bsdutils, libblkid1, libmount1, libsmartcols1 +4 moreinstalled 1:2.38.1-5+deb12u3 | no fix yet |
| Medium | CVE-2026-3184util-linux: util-linux: Access control bypass due to improper hostname canonicalization | bsdutils, libblkid1, libmount1, libsmartcols1 +4 moreinstalled 1:2.38.1-5+deb12u3 | no fix yet |
| Medium | CVE-2026-41991gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility | gzipinstalled 1.12-1 | no fix yet |
| Medium | CVE-2026-42250bzip2: bzip2: Denial of Service in bzip2recover via a specially crafted file | libbz2-1.0installed 1.0.8-5+b1 | no fix yet |
| Medium | CVE-2026-5435glibc: glibc: Out-of-bounds write via TSIG record processing | libc-bin, libc6installed 2.36-9+deb12u14 | no fix yet |
| Medium | CVE-2026-54370acl: TOCTOU Symlink Traversal via getfacl/setfacl | libacl1installed 2.3.1-3 | no fix yet |
| Medium | CVE-2026-54371attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr | libattr1installed 1:2.5.1-4 | no fix yet |
| Medium | CVE-2026-54411linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module | libpam-modules, libpam-modules-bin, libpam-runtime, libpam0ginstalled 1.5.2-6+deb12u2 | no fix yet |
| Medium | CVE-2026-5450glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width | libc-bin, libc6installed 2.36-9+deb12u14 | no fix yet |
| Medium | CVE-2026-5704tar: tar: Hidden file injection via crafted archives | tarinstalled 1.34+dfsg-1.2+deb12u1 | no fix yet |
| Medium | CVE-2026-5928glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings | libc-bin, libc6installed 2.36-9+deb12u14 | no fix yet |
| Medium | CVE-2026-6238glibc: glibc: Application crash or uninitialized memory read via crafted DNS response | libc-bin, libc6installed 2.36-9+deb12u14 | no fix yet |
| Medium | CVE-2026-6368glibc: glibc: Process abort due to invalid memory in wordexp | libc-bin, libc6installed 2.36-9+deb12u14 | no fix yet |
Showing the 40 most severe of 101 distinct vulnerabilities (224 findings, one per affected package).
Packages
- Debian packages
- 88
Image configuration
- Base OS
- Debian 12.15 (bookworm)
- Default user
- root (no USER set; the entrypoint may still drop privileges)
- Entrypoint
- —
- Command
- bash
- Exposed ports
- none
- Image created
- 2026-10-20
- amd64 digest
- sha256:ec31d744f83f4a73447ba045aaab9409997efe5cc706eca4890c1be36cc1606a
Other Debian tags
debian:trixie124 MB unpacked · 49 MB downloadH 43M 60L 60? 1
debian:trixie-slim81 MB unpacked · 30 MB downloadH 43M 60L 60? 1
Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-26 from digest sha256:ec31d744f83f. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.