eclipse-temurin:25-jdk image size, layers and vulnerabilities (2026-11-01)

docker pull eclipse-temurin:25-jdkeclipse-temurin@sha256:83f4a7fc27df94dcc7b8de04d14cbbba8da14406f921e966969c3b09000aa507

Size per platform

Compressed download size on Docker Hub for each architecture.

ppc64le153 MB
amd64151 MB
arm64149 MB
s390x145 MB

Where the bytes go

Unpacked bytes by directory in the final amd64 filesystem.

/opt/java264 MB
/usr/lib/x86_64-linux-gnu59 MB
/usr/bin49 MB
/usr/share/i18n16 MB
/usr/sbin5.0 MB
/var/lib3.8 MB
/usr/lib/locale3.4 MB
/usr/share/fonts3.4 MB
/usr/share/coreutils2.3 MB
/usr/share/doc1.9 MB

Layers

The 6 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.

1. umoci raw add-layer --image /home/bui42 MB
2. umoci raw add-layer --image /home/bui392 B
3. RUN … apt-get install16 MB
4. RUN set -eux; ARCH="$(dpkg --print-ar93 MB
5. RUN set -eux; echo "Verifying install32 B
6. COPY entrypoint.sh → /__cacert_entryp2 kB

Full build steps

42 MBumoci raw add-layer --image /home/buildd/rockcraft-ubuntu-cc003627bc5bab71b42ff0f8e1a41f88/images/ubuntu:rockcraft-base /home/buildd/rockcraft-ubuntu-cc003627bc5bab71b42ff0f8e1a41f88/images/.temp_layer.9587.tar --tag 26.04
392 Bumoci raw add-layer --image /home/buildd/rockcraft-ubuntu-cc003627bc5bab71b42ff0f8e1a41f88/images/ubuntu:26.04 /home/buildd/rockcraft-ubuntu-cc003627bc5bab71b42ff0f8e1a41f88/images/.temp_layer.control_data.9587.tar
16 MBRUN /bin/sh -c set -eux; apt-get update; DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends fontconfig ca-certificates p11-kit binutils tzdata locales ; echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen; locale-gen en_US.UTF-8; rm -rf /var/lib/apt/lists/* # buildkit
93 MBRUN /bin/sh -c set -eux; ARCH="$(dpkg --print-architecture)"; case "${ARCH}" in amd64) ESUM='68982529869257d0ee6b824ec5aa270ff8b118bb438670da0b97ebdab178d7fb'; BINARY_URL='https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.5%2B8/OpenJDK25U-jdk_x64_linux_hotspot_25.0.5_8.tar.gz'; ;; arm64) ESUM='bb5b2ded252f21c6090cf780b0a408ad0d83bbb557e702955643557f13231880'; BINARY_URL='https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.5%2B8/OpenJDK25U-jdk_aarch64_linux_hotspot_25.0.5_8.tar.gz';
32 BRUN /bin/sh -c set -eux; echo "Verifying install ..."; fileEncoding="$(echo 'System.out.println(System.getProperty("file.encoding"))' | jshell -s -)"; [ "$fileEncoding" = 'UTF-8' ]; rm -rf ~/.java; echo "javac --version"; javac --version; echo "java --version"; java --version; echo "Complete." # buildkit
2 kBCOPY --chmod=755 entrypoint.sh /__cacert_entrypoint.sh # buildkit

Known vulnerabilities

0Critical0 with a fix

0High0 with a fix

44Medium0 with a fix

12Low0 with a fix

0Unknown0 with a fix

56 findings across 126 packages; 0 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.

Severity	Vulnerability	Affected packages	Fixed in
Medium	CVE-2025-66382libexpat: libexpat: Denial of service via crafted file processing	libexpat1installed 2.7.4-1ubuntu0.2	no fix yet
Medium	CVE-2026-102473dash: dash: Super-polynomial backtracking in pmatch when libc fnmatch is disabled	dashinstalled 0.5.12-12ubuntu3	no fix yet
Medium	CVE-2026-102474dash: dash: Heap out-of-bounds write in conv_escape via undersized Unicode escape reservation	dashinstalled 0.5.12-12ubuntu3	no fix yet
Medium	CVE-2026-103111pcre2: pcre2: Out-of-bounds write via crafted regular expression	libpcre2-8-0installed 10.46-1build1	no fix yet
Medium	CVE-2026-13757p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing	libp11-kit0, p11-kit, p11-kit-modulesinstalled 0.26.2-2	no fix yet
Medium	CVE-2026-18374glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string	libc-bin, libc-gconv-modules-extra, libc6, localesinstalled 2.43-2ubuntu2.4	no fix yet
Medium	CVE-2026-18477tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape	tarinstalled 1.35+dfsg-4ubuntu0.4	no fix yet
Medium	CVE-2026-18508tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite	tarinstalled 1.35+dfsg-4ubuntu0.4	no fix yet
Medium	CVE-2026-35341rust-coreutils: uutils coreutils mkfifo: Information disclosure via unauthorized file permission modification	rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1	no fix yet
Medium	CVE-2026-35344The dd utility in uutils coreutils suppresses errors during file trunc ...	rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1	no fix yet
Medium	CVE-2026-35345A vulnerability in the tail utility of uutils coreutils allows for the ...	rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1	no fix yet
Medium	CVE-2026-35348The sort utility in uutils coreutils is vulnerable to a process panic ...	rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1	no fix yet
Medium	CVE-2026-35350The cp utility in uutils coreutils fails to properly handle setuid and ...	rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1	no fix yet
Medium	CVE-2026-35351The mv utility in uutils coreutils fails to preserve file ownership du ...	rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1	no fix yet
Medium	CVE-2026-35352A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the m ...	rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1	no fix yet
Medium	CVE-2026-35354A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv ...	rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1	no fix yet
Medium	CVE-2026-35357The cp utility in uutils coreutils is vulnerable to an information dis ...	rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1	no fix yet
Medium	CVE-2026-35359A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utilit ...	rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1	no fix yet
Medium	CVE-2026-35360The touch utility in uutils coreutils is vulnerable to a Time-of-Check ...	rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1	no fix yet
Medium	CVE-2026-35363A vulnerability in the rm utility of uutils coreutils allows the bypas ...	rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1	no fix yet
Medium	CVE-2026-35364rust-coreutils: uutils coreutils mv utility: Arbitrary File Overwrite via TOCTOU Race Condition	rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1	no fix yet
Medium	CVE-2026-35367The nohup utility in uutils coreutils creates its default output file, ...	rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1	no fix yet
Medium	CVE-2026-35368rust-coreutils: uutils coreutils: Privilege escalation and arbitrary code execution in chroot utility	rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1	no fix yet
Medium	CVE-2026-35370The id utility in uutils coreutils miscalculates the groups= section o ...	rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1	no fix yet
Medium	CVE-2026-35371The id utility in uutils coreutils exhibits incorrect behavior in its ...	rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1	no fix yet
Medium	CVE-2026-35373A logic error in the ln utility of uutils coreutils causes the program ...	rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1	no fix yet
Medium	CVE-2026-35374A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the sp ...	rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1	no fix yet
Medium	CVE-2026-35377A logic error in the env utility of uutils coreutils causes a failure ...	rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1	no fix yet
Medium	CVE-2026-86145pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions	libpcre2-8-0installed 10.46-1build1	no fix yet
Medium	CVE-2026-89092glibc: nscd stack overflow leads to degraded DNS resolution	libc-bin, libc-gconv-modules-extra, libc6, localesinstalled 2.43-2ubuntu2.4	no fix yet
Medium	CVE-2026-89156PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback	libpcre2-8-0installed 10.46-1build1	no fix yet
Medium	CVE-2026-89157pcre2: PCRE2: Out-of-bounds write via large pattern input	libpcre2-8-0installed 10.46-1build1	no fix yet
Medium	CVE-2026-89158PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms	libpcre2-8-0installed 10.46-1build1	no fix yet
Medium	CVE-2026-89160pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching	libpcre2-8-0installed 10.46-1build1	no fix yet
Medium	CVE-2026-89161pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match	libpcre2-8-0installed 10.46-1build1	no fix yet
Medium	CVE-2026-89162pcre2: PCRE2: Information disclosure via pcre2_serialize_encode	libpcre2-8-0installed 10.46-1build1	no fix yet
Low	CVE-2017-13716binutils: Memory leak with the C++ symbol demangler routine in libiberty	binutils, binutils-common, binutils-x86-64-linux-gnu, libbinutils +4 moreinstalled 2.46-3ubuntu2	no fix yet
Low	CVE-2024-56433shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise	login.defs, passwdinstalled 1:4.17.4-2ubuntu3	no fix yet
Low	CVE-2026-40228systemd: systemd-journald: Unintended output to user terminals via logger command	libsystemd0, libudev1installed 259.9-0ubuntu0.1	no fix yet

Packages

Debian packages: 115
Go modules: 11

Image configuration

Base OS: Ubuntu 26.04
Default user: root (no USER set; the entrypoint may still drop privileges)
Entrypoint: /__cacert_entrypoint.sh
Command: jshell
Exposed ports: none
Image created: 2026-10-29
amd64 digest: sha256:952ae4db91699d916ee219f7830c424022c9eb8792d35899af97316b8000a078

Other Eclipse Temurin (Java) tags

eclipse-temurin:25-jre351 MB unpacked · 117 MB downloadM 44L 4 eclipse-temurin:25-jre-alpine227 MB unpacked · 76 MB download✓ 0 known

eclipse-temurin:25-jdk vs eclipse-temurin:25-jre

Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-31 from digest sha256:952ae4db9169. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.