httpd:2.4-alpine image size, layers and vulnerabilities (2026-11-01)

docker pull httpd:2.4-alpinehttpd@sha256:070da7661f0be8a05430b2c125c0cde9e53176b4048c813024021969a0e3893c

Size per platform

Compressed download size on Docker Hub for each architecture.

s390x21 MB
ppc64le21 MB
arm6421 MB
amd6421 MB
i38620 MB
riscv6420 MB
arm/v619 MB
arm/v719 MB

Where the bytes go

Unpacked bytes by directory in the final amd64 filesystem.

/usr/share/perl521 MB
/usr/lib/perl519 MB
/usr/lib14 MB
/usr/local/apache29.4 MB
/bin805 kB
/lib670 kB
/usr/bin218 kB
/etc/ssl204 kB
/usr/share/ca-certificates179 kB
/lib/apk136 kB

Layers

The 7 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.

1. Base filesystem (alpine-minirootfs-3.3.9 MB
2. RUN set -x && adduser -u 82 -D -S -G 935 B
3. RUN … create directories145 B
4. WORKDIR /usr/local/apache232 B
5. RUN … apk add11 MB
6. RUN … apk add5.8 MB
7. COPY httpd-foreground → /usr/local/bi288 B

Full build steps

3.9 MBADD alpine-minirootfs-3.24.3-x86_64.tar.gz / # buildkit
935 BRUN /bin/sh -c set -x && adduser -u 82 -D -S -G www-data www-data # buildkit
145 BRUN /bin/sh -c mkdir -p "$HTTPD_PREFIX" && chown www-data:www-data "$HTTPD_PREFIX" # buildkit
32 BWORKDIR /usr/local/apache2
11 MBRUN /bin/sh -c set -eux; apk add --no-cache apr apr-util apr-util-ldap ca-certificates perl ; # buildkit
5.8 MBRUN /bin/sh -c set -eux; apk add --no-cache --virtual .build-deps apr-dev apr-util-dev coreutils dpkg-dev dpkg gcc gnupg libc-dev patch curl-dev jansson-dev libxml2-dev lua-dev make nghttp2-dev openssl openssl-dev pcre-dev tar zlib-dev brotli-dev ; ddist() { local f="$1"; shift; local distFile="$1"; shift; local success=; local distUrl=; for distUrl in 'https://www.apache.org/dyn/closer.cgi?action=download&filename=' https://downloads.apache.org/ https://www-us.apache.org/dist/ https://www.apache.org/dist/ https://archive.ap
288 BCOPY httpd-foreground /usr/local/bin/ # buildkit

Known vulnerabilities

1Critical1 with a fix

1High1 with a fix

1Medium1 with a fix

22Low22 with a fix

0Unknown0 with a fix

25 findings across 41 packages; 25 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.

Severity	Vulnerability	Affected packages	Fixed in
Critical	CVE-2026-111497brotli: Out-of-Bounds Write in Google Brotli Decoder	brotli-libsinstalled 1.2.0-r1	1.2.1-r0
High	CVE-2026-92392curl: curl: HTTP/2 upload Use-After-Free	libcurlinstalled 8.22.0-r0	8.23.0-r0
Medium	CVE-2026-92388curl: curl: FTP wildcard write callback mixup	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-107928curl: curl: info leak uploading over WebSockets with GnuTLS	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-107929curl: curl: local interface connection reuse mixup	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-86409curl: curl: stale SigV4 headers sent unintended	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-86410curl: curl: redirect to SFTP or SCP bypasses host verification	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-86411curl: curl: FTP connection reuse inherits client-certificate	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-86412curl: curl: server-set cookie erases cookie jar	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-86413curl: curl: Negotiate credentials sent to redirected origin	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-86414curl: curl: leaking host credentials to HTTP proxy	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-86415curl: curl: auto client cert connection reuse mixup	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-87861curl: curl: cross-origin reuse of a Negotiate connection	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-87862curl: curl: HSTS cache import drops longer-lived child	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-87863curl: curl: Hsts Response Erases Persisted Entries	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-87864curl: IMAP APPEND plus CRLF conversion command injection	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-87865curl: curl: knownhost callback mismatches key as missing	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-87866curl: curl: wolfSSL public-key pinning bypass	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-92386curl: curl: server-set cookie aborts cookie jar load	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-92387curl: curl: never-ending loop via server response omission	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-92389curl: curl: TFTP direction confusion	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-92390curl: curl: -J no-clobber guarantee bypassed with 103 early hints	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-92391curl: curl: curl_mime_free stack overflow by recursion	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-94265curl: curl: Authorization: Negotiate sent to foreign origin	libcurlinstalled 8.22.0-r0	8.23.0-r0
Low	CVE-2026-94266curl: curl: password leak in CURLINFO_EFFECTIVE_URL	libcurlinstalled 8.22.0-r0	8.23.0-r0

Packages

Alpine packages: 41

Image configuration

Base OS: Alpine Linux 3.24.3
Default user: root (no USER set; the entrypoint may still drop privileges)
Entrypoint: —
Command: httpd-foreground
Exposed ports: 80/tcp
Image created: 2026-10-21
amd64 digest: sha256:013ffcb0bf1a584c1939c6d7889ff5c68b8ea903e065fc10e4eb6da492767f77

Other Apache httpd tags

httpd:2.4120 MB unpacked · 45 MB downloadC 1H 52M 86L 123? 4

nginx:1.30-alpine vs httpd:2.4-alpine

Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-26 from digest sha256:013ffcb0bf1a. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.