docker pull httpd:2.4httpd@sha256:c6b7745aa371570cc8460a9f08c39989583d4aa7bc8e3ed8bd77a492803ea704Size per platform
Compressed download size on Docker Hub for each architecture.
Where the bytes go
Unpacked bytes by directory in the final amd64 filesystem.
Layers
The 6 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.
Full build steps
- 30 MB
# debian.sh --arch 'amd64' out/ 'trixie' '@1793059200' - 146 B
RUN /bin/sh -c mkdir -p "$HTTPD_PREFIX" && chown www-data:www-data "$HTTPD_PREFIX" # buildkit - 32 B
WORKDIR /usr/local/apache2 - 2.0 MB
RUN /bin/sh -c set -eux; apt-get install --update -y --no-install-recommends ca-certificates libaprutil1-ldap libldap-common ; apt-get dist-clean # buildkit - 13 MB
RUN /bin/sh -c set -eux; savedAptMark="$(apt-mark showmanual)"; apt-get install --update -y --no-install-recommends bzip2 dpkg-dev gcc gnupg libapr1-dev libaprutil1-dev libbrotli-dev libcurl4-openssl-dev libjansson-dev liblua5.2-dev libnghttp2-dev libpcre2-dev libssl-dev libxml2-dev make patch wget zlib1g-dev ; ddist() { local f="$1"; shift; local distFile="$1"; shift; local success=; local distUrl=; for distUrl in https://dlcdn.apache.org/ https://archive.apache.org/dist/ ; do if wget -O "$f" "$distUrl$distFile" && [ -s "$f" ]; th - 291 B
COPY httpd-foreground /usr/local/bin/ # buildkit
Known vulnerabilities
1Critical0 with a fix
52High0 with a fix
86Medium0 with a fix
123Low0 with a fix
4Unknown0 with a fix
266 findings across 112 packages; 0 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.
| Severity | Vulnerability | Affected packages | Fixed in |
|---|---|---|---|
| Critical | CVE-2026-6653libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free | libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | no fix yet |
| High | CVE-2025-69720ncurses: ncurses: Buffer overflow vulnerability may lead to arbitrary code execution. | libtinfo6, ncurses-base, ncurses-bininstalled 6.5+20250216-2 | no fix yet |
| High | CVE-2026-12064curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP | libcurl4t64installed 8.14.1-2+deb13u7 | no fix yet |
| High | CVE-2026-16742systemd: systemd-homed: Local privilege escalation via missing home-record signature verification | libsystemd0, libudev1installed 257.13-1~deb13u1 | no fix yet |
| High | CVE-2026-54369acl: Symlink traversal privilege escalation via libacl functions | libacl1installed 2.3.2-2+b1 | no fix yet |
| High | CVE-2026-74860libxml2: double-free/UAF in libxml2 Python bindings | libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | no fix yet |
| High | CVE-2026-76642util-linux: util-linux: failed external mount helper still runs privileged X-mount post-hooks | bsdutils, libblkid1, liblastlog2-2, libmount1 +5 moreinstalled 1:2.41.5-0+deb13u1 | no fix yet |
| High | CVE-2026-78408util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority | bsdutils, libblkid1, liblastlog2-2, libmount1 +5 moreinstalled 1:2.41.5-0+deb13u1 | no fix yet |
| High | CVE-2026-78409util-linux: util-linux: X-mount.subdir detached-tree resolution can escape via intermediate symlinks | bsdutils, libblkid1, liblastlog2-2, libmount1 +5 moreinstalled 1:2.41.5-0+deb13u1 | no fix yet |
| High | CVE-2026-78410util-linux: util-linux: restricted bind mounts do not pin the source, allowing X-mount.owner/group/mode redirection | bsdutils, libblkid1, liblastlog2-2, libmount1 +5 moreinstalled 1:2.41.5-0+deb13u1 | no fix yet |
| High | CVE-2026-8458curl: libcurl: Unauthorized connection reuse due to a logical error | libcurl4t64installed 8.14.1-2+deb13u7 | no fix yet |
| High | CVE-2026-86138libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow | libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | no fix yet |
| High | CVE-2026-86139libxml2: libxml2: Integer overflow in xmlURIEscapeStr may lead to arbitrary code execution | libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | no fix yet |
| High | CVE-2026-86140libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements | libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | no fix yet |
| High | CVE-2026-86142libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation | libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | no fix yet |
| High | CVE-2026-86143libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks | libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | no fix yet |
| High | CVE-2026-86144libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation. | libxml2installed 2.12.7+dfsg+really2.9.14-2.1+deb13u3 | no fix yet |
| High | CVE-2026-9538perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size | perl-baseinstalled 5.40.1-6+deb13u1 | no fix yet |
| Medium | CVE-2025-66382libexpat: libexpat: Denial of service via crafted file processing | libexpat1installed 2.9.0-1~deb13u1 | no fix yet |
| Medium | CVE-2026-102010gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if | gcc-14-base, libgcc-s1, libstdc++6installed 14.2.0-19 | no fix yet |
| Medium | CVE-2026-10536libcurl: libcurl: Use-after-free vulnerability leading to Denial of Service | libcurl4t64installed 8.14.1-2+deb13u7 | no fix yet |
| Medium | CVE-2026-107161cyrus-sasl: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise DIGEST-MD5 clients | libsasl2-2, libsasl2-modules-dbinstalled 2.1.28+dfsg1-9 | no fix yet |
| Medium | CVE-2026-107708krb5: krb5: Denial of Service via malformed PAC in S4U2Proxy requests | libgssapi-krb5-2, libk5crypto3, libkrb5-3, libkrb5support0installed 1.21.3-5+deb13u1 | no fix yet |
| Medium | CVE-2026-107778krb5: krb5: Denial of Service via crafted forwarded credentials | libgssapi-krb5-2, libk5crypto3, libkrb5-3, libkrb5support0installed 1.21.3-5+deb13u1 | no fix yet |
| Medium | CVE-2026-113351expat: expat: Denial of Service via improper memory tracking in XML_ParserReset | libexpat1installed 2.9.0-1~deb13u1 | no fix yet |
| Medium | CVE-2026-11856curl: curl: Information disclosure via incorrect Digest authentication header reuse | libcurl4t64installed 8.14.1-2+deb13u7 | no fix yet |
| Medium | CVE-2026-13757p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing | libp11-kit0installed 0.25.5-3 | no fix yet |
| Medium | CVE-2026-15059systemd: systemd-oomd: Unprivileged users can terminate arbitrary processes via IPC API | libsystemd0, libudev1installed 257.13-1~deb13u1 | no fix yet |
| Medium | CVE-2026-15534perl: Perl: Arbitrary code execution via out-of-bounds memory access in regular expression engine. | perl-baseinstalled 5.40.1-6+deb13u1 | no fix yet |
| Medium | CVE-2026-18374glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string | libc-bin, libc6installed 2.41-12+deb13u4 | no fix yet |
| Medium | CVE-2026-18477tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape | tarinstalled 1.35+dfsg-3.1 | no fix yet |
| Medium | CVE-2026-18508tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite | tarinstalled 1.35+dfsg-3.1 | no fix yet |
| Medium | CVE-2026-18938p11-kit: Integer overflow in RPC attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems | libp11-kit0installed 0.25.5-3 | no fix yet |
| Medium | CVE-2026-19499glibc: Buffer Overflow in strfmon right-justification padding | libc-bin, libc6installed 2.41-12+deb13u4 | no fix yet |
| Medium | CVE-2026-19542glibc: Fix out-of-bounds array write in tdelete | libc-bin, libc6installed 2.41-12+deb13u4 | no fix yet |
| Medium | CVE-2026-19931curl: libcurl: Information disclosure via incorrect connection reuse with Negotiate authentication | libcurl4t64installed 8.14.1-2+deb13u7 | no fix yet |
| Medium | CVE-2026-27171zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions | zlib1ginstalled 1:1.3.dfsg+really1.3.1-1+b1 | no fix yet |
| Medium | CVE-2026-3184util-linux: util-linux: Access control bypass due to improper hostname canonicalization | bsdutils, libblkid1, liblastlog2-2, libmount1 +5 moreinstalled 1:2.41.5-0+deb13u1 | no fix yet |
| Medium | CVE-2026-42250bzip2: bzip2: Denial of Service in bzip2recover via a specially crafted file | libbz2-1.0installed 1.0.8-6 | no fix yet |
| Medium | CVE-2026-50812sqlite: SQLite: Denial of Service via malformed changeset in Session Extension | libsqlite3-0installed 3.46.1-7+deb13u2 | no fix yet |
Showing the 40 most severe of 150 distinct vulnerabilities (266 findings, one per affected package).
Packages
- Debian packages
- 112
Image configuration
- Base OS
- Debian 13.7 (trixie)
- Default user
- root (no USER set; the entrypoint may still drop privileges)
- Entrypoint
- —
- Command
- httpd-foreground
- Exposed ports
- 80/tcp
- Image created
- 2026-10-28
- amd64 digest
- sha256:c492904b9367e83e16e0e8c0a3175b0bb97b861023a17dcdfd09cd4c8b6efd9f
Other Apache httpd tags
Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-31 from digest sha256:c492904b9367. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.