docker pull ubuntu:24.04ubuntu@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852Size per platform
Compressed download size on Docker Hub for each architecture.
Where the bytes go
Unpacked bytes by directory in the final amd64 filesystem.
Layers
The 1 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.
Full build steps
- 30 MB
ADD file:eed88e94d6aa7c9da62836e137f889e03988c1a6b237b0cedb6ca666dfaa98ea in /
Known vulnerabilities
0Critical0 with a fix
0High0 with a fix
22Medium1 with a fix
4Low0 with a fix
0Unknown0 with a fix
26 findings across 92 packages; 1 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.
| Severity | Vulnerability | Affected packages | Fixed in |
|---|---|---|---|
| Medium | CVE-2026-85091zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ... | zlib1ginstalled 1:1.3.dfsg-3.1ubuntu2.2 | 1:1.3.dfsg-3.1ubuntu2.3 |
| Medium | CVE-2026-102473dash: dash: Super-polynomial backtracking in pmatch when libc fnmatch is disabled | dashinstalled 0.5.12-6ubuntu5 | no fix yet |
| Medium | CVE-2026-102474dash: dash: Heap out-of-bounds write in conv_escape via undersized Unicode escape reservation | dashinstalled 0.5.12-6ubuntu5 | no fix yet |
| Medium | CVE-2026-103111pcre2: pcre2: Out-of-bounds write via crafted regular expression | libpcre2-8-0installed 10.42-4ubuntu2.1 | no fix yet |
| Medium | CVE-2026-18374glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string | libc-bin, libc6installed 2.39-0ubuntu8.9 | no fix yet |
| Medium | CVE-2026-18477tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape | tarinstalled 1.35+dfsg-3ubuntu0.4 | no fix yet |
| Medium | CVE-2026-18508tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite | tarinstalled 1.35+dfsg-3ubuntu0.4 | no fix yet |
| Medium | CVE-2026-67693gnutls: gnutls: Information disclosure via contradictory Key Usage and Extended Key Usage extensions | libgnutls30t64installed 3.8.3-1.1ubuntu3.6 | no fix yet |
| Medium | CVE-2026-86145pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions | libpcre2-8-0installed 10.42-4ubuntu2.1 | no fix yet |
| Medium | CVE-2026-88647gnutls: gnutls: Information disclosure via hostname verification bypass | libgnutls30t64installed 3.8.3-1.1ubuntu3.6 | no fix yet |
| Medium | CVE-2026-88648gnutls: gnutls: Cross-domain certificate restriction bypass via incomplete X.509 validation | libgnutls30t64installed 3.8.3-1.1ubuntu3.6 | no fix yet |
| Medium | CVE-2026-89092glibc: nscd stack overflow leads to degraded DNS resolution | libc-bin, libc6installed 2.39-0ubuntu8.9 | no fix yet |
| Medium | CVE-2026-89156PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback | libpcre2-8-0installed 10.42-4ubuntu2.1 | no fix yet |
| Medium | CVE-2026-89157pcre2: PCRE2: Out-of-bounds write via large pattern input | libpcre2-8-0installed 10.42-4ubuntu2.1 | no fix yet |
| Medium | CVE-2026-89158PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms | libpcre2-8-0installed 10.42-4ubuntu2.1 | no fix yet |
| Medium | CVE-2026-89160pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching | libpcre2-8-0installed 10.42-4ubuntu2.1 | no fix yet |
| Medium | CVE-2026-89161pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match | libpcre2-8-0installed 10.42-4ubuntu2.1 | no fix yet |
| Medium | CVE-2026-95184gnutls: gnutls: legitimate user certificates incorrectly rejected causing denial of service | libgnutls30t64installed 3.8.3-1.1ubuntu3.6 | no fix yet |
| Medium | CVE-2026-95209gnutls: gnutls: legitimate CA certificates incorrectly rejected causing denial of service | libgnutls30t64installed 3.8.3-1.1ubuntu3.6 | no fix yet |
| Medium | CVE-2026-95210gnutls: gnutls: certificates with invalid extensions incorrectly accepted | libgnutls30t64installed 3.8.3-1.1ubuntu3.6 | no fix yet |
| Low | CVE-2024-56433shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise | login, passwdinstalled 1:4.13+dfsg1-4ubuntu3.2 | no fix yet |
| Low | CVE-2026-40228systemd: systemd-journald: Unintended output to user terminals via logger command | libsystemd0, libudev1installed 255.4-1ubuntu8.17 | no fix yet |
Packages
- Debian packages
- 92
Image configuration
- Base OS
- Ubuntu 24.04
- Default user
- root (no USER set; the entrypoint may still drop privileges)
- Entrypoint
- —
- Command
- /bin/bash
- Exposed ports
- none
- Image created
- 2026-10-02
- amd64 digest
- sha256:a2d43bffc46670d7108bb3c0468c67c5557c4c92e83e1e34cbff1322ad1b94dc
Other Ubuntu tags
Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-26 from digest sha256:a2d43bffc466. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.