docker pull ubuntu:26.04ubuntu@sha256:6a06111c3b0a8600feadb270aec771dc239bf407b25625f93f44ab00e11f4d3cSize per platform
Compressed download size on Docker Hub for each architecture.
Where the bytes go
Unpacked bytes by directory in the final amd64 filesystem.
Layers
The 2 filesystem layers of the amd64 image, in build order, with each layer's compressed size and the build step that made it.
Full build steps
- 42 MB
umoci raw add-layer --image /home/buildd/rockcraft-ubuntu-cc003627bc5bab71b42ff0f8e1a41f88/images/ubuntu:rockcraft-base /home/buildd/rockcraft-ubuntu-cc003627bc5bab71b42ff0f8e1a41f88/images/.temp_layer.9587.tar --tag 26.04 - 392 B
umoci raw add-layer --image /home/buildd/rockcraft-ubuntu-cc003627bc5bab71b42ff0f8e1a41f88/images/ubuntu:26.04 /home/buildd/rockcraft-ubuntu-cc003627bc5bab71b42ff0f8e1a41f88/images/.temp_layer.control_data.9587.tar
Known vulnerabilities
0Critical0 with a fix
4High4 with a fix
48Medium10 with a fix
5Low1 with a fix
0Unknown0 with a fix
57 findings across 98 packages; 15 have a fixed version upstream, so rebuilding or updating packages clears them. The rest have no fix released yet; distributions often mark these “will not fix” or “deferred” for issues that do not affect the packaged build.
| Severity | Vulnerability | Affected packages | Fixed in |
|---|---|---|---|
| High | CVE-2026-111943crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates | stdlibinstalled v1.27.1 | 1.26.10, 1.27.3 |
| High | CVE-2026-78667net/http: golang: golang: Denial of Service via crafted HTTP Range headers | stdlibinstalled v1.27.1 | 1.26.9, 1.27.2 |
| High | CVE-2026-78669net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames | stdlibinstalled v1.27.1 | 1.26.9, 1.27.2 |
| High | CVE-2026-97031crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references | stdlibinstalled v1.27.1 | 1.26.9, 1.27.2 |
| Medium | CVE-2026-56866net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections | stdlibinstalled v1.27.1 | 1.26.9, 1.27.2 |
| Medium | CVE-2026-78659net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion | stdlibinstalled v1.27.1 | 1.26.9, 1.27.2 |
| Medium | CVE-2026-78660net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers | stdlibinstalled v1.27.1 | 1.26.9, 1.27.2 |
| Medium | CVE-2026-78663net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server | stdlibinstalled v1.27.1 | 1.26.9, 1.27.2 |
| Medium | CVE-2026-85091zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ... | zlib1ginstalled 1:1.3.dfsg+really1.3.1-1ubuntu3.1 | 1:1.3.dfsg+really1.3.1-1ubuntu3.2 |
| Medium | CVE-2026-94439net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses | stdlibinstalled v1.27.1 | 1.26.9, 1.27.2 |
| Medium | CVE-2026-94440net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing | stdlibinstalled v1.27.1 | 1.26.9, 1.27.2 |
| Medium | CVE-2026-94448html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals | stdlibinstalled v1.27.1 | 1.26.9, 1.27.2 |
| Medium | CVE-2026-97030html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword | stdlibinstalled v1.27.1 | 1.26.9, 1.27.2 |
| Medium | CVE-2026-97032net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification | stdlibinstalled v1.27.1 | 1.26.9, 1.27.2 |
| Medium | CVE-2026-102473dash: dash: Super-polynomial backtracking in pmatch when libc fnmatch is disabled | dashinstalled 0.5.12-12ubuntu3 | no fix yet |
| Medium | CVE-2026-102474dash: dash: Heap out-of-bounds write in conv_escape via undersized Unicode escape reservation | dashinstalled 0.5.12-12ubuntu3 | no fix yet |
| Medium | CVE-2026-103111pcre2: pcre2: Out-of-bounds write via crafted regular expression | libpcre2-8-0installed 10.46-1build1 | no fix yet |
| Medium | CVE-2026-18374glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string | libc-bin, libc-gconv-modules-extra, libc6installed 2.43-2ubuntu2.4 | no fix yet |
| Medium | CVE-2026-18477tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape | tarinstalled 1.35+dfsg-4ubuntu0.4 | no fix yet |
| Medium | CVE-2026-18508tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite | tarinstalled 1.35+dfsg-4ubuntu0.4 | no fix yet |
| Medium | CVE-2026-35341rust-coreutils: uutils coreutils mkfifo: Information disclosure via unauthorized file permission modification | rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1 | no fix yet |
| Medium | CVE-2026-35344The dd utility in uutils coreutils suppresses errors during file trunc ... | rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1 | no fix yet |
| Medium | CVE-2026-35345A vulnerability in the tail utility of uutils coreutils allows for the ... | rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1 | no fix yet |
| Medium | CVE-2026-35348The sort utility in uutils coreutils is vulnerable to a process panic ... | rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1 | no fix yet |
| Medium | CVE-2026-35350The cp utility in uutils coreutils fails to properly handle setuid and ... | rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1 | no fix yet |
| Medium | CVE-2026-35351The mv utility in uutils coreutils fails to preserve file ownership du ... | rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1 | no fix yet |
| Medium | CVE-2026-35352A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the m ... | rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1 | no fix yet |
| Medium | CVE-2026-35354A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv ... | rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1 | no fix yet |
| Medium | CVE-2026-35357The cp utility in uutils coreutils is vulnerable to an information dis ... | rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1 | no fix yet |
| Medium | CVE-2026-35359A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utilit ... | rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1 | no fix yet |
| Medium | CVE-2026-35360The touch utility in uutils coreutils is vulnerable to a Time-of-Check ... | rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1 | no fix yet |
| Medium | CVE-2026-35363A vulnerability in the rm utility of uutils coreutils allows the bypas ... | rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1 | no fix yet |
| Medium | CVE-2026-35364rust-coreutils: uutils coreutils mv utility: Arbitrary File Overwrite via TOCTOU Race Condition | rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1 | no fix yet |
| Medium | CVE-2026-35367The nohup utility in uutils coreutils creates its default output file, ... | rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1 | no fix yet |
| Medium | CVE-2026-35368rust-coreutils: uutils coreutils: Privilege escalation and arbitrary code execution in chroot utility | rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1 | no fix yet |
| Medium | CVE-2026-35370The id utility in uutils coreutils miscalculates the groups= section o ... | rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1 | no fix yet |
| Medium | CVE-2026-35371The id utility in uutils coreutils exhibits incorrect behavior in its ... | rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1 | no fix yet |
| Medium | CVE-2026-35373A logic error in the ln utility of uutils coreutils causes the program ... | rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1 | no fix yet |
| Medium | CVE-2026-35374A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the sp ... | rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1 | no fix yet |
| Medium | CVE-2026-35377A logic error in the env utility of uutils coreutils causes a failure ... | rust-coreutilsinstalled 0.10.0-1ubuntu2~26.04.1 | no fix yet |
Showing the 40 most severe of 51 distinct vulnerabilities (57 findings, one per affected package).
Packages
- Debian packages
- 87
- Go modules
- 11
Image configuration
- Base OS
- Ubuntu 26.04
- Default user
- root (no USER set; the entrypoint may still drop privileges)
- Entrypoint
- —
- Command
- /bin/bash
- Exposed ports
- none
- Image created
- 2026-10-06
- amd64 digest
- sha256:42527649dbc4f9197a6073f426f488cbff0e9cc9f2afce32d91c383e4875634a
Other Ubuntu tags
Platform sizes and layers: Docker Hub API, checked 2026-11-01. Unpacked size, files and SBOM: measured 2026-10-26 from digest sha256:42527649dbc4. Vulnerabilities: Trivy re-scan 2026-11-01, database 2026-11-01. Methodology.