Skip to content
ENExplore Calculators

Container Image Vulnerability Calculator

Score container image risk from CVE counts by severity and show how many fleet-wide criticals a single base image bump removes.

About Container Image Vulnerability Calculator

A container image inherits every vulnerability in its base layers, so one unpatched base image multiplies across every image built on it. Separating inherited from application-layer CVEs turns a fleet of thousands of findings into two numbers: the ones a base image bump fixes and the ones that need an actual code or dependency change. Scanner output looks like an unwinnable backlog until you notice that the same six base-image criticals account for two thirds of it, and one rebuild closes them everywhere at once.

Formulas

Container Image Vulnerability

Image risk = 0.2 × (critical × 10 + high × 5 + medium × 2 + low × 0.5) per image, clamped to 0–100, where critical and high include CVEs inherited from the base image.

perImageCritical
Base image criticals plus application-layer criticals
weightedPerImage
Severity-weighted CVE load for one image
imageRiskScore
0–100 risk for a representative image

Base image inheritance

Fleet critical instances = base image criticals × images on that base + application criticals × all images. Rebuilding on a patched base removes the first term in one change.

inheritedCritical
Critical CVE instances that came from the base image
criticalsFixedByBaseBump
Instances a single base image update clears
inheritedShare
Inherited instances ÷ all fleet critical instances × 100

Worked example

With the default values below, Container Image Vulnerability Calculator returns Image Risk Score of 75.4. Change any input above and every figure here is recalculated in your browser.

Inputs used

Images in the registryaccepts 1–200,000 images
340 images
Images built on the shared base imageaccepts 0–200,000 images
280 images
Critical CVEs in the base imageaccepts 0–5,000 CVEs
6 CVEs
High CVEs in the base imageaccepts 0–5,000 CVEs
24 CVEs
Critical CVEs added by application layersaccepts 0–5,000 CVEs
3 CVEs
High CVEs added by application layersaccepts 0–5,000 CVEs
11 CVEs
Medium CVEs per imageaccepts 0–5,000 CVEs
38 CVEs
Low CVEs per imageaccepts 0–5,000 CVEs
72 CVEs
CVEs with a fix availableaccepts 0–100 %
64 %

Results

Image Risk Score
75.4 / 100
Risk Level
High
Critical CVEs per Image
9 CVEs
Fleet-Wide Critical CVE Instances
2,700 instances
Share Inherited From the Base Image
62.2%
Criticals Removed by One Base Image Bump
1,680 instances
Fleet Criticals With a Fix Available
1,728 instances
Suggested Remediation Window
7 days
Priority
Rebuild on a patched base image — one change clears most of the fleet's critical CVEs

Step by step

  1. 1Values used
  2. 2Container Image Vulnerability
  3. 3Base image inheritance
  4. 4Image Risk Score= 75.4 / 100
  5. 5Risk Level= High
  6. 6Critical CVEs per Image= 9 CVEs
  7. 7Fleet-Wide Critical CVE Instances= 2,700 instances
  8. 8Share Inherited From the Base Image= 62.2
  9. 9Criticals Removed by One Base Image Bump= 1,680 instances

Assumptions and limits

  • The result is derived only from the 9 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Container Image Vulnerability calculated?

Image risk = 0.2 × (critical × 10 + high × 5 + medium × 2 + low × 0.5) per image, clamped to 0–100, where critical and high include CVEs inherited from the base image. A container image inherits every vulnerability in its base layers, so one unpatched base image multiplies across every image built on it. Separating inherited from application-layer CVEs turns a fleet of thousands of findings into two numbers: the ones a base image bump fixes and the ones that need an actual code or dependency change.

Why does Container Image Vulnerability matter?

Scanner output looks like an unwinnable backlog until you notice that the same six base-image criticals account for two thirds of it, and one rebuild closes them everywhere at once.

What values do I need to enter?

This calculator takes 9 inputs: Images in the registry, Images built on the shared base image, Critical CVEs in the base image, High CVEs in the base image, Critical CVEs added by application layers, High CVEs added by application layers, Medium CVEs per image, Low CVEs per image, CVEs with a fix available. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Should I chase every CVE in an image?

No. Prioritise by fixability, reachability and severity in that order. A critical CVE in a library your code never loads is not urgent; a high CVE in your HTTP parser is. Distroless or minimal base images reduce the count dramatically simply by removing packages you never used.

How often should base images be rebuilt?

Weekly, on a schedule, with no human in the loop. CVE age is the metric that matters, and a scheduled rebuild keeps it bounded automatically. Chasing individual advisories with manual rebuilds always loses to the rate at which advisories are published.

Related Calculators

Container Image Vulnerability Calculator | Calcrivo