Images / Observability / graylog 7.1.6 F 18 cosign signed SPDX SBOM SLSA provenance amd64 · arm64 Rebuilt 2026-08-17
Graylog, the log-management and analysis server (search, dashboards, alerting, GELF/Beats inputs). Built clean-room on a hardened Wolfi JRE (nonroot, read-only rootfs); the chart provides MongoDB (metadata) and OpenSearch (log storage) backends. Graylog Server is SSPL-1.0 (source-available, not OSI-approved).
Version
The latest line lives at the base page; older lines have their own page so you can pin and verify exactly that version.
Architectures
amd64, arm64
Runs as
nonroot (uid 1001)
Published versions 6 tags Each tag is a multi-arch index (amd64 + arm64) pinned by digest. Tagged by version, never :latest.
Version Size Published Digest 7.1.8 latest 425.1 MB 2026-08-27 sha256:364d589f0d75… 7.1.6 427.2 MB 2026-08-17 sha256:6a982d16989a… 7.1.5 424.9 MB 2026-07-09 sha256:d7895de6ea44… 7.1.4 423.3 MB 2026-07-02 sha256:f536a26aa7cc… 7.0.9 393.9 MB 2026-07-02 sha256:4293f2e249b0… 6.3.14 386.7 MB 2026-07-02 sha256:a80f658da5ae…
License caution · SSPL-1.0 is not OSI-approved
graylog is source-available, not open source. We carry it hardened, but do not represent it as open source.
Security report (Trivy) F· 0/100 17 fixable · rebuild clears them Full report
Vulnerability detail graylog 7.1.6 · 16 CVE CVE Severity Package Installed Fixed in Title CVE-2026-75595 CRITICAL io.netty:netty-handler 4.2.16.Final 4.2.17.Final, 4.1.137.Final Netty is an asynchronous, event-driven network application framework. ... CVE-2026-14456 HIGH libcrypto3 3.6.3-r4 3.6.3-r5 openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server CVE-2026-38754 HIGH busybox 1.37.0-r61 1.38.0-r0 busybox: Busybox: Denial of Service via heap overflow in ifsbreakup() function CVE-2026-63337 HIGH com.rabbitmq:amqp-client 5.29.0 5.33.0 The RabbitMQ Java client library allows Java and JVM-based application ... CVE-2026-69219 HIGH com.rabbitmq:amqp-client 5.29.0 5.33.1 The RabbitMQ Java client library allows Java and JVM-based application ... CVE-2026-69220 HIGH com.rabbitmq:amqp-client 5.29.0 5.33.1 The RabbitMQ Java client library allows Java and JVM-based application ... CVE-2026-38752 MEDIUM busybox 1.37.0-r61 1.38.0-r1 busybox: BusyBox: Denial of Service via crafted AWK script CVE-2026-38753 MEDIUM busybox 1.37.0-r61 1.38.0-r0 busybox: Busybox: Denial of Service via crafted AWK script in awk_sub() function CVE-2026-38755 MEDIUM busybox 1.37.0-r61 1.38.0-r0 busybox: Busybox: Denial of Service via heap overflow in evalcommand() function CVE-2026-59903 MEDIUM io.netty:netty-codec-http 4.2.16.Final 4.2.17.Final, 4.1.137.Final io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite CVE-2026-63335 MEDIUM com.rabbitmq:amqp-client 5.29.0 5.31.0 The RabbitMQ Java client library allows Java and JVM-based application ... CVE-2026-63336 MEDIUM com.rabbitmq:amqp-client 5.29.0 5.33.0 The RabbitMQ Java client library allows Java and JVM-based application ... CVE-2026-75596 MEDIUM io.netty:netty-handler 4.2.16.Final 4.2.17.Final, 4.1.137.Final Netty is an asynchronous, event-driven network application framework. ... CVE-2026-85091 MEDIUM zlib 1.3.2-r4 1.3.3-r0 zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ... CVE-2025-48924 MEDIUM commons-lang:commons-lang 2.6 — not fixable commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang CVE-2026-61634 LOW com.rabbitmq:amqp-client 5.29.0 5.33.0 The RabbitMQ Java client library allows Java and JVM-based application ...
Close
Pull the image Run it directly with Docker, Podman, or any Kubernetes workload. Nonroot, read-only root filesystem, built for amd64 and arm64.
Pull (tag)
docker pull ghcr.io/quenchworks/images/graylog:7.1.6Tags
7.1.6 7.1.6-amd64 7.1.6-arm64
Images are tagged by app version (never :latest): a multi-arch index plus per-arch tags.
App version 7.1.6
Architectures amd64, arm64
Runs as nonroot (uid 1001)
Root filesystem read-only
License SSPL-1.0 Verify the supply chain
This image is cosign-signed and carries an SPDX SBOM and a SLSA build-provenance attestation on the same digest. Check all three yourself:
# 1. signature — built and signed by QuenchWorks CI
cosign verify ghcr.io/quenchworks/images/graylog:7.1.6 \
--certificate-identity-regexp 'https://github.com/quenchworks/.+' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
# 2. SLSA build provenance — which workflow built it, from what
cosign verify-attestation --type https://slsa.dev/provenance/v1 ghcr.io/quenchworks/images/graylog:7.1.6 \
--certificate-identity-regexp 'https://github.com/quenchworks/.+' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
# 3. SPDX SBOM — the package inventory
cosign verify-attestation --type https://spdx.dev/Document/v2.3 ghcr.io/quenchworks/images/graylog:7.1.6 \
--certificate-identity-regexp 'https://github.com/quenchworks/.+' \
--certificate-oidc-issuer https://token.actions.githubusercontent.comSee the SBOM & provenance guide for reading the SBOM and using these checks in CI.
Transparency
Every image carries its SBOM and provenance as attestations on the same digest, publicly verifiable with the commands above (they check the package and the Sigstore transparency log, Rekor).
Upstream project: https://www.graylog.org
