What is a near-zero CVE image?

In brief

• Near-zero, not zero: thousands of new CVE Records are published every quarter and scanners count differently, so the durable commitment is the fix window, not a permanent count of zero.
• A credible near-zero CVE promise states five things: severity tiers, time unit, clock start, a separate CISA KEV window, and whether it is in the contract.
• RapidFort Images: Patch windows are CISA KEV 1 day, Critical and High 7 days, Moderate 21 days, Low 28 days, from when a patch is available.

A near-zero CVE image is a hardened container image with a near-zero CVE baseline, continuously patched to eliminate all CVEs for which a patch is available. A container image includes all the components used to run an application, and those components may be missing critical security updates; a near-zero CVE image eliminates the resulting CVEs for which a patch is available, so teams start from a near-zero baseline instead of a backlog. "Near-zero" is the accurate term because new CVEs are disclosed continuously, and a count of exactly zero depends on which scanner and vulnerability database you use and on the day you scan.

Why is it "near-zero" and not "zero"?

Because zero is a moment, not a property. A CVE ID is a unique identifier that the CVE Program assigns to a specific vulnerability, and CVE Program partners publish thousands of new CVE Records every quarter. An image that scans at zero this morning can show a new critical CVE this afternoon when a disclosure lands for a package it contains. What a buyer can hold a vendor to is not a permanent zero but a patch window: how many days pass between a stated starting point, such as an upstream patch becoming available, and the rebuilt image.

Scanners also disagree with each other. A 2024 IEEE study scanned 927 Docker images with Trivy and Grype and found that, among the 865 images with vulnerabilities, the two scanners disagreed on both the number of vulnerabilities and the vulnerability IDs. A vendor's "zero" was measured with one scanner on one day; your scanner may count differently.

How an image reaches near-zero CVEs

Near-zero is reached in four steps, repeated for the life of the image. Start from a hardened base built on a maintained distribution, so the starting count is low. Patch or backport every CVE for which an upstream fix exists, including fixes the distribution has not yet shipped for the version you run; backporting takes a fix for a security flaw from the most recent upstream version of a package and applies it to an older version of that package. Rebuild the image when fixes land, not on a calendar. And verify each build with scanners, so the published count is one you can reproduce. What are hardened container images?

This is also what separates a near-zero CVE image from an image that is only labeled hardened. The NIST definition of hardening includes patching vulnerabilities, but a hardened label on a container image does not by itself commit to patching known CVEs or to a patch timeline. In the RapidFort definition, hardening alone removes unnecessary software and applies benchmarks such as CIS and STIG, but the software that remains can still carry vulnerabilities; near-zero adds the patching and the rebuild cadence. Hardened vs minimal vs distroless

Why does my scanner still show CVEs in a near-zero CVE image?

For one of four reasons, and each one is checkable. No applicable upstream patch exists yet, so no upstream fix can be applied. A patch was released recently and the CVE is inside its patch window, so the next rebuild will carry it. The scanner does not recognize a backported fix and matches on the package version string, reporting a patched package as vulnerable. Or the scanner's vulnerability data differs from the data another scanner uses, which the IEEE study above documents. Ask the vendor which of the four applies to each finding, and ask for VEX statements: a VEX (Vulnerability Exploitability eXchange) statement is a machine-readable record of whether a product is affected by a specific vulnerability, with the statuses not affected, affected, fixed or under investigation.

Five things a near-zero CVE promise must state

A promise missing any of these five is a marketing line rather than a commitment. First, the severity tiers it covers. Second, the time unit, calendar or business days. Third, when the clock starts: at CVE publication, at listing in the CISA Known Exploited Vulnerabilities catalog, or at upstream patch availability. Fourth, whether there is a separate, shorter window for KEV entries, since those have reliable evidence of active exploitation. KEV entries added since CISA issued Binding Operational Directive 26-04 on June 10, 2026 carry federal due dates of 3 or 14 days. Fifth, whether the promise is in the contract or only on the website.

How RapidFort Images meet that standard

RapidFort Images are near-zero CVE images that RapidFort engineers manually patch and rebuild, and every image is continuously patched to eliminate all CVEs for which a patch is available. Patch windows: CISA KEV 1 day, Critical and High 7 days, Moderate 21 days, Low 28 days, from when a patch is available.

The images carry rich metadata and are compatible with every major scanner. With a RapidFort Full Catalog subscription, SBOM export includes CycloneDX with VEX support. For example, joint Wiz and RapidFort customers see RapidFort advisory context alongside findings on RapidFort Images inside Wiz.

How to verify a near-zero CVE claim yourself

Pull the image and the upstream image it replaces, scan both with the scanner you already run, and compare the counts by severity. Read the SBOM to confirm the package versions, and read the VEX statements for any finding that remains. Then check the patch windows against the vendor's contract documents, not the landing page. A claim that survives your own scanner, your own SBOM reader and the contract is one you can take to an auditor.

Frequently asked questions

What is the difference between a near-zero CVE image and a hardened image?

Hardening a container image commonly involves removing components the application does not need and applying a configuration benchmark, but a hardened label does not by itself tell you whether known CVEs in the remaining packages are patched or on what timeline. A near-zero CVE image also patches or backports those CVEs and rebuilds when fixes land, on published timelines.

Can a container image have zero CVEs?

At a point in time, with a given scanner, yes. As a standing property, no: new CVEs are disclosed continuously and scanners count differently. The durable measure is how fast new CVEs are fixed once a patch exists.

Why do Trivy and Grype report different CVE counts for the same image?

In part because of how each tool interfaces with external vulnerability databases, which partially overlap and frequently contradict one another. A 2024 IEEE study of 927 Docker images found that, among the 865 images with vulnerabilities, the two scanners disagreed on both the number of vulnerabilities and the vulnerability IDs.

Does a near-zero CVE image need to be rescanned after deployment?

Yes. New CVEs are disclosed after an image ships, so rescan on a schedule and after every rebuild, and track the gap between an upstream patch and the rebuilt image in your registry. FedRAMP's 2021 container requirements allow only containers from images scanned within a 30-day vulnerability scanning window to be actively deployed on the production environment.

What happens when a CVE has no upstream patch?

No fix can be applied until an upstream patch exists; once it does, RapidFort Images follow the fix windows above.