CVEs

Our organization has highlighted some vulnerabilities in the Cassandra image being used (5.0.6). Is there any documentation where these vulnerable packages are actually not really in use by Cassandra?
<img width="1572" height="732" alt="Image" src="https://github.com/user-attachments/assets/1f4e9bd3-f193-4a61-853f-186f3629fd17" />