Vulnerability Reportgolang:1.27.1-alpine

golang:1.27.1-alpine

digestsha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414

Executive Summary

Last scanned: Oct 20, 2026

Threat ScoreSAFE• Official Docker image from Docker Official publisher, pinned by digest, with trust verdict TRUSTED and score 100.• Pre-calculated threat score is 0, placing this image in the SAFE band from 0 to 24.• INPUT 3 shows 6 exposed_total and 8 post_total findings, but exposed_count_ge6 is 0 and post_count_ge6 is 0.• Maximum severities are low: 2.8 exposed and 2.29 post-exploit.• No top exposed-surface or post-exploit-only findings were provided, so there are no specific CVE IDs from INPUT 4 or INPUT 5 to cite.

0/100SAFE

ReputationOFFICIAL• Official Docker Hub Image• Pinned by digest (Immutable)

TRUSTED

This base/runtime image is a clean foundation for building production images. It does carry 6 exposed and 8 post-exploit findings in the stats, but their maximum severities are only 2.8 and 2.29, and none reach severity 6.0. With a threat score of 0 and no top findings listed, images built on this base inherit only low-severity issues that do not change the SAFE verdict. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.

Relevant for golang:1.27.1-alpine

How to fix CVEs in runtime Docker images

Only a handful of these findings are real. Five steps that cut the count — and VEX for the rest.

Read the article

Vulnerabilities

Vulnerability Log

14 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-56857	LOW2.8	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-78667	LOW2.29	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Post-Exploit
CVE-2026-78669	LOW2.29	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Post-Exploit
CVE-2026-97031	LOW2.29	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Post-Exploit
CVE-2026-56866	LOW1.99	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Post-Exploit
CVE-2026-94439	LOW1.99	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Post-Exploit
CVE-2026-94448	LOW1.87	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.2% Theoretical Threat	Post-Exploit
CVE-2026-97032	LOW1.81	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Post-Exploit
CVE-2026-78663	LOW1.62	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Post-Exploit
CVE-2026-85091	NONE0	zlib 1.3.2-r0 fixed in 1.3.2-r1	0.4% Theoretical Threat	Not Applicable
CVE-2026-78659	NONE0	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Not Applicable
CVE-2026-78660	NONE0	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Not Applicable
CVE-2026-94440	NONE0	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Not Applicable
CVE-2026-97030	NONE0	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.2% Theoretical Threat	Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.