Last scanned:
This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker could slow or knock the service offline with crafted requests, and where PostgreSQL is used, a compromised database server could corrupt memory in the gotify process. Staying on the default database setup fully removes the pgx exposure (CVE-2026-33815). The main concern under the default configuration is availability: CVE-2026-78667 can be triggered by ordinary-looking HTTP traffic and slow the web service. The other denial-of-service flaws in the scan only apply when HTTP/2 or TLS is enabled, which the default plain port 80 setup does not do. Updating the Go standard library and pgx to fixed versions is the practical next step.
Hardening plan for this image · 3 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-33815 | HIGH7.84 | github.com/jackc/pgx/v5 v5.7.6 fixed in 5.9.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-33816 | HIGH7.84 | github.com/jackc/pgx/v5 v5.7.6 fixed in 5.9.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78667 | HIGH7.5 | stdlib v1.26.0 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: HIGH |
| CVE-2026-56853 | MEDIUM6 | stdlib v1.26.0 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56860 | MEDIUM6 | stdlib v1.26.0 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56862 | MEDIUM6 | stdlib v1.26.0 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78669 | MEDIUM6 | stdlib v1.26.0 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97031 | MEDIUM6 | stdlib v1.26.0 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78659 | MEDIUM6 | stdlib v1.26.0 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-94440 | MEDIUM6 | stdlib v1.26.0 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97032 | MEDIUM5.9 | stdlib v1.26.0 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-41889 | MEDIUM5.88 | github.com/jackc/pgx/v5 v5.7.6 fixed in 5.9.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-32288 | MEDIUM5.5 | stdlib v1.26.0 fixed in 1.25.9, 1.26.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-27142 | MEDIUM5.4 | stdlib v1.26.0 fixed in 1.25.8, 1.26.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-39823 | MEDIUM5.4 | stdlib v1.26.0 fixed in 1.25.10, 1.26.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-39826 | MEDIUM5.4 | stdlib v1.26.0 fixed in 1.25.10, 1.26.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42505 | MEDIUM5.3 | stdlib v1.26.0 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-42507 | MEDIUM5.3 | stdlib v1.26.0 fixed in 1.25.11, 1.26.4 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-78663 | MEDIUM5.3 | stdlib v1.26.0 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-94439 | MEDIUM5.2 | stdlib v1.26.0 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-39821 | MEDIUM4.92 | stdlib v1.26.0 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 1.8% Low-Moderate Risk | Directly Exposed |
| CVE-2026-32289 | MEDIUM4.88 | stdlib v1.26.0 fixed in 1.25.9, 1.26.2 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-94448 | MEDIUM4.88 | stdlib v1.26.0 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56858 | MEDIUM4.86 | stdlib v1.26.0 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-39822 | MEDIUM4.68 | stdlib v1.26.0 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-40898 | MEDIUM4.5 | github.com/quic-go/quic-go v0.59.0 fixed in 0.59.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-56851 | MEDIUM4.5 | golang.org/x/text v0.38.0 fixed in 0.41.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-56852 | MEDIUM4.5 | golang.org/x/text v0.38.0 fixed in 0.39.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-25679 | MEDIUM4.5 | stdlib v1.26.0 fixed in 1.25.8, 1.26.1 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-32283 | MEDIUM4.5 | stdlib v1.26.0 fixed in 1.25.9, 1.26.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-33811 | MEDIUM4.5 | stdlib v1.26.0 fixed in 1.25.10, 1.26.3 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-39820 | MEDIUM4.5 | stdlib v1.26.0 fixed in 1.25.10, 1.26.3 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-42499 | MEDIUM4.5 | stdlib v1.26.0 fixed in 1.25.10, 1.26.3 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-42504 | MEDIUM4.5 | stdlib v1.26.0 fixed in 1.25.11, 1.26.4 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-56859 | MEDIUM4.5 | stdlib v1.26.0 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78660 | MEDIUM4.5 | stdlib v1.26.0 fixed in 1.26.9, 1.27.2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-56854 | MEDIUM4.08 | golang.org/x/crypto v0.53.0 fixed in 0.55.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-39825 | LOW3.9 | stdlib v1.26.0 fixed in 1.25.10, 1.26.3 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-56866 | LOW3.9 | stdlib v1.26.0 fixed in 1.26.9, 1.27.2 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-32282 | LOW3.84 | stdlib v1.26.0 fixed in 1.25.9, 1.26.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-26958 | LOW3.7 | filippo.io/edwards25519 v1.1.0 fixed in 1.1.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-27138 | LOW3.7 | stdlib v1.26.0 fixed in 1.26.1 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-97030 | LOW3.66 | stdlib v1.26.0 fixed in 1.26.9, 1.27.2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-56857 | LOW3.3 | stdlib v1.26.0 fixed in 1.26.9, 1.27.2 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-56855 | LOW3.18 | golang.org/x/crypto v0.53.0 fixed in 0.56.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-78662 | LOW3.18 | golang.org/x/crypto v0.53.0 fixed in 0.56.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-33810 | LOW2.95 | stdlib v1.26.0 fixed in 1.26.2 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-46600 | LOW2.7 | golang.org/x/net v0.55.0 fixed in 0.56.0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-78669 | LOW2.7 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-78659 | LOW2.7 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-78660 | LOW2.7 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-27137 | LOW2.7 | stdlib v1.26.0 fixed in 1.26.1 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-27145 | LOW2.7 | stdlib v1.26.0 fixed in 1.25.11, 1.26.4 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-32280 | LOW2.7 | stdlib v1.26.0 fixed in 1.25.9, 1.26.2 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-32281 | LOW2.7 | stdlib v1.26.0 fixed in 1.25.9, 1.26.2 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-33814 | LOW2.7 | stdlib v1.26.0 fixed in 1.25.10, 1.26.3 | 0.8% Theoretical Threat | Post-Exploit |
| CVE-2026-33818 | LOW2.7 | stdlib v1.26.0 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-39836 | LOW2.7 | stdlib v1.26.0 fixed in 1.25.10, 1.26.3 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-46600 | LOW2.7 | stdlib v1.26.0 fixed in 1.26.6, 1.27.0-rc.3 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-27139 | LOW2.5 | stdlib v1.26.0 fixed in 1.25.8, 1.26.1 | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-111943 | LOW2.45 | stdlib v1.26.0 fixed in 1.26.10, 1.27.3 | 0.3% Theoretical Threat | Post-Exploit |
| GO-2026-5932 | LOW2.4 | golang.org/x/crypto v0.53.0 No fix yet | — | Directly Exposed |
| CVE-2026-97032 | LOW2.12 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-78663 | LOW1.91 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Post-Exploit |
Want to check another image? Run a full scan with the Docker Security Scanner.