Last scanned:
··This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The findings are mostly denial-of-service flaws that an outside client could trigger by flooding the exposed port, which could slow or crash the service. Most of them depend on optional features such as gRPC, HTTP/2 over TLS, Prometheus remote-read, or tracing baggage propagation, so their relevance depends on how the service is deployed. Because the main process is a statically linked Go binary, flaws in the OS libraries are not reachable through it. Upgrading the affected Go modules in a future rebuild is the practical next step.
Hardening plan for this image · 3 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| GHSA-hrxh-6v49-42gf | HIGH7.04 | google.golang.org/grpc v1.79.3 fixed in 1.82.1 | — | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56852 | MEDIUM6 | golang.org/x/text v0.37.0 fixed in 0.39.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-42154 | MEDIUM6 | github.com/prometheus/prometheus v0.0.0-20200609090129-a6600f564e3c fixed in 0.311.3, 0.305.2 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-29181 | MEDIUM6 | go.opentelemetry.io/otel v1.40.0 fixed in 1.41.0 | 0.8% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78669 | MEDIUM6 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78659 | MEDIUM6 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-84304 | MEDIUM6 | google.golang.org/grpc v1.79.3 fixed in 1.83.1 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-97032 | MEDIUM4.72 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-56851 | MEDIUM4.5 | golang.org/x/text v0.37.0 fixed in 0.41.0 | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-34986 | MEDIUM4.5 | github.com/go-jose/go-jose/v4 v4.1.3 fixed in 4.1.4 | 0.7% Theoretical Threat | Directly Exposed |
| CVE-2026-78660 | MEDIUM4.5 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-84445 | MEDIUM4.5 | google.golang.org/grpc v1.79.3 fixed in 1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78663 | MEDIUM4.24 | golang.org/x/net v0.55.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-84303 | LOW3.78 | google.golang.org/grpc v1.79.3 fixed in 1.83.1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-44903 | LOW3.66 | github.com/prometheus/prometheus v0.0.0-20200609090129-a6600f564e3c fixed in 0.311.3 | 0.2% Theoretical Threat | Directly Exposed |
| GHSA-xmrv-pmrh-hhx2 | LOW3.54 | github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2 fixed in 1.7.8 | — | Directly Exposed |
| GHSA-xmrv-pmrh-hhx2 | LOW3.54 | github.com/aws/aws-sdk-go-v2/service/s3 v1.54.4 fixed in 1.97.3 | — | Directly Exposed |
| CVE-2026-63209 | LOW2.7 | github.com/klauspost/compress v1.18.0 fixed in 1.18.7 | 0.6% Theoretical Threat | Post-Exploit |
| CVE-2026-46600 | LOW2.7 | golang.org/x/net v0.55.0 fixed in 0.56.0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-39883 | LOW2.52 | go.opentelemetry.io/otel/sdk v1.40.0 fixed in 1.43.0 | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-56854 | LOW2.45 | golang.org/x/crypto v0.52.0 fixed in 0.55.0 | 0.4% Theoretical Threat | Post-Exploit |
| CVE-2026-40179 | LOW2.2 | github.com/prometheus/prometheus v0.0.0-20200609090129-a6600f564e3c fixed in 3.5.2, 3.11.2, 0.311.2-0.20260410083055-07c6232d159b | 0.3% Theoretical Threat | Post-Exploit |
| CVE-2026-56855 | LOW1.91 | golang.org/x/crypto v0.52.0 fixed in 0.56.0 | 0.5% Theoretical Threat | Post-Exploit |
| CVE-2026-78662 | LOW1.91 | golang.org/x/crypto v0.52.0 fixed in 0.56.0 | 0.4% Theoretical Threat | Post-Exploit |
| GO-2026-5932 | LOW1.44 | golang.org/x/crypto v0.52.0 No fix yet | — | Post-Exploit |
| CVE-2026-81870 | LOW1.19 | go.opentelemetry.io/otel/sdk v1.40.0 fixed in 1.45.0 | 0.3% Theoretical Threat | Post-Exploit |
Want to check another image? Run a full scan with the Docker Security Scanner.