Last scanned:
This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The scan found 43 findings in total, and the two most relevant ones are both denial-of-service flaws in the Go HTTP/2 library, CVE-2026-78669 and CVE-2026-78659. A malicious client could slow or crash Mattermost, but these flaws do not allow data theft or code execution and are not known to be exploited. Note: both CVEs only apply when TLS is enabled on the Mattermost listener, so plain HTTP deployments are not affected. Updating golang.org/x/net to a fixed release would address both flaws.
Hardening plan for this image · 5 steps
| CVE ID | Adjusted Severity | Package | Exploit Probability | Risk Context |
|---|---|---|---|---|
| CVE-2026-78669 | MEDIUM6 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-78659 | MEDIUM6 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-6368 | MEDIUM5.5 | libc6 2.36-9+deb12u14 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-8674 | MEDIUM5.3 | libc6 2.36-9+deb12u14 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-75806 | MEDIUM5.3 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u2 | 1.1% Low-Moderate Risk | Directly Exposed |
| CVE-2026-42767 | MEDIUM5.3 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-5450 | MEDIUM5 | libc6 2.36-9+deb12u14 No fix yet | 0.5% Theoretical Threat | Directly Exposed |
| CVE-2026-5928 | MEDIUM5 | libc6 2.36-9+deb12u14 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-18374 | MEDIUM4.9 | libc6 2.36-9+deb12u14 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-97032 | MEDIUM4.72 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.5% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-63072 | MEDIUM4.5 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u1 | 0.9% Theoretical Threat | Directly Exposed |
| CVE-2026-63076 | MEDIUM4.5 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u1 | 1.6% Low-Moderate Risk | Directly Exposed |
| CVE-2026-54874 | MEDIUM4.5 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-63074 | MEDIUM4.5 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u1 | 0.6% Theoretical Threat | Directly Exposed |
| CVE-2026-78660 | MEDIUM4.5 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-84782 | MEDIUM4.44 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u2 | 0.8% Theoretical Threat | Directly Exposed |
| CVE-2026-78663 | MEDIUM4.24 | golang.org/x/net v0.58.0 fixed in 0.60.0 | 0.6% Theoretical Threat | Directly ExposedContext importance: MEDIUM |
| CVE-2026-86805 | MEDIUM4.2 | libc6 2.36-9+deb12u14 No fix yet | <0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-95818 | MEDIUM4.2 | libc6 2.36-9+deb12u14 No fix yet | 0.1% Theoretical Threat | Directly Exposed |
| CVE-2026-19542 | MEDIUM4.2 | libc6 2.36-9+deb12u14 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-89092 | MEDIUM4.2 | libc6 2.36-9+deb12u14 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-19499 | MEDIUM4.08 | libc6 2.36-9+deb12u14 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| DLA-4845-1 | MEDIUM4 | ca-certificates 20250419~deb12u1 fixed in 20250419~deb12u2 | — | Directly Exposed |
| GO-2026-5932 | MEDIUM4 | golang.org/x/crypto v0.57.0 No fix yet | — | Directly Exposed |
| CVE-2026-6238 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2010-4756 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 2.6% Low-Moderate Risk | Directly Exposed |
| CVE-2018-20796 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 5.8% Low-Moderate Risk | Directly Exposed |
| CVE-2019-1010022 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 3.2% Low-Moderate Risk | Directly Exposed |
| CVE-2019-1010023 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 3.1% Low-Moderate Risk | Directly Exposed |
| CVE-2019-1010024 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 3.2% Low-Moderate Risk | Directly Exposed |
| CVE-2019-1010025 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 2.5% Low-Moderate Risk | Directly Exposed |
| CVE-2019-9192 | LOW3.9 | libc6 2.36-9+deb12u14 No fix yet | 2.4% Low-Moderate Risk | Directly Exposed |
| CVE-2026-97399 | LOW3.7 | libc6 2.36-9+deb12u14 No fix yet | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-35189 | LOW3.7 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-75803 | LOW3.7 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u1 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-5435 | LOW3.54 | libc6 2.36-9+deb12u14 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-6791 | LOW3.54 | libc6 2.36-9+deb12u14 No fix yet | 0.2% Theoretical Threat | Directly Exposed |
| CVE-2026-77117 | LOW3.54 | libc6 2.36-9+deb12u14 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-80489 | LOW3.54 | libc6 2.36-9+deb12u14 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-54872 | LOW3.54 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2026-75805 | LOW3.54 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u2 | 0.3% Theoretical Threat | Directly Exposed |
| CVE-2026-77696 | LOW3.54 | libssl3 3.0.20-1~deb12u2 fixed in 3.0.22-1~deb12u2 | 0.4% Theoretical Threat | Directly Exposed |
| CVE-2025-27587 | LOW2.12 | libssl3 3.0.20-1~deb12u2 No fix yet | 0.4% Theoretical Threat | Directly Exposed |
| DLA-4792-1 | NONE0 | tzdata 2026b-0+deb12u1 fixed in 2026c-0+deb12u1 | — | Not Applicable |
| DLA-4854-1 | NONE0 | tzdata 2026b-0+deb12u1 fixed in 2026e-0+deb12u1 | — | Not Applicable |
Want to check another image? Run a full scan with the Docker Security Scanner.