Vulnerability Reportnvidia/dcgm-exporter:4.6.1-4.8.4

nvidia/dcgm-exporter:4.6.1-4.8.4nvidia/dcgm-exporter:4.6.1-4.8.4-distrolessnvidia/dcgm-exporter:4.8.4

digestsha256:148b0c025e5f2850256816fa33754fbf4733b7a086697a95613fc0ba3db5b003

Executive Summary

Last scanned: Nov 10, 2026

Threat ScoreNEEDS ATTENTION• The scan reports 78 exposed-surface findings, 8 of them at severity 6.0 or above, with a maximum severity of 6.16.• No exposed findings are known to be actively exploited, and no post-exploit-only findings were reported.• CVE-2026-95619 is rated MEDIUM context importance: it requires a C++ component to call aligned operator new with attacker-controlled sizes, which the exporter does not stated-ly expose.• CVE-2026-78669 and CVE-2026-78659 are denial-of-service issues that require HTTP/2 to be served, which normally means TLS is enabled on the metrics endpoint.• The publisher is a popular community image with a RELIABLE trust verdict and is pinned by digest, which lowers supply-chain concern.• The container runs as root and has no exposed ports listed, so the findings are not tied to a directly reachable service in this context.

39/100NEEDS ATTENTION

ReputationPOPULAR COMMUNITY• High Reputation Community Image (92M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The main findings are denial-of-service and memory-handling flaws in the Go HTTP stack and the GCC C++ runtime, rated at medium context importance rather than reachable in normal operation. CVE-2026-78669 and CVE-2026-78659 only matter if HTTP/2 is served on the metrics endpoint with TLS enabled, and CVE-2026-95619 only applies if a C++ component passes attacker-controlled sizes to aligned operator new. Because the image runs as root, updating the base packages and Go dependencies is a worthwhile hardening step even though these issues do not change the verdict.

Hardening plan for this image · 4 steps

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

78 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-95619	MEDIUM6.16	gcc-14-base 14.2.0-19 No fix yet	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-95619	MEDIUM6.16	libgcc-s1 14.2.0-19 No fix yet	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-95619	MEDIUM6.16	libgomp1 14.2.0-19 No fix yet	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-95619	MEDIUM6.16	libstdc++6 14.2.0-19 No fix yet	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78669	MEDIUM6	golang.org/x/net v0.59.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78659	MEDIUM6	golang.org/x/net v0.59.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78669	MEDIUM6	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78659	MEDIUM6	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-5435	MEDIUM5.9	libc6 2.41-12+deb13u4 No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2026-6791	MEDIUM5.9	libc6 2.41-12+deb13u4 No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2026-77117	MEDIUM5.9	libc6 2.41-12+deb13u4 No fix yet	0.4% Theoretical Threat	Directly Exposed
CVE-2026-80489	MEDIUM5.9	libc6 2.41-12+deb13u4 No fix yet	0.4% Theoretical Threat	Directly Exposed
CVE-2026-54872	MEDIUM5.9	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.4% Theoretical Threat	Directly Exposed
CVE-2026-72897	MEDIUM5.9	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.4% Theoretical Threat	Directly Exposed
CVE-2026-75805	MEDIUM5.9	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.3% Theoretical Threat	Directly Exposed
CVE-2026-77696	MEDIUM5.9	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.4% Theoretical Threat	Directly Exposed
CVE-2026-54872	MEDIUM5.9	openssl-provider-fips 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.4% Theoretical Threat	Directly Exposed
CVE-2026-72897	MEDIUM5.9	openssl-provider-fips 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.4% Theoretical Threat	Directly Exposed
CVE-2026-75805	MEDIUM5.9	openssl-provider-fips 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.3% Theoretical Threat	Directly Exposed
CVE-2026-77696	MEDIUM5.9	openssl-provider-fips 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.4% Theoretical Threat	Directly Exposed
CVE-2026-97032	MEDIUM5.9	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-6368	MEDIUM5.5	libc6 2.41-12+deb13u4 No fix yet	0.1% Theoretical Threat	Directly Exposed
CVE-2026-27171	MEDIUM5.5	zlib1g 1:1.3.dfsg+really1.3.1-1+b1 No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2026-8674	MEDIUM5.3	libc6 2.41-12+deb13u4 No fix yet	0.3% Theoretical Threat	Directly Exposed
CVE-2026-42772	MEDIUM5.3	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.5% Theoretical Threat	Directly Exposed
CVE-2026-54873	MEDIUM5.3	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.7% Theoretical Threat	Directly Exposed
CVE-2026-75804	MEDIUM5.3	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.5% Theoretical Threat	Directly Exposed
CVE-2026-75806	MEDIUM5.3	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	1.1% Low-Moderate Risk	Directly Exposed
CVE-2026-84784	MEDIUM5.3	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.6% Theoretical Threat	Directly Exposed
CVE-2026-42772	MEDIUM5.3	openssl-provider-fips 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.5% Theoretical Threat	Directly Exposed
CVE-2026-54873	MEDIUM5.3	openssl-provider-fips 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.7% Theoretical Threat	Directly Exposed
CVE-2026-75804	MEDIUM5.3	openssl-provider-fips 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.5% Theoretical Threat	Directly Exposed
CVE-2026-75806	MEDIUM5.3	openssl-provider-fips 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	1.1% Low-Moderate Risk	Directly Exposed
CVE-2026-84784	MEDIUM5.3	openssl-provider-fips 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.6% Theoretical Threat	Directly Exposed
CVE-2026-78663	MEDIUM5.3	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-85091	MEDIUM5	zlib1g 1:1.3.dfsg+really1.3.1-1+b1 No fix yet	0.5% Theoretical Threat	Directly Exposed
CVE-2026-18374	MEDIUM4.9	libc6 2.41-12+deb13u4 No fix yet	0.1% Theoretical Threat	Directly Exposed
CVE-2026-97032	MEDIUM4.72	golang.org/x/net v0.59.0 fixed in 0.60.0	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-54875	MEDIUM4.7	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.5% Theoretical Threat	Directly Exposed
CVE-2026-54875	MEDIUM4.7	openssl-provider-fips 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.5% Theoretical Threat	Directly Exposed
CVE-2026-78660	MEDIUM4.5	golang.org/x/net v0.59.0 fixed in 0.60.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-78667	MEDIUM4.5	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-97031	MEDIUM4.5	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-78660	MEDIUM4.5	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Directly Exposed
CVE-2026-94440	MEDIUM4.5	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-84782	MEDIUM4.44	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.8% Theoretical Threat	Directly Exposed
CVE-2026-84782	MEDIUM4.44	openssl-provider-fips 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.8% Theoretical Threat	Directly Exposed
CVE-2026-78663	MEDIUM4.24	golang.org/x/net v0.59.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-102010	MEDIUM4.2	gcc-14-base 14.2.0-19 No fix yet	0.3% Theoretical Threat	Directly Exposed
CVE-2026-86805	MEDIUM4.2	libc6 2.41-12+deb13u4 No fix yet	<0.1% Theoretical Threat	Directly Exposed
CVE-2026-95818	MEDIUM4.2	libc6 2.41-12+deb13u4 No fix yet	0.1% Theoretical Threat	Directly Exposed
CVE-2026-102010	MEDIUM4.2	libgcc-s1 14.2.0-19 No fix yet	0.3% Theoretical Threat	Directly Exposed
CVE-2026-102010	MEDIUM4.2	libgomp1 14.2.0-19 No fix yet	0.3% Theoretical Threat	Directly Exposed
CVE-2026-102010	MEDIUM4.2	libstdc++6 14.2.0-19 No fix yet	0.3% Theoretical Threat	Directly Exposed
CVE-2026-19542	MEDIUM4.2	libc6 2.41-12+deb13u4 No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2026-89092	MEDIUM4.2	libc6 2.41-12+deb13u4 No fix yet	0.2% Theoretical Threat	Directly Exposed
CVE-2026-19499	MEDIUM4.08	libc6 2.41-12+deb13u4 No fix yet	0.3% Theoretical Threat	Directly Exposed
CVE-2026-111943	MEDIUM4.08	stdlib v1.27.1 fixed in 1.26.10, 1.27.3	0.3% Theoretical Threat	Directly Exposed
DSA-6572-1	MEDIUM4	ca-certificates 20250419 fixed in 20250419+deb13u1	—	Directly Exposed
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.57.0 No fix yet	—	Directly Exposed
CVE-2026-6238	LOW3.9	libc6 2.41-12+deb13u4 No fix yet	0.4% Theoretical Threat	Directly Exposed
CVE-2026-56866	LOW3.9	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-94439	LOW3.9	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Directly Exposed
CVE-2010-4756	LOW3.9	libc6 2.41-12+deb13u4 No fix yet	2.6% Low-Moderate Risk	Directly Exposed
CVE-2018-20796	LOW3.9	libc6 2.41-12+deb13u4 No fix yet	5.8% Low-Moderate Risk	Directly Exposed
CVE-2019-1010022	LOW3.9	libc6 2.41-12+deb13u4 No fix yet	3.2% Low-Moderate Risk	Directly Exposed
CVE-2019-1010023	LOW3.9	libc6 2.41-12+deb13u4 No fix yet	3.1% Low-Moderate Risk	Directly Exposed
CVE-2019-1010024	LOW3.9	libc6 2.41-12+deb13u4 No fix yet	3.2% Low-Moderate Risk	Directly Exposed
CVE-2019-1010025	LOW3.9	libc6 2.41-12+deb13u4 No fix yet	2.5% Low-Moderate Risk	Directly Exposed
CVE-2019-9192	LOW3.9	libc6 2.41-12+deb13u4 No fix yet	2.4% Low-Moderate Risk	Directly Exposed
CVE-2026-97399	LOW3.7	libc6 2.41-12+deb13u4 No fix yet	0.3% Theoretical Threat	Directly Exposed
CVE-2026-35189	LOW3.7	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.3% Theoretical Threat	Directly Exposed
CVE-2026-35191	LOW3.7	libssl3t64 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.7% Theoretical Threat	Directly Exposed
CVE-2026-35189	LOW3.7	openssl-provider-fips 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.3% Theoretical Threat	Directly Exposed
CVE-2026-35191	LOW3.7	openssl-provider-fips 3.5.7-1~deb13u2 fixed in 3.5.7-1~deb13u3	0.7% Theoretical Threat	Directly Exposed
CVE-2026-94448	LOW3.66	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-97030	LOW3.66	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-56857	LOW3.3	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.