Vulnerability Reportprom/pushgateway:latest

prom/pushgateway:latestprom/pushgateway:v1

digestsha256:7332ee96119c0b927a3e64971189d884718939b6102c3e9e047bc11e83715d6f

Executive Summary

Last scanned: Oct 27, 2026

Threat ScoreNEEDS ATTENTION• The image has 6 exposed-surface findings, and the highest severity is 6.0, so none reach the 7.0 threshold.• Two findings, CVE-2026-78669 and CVE-2026-78659, are denial-of-service issues in golang.org/x/net rated 6.0.• Both CVEs require HTTP/2 over TLS through a web config file, which is not the default, so they likely do not apply in a standard deployment.• No exposed-surface findings are listed as known exploited, and no post-exploit-only findings were reported.• The publisher is a popular community image pinned by digest, which supports its trustworthiness.

30/100NEEDS ATTENTION

ReputationPOPULAR COMMUNITY• High Reputation Community Image (266M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The six exposed-surface findings are real, but the two most notable, CVE-2026-78669 and CVE-2026-78659, are denial-of-service flaws that could slow or hang metric ingestion through HTTP/2 floods. Note: both CVEs only apply if HTTP/2 is enabled through TLS in a web config file, which is not the default. Upgrading the golang.org/x/net dependency in a future image build is the practical way to clear them.

Relevant for prom/pushgateway:latest

Most CVEs in Go images aren't exploitable

This image is a Go binary — most findings can be ruled out with three commands. How to prove which ones are real.

Read the article

Vulnerabilities

Vulnerability Log

6 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-78669	MEDIUM6	golang.org/x/net v0.59.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78659	MEDIUM6	golang.org/x/net v0.59.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-97032	MEDIUM4.72	golang.org/x/net v0.59.0 fixed in 0.60.0	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78660	MEDIUM4.5	golang.org/x/net v0.59.0 fixed in 0.60.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-78663	MEDIUM4.24	golang.org/x/net v0.59.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.57.0 No fix yet	—	Directly Exposed

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.