Vulnerability Reporttelegraf:1.40.2-alpine

telegraf:alpinetelegraf:1.40.2-alpinetelegraf:1.40-alpine

digestsha256:4a62bd294bf2f4c1e3781194fe7b625b7e527244eeb31afd5758227914a16229

Executive Summary

Last scanned: Nov 2, 2026

Threat ScoreNEEDS ATTENTION• CVE-2026-78669 in golang.org/x/net could let a client drive up CPU use on an HTTP/2 listener, which would slow telegraf, but only if such a listener is enabled.• CVE-2026-78659 in golang.org/x/net could exhaust memory on an HTTP/2 listener and crash telegraf, but this also needs a non-default HTTP/2 listener.• The scan found 21 exposed findings, six of them rated 6.0 or higher, and none are known to be actively exploited.• CVE-2026-97031 in the Go standard library (stdlib) could exhaust memory in a TLS listener that accepts Encrypted Client Hello, which is not enabled by default.• No findings were flagged as reachable only after the container is already compromised, and the highest severity in the scan is 6.0.

30/100NEEDS ATTENTION

ReputationOFFICIAL• Official Docker Hub Image• Pinned by digest (Immutable)

TRUSTED

This image is acceptable for production, but remediating the identified vulnerabilities is recommended to reduce the attack surface. The main findings are denial-of-service flaws, such as CVE-2026-78669 in golang.org/x/net, that could slow or crash telegraf by exhausting CPU or memory. Each of these needs a non-default HTTP/2 or TLS listener to be turned on, so they do not apply to the default setup. Keeping those listeners disabled removes the path for CVE-2026-78669 entirely. Updating the Go and golang.org/x/net dependencies in a future image build is the practical way to close the remaining findings.

Hardening plan for this image · 3 steps

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

21 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-78669	MEDIUM6	golang.org/x/net v0.59.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78659	MEDIUM6	golang.org/x/net v0.59.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78669	MEDIUM6	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-97031	MEDIUM6	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78659	MEDIUM6	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-94440	MEDIUM6	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-111943	MEDIUM5.44	stdlib v1.27.1 fixed in 1.26.10, 1.27.3	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-94439	MEDIUM5.2	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-97032	MEDIUM4.72	golang.org/x/net v0.59.0 fixed in 0.60.0	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-97032	MEDIUM4.72	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78660	MEDIUM4.5	golang.org/x/net v0.59.0 fixed in 0.60.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-78667	MEDIUM4.5	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-78660	MEDIUM4.5	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Directly Exposed
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.57.0 No fix yet	—	Directly Exposed
CVE-2026-56866	LOW3.9	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-94448	LOW3.66	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-97030	LOW3.66	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-56857	LOW3.3	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-78663	LOW3.18	golang.org/x/net v0.59.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-78663	LOW3.18	stdlib v1.27.1 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-114437	LOW2.88	github.com/go-chi/chi/v5 v5.3.2 fixed in 5.4.0	0.1% Theoretical Threat	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.