Vulnerability Reportvictoriametrics/victoria-metrics:v1.145.0-enterprise-fips

victoriametrics/victoria-metrics:v1.145.0-enterprise-fipsvictoriametrics/victoria-metrics:v1.145.0-enterprise-rc0-fips
digestsha256:d2b269441a531a9b3257b52e8288d320182a98ff27b4e8203cad1cf803a74411

Executive Summary

Last scanned:

Threat Score
0/100SAFE
Reputation
TRUSTED

This image is safe for production use. It contains 3 exposed and 2 post-exploit vulnerabilities, but all have very low severity (max CVSS 2.39) and no practical impact in typical deployment scenarios. The image is from a verified publisher and pinned by digest, ensuring immutability and trust.

Already in good shape · 2 hardening steps left

Included in Pro

Scanning procedure

  1. Vulnerability scan
    Full CVE sweep across OS packages and app dependencies
  2. Exploitability check
    CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
  3. Reachability analysis
    Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
  4. Runtime verification
    Live-container probes: exposed endpoints, feature flags, real defaults
  5. Supply chain analysis
    Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
  6. Hardening recommendations
    A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

5 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-39822LOW2.39
stdlib
v1.26.4
fixed in 1.25.12, 1.26.5, 1.27.0-rc.2
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-42505LOW1.62
stdlib
v1.26.4
fixed in 1.25.12, 1.26.5, 1.27.0-rc.2
0.4%
Theoretical Threat
Post-Exploit
GO-2026-5932NONE0
golang.org/x/crypto
v0.52.0
No fix yet
—
Not Applicable
CVE-2026-46600NONE0
golang.org/x/net
v0.55.0
fixed in 0.56.0
—
Not Applicable
CVE-2026-56852NONE0
golang.org/x/text
v0.37.0
fixed in 0.39.0
—
Not Applicable

Want to check another image? Run a full scan with the Docker Security Scanner.