Vulnerability Reportvictoriametrics/victoria-metrics:v1.145.0-enterprise-fips

victoriametrics/victoria-metrics:v1.145.0-enterprise-fipsvictoriametrics/victoria-metrics:v1.145.0-enterprise-rc0-fips
digestsha256:d2b269441a531a9b3257b52e8288d320182a98ff27b4e8203cad1cf803a74411

Executive Summary

Last scanned:

Threat Score
0/100SAFE
Reputation
TRUSTED

This image is safe for production use. It contains 3 exposed and 2 post-exploit vulnerabilities, but all have very low severity (max CVSS 2.39) and no practical impact in typical deployment scenarios. The image is from a verified publisher and pinned by digest, ensuring immutability and trust.

Relevant for victoriametrics/victoria-metrics:v1.145.0-enterprise-fips

Most CVEs in Go images aren't exploitable

This image is a Go binary — most findings can be ruled out with three commands. How to prove which ones are real.

Read the article

Vulnerabilities

Vulnerability Log

5 total
CVE IDAdjusted SeverityPackageExploit ProbabilityRisk Context
CVE-2026-39822LOW2.39
stdlib
v1.26.4
fixed in 1.25.12, 1.26.5, 1.27.0-rc.2
0.2%
Theoretical Threat
Post-Exploit
CVE-2026-42505LOW1.62
stdlib
v1.26.4
fixed in 1.25.12, 1.26.5, 1.27.0-rc.2
0.4%
Theoretical Threat
Post-Exploit
GO-2026-5932NONE0
golang.org/x/crypto
v0.52.0
No fix yet
—
Not Applicable
CVE-2026-46600NONE0
golang.org/x/net
v0.55.0
fixed in 0.56.0
—
Not Applicable
CVE-2026-56852NONE0
golang.org/x/text
v0.37.0
fixed in 0.39.0
—
Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.