Vulnerability Reportvictoriametrics/victoria-metrics:v1.145.0-enterprise-scratch

victoriametrics/victoria-metrics:v1.145.0-enterprise-scratchvictoriametrics/victoria-metrics:v1.145.0-enterprise-rc0-scratch

digestsha256:464528e7771d7945dfbdc8e1ca027e639cb25d2af2a45d487edae7712e782a1d

Executive Summary

Last scanned: Jul 26, 2026

Threat ScoreSAFE• Trusted publisher (victoriametrics) with verified image and pinned digest.• No exposed vulnerabilities in the surface findings (INPUT 4 empty).• Post-exploit findings are absent (INPUT 5 empty).• Vulnerability stats show low severity: max exposed severity 3.6, max post-exploit severity 2.39.• Total exposed vulnerabilities (4) are all low severity, not actionable for production risk.

0/100SAFE

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image is safe for production use. While there are 4 low-severity and 1 negligible-severity vulnerabilities detected, none appear in the exposed surface or post-exploit analysis, and they pose no practical risk to the container's operation as a metrics service. The image is published by a trusted vendor and pinned by digest, ensuring integrity.

Already in good shape · 3 hardening steps left

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

5 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-42505	LOW3.6	stdlib v1.26.4 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-39822	LOW2.39	stdlib v1.26.4 fixed in 1.25.12, 1.26.5, 1.27.0-rc.2	0.2% Theoretical Threat	Post-Exploit
GO-2026-5932	NONE0	golang.org/x/crypto v0.52.0 No fix yet	—	Not Applicable
CVE-2026-46600	NONE0	golang.org/x/net v0.55.0 fixed in 0.56.0	—	Not Applicable
CVE-2026-56852	NONE0	golang.org/x/text v0.37.0 fixed in 0.39.0	—	Not Applicable

Want to check another image? Run a full scan with the Docker Security Scanner.