Vulnerability Reportvictoriametrics/victoria-metrics:v1.149.0

victoriametrics/victoria-metrics:v1.149.0

digestsha256:13b8951e35bb3589626816538483127785a9d8b53f9f5123769db0fcab1d961f

Executive Summary

Last scanned: Oct 20, 2026

Threat ScoreCAUTION• Pre-calculated threat band is CAUTION: 8 exposed findings have severity >=6.0, with max exposed severity 6.38 and none at severity >=7.0.• CVE-2026-63074 and CVE-2026-63075 affect OpenSSL packages and can cause remote memory-exhaustion denial of service in CMP or QUIC usage.• CVE-2026-78669 adds HTTP/2 CPU-exhaustion risk, increasing availability impact for an exposed metrics service.• Exposed surface is broad with 30 total exposed findings, but post-exploit-only risk is limited: 17 total with max severity 2.7 and none at severity >=6.0.• Trust signals are strong: verified publisher and digest-pinned image, reducing supply-chain concern but not eliminating runtime vulnerability exposure.

50/100CAUTION

ReputationVERIFIED• Verified Publisher (Trusted Vendor)• Pinned by digest (Immutable)

TRUSTED

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker could disrupt service availability by driving memory exhaustion or excessive CPU consumption through crafted CMP, QUIC, HTTP/2, Range, or TLS traffic, potentially taking metrics ingestion or query offline. CVE-2026-63074 only applies if a CMP server reuses a single OSSL_CMP_CTX, and CVE-2026-63075 only applies to exposed QUIC traffic; disabling unused QUIC or avoiding CMP server usage fully eliminates those specific risks. Restricting network access to trusted metrics clients fully eliminates remote exploitation of these exposed-surface findings.

Relevant for victoriametrics/victoria-metrics:v1.149.0

Most CVEs in Go images aren't exploitable

This image is a Go binary — most findings can be ruled out with three commands. How to prove which ones are real.

Read the article

Vulnerabilities

Vulnerability Log

47 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-63074	MEDIUM6.38	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-63075	MEDIUM6.38	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.8% Theoretical Threat	Directly Exposed
CVE-2026-63074	MEDIUM6.38	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-63075	MEDIUM6.38	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.8% Theoretical Threat	Directly Exposed
CVE-2026-78669	MEDIUM6.38	golang.org/x/net v0.57.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-78667	MEDIUM6.38	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Directly Exposed
CVE-2026-78669	MEDIUM6.38	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-97031	MEDIUM6.38	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Directly Exposed
CVE-2026-63073	MEDIUM5.9	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.2% Low-Moderate Risk	Directly Exposed
CVE-2026-63073	MEDIUM5.9	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.2% Low-Moderate Risk	Directly Exposed
CVE-2026-56866	MEDIUM5.52	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-94439	MEDIUM5.52	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-56858	MEDIUM5.5	stdlib v1.26.5 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-94448	MEDIUM5.18	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.2% Theoretical Threat	Directly Exposed
CVE-2026-56853	MEDIUM5.1	stdlib v1.26.5 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-56862	MEDIUM5.1	stdlib v1.26.5 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3	0.6% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-97032	MEDIUM5.02	golang.org/x/net v0.57.0 fixed in 0.60.0	0.4% Theoretical Threat	Directly Exposed
CVE-2026-97032	MEDIUM5.02	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Directly Exposed
CVE-2026-78663	MEDIUM4.5	golang.org/x/net v0.57.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly Exposed
CVE-2026-78663	MEDIUM4.5	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-75803	LOW3.15	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.2% Theoretical Threat	Directly Exposed
CVE-2026-75803	LOW3.15	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.2% Theoretical Threat	Directly Exposed
CVE-2026-56857	LOW2.8	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-18798	LOW2.7	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.5% Low-Moderate Risk	Post-Exploit
CVE-2026-63076	LOW2.7	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.6% Low-Moderate Risk	Post-Exploit
CVE-2026-14457	LOW2.7	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	1.0% Low-Moderate Risk	Post-Exploit
CVE-2026-18798	LOW2.7	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.5% Low-Moderate Risk	Post-Exploit
CVE-2026-63076	LOW2.7	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.6% Low-Moderate Risk	Post-Exploit
CVE-2026-14457	LOW2.7	libssl3 3.5.7-r0 fixed in 3.5.8-r0	1.0% Low-Moderate Risk	Post-Exploit
CVE-2026-39821	LOW2.51	stdlib v1.26.5 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3	0.7% Theoretical Threat	Post-Exploit
CVE-2026-14456	LOW2.29	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-63072	LOW2.29	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.9% Theoretical Threat	Post-Exploit
CVE-2026-54874	LOW2.29	libcrypto3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-14456	LOW2.29	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.7% Theoretical Threat	Post-Exploit
CVE-2026-63072	LOW2.29	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.9% Theoretical Threat	Post-Exploit
CVE-2026-54874	LOW2.29	libssl3 3.5.7-r0 fixed in 3.5.8-r0	0.6% Theoretical Threat	Post-Exploit
CVE-2026-33818	LOW2.29	stdlib v1.26.5 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3	0.6% Theoretical Threat	Post-Exploit
CVE-2026-46600	LOW2.29	stdlib v1.26.5 fixed in 1.26.6, 1.27.0-rc.3	0.5% Theoretical Threat	Post-Exploit
CVE-2026-56859	LOW2.29	stdlib v1.26.5 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3	0.6% Theoretical Threat	Post-Exploit
CVE-2026-56860	LOW2.29	stdlib v1.26.5 fixed in 1.25.13, 1.26.6, 1.27.0-rc.3	0.5% Theoretical Threat	Post-Exploit
CVE-2026-85091	NONE0	zlib 1.3.2-r0 fixed in 1.3.2-r1	0.4% Theoretical Threat	Not Applicable
CVE-2026-78659	NONE0	golang.org/x/net v0.57.0 fixed in 0.60.0	0.6% Theoretical Threat	Not Applicable
CVE-2026-78660	NONE0	golang.org/x/net v0.57.0 fixed in 0.60.0	0.3% Theoretical Threat	Not Applicable
CVE-2026-78659	NONE0	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Not Applicable
CVE-2026-78660	NONE0	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Not Applicable
CVE-2026-94440	NONE0	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Not Applicable
CVE-2026-97030	NONE0	stdlib v1.26.5 fixed in 1.26.9, 1.27.2	0.2% Theoretical Threat	Not Applicable

Reachability analysis

Which CVEs are actually reachable — is the vulnerable code even linked and callable.

Locked

Runtime verification

Live-container probes: default user, writable paths, capabilities, exposed ports.

Locked

Supply chain analysis

Base-image lineage, package provenance and signatures — nothing slipped in unnoticed.

Locked

Hardening recommendations

A step-by-step hardened build plan, with parity tests proving nothing breaks.

Locked

Want to check another image? Run a full scan with the Docker Security Scanner.