Vulnerability Reportvxcontrol/pentagi:2.2.0

vxcontrol/pentagi:2.2.0vxcontrol/pentagi:2.2vxcontrol/pentagi:2

digestsha256:64bd1802799142a12bc5eb23c15a1ccc50d3476736d3d2a98a9b773910283a1e

Executive Summary

Last scanned: Nov 11, 2026

Threat ScoreCAUTION• CVE-2026-78669 in golang.org/x/net (severity 7.5) lets a malicious HTTP/2 client flood SETTINGS frames and drive up server CPU, degrading the service. The main Go binary accepts these connections from the network in normal operation.• CVE-2026-78659 in golang.org/x/net (severity 7.5) lets a client send many HTTP/2 trailer fields and exhaust server memory, which also degrades availability in normal operation.• The scan found 29 exposed findings: 4 at severity 7.0 or above and 7 at 6.0 or above. None are listed as known to be actively exploited.• The top findings are denial-of-service flaws rather than code execution, data exposure, or access bypass, so the realistic impact is service disruption.• Several findings in the standard library are also reachable through the same HTTP/2 and multipart handling paths, so the exposure is concentrated in the network-facing server code.• Post-exploit exposure is zero, and the main binary is statically linked, so flaws in OS libraries are not reachable through the main process.

58/100CAUTION

ReputationCOMMUNITY• Community Image with low/unknown reputation• Pinned by digest (Immutable)

UNVERIFIED

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. An attacker who reaches the service over the network could flood it with crafted HTTP/2 traffic to exhaust CPU and memory, causing the pentagi service to slow down or stop responding. The most significant items are CVE-2026-78669 and CVE-2026-78659 in golang.org/x/net, which affect the main network-facing server; none of the findings are known to be actively exploited. These flaws need no special configuration to be reachable, so they apply in the default setup. Patching the Go and golang.org/x/net dependencies and placing the service behind rate limiting or connection controls would reduce the risk before production use.

Hardening plan for this image · 4 steps

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

29 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-78669	HIGH7.5	golang.org/x/net v0.58.0 fixed in 0.60.0	0.8% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-78659	HIGH7.5	golang.org/x/net v0.58.0 fixed in 0.60.0	0.9% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-78669	HIGH7.5	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.8% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-78659	HIGH7.5	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.9% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-32285	MEDIUM6	github.com/buger/jsonparser v1.1.1 fixed in 1.1.2	0.8% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78667	MEDIUM6	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.7% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-94440	MEDIUM6	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.7% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-97032	MEDIUM5.9	golang.org/x/net v0.58.0 fixed in 0.60.0	0.7% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-97032	MEDIUM5.9	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.7% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-111943	MEDIUM5.44	stdlib v1.26.8 fixed in 1.26.10, 1.27.3	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78663	MEDIUM5.3	golang.org/x/net v0.58.0 fixed in 0.60.0	0.9% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-78663	MEDIUM5.3	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.9% Theoretical Threat	Directly Exposed
CVE-2026-85091	MEDIUM5	zlib 1.3.2-r0 fixed in 1.3.2-r1	0.5% Theoretical Threat	Directly Exposed
CVE-2026-94448	MEDIUM4.88	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-63209	MEDIUM4.5	github.com/klauspost/compress v1.18.3 fixed in 1.18.7	0.6% Theoretical Threat	Directly Exposed
CVE-2026-78660	MEDIUM4.5	golang.org/x/net v0.58.0 fixed in 0.60.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-97031	MEDIUM4.5	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.7% Theoretical Threat	Directly Exposed
CVE-2026-78660	MEDIUM4.5	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-56866	LOW3.9	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-94439	LOW3.9	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-97030	LOW3.66	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-107891	LOW3.4	musl 1.2.5-r23 fixed in 1.2.5-r24	0.5% Theoretical Threat	Directly Exposed
CVE-2026-107891	LOW3.4	musl-utils 1.2.5-r23 fixed in 1.2.5-r24	0.5% Theoretical Threat	Directly Exposed
CVE-2026-81870	LOW3.3	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 fixed in 1.45.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-81870	LOW3.3	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.39.0 fixed in 1.45.0	0.3% Theoretical Threat	Directly Exposed
CVE-2026-56857	LOW3.3	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-56855	LOW3.18	golang.org/x/crypto v0.55.0 fixed in 0.56.0	0.5% Theoretical Threat	Directly Exposed
CVE-2026-78662	LOW3.18	golang.org/x/crypto v0.55.0 fixed in 0.56.0	0.4% Theoretical Threat	Directly Exposed
GO-2026-5932	LOW2.4	golang.org/x/crypto v0.55.0 No fix yet	—	Directly Exposed

Want to check another image? Run a full scan with the Docker Security Scanner.