Finding · critical
GO-2026-6604
A VEX statement covers it in every image that has it, so the report doesn't count it.
Covered by a VEX statement
These images have it, and a VEX statement says it doesn't apply to them, so the report doesn't count it there.
| Image | Package | Version | Fixed in | Severity | Platforms | Scanned |
|---|---|---|---|---|---|---|
| amazonlinux-tools:latest Verified | stdlib | go1.26.8 | 1.26.9, 1.27.2 | critical | linux/amd64, linux/arm64 | 2026-10-10 16:25 UTC, 26 minutes before the report |
| debian-tools:latest Verified | stdlib | go1.26.8 | 1.26.9, 1.27.2 | critical | linux/amd64, linux/arm64 | 2026-10-10 16:25 UTC, 26 minutes before the report |
| platform-tools:latest Verified | stdlib | go1.26.4 | 1.26.9, 1.27.2 | critical | linux/amd64, linux/arm64 | 2026-10-10 16:26 UTC, 25 minutes before the report |
| platform-tools:latest Verified | stdlib | go1.26.6 | 1.26.9, 1.27.2 | critical | linux/amd64, linux/arm64 | 2026-10-10 16:26 UTC, 25 minutes before the report |
| platform-tools:latest Verified | stdlib | go1.26.8 | 1.26.9, 1.27.2 | critical | linux/amd64, linux/arm64 | 2026-10-10 16:26 UTC, 25 minutes before the report |
| platform-tools:latest Verified | stdlib | go1.27.1 | 1.26.9, 1.27.2 | critical | linux/amd64, linux/arm64 | 2026-10-10 16:26 UTC, 25 minutes before the report |
Where it is unknown
4 images have no vulnerability data, so whether they have it is unknown: the images with no data.