Image reports › mongo
mongo — vulnerabilities, FIPS 140-3 and fixes
mirror.gcr.io/library/mongo · Ubuntu 24.04.5 LTS
Latest: mongo:latest · checked 2026-09-25
Not FIPS-ready
No. mongo:latest relies on cryptography that isn't FIPS-certified, so it can't be used where FIPS 140-3 is required as it stands.
Security: 81 known vulnerabilities
81 known vulnerabilities in 16 packages (3 critical, 35 high); 58 can be fixed by upgrading 5 packages. Start with stdlib: upgrade 1.24.6 → 1.25.13 (fixes 45). Rebuilding on the latest base image picks up most OS fixes at once.
Fix plan for latest
| Package | Installed | Upgrade to | Fixes |
|---|---|---|---|
| stdlib | 1.24.6 | 1.25.13 | 45 |
| stdlib | 1.26.5 | 1.26.6 | 8 |
| golang.org/x/crypto | 0.54.0 | 0.56.0 | 3 |
| golang.org/x/sys | 0.1.0 | 0.44.0 | 1 |
| github.com/klauspost/compress | 1.18.6 | 1.18.7 | 1 |
Critical, high and exploited vulnerabilities in latest
| Severity | ID | Package | Fixed in | Summary |
|---|---|---|---|---|
| critical | GO-2026-5026 | stdlib 1.24.6 | 1.25.13 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna |
| critical | GO-2026-5026 | stdlib 1.26.5 | 1.26.6 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna |
| critical | GO-2026-4337 | stdlib 1.24.6 | 1.24.13 | Unexpected session resumption in crypto/tls |
| high | GO-2026-4970 | stdlib 1.24.6 | 1.25.12 | Root escape via symlink plus trailing slash in os |
| high | GO-2026-6303 | golang.org/x/crypto 0.54.0 | 0.55.0 | Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh |
| high | GO-2026-6354 | golang.org/x/crypto 0.54.0 | 0.56.0 | Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh |
| high | GO-2026-6355 | golang.org/x/crypto 0.54.0 | 0.56.0 | Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh |
| high | GO-2025-4006 | stdlib 1.24.6 | 1.24.8 | Excessive CPU consumption in ParseAddress in net/mail |
| high | GO-2025-4007 | stdlib 1.24.6 | 1.24.9 | Quadratic complexity when checking name constraints in crypto/x509 |
| high | GO-2025-4009 | stdlib 1.24.6 | 1.24.8 | Quadratic complexity when parsing some invalid inputs in encoding/pem |
| high | GO-2025-4013 | stdlib 1.24.6 | 1.24.8 | Panic when validating certificates with DSA public keys in crypto/x509 |
| high | GO-2025-4155 | stdlib 1.24.6 | 1.24.11 | Excessive resource consumption when printing error string for host certificate validation in crypto/x509 |
| high | GO-2026-4341 | stdlib 1.24.6 | 1.24.12 | Memory exhaustion in query parameter parsing in net/url |
| high | GO-2026-4601 | stdlib 1.24.6 | 1.25.8 | Incorrect parsing of IPv6 host literals in net/url |
| high | GO-2026-4870 | stdlib 1.24.6 | 1.25.9 | Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls |
All checked tags
| Tag | FIPS | Known vulnerabilities | Checked | |
|---|---|---|---|---|
| latest | Not FIPS-ready | F 81 3 critical | 2026-09-25 | Full report |