ghcr.io/pair-ai-platform/go:1.25.14-20261109.19

Go 1.25.14 (runtime). Tags: 1.25.14-20261109.19, 1.25, 1.25.14. Index digest sha256:175d1281b07c50e9bdffad5dd2bb9dbf030b3a97391ac053df9bb9562b362a9d.

Vulnerabilities · SBOM · Hardening profile

Vulnerabilities

Critical: 1 · High: 10 · Medium: 3 (Grype)

IDSeverityPackageInstalledComes fromFixed upstream inArchitectures
GO-2026-6612Criticalstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9x86_64, aarch64
CVE-2026-119586Highsqlite-libs3.54.1-r0sqlite-libs 3.54.1-r0no fix yetx86_64, aarch64
CVE-2026-84243Highglibc-2.442.44-r15glibc-2.44 2.44-r15no fix yetx86_64, aarch64
GO-2026-6603Highstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9x86_64, aarch64
GO-2026-6605Highstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9, 1.27.2x86_64, aarch64
GO-2026-6607Highstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9, 1.27.2x86_64, aarch64
GO-2026-6608Highstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9, 1.27.2x86_64, aarch64
GO-2026-6610Highstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9x86_64, aarch64
GO-2026-6611Highstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9x86_64, aarch64
GO-2026-6613Highstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9, 1.27.2x86_64, aarch64
GO-2026-6617Highstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9x86_64, aarch64
GO-2026-6599Mediumstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9, 1.27.2x86_64, aarch64
GO-2026-6600Mediumstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.9, 1.27.2x86_64, aarch64
GO-2026-6809Mediumstdlibgo1.25.14go-1.25-upstream 1.25.14-r01.26.10, 1.27.3x86_64, aarch64

Comes from is the Wolfi package that brings the affected code into the image; a library bundled inside the toolchain, for example, comes from that package. Fixed upstream in is the version of the affected code that fixes it; the image gets the fix when the package it comes from ships that version, and the next build after that publishes it.

SBOM

One SPDX SBOM per architecture, also attached to the image as a signed attestation.

x86_64: 43 packages

Download sbom-x86_64.spdx.json · 77.3 MB compressed, 222.0 MB installed

PackageVersionLicense
bash5.3-r14GPL-3.0-or-later
busybox1.38.0-r3GPL-2.0-only
ca-certificates-bundle20261020-r0MPL-2.0 AND MIT
cyrus-sasl-heimdal-libs2.1.28-r58BSD-3-Clause
gdbm1.26-r9GPL-3.0-or-later
git2.56.0-r3GPL-2.0-or-later AND ( Artistic-1.0-Perl OR GPL-1.0-or-later )
glibc-2.442.44-r15LGPL-2.1-or-later
glibc-2.44-locale-posix2.44-r15LGPL-2.1-or-later
go-1.25-upstream1.25.14-r0BSD-3-Clause
heimdal-libs7.8.0-r55BSD-3-Clause
keyutils-libs1.6.3-r41GPL-2.0-or-later OR LGPL-2.0-or-later
krb5-conf1.0-r10MIT
krb5-libs1.22.2-r6MIT
ld-linux-2.442.44-r15LGPL-2.1-or-later
libbrotlicommon11.2.1-r3MIT
libbrotlidec11.2.1-r3MIT
libbrotlienc11.2.1-r3MIT
libcom_err1.47.4-r5GPL-2.0-or-later AND LGPL-2.0-or-later AND BSD-3-Clause AND MIT
libcrypt1-2.442.44-r15LGPL-2.1-or-later
libcurl-openssl48.23.0-r3MIT
libexpat12.10.0-r1MIT
libgcc16.2.0-r3GPL-3.0-or-later WITH GCC-exception-3.1
libidn22.3.8-r12GPL-2.0-or-later AND LGPL-3.0-or-later
libldap-2.72.7.2-r0OLDAP-2.8
libnghttp2-141.71.0-r0MIT
libpcre2-8-010.49-r3BSD-3-Clause
libpsl0.23.3-r4MIT
libunistring1.5-r1GPL-2.0-or-later OR LGPL-3.0-or-later
libverto0.3.2-r11MIT
libxcrypt4.5.2-r8GPL-2.0-or-later AND LGPL-2.1-or-later
lmdb0.9.35-r3OLDAP-2.8
ncurses6.6.20261107-r0MIT
ncurses-terminfo-base6.6.20261107-r0MIT
nghttp31.19.0-r0MIT
ngtcp21.26.0-r0MIT
openssl-4.0-libcrypto4.0.3-r8Apache-2.0
openssl-4.0-libssl4.0.3-r8Apache-2.0
openssl-provider-legacy-allowed4.1.0-r0Apache-2.0
readline8.3-r3GPL-3.0-or-later
sqlite-libs3.54.1-r0blessing
tzdata2026f-r0CC-PDDC
wolfi-baselayout20230201-r31MIT
zlib1.3.2.1_rc20260921-r2MPL-2.0 AND MIT

aarch64: 43 packages

Download sbom-aarch64.spdx.json · 72.8 MB compressed, 218.8 MB installed

PackageVersionLicense
bash5.3-r14GPL-3.0-or-later
busybox1.38.0-r3GPL-2.0-only
ca-certificates-bundle20261020-r0MPL-2.0 AND MIT
cyrus-sasl-heimdal-libs2.1.28-r58BSD-3-Clause
gdbm1.26-r9GPL-3.0-or-later
git2.56.0-r3GPL-2.0-or-later AND ( Artistic-1.0-Perl OR GPL-1.0-or-later )
glibc-2.442.44-r15LGPL-2.1-or-later
glibc-2.44-locale-posix2.44-r15LGPL-2.1-or-later
go-1.25-upstream1.25.14-r0BSD-3-Clause
heimdal-libs7.8.0-r55BSD-3-Clause
keyutils-libs1.6.3-r41GPL-2.0-or-later OR LGPL-2.0-or-later
krb5-conf1.0-r10MIT
krb5-libs1.22.2-r6MIT
ld-linux-2.442.44-r15LGPL-2.1-or-later
libbrotlicommon11.2.1-r3MIT
libbrotlidec11.2.1-r3MIT
libbrotlienc11.2.1-r3MIT
libcom_err1.47.4-r5GPL-2.0-or-later AND LGPL-2.0-or-later AND BSD-3-Clause AND MIT
libcrypt1-2.442.44-r15LGPL-2.1-or-later
libcurl-openssl48.23.0-r3MIT
libexpat12.10.0-r1MIT
libgcc16.2.0-r3GPL-3.0-or-later WITH GCC-exception-3.1
libidn22.3.8-r12GPL-2.0-or-later AND LGPL-3.0-or-later
libldap-2.72.7.2-r0OLDAP-2.8
libnghttp2-141.71.0-r0MIT
libpcre2-8-010.49-r3BSD-3-Clause
libpsl0.23.3-r4MIT
libunistring1.5-r1GPL-2.0-or-later OR LGPL-3.0-or-later
libverto0.3.2-r11MIT
libxcrypt4.5.2-r8GPL-2.0-or-later AND LGPL-2.1-or-later
lmdb0.9.35-r3OLDAP-2.8
ncurses6.6.20261107-r0MIT
ncurses-terminfo-base6.6.20261107-r0MIT
nghttp31.19.0-r0MIT
ngtcp21.26.0-r0MIT
openssl-4.0-libcrypto4.0.3-r8Apache-2.0
openssl-4.0-libssl4.0.3-r8Apache-2.0
openssl-provider-legacy-allowed4.1.0-r0Apache-2.0
readline8.3-r3GPL-3.0-or-later
sqlite-libs3.54.1-r0blessing
tzdata2026f-r0CC-PDDC
wolfi-baselayout20230201-r31MIT
zlib1.3.2.1_rc20260921-r2MPL-2.0 AND MIT

Hardening profile (OpenSCAP, DISA GPOS SRG)

Derived from the DISA General Purpose Operating System SRG; not an official DISA STIG for containers.

ArchitecturePassed / applicableNot applicableReport
x86_6485 / 91 (93.4%)107OpenSCAP report
aarch6485 / 91 (93.4%)107OpenSCAP report