Image reports › rabbitmq
rabbitmq — vulnerabilities, FIPS 140-3 and fixes
docker.io/library/rabbitmq · Ubuntu 24.04.5 LTS
Latest: rabbitmq:4 · checked 2026-09-28
Not FIPS-ready
No. rabbitmq:4 relies on cryptography that isn't FIPS-certified, so it can't be used where FIPS 140-3 is required as it stands.
Security: Grade F: 69 known vulnerabilities
69 known vulnerabilities in 8 packages (4 critical, 27 high); 62 can be fixed by upgrading 1 package. Start with stdlib: upgrade 1.22.2 → 1.25.13 (fixes 62).
Open the full report → Get a fixed image Get a FIPS image Scan your own image
Fix plan for 4
| Package | Installed | Upgrade to | Fixes |
|---|---|---|---|
| stdlib | 1.22.2 | 1.25.13 | 62 |
Critical, high and exploited vulnerabilities in 4
| Severity | ID | Package | Fixed in | Summary |
|---|---|---|---|---|
| critical | GO-2024-2887 | stdlib 1.22.2 | 1.22.4 | Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip |
| critical | GO-2026-4337 | stdlib 1.22.2 | 1.24.13 | Unexpected session resumption in crypto/tls |
| critical | GO-2025-3563 | stdlib 1.22.2 | 1.23.8 | Request smuggling due to acceptance of invalid chunked data in net/http |
| critical | GO-2026-5026 | stdlib 1.22.2 | 1.25.13 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna |
| high | GO-2026-4341 | stdlib 1.22.2 | 1.24.12 | Memory exhaustion in query parameter parsing in net/url |
| high | UBUNTU-CVE-2016-20013 | libc6 2.39-0ubuntu8.9 | no fix yet | sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password. |
| high | GO-2024-3106 | stdlib 1.22.2 | 1.22.7 | Stack exhaustion in Decoder.Decode in encoding/gob |
| high | GO-2024-2963 | stdlib 1.22.2 | 1.22.5 | Denial of service due to improper 100-continue handling in net/http |
| high | GO-2024-3107 | stdlib 1.22.2 | 1.22.7 | Stack exhaustion in Parse in go/build/constraint |
| high | GO-2026-4981 | stdlib 1.22.2 | 1.25.10 | Crash when handling long CNAME response in net |
| high | GO-2026-4986 | stdlib 1.22.2 | 1.25.10 | Quadratic string concatentation in consumeComment in net/mail |
| high | GO-2026-4601 | stdlib 1.22.2 | 1.25.8 | Incorrect parsing of IPv6 host literals in net/url |
| high | GO-2026-4977 | stdlib 1.22.2 | 1.25.10 | Quadratic string concatenation in consumePhrase in net/mail |
| high | GO-2026-4918 | stdlib 1.22.2 | 1.25.10 | Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net |
| high | GO-2026-4947 | stdlib 1.22.2 | 1.25.9 | Unexpected work during chain building in crypto/x509 |