pulsar 4.8.0 Helm chart

Name: pulsar Helm chart 4.8.0: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

apache

Scored 14 Oct 2026

Apache Pulsar Helm chart for Kubernetes

Version 4.8.0 todayapp version 5.0.0 13Artifact Hub

pulsar 4.8.0 deploys 10 container images: quay.io/prometheus/node-exporter, library/busybox, curlimages/curl, quay.io/kiwigrid/k8s-sidecar and 6 more. Across them, 1,086 findings — 5 critical, 3 high — 1 on CISA KEV. The highest contribution is GO-2024-2687 in stdlib go1.19, fixed in 1.21.9. Chart.yaml declares kubeVersion >=1.25.0-0; rendered for Kubernetes 1.25.0.

Radar Score

13,59853259819

1,086 findings over 10 of 10 images measured

KEV confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

10 images

Image	Tag	Vulnerabilities	Radar Score
quay.io/prometheus/node-exporter	v1.10.2	001670	1,026
library/busybox	1.37.0	0000	0
curlimages/curl	8.18.0	102131	764
quay.io/kiwigrid/k8s-sidecar	2.5.0	102156	977
grafana/grafana	12.4.1	0053158	2,540
registry.k8s.io/kube-state-metrics/kube-state-metrics	v2.18.0	002070	1,060
victoriametrics/operator	v0.68.3	00650	650
apachepulsar/pulsar×17	5.0.0	0002	22
rancher/kubectl	v1.25.0	2362121	2,815
alpine/k8s×2	1.32.12	1060261	3,744

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

478 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	ALPINE-CVE-2026-50219	expat@2.7.4-r0	2.8.2-r0
Low	ALPINE-CVE-2026-56412	expat@2.7.4-r0	2.8.2-r0
Low	GHSA-qxp5-gwg8-xv66	golang.org/x/net@v0.19.0	0.36.0
Low	GO-2025-3503	stdlib@go1.24.0	1.23.7
Low	ALPINE-CVE-2026-42769	openssl@3.5.4-r0	3.5.7-r0
Low	ALPINE-CVE-2026-56132	expat@2.7.4-r0	2.8.2-r0
Low	GHSA-jwvj-g8pc-cx45	github.com/openfga/openfga@v1.11.3	1.14.0
Low	ALPINE-CVE-2025-15469	openssl@3.5.4-r0	3.5.5-r0
Low	GHSA-vh4v-2xq2-g5cg	oras.land/oras-go/v2@v2.6.0	2.6.1
Low	GHSA-w67g-5rqw-f597	github.com/gorilla/websocket@v1.5.0	1.5.3
Low	ALPINE-CVE-2026-56409	expat@2.7.4-r0	2.8.2-r0
Low	ALPINE-CVE-2026-27171	zlib@1.3.1-r2	1.3.2-r0
Low	GHSA-xpv3-w29h-x7cv	oauthlib@3.3.1	4.0.0
Low	PYSEC-2026-2275	requests@2.32.5	2.33.0
Low	GO-2026-4869	stdlib@go1.25.3	1.25.9
Low	ALPINE-CVE-2026-32777	expat@2.7.4-r0	2.7.5-r0
Low	GO-2026-6599	stdlib@go1.25.3	1.26.9
Low	GO-2026-6600	stdlib@go1.25.3	1.26.9
Low	GO-2026-6617	golang.org/x/net@v0.44.0	0.60.0
Low	GO-2026-6617	stdlib@go1.25.3	1.26.9
Low	ALPINE-CVE-2026-33947	jq@1.8.1-r0	1.8.2-r0
Low	ALPINE-CVE-2025-14017	curl@8.17.0-r1	8.18.0-r0
Low	GHSA-w8rr-5gcm-pp58	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.12.2	0.19.0
Low	GHSA-w8rr-5gcm-pp58	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.39.0	1.43.0
Low	GHSA-w8rr-5gcm-pp58	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.39.0	1.43.0
Low	GHSA-57j5-qwp2-vqp6	github.com/openfga/openfga@v1.11.3	1.14.1
Low	ALPINE-CVE-2026-22795	openssl@3.5.4-r0	3.5.5-r0
Low	ALPINE-CVE-2026-32776	expat@2.7.4-r0	2.7.5-r0
Low	GHSA-wfp6-f47h-hxc3	awscli@1.44.39	1.44.78
Low	ALPINE-CVE-2026-32778	expat@2.7.4-r0	2.7.5-r0
Low	ALPINE-CVE-2026-41256	jq@1.8.1-r0	1.8.2-r0
Low	ALPINE-CVE-2026-45446	openssl@3.5.4-r0	3.5.7-r0
Low	ALPINE-CVE-2026-40612	jq@1.8.1-r0	1.8.2-r0
Low	ALPINE-CVE-2026-44777	jq@1.8.1-r0	1.8.2-r0
Low	ALPINE-CVE-2026-47770	jq@1.8.1-r0	1.8.2-r0
Low	ALPINE-CVE-2026-42770	openssl@3.5.4-r0	3.5.7-r0
Low	GHSA-jp4c-xjxw-mgf9	pip@25.3	26.1
Low	ALPINE-CVE-2026-43894	jq@1.8.1-r0	1.8.2-r0
Low	GHSA-gcjh-h69q-9w9g	github.com/google/cel-go@v0.26.1	0.29.0
Low	ALPINE-CVE-2026-43896	jq@1.8.1-r0	1.8.2-r0
Low	ALPINE-CVE-2026-54679	jq@1.8.1-r0	1.8.2-r0
Low	ALPINE-CVE-2026-41257	jq@1.8.1-r0	1.8.2-r0
Low	GHSA-hj66-6f7g-4r5v	oauthlib@3.3.1	4.0.0
Low	GHSA-vp62-88p7-qqf5	github.com/moby/moby@v28.0.1+incompatible	no fix listed
Low	GHSA-hr2v-4r36-88hr	helm.sh/helm/v4@v4.1.0	4.1.4
Low	GHSA-hr2v-4r36-88hr	helm.sh/helm/v3@v3.19.0	3.20.2
Low	GHSA-xc8m-28vv-4pjc	k8s.io/kubernetes@v1.25.0	1.25.10
Low	GHSA-f9jg-8p32-2f55	k8s.io/kubernetes@v1.25.0	1.26.0-alpha.3
Low	ALPINE-CVE-2026-0864	python3@3.12.12-r0	3.14.7-r0
Low	ALPINE-CVE-2026-56131	expat@2.7.4-r0	2.8.2-r0

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
4.8.0latest	today	5.0.0	53259819	13,598
4.7.0	3 months ago	4.0.12	53259817	13,576

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/apache/pulsar.svg)](https://charts.stackradar.io/charts/apache/pulsar)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.