fulcio 2.11.3 Helm chart

Name: fulcio Helm chart 2.11.3: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

sigstore

Scored 6 Oct 2026

Fulcio is a free code signing Certificate Authority, built to make short-lived certificates available to anyone.

Version 2.11.3 todayapp version 1.9.0 3Artifact Hub

fulcio 2.11.3 deploys 6 container images: ghcr.io/sigstore/scaffolding/ct_server, ghcr.io/sigstore/fulcio, curlimages/curl, ghcr.io/sigstore/scaffolding/createctconfig and 2 more. Across them, 370 findings — 1 critical, 0 high. The highest contribution is ALPINE-CVE-2025-15467 in openssl 3.5.4-r0, fixed in 3.5.5-r0.

Radar Score

4,5381081288

370 findings over 6 of 6 images measured

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

6 images

Image	Tag	Vulnerabilities	Radar Score
ghcr.io/sigstore/scaffolding/ct_server	v0.7.31	002171	1,107
ghcr.io/sigstore/fulcio	v1.9.0	0011	20
curlimages/curl	8.17.0	102132	772
ghcr.io/sigstore/scaffolding/createctconfig	v0.7.31	001669	1,017
ghcr.io/sigstore/scaffolding/createtree	v0.7.31	00952	721
ghcr.io/sigstore/scaffolding/createcerts	digest-pinned	001363	901

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

151 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	ALPINE-CVE-2026-42767	openssl@3.5.4-r0	3.5.7-r0
Low	ALPINE-CVE-2026-22796	openssl@3.5.4-r0	3.5.5-r0
Low	GHSA-j5w8-q4qc-rx2x	golang.org/x/crypto@v0.43.0	0.45.0
Low	GO-2025-4011	stdlib@go1.25.0	1.24.8
Low	GO-2025-4015	stdlib@go1.25.0	1.24.8
Low	GO-2026-4603	stdlib@go1.25.0	1.25.8
Low	GO-2025-4175	stdlib@go1.25.0	1.24.11
Low	GHSA-qc2q-p7wx-3px3	google.golang.org/grpc@v1.76.0	1.83.1
Low	GHSA-fcv2-xgw5-pqxf	github.com/sigstore/sigstore@v1.9.6-0.20250729224751-181c5d3339b3	1.10.4
Low	GHSA-qpw4-5x99-6vjp	golang.org/x/crypto@v0.43.0	0.52.0
Low	GHSA-9m57-25v3-79x9	golang.org/x/crypto@v0.43.0	0.52.0
Low	GO-2026-4864	stdlib@go1.25.0	1.25.9
Low	GHSA-f6x5-jh6r-wrfv	golang.org/x/crypto@v0.43.0	0.45.0
Low	GO-2026-4865	stdlib@go1.25.0	1.25.9
Low	GO-2026-4982	stdlib@go1.25.0	1.25.10
Low	GO-2026-5025	golang.org/x/net@v0.46.0	0.55.0
Low	ALPINE-CVE-2026-34181	openssl@3.5.4-r0	3.5.7-r0
Low	GHSA-vffh-x6r8-xx99	github.com/prometheus/prometheus@v0.51.0	0.311.2-0.20260410083055-07c6232d159b
Low	GO-2026-6091	stdlib@go1.25.0	1.25.13
Low	GO-2025-4008	stdlib@go1.25.0	1.24.8
Low	GO-2025-4010	stdlib@go1.25.0	1.24.8
Low	GHSA-hrxh-6v49-42gf	google.golang.org/grpc@v1.76.0	1.82.1
Low	GO-2026-4976	stdlib@go1.25.0	1.25.10
Low	GO-2026-5039	stdlib@go1.25.0	1.25.11
Low	GO-2022-0646	github.com/aws/aws-sdk-go@v1.55.8	no fix listed
Low	GO-2026-5856	stdlib@go1.25.0	1.25.12
Low	GHSA-fw8g-cg8f-9j28	github.com/prometheus/prometheus@v0.51.0	0.311.3
Low	GO-2025-3955	stdlib@go1.25.0	1.25.1
Low	GO-2026-5027	golang.org/x/net@v0.46.0	0.55.0
Low	GO-2026-5029	golang.org/x/net@v0.46.0	0.55.0
Low	GO-2026-5030	golang.org/x/net@v0.46.0	0.55.0
Low	GO-2026-4340	stdlib@go1.25.0	1.24.12
Low	GHSA-59jp-pj84-45mr	github.com/sigstore/fulcio@v1.7.1	1.8.5
Low	ALPINE-CVE-2026-42769	openssl@3.5.4-r0	3.5.7-r0
Low	ALPINE-CVE-2025-15469	openssl@3.5.4-r0	3.5.5-r0
Low	ALPINE-CVE-2026-27171	zlib@1.3.1-r2	1.3.2-r0
Low	GO-2026-4869	stdlib@go1.25.0	1.25.9
Low	ALPINE-CVE-2026-22795	openssl@3.5.4-r0	3.5.5-r0
Low	ALPINE-CVE-2026-45446	openssl@3.5.4-r0	3.5.7-r0
Low	ALPINE-CVE-2025-68160	openssl@3.5.4-r0	3.5.5-r0
Low	ALPINE-CVE-2026-6042	musl@1.2.5-r10	1.2.5-r11
Low	ALPINE-CVE-2026-42768	openssl@3.5.4-r0	3.5.7-r0
Low	ALPINE-CVE-2026-42770	openssl@3.5.4-r0	3.5.7-r0
Low	ALPINE-CVE-2025-69418	openssl@3.5.4-r0	3.5.5-r0
Low	ALPINE-CVE-2025-46394	busybox@1.37.0-r19	1.37.0-r20
Low	GO-2026-5932	golang.org/x/crypto@v0.57.0	no fix listed
Low	GHSA-j88v-2chj-qfwx	github.com/jackc/pgx/v5@v5.7.5	5.9.2
Low	GO-2026-5024	golang.org/x/sys@v0.37.0	0.44.0
Low	GO-2022-0635	github.com/aws/aws-sdk-go@v1.55.8	no fix listed
Low	ALPINE-CVE-2024-58251	busybox@1.37.0-r19	1.37.0-r20

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
2.11.3latest	today	1.9.0	1081288	4,538
2.11.2	9 days ago	1.8.8	1083306	4,756
2.11.1	1 month ago	1.8.8	1083306	4,756

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/sigstore/fulcio.svg)](https://charts.stackradar.io/charts/sigstore/fulcio)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.