StackRadar

CVE-2021-38561

High

Advisory

Published 6 Oct 2021In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.014
70th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
666
of 17,787 indexed, latest versions
Container images
684
deployed by those charts
Fix available
1 of 1
affected package

golang.org/x/text/language Out-of-bounds Read vulnerability

Carried by container images the latest versions of 666 of 17,787 indexed charts deploy, on 684 images.

Affected packageAffected versionsFixed inImages
golang.org/x/textgolangv0.3.0, v0.3.1-0.20180807135948-17ff2d5776d2, v0.3.1-0.20181227161524-e6919f6577db, v0.3.2+6 more0.3.7684
OSV records
GHSA-ppp9-7jff-5vj2
Also known as
GO-2021-0113

Charts affected

666 by stars
ChartLatestAffected imagesRadar Score
athens-proxywenerme0.5.21 of 2See more

athens-proxy wenerme 0.5.2

1 of the 2 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
gomods/athens:v0.11.0efb811df7844
golang.org/x/text@v0.3.0
0.3.7

Open the chart page →

4,985
cadencewenerme0.23.01 of 5See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
ubercadence/server:0.23.22ac5491d13bb
golang.org/x/text@v0.3.4
0.3.7

Open the chart page →

10,127
filebrowserwenerme1.0.01 of 1See more

filebrowser wenerme 1.0.0

1 of the 1 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.13.0c5d0a75a0041
golang.org/x/text@v0.3.2
0.3.7

Open the chart page →

3,174
frpcwenerme1.0.11 of 1See more

frpc wenerme 1.0.1

1 of the 1 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
wener/frpc:v0.37.0cc9fd4da44c0
golang.org/x/text@v0.3.2
0.3.7

Open the chart page →

3,359
longhornwenerme1.2.31 of 2See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
longhornio/longhorn-manager:v1.2.3dca34321452c
golang.org/x/text@v0.3.3
0.3.7

Open the chart page →

15,287
miniowenerme8.0.101 of 1See more

minio wenerme 8.0.10

1 of the 1 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2021-02-14T04-01-33Zbd11edda91f3
golang.org/x/text@v0.3.3
0.3.7

Open the chart page →

6,915
nfs-subdir-external-provisionerwenerme4.0.181 of 1See more

nfs-subdir-external-provisioner wenerme 4.0.18

1 of the 1 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.263d5e04551ec
golang.org/x/text@v0.3.2
0.3.7

Open the chart page →

2,745
temporalwenerme0.15.13 of 13See more

temporal wenerme 0.15.1

3 of the 13 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
grafana/grafana:6.7.11ff3999e0fc0
golang.org/x/text@v0.3.2
0.3.7
prom/alertmanager:v0.20.07e4e9f7a0954
golang.org/x/text@v0.3.2
0.3.7
prom/prometheus:v2.16.0e4ca62c0d62f
golang.org/x/text@v0.3.2
0.3.7

Open the chart page →

22,665
traefikwenerme9.1.11 of 1See more

traefik wenerme 9.1.1

1 of the 1 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
library/traefik:2.2.8f5af5a5ce17f
golang.org/x/text@v0.3.2
0.3.7

Open the chart page →

3,369
wireguardwireguard-bananas1.5.01 of 1See more

wireguard wireguard-bananas 1.5.0

1 of the 1 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
place1/wg-access-server:v0.4.62b2f3ea80ed6
golang.org/x/text@v0.3.3
0.3.7

Open the chart page →

2,745
csi-driver-host-pathwiremindVerified publisher0.1.11 of 8See more

csi-driver-host-path wiremind 0.1.1

1 of the 8 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/hostpathplugin:v1.9.092257881c1d6
golang.org/x/text@v0.3.4
0.3.7

Open the chart page →

12,607
dex-k8s-authenticatorwiremindVerified publisher1.7.01 of 1See more

dex-k8s-authenticator wiremind 1.7.0

1 of the 1 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
mintel/dex-k8s-authenticator:1.4.0caf71cee7b9a
golang.org/x/text@v0.3.0
0.3.7

Open the chart page →

2,791
mrtg-backendwitcom-gmbh0.7.01 of 2See more

mrtg-backend witcom-gmbh 0.7.0

1 of the 2 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
quay.io/oauth2-proxy/oauth2-proxy:v7.2.1febeebebe762
golang.org/x/text@v0.3.3
0.3.7

Open the chart page →

2,616
rawfile-csiymatrixVerified publisher0.2.12 of 4See more

rawfile-csi ymatrix 0.2.1

2 of the 4 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
matrixdb/sig-storage_csi-node-driver-registrar:v2.2.0ba763bb01ddc
golang.org/x/text@v0.3.5
0.3.7
matrixdb/sig-storage_livenessprobe:v2.3.07ab06fe3d8a7
golang.org/x/text@v0.3.5
0.3.7

Open the chart page →

7,972
version-checkerymrs0.2.31 of 1See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
quay.io/jetstack/version-checker:v0.2.15f6f8ba0b671
golang.org/x/text@v0.3.3
0.3.7

Open the chart page →

3,023
zahori-consulzahoriVerified publisher1.0.11 of 2See more

zahori-consul zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
hashicorp/consul-k8s-control-plane:1.1.262bed1bf8106
golang.org/x/text@v0.3.2
0.3.7

Open the chart page →

5,033

Container images carrying it

684 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
golang.org/x/text@v0.3.6
0.3.7
1
ghcr.io/luisico/cert-manager-webhook-infoblox-wapi:1.5ded797477896
golang.org/x/text@v0.3.5
0.3.7
1
ghcr.io/melodyyangaws/hive-metastore:3.0.0e949b0f733f0
golang.org/x/text@v0.3.2
0.3.7
1
ghcr.io/mmontes11/echoperator:v0.0.4a544a71c6e3b
golang.org/x/text@v0.3.4
0.3.7
1
ghcr.io/mvisonneau/approuvez:v0.1.0441da62e6cb3
golang.org/x/text@v0.3.0
0.3.7
1
ghcr.io/netsoc/iamd:1.1.22fe6b69b20d7
golang.org/x/text@v0.3.6
0.3.7
1
ghcr.io/netsoc/shhd:0.1.60bb44992b62c
golang.org/x/text@v0.3.5
0.3.7
1
ghcr.io/netsoc/webspaced:0.5.1edc238a538a0
golang.org/x/text@v0.3.6
0.3.7
1
ghcr.io/nimbolus/k8s-openstack-node-upgrade-agent:0.1.0e0c7cf2415f0
golang.org/x/text@v0.3.6
0.3.7
1
ghcr.io/paganuzzi/ngrokoperator:latest5a10cd095699
golang.org/x/text@v0.3.2
0.3.7
1
ghcr.io/pipe-cd/pipecd:v0.39.00fae829caf29
golang.org/x/text@v0.3.2
0.3.7
1
ghcr.io/prymitive/karma:v0.85d06892218680
golang.org/x/text@v0.3.6
0.3.7
1
ghcr.io/salesforce/sloop:sha-2ce8bbe119e24f24b1d
golang.org/x/text@v0.3.2
0.3.7
1
ghcr.io/sergelogvinov/postgresql:16.15fafb72e98f22
golang.org/x/text@v0.3.3
0.3.7
1
ghcr.io/snapp-incubator/health-exporter:0.3.252a0d8f6278c
golang.org/x/text@v0.3.6
0.3.7
1
ghcr.io/stashed/stash-enterprise:v0.32.0e9bde36e34b7
golang.org/x/text@v0.3.6
0.3.7
1
ghcr.io/stefanprodan/podinfo:6.1.3f25ebb9c6788
golang.org/x/text@v0.3.6
0.3.7
1
ghcr.io/substra/fabric-peer:0.2.4f681e0343a31
golang.org/x/text@v0.3.3
0.3.7
1
ghcr.io/substra/fabric-tools:0.2.43491a0f31c4a
golang.org/x/text@v0.3.3
0.3.7
1
ghcr.io/wittdennis/calibre-web:1.1.1aa7d5d5dd6be
golang.org/x/text@v0.3.6
0.3.7
1
mcr.microsoft.com/k8s/csi/azuredisk-csi:v1.1.1ec1803037ed9
golang.org/x/text@v0.3.4
0.3.7
1
mcr.microsoft.com/oss/kubernetes-csi/csi-attacher:v2.2.0f55f30876129
golang.org/x/text@v0.3.2
0.3.7
1
mcr.microsoft.com/oss/kubernetes-csi/csi-node-driver-registrar:v2.0.1fc5d14e9f26f
golang.org/x/text@v0.3.3
0.3.7
1
mcr.microsoft.com/oss/kubernetes-csi/csi-provisioner:v1.6.1667b1b1ea1e4
golang.org/x/text@v0.3.2
0.3.7
1
mcr.microsoft.com/oss/kubernetes-csi/csi-resizer:v1.1.07997e0f236bc
golang.org/x/text@v0.3.4
0.3.7
1
mcr.microsoft.com/oss/kubernetes-csi/livenessprobe:v2.2.0b7d82802cca8
golang.org/x/text@v0.3.4
0.3.7
1
public.ecr.aws/aws-ec2/amazon-ec2-metadata-mock:v1.11.2dd02d3569da0
golang.org/x/text@v0.3.6
0.3.7
1
public.ecr.aws/aws-observability/aws-sigv4-proxy-admission-controller:1.067b89ae52240
golang.org/x/text@v0.3.3
0.3.7
1
public.ecr.aws/aws-secrets-manager/secrets-store-csi-driver-provider-aws:1.0.r2-2021.08.13.20.34-linux-amd6402aed3370fce
golang.org/x/text@v0.3.4
0.3.7
1
public.ecr.aws/aws-secrets-manager/secrets-store-csi-driver-provider-aws:1.0.r1-10-g1942553-2021.06.04.00.07-linux-amd64b32c99e7bc45
golang.org/x/text@v0.3.3
0.3.7
1
public.ecr.aws/j1r0q0g6/notebooks/notebook-controller:v1.4cac3ed9a9826
golang.org/x/text@v0.3.2
0.3.7
1
public.ecr.aws/j1r0q0g6/training/training-operator:760ac1171dd30039a7363ffa03c77454bd714da5ae59d222fd87
golang.org/x/text@v0.3.5
0.3.7
1
public.ecr.aws/spotinst/spot-network-client:1.0.0-8-lb_endpoint-d0ec127efcecf98b912
golang.org/x/text@v0.3.6
0.3.7
1
quay.io/argoproj/argocd:v2.4.115b6701d8fb31
golang.org/x/text@v0.3.4
0.3.7
1
quay.io/backube/scribe:0.2.0cdefc81c6b2e
golang.org/x/text@v0.3.4
0.3.7
1
quay.io/cloudnativetoolkit/cli-tools:v1.1-v1.8.2d6fd2a9e3273
golang.org/x/text@v0.3.6
0.3.7
1
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
golang.org/x/text@v0.3.4
0.3.7
1
quay.io/cortexproject/cortex:v1.9.05d1c2cf4c538
golang.org/x/text@v0.3.5
0.3.7
1
quay.io/ddn/exascaler-csi-file-driver:v2.2.6fe2e2e5a2751
golang.org/x/text@v0.3.2
0.3.7
1
quay.io/eformat/jenkins-agent-graalvm:latesta3b9a07648b6
golang.org/x/text@v0.3.5
0.3.7
1
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
golang.org/x/text@v0.3.5
0.3.7
1
quay.io/icdh/core-dump-handler:v9.0.0cc79b9e2a1c8
golang.org/x/text@v0.3.6
0.3.7
1
quay.io/influxdb/chronograf:1.9.4bb0a980bc2bf
golang.org/x/text@v0.3.6
0.3.7
1
quay.io/influxdb/chronograf:1.9.3c2ed16080689
golang.org/x/text@v0.3.6
0.3.7
1
quay.io/jenkins-kubernetes-operator/operator:v0.8.171cb50263c3b
golang.org/x/text@v0.3.4
0.3.7
1
quay.io/jetstack/kube-oidc-proxy:v0.3.0e045b26eb6df
golang.org/x/text@v0.3.2
0.3.7
1
quay.io/keycloak/keycloak-operator:19.0.3-legacy09d52508fee9
golang.org/x/text@v0.3.4
0.3.7
1
quay.io/keycloak/keycloak-operator:19.0.2-legacy15fa0ed662b1
golang.org/x/text@v0.3.4
0.3.7
1
quay.io/keycloak/keycloak-operator:18.0.0-legacy36ce77526145
golang.org/x/text@v0.3.4
0.3.7
1
quay.io/kube-ops/loki:2.2.14fbd63194674
golang.org/x/text@v0.3.4
0.3.7
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.