StackRadar

CVE-2021-38561

High

Advisory

Published 6 Oct 2021In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.014
70th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
664
of 17,787 indexed, latest versions
Container images
682
deployed by those charts
Fix available
1 of 1
affected package

golang.org/x/text/language Out-of-bounds Read vulnerability

Carried by container images the latest versions of 664 of 17,787 indexed charts deploy, on 682 images.

Affected packageAffected versionsFixed inImages
golang.org/x/textgolangv0.3.0, v0.3.1-0.20180807135948-17ff2d5776d2, v0.3.1-0.20181227161524-e6919f6577db, v0.3.2+6 more0.3.7682
OSV records
GHSA-ppp9-7jff-5vj2
Also known as
GO-2021-0113

Charts affected

664 by stars
ChartLatestAffected imagesRadar Score
filebrowserwenerme1.0.01 of 1See more

filebrowser wenerme 1.0.0

1 of the 1 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.13.0c5d0a75a0041
golang.org/x/text@v0.3.2
0.3.7

Open the chart page →

3,174
frpcwenerme1.0.11 of 1See more

frpc wenerme 1.0.1

1 of the 1 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
wener/frpc:v0.37.0cc9fd4da44c0
golang.org/x/text@v0.3.2
0.3.7

Open the chart page →

3,359
longhornwenerme1.2.31 of 2See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
longhornio/longhorn-manager:v1.2.3dca34321452c
golang.org/x/text@v0.3.3
0.3.7

Open the chart page →

15,230
miniowenerme8.0.101 of 1See more

minio wenerme 8.0.10

1 of the 1 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2021-02-14T04-01-33Zbd11edda91f3
golang.org/x/text@v0.3.3
0.3.7

Open the chart page →

6,915
nfs-subdir-external-provisionerwenerme4.0.181 of 1See more

nfs-subdir-external-provisioner wenerme 4.0.18

1 of the 1 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.263d5e04551ec
golang.org/x/text@v0.3.2
0.3.7

Open the chart page →

2,743
temporalwenerme0.15.13 of 13See more

temporal wenerme 0.15.1

3 of the 13 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
grafana/grafana:6.7.11ff3999e0fc0
golang.org/x/text@v0.3.2
0.3.7
prom/alertmanager:v0.20.07e4e9f7a0954
golang.org/x/text@v0.3.2
0.3.7
prom/prometheus:v2.16.0e4ca62c0d62f
golang.org/x/text@v0.3.2
0.3.7

Open the chart page →

22,665
traefikwenerme9.1.11 of 1See more

traefik wenerme 9.1.1

1 of the 1 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
library/traefik:2.2.8f5af5a5ce17f
golang.org/x/text@v0.3.2
0.3.7

Open the chart page →

3,369
wireguardwireguard-bananas1.5.01 of 1See more

wireguard wireguard-bananas 1.5.0

1 of the 1 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
place1/wg-access-server:v0.4.62b2f3ea80ed6
golang.org/x/text@v0.3.3
0.3.7

Open the chart page →

2,745
csi-driver-host-pathwiremindVerified publisher0.1.11 of 8See more

csi-driver-host-path wiremind 0.1.1

1 of the 8 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/hostpathplugin:v1.9.092257881c1d6
golang.org/x/text@v0.3.4
0.3.7

Open the chart page →

12,606
dex-k8s-authenticatorwiremindVerified publisher1.7.01 of 1See more

dex-k8s-authenticator wiremind 1.7.0

1 of the 1 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
mintel/dex-k8s-authenticator:1.4.0caf71cee7b9a
golang.org/x/text@v0.3.0
0.3.7

Open the chart page →

2,791
mrtg-backendwitcom-gmbh0.7.01 of 2See more

mrtg-backend witcom-gmbh 0.7.0

1 of the 2 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
quay.io/oauth2-proxy/oauth2-proxy:v7.2.1febeebebe762
golang.org/x/text@v0.3.3
0.3.7

Open the chart page →

2,616
rawfile-csiymatrixVerified publisher0.2.12 of 4See more

rawfile-csi ymatrix 0.2.1

2 of the 4 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
matrixdb/sig-storage_csi-node-driver-registrar:v2.2.0ba763bb01ddc
golang.org/x/text@v0.3.5
0.3.7
matrixdb/sig-storage_livenessprobe:v2.3.07ab06fe3d8a7
golang.org/x/text@v0.3.5
0.3.7

Open the chart page →

7,972
version-checkerymrs0.2.31 of 1See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
quay.io/jetstack/version-checker:v0.2.15f6f8ba0b671
golang.org/x/text@v0.3.3
0.3.7

Open the chart page →

3,023
zahori-consulzahoriVerified publisher1.0.11 of 2See more

zahori-consul zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2021-38561.

Container imageDigestPackageFixed in
hashicorp/consul-k8s-control-plane:1.1.262bed1bf8106
golang.org/x/text@v0.3.2
0.3.7

Open the chart page →

5,033

Container images carrying it

682 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
keptnsandbox/job-executor-service:0.1.36e6d323dd7ae
golang.org/x/text@v0.3.6
0.3.7
1
keyporttech/csi-driver-nfs:2.0.05bd7955ea2f1
golang.org/x/text@v0.3.1-0.20181227161524-e6919f6577db
0.3.7
1
kfserving/kfserving-controller:v0.6.163d79d04c2e3
golang.org/x/text@v0.3.3
0.3.7
1
kiosksh/kiosk:0.2.11501725ba2025
golang.org/x/text@v0.3.4
0.3.7
1
kubebb/kube-oidc-proxy-ce:v0.3.0-2022100858d5efec568b
golang.org/x/text@v0.3.6
0.3.7
1
kubebb/resource-viewer:v0.2.065bb40b353db
golang.org/x/text@v0.3.6
0.3.7
1
kubedb/kubedb-enterprise:v0.11.05829bcedcb0d
golang.org/x/text@v0.3.6
0.3.7
1
kubedb/operator:v0.24.01a06ff0bda52
golang.org/x/text@v0.3.6
0.3.7
1
kubeflowkatib/katib-controller:v0.12.012a28c8a0b41
golang.org/x/text@v0.3.5
0.3.7
1
kubeflowkatib/katib-db-manager:v0.12.0db88bf09d88e
golang.org/x/text@v0.3.5
0.3.7
1
kubeflowkatib/katib-ui:v0.12.0129f0aaba976
golang.org/x/text@v0.3.5
0.3.7
1
kubeflownotebookswg/kfam:v1.6.1f226fb44db57
golang.org/x/text@v0.3.5
0.3.7
1
kubemod/kubemod:v0.19.11f8154f7e80c
golang.org/x/text@v0.3.3
0.3.7
1
kubemod/kubemod:v0.13.0cadca39288ad
golang.org/x/text@v0.3.3
0.3.7
1
kubemod/kubemod-crt:v1.3.0028347c9fa77
golang.org/x/text@v0.3.6
0.3.7
1
kubeoperator/webkubectl:v2.4.0be8f0d624640
golang.org/x/text@v0.3.2
0.3.7
1
kubesphere/fluentbit-operator:v0.9.0b87db3c57cb3
golang.org/x/text@v0.3.2
0.3.7
1
kubesphere/openelb:v0.5.0b5b665c4672c
golang.org/x/text@v0.3.2
0.3.7
1
kubesphere/openelb:v0.4.4ed7311a0f9e4
golang.org/x/text@v0.3.2
0.3.7
1
kubesphere/porter:v0.4.38d1ed5ee1d2e
golang.org/x/text@v0.3.2
0.3.7
1
kubesphere/pvc-autoresizer:v0.19a18a16c7b87
golang.org/x/text@v0.3.6
0.3.7
1
kubesphere/storageclass-accessor:v0.1.1eac8f273a9b6
golang.org/x/text@v0.3.6
0.3.7
1
kudobuilder/controller:v0.9.069072d979708
golang.org/x/text@v0.3.2
0.3.7
1
kvalitetsit/metadoc-app:maine89e351733ad
golang.org/x/text@v0.3.6
0.3.7
1
kvalitetsit/metadoc-web:mainf57e7553f5bd
golang.org/x/text@v0.3.6
0.3.7
1
layer5/meshery-cpx:stable-latest8c20a8a1d6a4
golang.org/x/text@v0.3.0
0.3.7
1
layer5/meshery-nsm:stable-latestebd6a8faf21f
golang.org/x/text@v0.3.3
0.3.7
1
library/caddy:2.2.0-alpine7367adca165f
golang.org/x/text@v0.3.2
0.3.7
1
library/caddy:2.4.5874405536b3e
golang.org/x/text@v0.3.6
0.3.7
1
library/caddy:2.4.2-alpinefbc51bcf1ab0
golang.org/x/text@v0.3.6
0.3.7
1
library/chronograf:1.9.496d8a3f65a4f
golang.org/x/text@v0.3.6
0.3.7
1
library/influxdb:2.0.8ba10ac9ba17a
golang.org/x/text@v0.3.5
0.3.7
1
library/influxdb:2.3.0-alpined7f5dd5f70e2
golang.org/x/text@v0.3.3
0.3.7
1
library/kapacitor:1.6.37232f6388a4d
golang.org/x/text@v0.3.5
0.3.7
1
library/mongo:4.4.1305678ae4e5e1
golang.org/x/text@v0.3.5
0.3.7
1
library/mongo:4.4-bionic3d0e6df9fd5b
golang.org/x/text@v0.3.5
0.3.7
1
library/telegraf:1.19.0-alpine794079a7f241
golang.org/x/text@v0.3.4
0.3.7
1
library/telegraf:1.19-alpineaddb86c0c520
golang.org/x/text@v0.3.6
0.3.7
1
library/traefik:2.5.62f603f8d3abe
golang.org/x/text@v0.3.6
0.3.7
1
library/traefik:2.5.47d0228d19042
golang.org/x/text@v0.3.6
0.3.7
1
library/traefik:2.4.8eda951fd29a8
golang.org/x/text@v0.3.4
0.3.7
1
library/traefik:2.2.8f5af5a5ce17f
golang.org/x/text@v0.3.2
0.3.7
1
linuxserver/calibre-web:0.6.24241009026e6f
golang.org/x/text@v0.3.6
0.3.7
1
linuxserver/calibre-web:version-0.6.12938810eca3d3
golang.org/x/text@v0.3.6
0.3.7
1
lmierzwa/karma:v0.503751e5eed656
golang.org/x/text@v0.3.2
0.3.7
1
lmierzwa/karma:v0.70d417abe7ddb5
golang.org/x/text@v0.3.3
0.3.7
1
loftsh/directclusterendpoint:1.14.0310cc7d690f5
golang.org/x/text@v0.3.6
0.3.7
1
loftsh/virtual-cluster:0.0.28023b13bf5898
golang.org/x/text@v0.3.4
0.3.7
1
logiqai/flash-discovery:v2.0.3f5b551bca98e
golang.org/x/text@v0.3.2
0.3.7
1
logiqai/logiqctl:2.0.4798306811f2d
golang.org/x/text@v0.3.2
0.3.7
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.