StackRadar

CVE-2025-61726

High

Advisory

Published 28 Jan 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.022
82nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
3,686
of 17,837 indexed, latest versions
Container images
4,137
deployed by those charts
Fix available
2 of 3
affected packages

Red Hat Security Advisory: go-rpm-macros security update

Carried by container images the latest versions of 3,686 of 17,837 indexed charts deploy, on 4,137 images.

Affected packageAffected versionsFixed inImages
go-rpm-macrosrpm3.2.0-3.el90:3.6.0-13.el9_73
golang-1.19deb1.19.8-2no fix listed1
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+173 more1.24.124,135
OSV records
DEBIAN-CVE-2025-61726RHSA-2026:3668RLSA-2026:3668GO-2026-4341
Also known as
BIT-golang-2025-61726

Charts affected

3,686 by stars
ChartLatestAffected imagesRadar Score

Container images carrying it

4,137 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/parmincloud/arvancloud-certmanager-issuer:v1.0.00b97452674a3
stdlib@go1.25.4
1.24.12
1
ghcr.io/patricklaabs/sample-application:0.0.1f0935fa2eee3
stdlib@go1.22.0
1.24.12
1
ghcr.io/pbufio/registry:v0.4.177a36c035b4b
stdlib@go1.25.5
1.24.12
1
ghcr.io/peak-scale/observability-tenancy/cortex-proxy:0.4.11838720c13b2
stdlib@go1.24.6
1.24.12
1
ghcr.io/peak-scale/observability-tenancy/loki-proxy:0.4.1548e962d0061
stdlib@go1.24.6
1.24.12
1
ghcr.io/peimanja/artifactory_exporter:v1.16.0d3e3929a3d2b
stdlib@go1.21.13
1.24.12
1
ghcr.io/perceptolab/devops-demo-app:0.0.2cdc0658c40fb
stdlib@go1.18.4
1.24.12
1
ghcr.io/permify/permify:v1.3.5f0c6f7d7daa6
stdlib@go1.22.4
1.24.12
1
ghcr.io/pipe-cd/pipecd:v0.39.00fae829caf29
stdlib@go1.14.6
1.24.12
1
ghcr.io/podtato-head/entry:latestc3d9d9c98be7
stdlib@go1.19
1.24.12
1
ghcr.io/podtato-head/hat:latestde37ff39a4c0
stdlib@go1.19
1.24.12
1
ghcr.io/podtato-head/left-arm:latest97596c95276a
stdlib@go1.19
1.24.12
1
ghcr.io/podtato-head/left-leg:latest00bb31622b1e
stdlib@go1.19
1.24.12
1
ghcr.io/podtato-head/right-arm:latest5f8f97a60558
stdlib@go1.19
1.24.12
1
ghcr.io/podtato-head/right-leg:latest03e125b9279e
stdlib@go1.19
1.24.12
1
ghcr.io/predicatelabs/operator:v1.0.5b62113fe1b27
stdlib@go1.23.5
1.24.12
1
ghcr.io/privacyengineering/collector-go:main7217f1a4fa28
stdlib@go1.17.13
1.24.12
1
ghcr.io/privacyengineering/consumer:main73f59c032812
stdlib@go1.17.13
1.24.12
1
ghcr.io/privacyengineering/hawk-service:latestbfedf47bb5e0
stdlib@go1.20.11
1.24.12
1
ghcr.io/projectcapsule/capsule-addon-fluxcd:0.2.2e0baf564b706
stdlib@go1.23.4
1.24.12
1
ghcr.io/projectcontour/contour:v1.30.0b12824d7eb58
stdlib@go1.22.5
1.24.12
1
ghcr.io/projectcontour/contour:v1.33.0cd6e13fa882d
stdlib@go1.25.1
1.24.12
1
ghcr.io/prymitive/karma:v0.85d06892218680
stdlib@go1.16.3
1.24.12
1
ghcr.io/pschichtel/cert-manager-webhook-cloudns:1.1.01020638bbe23
stdlib@go1.21.6
1.24.12
1
ghcr.io/puckpuck/seashell:1.2ef5e31333821
stdlib@go1.20.10
1.24.12
1
ghcr.io/pulumi/pulumi-esc-csi-provider:0.1.13fb058e93502
stdlib@go1.23.1
1.24.12
1
ghcr.io/punchplatform/operator:8.1-dev2a9536c8cee2
stdlib@go1.22.0
1.24.12
1
ghcr.io/pyrra-dev/pyrra:v0.8.10e02ef538ef0
stdlib@go1.23.3
1.24.12
1
ghcr.io/rabbitmq/cluster-operator:2.17.25d690e6cd856
stdlib@go1.25.4
1.24.12
1
ghcr.io/raffis/mongodb-query-exporter:v5.1.0ca6ac8a5b329
stdlib@go1.20.5
1.24.12
1
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
stdlib@go1.20.7
1.24.12
1
ghcr.io/reiche-world/traefik-secrets-exporter:0.0.21485ff93cbf9
stdlib@go1.25.5
1.24.12
1
ghcr.io/riesinger/plausible-exporter:1.1.061112cda1be5
stdlib@go1.19.7
1.24.12
1
ghcr.io/riotkit-org/backup-maker-controller:v0.1.262370545ba3d
stdlib@go1.19.4
1.24.12
1
ghcr.io/riotkit-org/backup-repository:v4.0.0ab41ffa78f69
stdlib@go1.17.13
1.24.12
1
ghcr.io/riotkit-org/waf-proxy:snapshot683656fdace2
stdlib@go1.18.3
1.24.12
1
ghcr.io/riotkit-org/wordpress-hardened:v2.0edc6b69873be
stdlib@go1.17.9
1.24.12
1
ghcr.io/riverqueue/riverui:0.5.32dc54179b25a
stdlib@go1.23.0
1.24.12
1
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
stdlib@go1.20.7
1.24.12
1
ghcr.io/sagernet/sing-box:v1.12.03c1ee82d450d
stdlib@go1.24.5
1.24.12
1
ghcr.io/salaboy/fmtok8s-email-service:v0.2.0-nativeb52d5dbac2ca
stdlib@go1.17.11
1.24.12
1
ghcr.io/salaboy/fmtok8s-email-service:v0.1.0-nativecf28472bc460
stdlib@go1.17.11
1.24.12
1
ghcr.io/salesforce/kubelet-summary-exporter:sha-c2bf90d377e09d2dd72
stdlib@go1.18.10
1.24.12
1
ghcr.io/salesforce/sloop:sha-2ce8bbe119e24f24b1d
stdlib@go1.16.15
1.24.12
1
ghcr.io/samr037/node-debug-dashboard:0.3.0c79b2e64a211
stdlib@go1.23.3
1.24.12
1
ghcr.io/sapcc/ntp_exporter:v2.9.079c40c65f5d4
stdlib@go1.24.6
1.24.12
1
ghcr.io/schaka/janitorr:native-stable7cfe1e0c41da
stdlib@go1.24.6
1.24.12
1
ghcr.io/schmitzis/cert-manager-webhook-bunny:latest125e31c8e85a
stdlib@go1.19.13
1.24.12
1
ghcr.io/seanmorley15/adventurelog-frontend:v0.13.051ee22428b41
stdlib@go1.23.12
1.24.12
1
ghcr.io/sergelogvinov/hybrid-csi-provisioner:v0.3.1221e07794a8a
stdlib@go1.25.5
1.24.12
1

syft 1.42.1 · advisories as of 23 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.