CVE-2026-100348
MediumAdvisory
Published 15 Oct 2026In the index since 16 Oct 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 166
- of 18,137 indexed, latest versions
- Container images
- 132
- deployed by those charts
- Fix available
- 1 of 1
- affected package
kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)
Carried by container images the latest versions of 166 of 18,137 indexed charts deploy, on 132 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| github.com/ | v0.33.0, v0.53.0, v0.61.0, v0.66.0+28 more | 0.145.0 | 132 |
- OSV records
- GHSA-mh7x-f8wq-4jhx
Charts affected
166 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| stunner-prometheusstunner | 0.2.1 | 1 of 4See more | 4,389 |
| surogate-hubsurogate-hubVerified publisher | 2.1.5 | 1 of 1See more | 4,412 |
| grafanasvtech-public-helm-charts | 1.0.0 | 1 of 2See more | 12,661 |
| monitoringthl-chartsVerified publisher | 0.1.1 | 1 of 10See more | 28,276 |
| todolist-charttodolist-chart | 0.1.7 | 1 of 10See more | 8,372 |
| truefoundry-monitoringtruefoundryVerified publisher | 0.1.6 | 1 of 8See more | 6,532 |
| typhoontyphoonVerified publisher | 0.2.3 | 2 of 2See more | 2,818 |
| unlaunla | 0.10.0 | 1 of 3See more | 11,172 |
| wallarm-node-nextwallarmVerified publisher | 0.5.3 | 2 of 2See more | 3,766 |
| kube-prometheus-stackwener | 92.9.0 | 1 of 6See more | 1,504 |
| mesherywener | 1.0.71 | 1 of 1See more | 1,943 |
| victoria-metrics-k8s-stackwener | 0.96.0 | 1 of 7See more | 1,740 |
| mesherywenerme | 1.0.71 | 1 of 1See more | 1,943 |
| victoria-metrics-k8s-stackwenerme | 0.96.0 | 1 of 7See more | 1,740 |
| ygdrassil-monitoringygdrassilVerified publisher | 0.4.0 | 1 of 10See more | 13,875 |
| prometheus-monitoring-stackyotron-helm-charts | 1.2.0 | 1 of 3See more | 904 |
Container images carrying it
132 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| grafana/ | 7cb8c64c4d57 | github.com/ | 0.145.0 | 1 |
| grafana/ | 8640e5038e83 | github.com/ | 0.145.0 | 1 |
| grafana/ | 8b37a2f028f1 | github.com/ | 0.145.0 | 1 |
| grafana/ | 9746858c20e6 | github.com/ | 0.145.0 | 1 |
| grafana/ | a1701c218024 | github.com/ | 0.145.0 | 1 |
| grafana/ | a738d0744784 | github.com/ | 0.145.0 | 1 |
| grafana/ | a9043254ba16 | github.com/ | 0.145.0 | 1 |
| grafana/ | ab5cb380e3ff | github.com/ | 0.145.0 | 1 |
| grafana/ | b23b588cf7cb | github.com/ | 0.145.0 | 1 |
| grafana/ | b5b59bfc7561 | github.com/ | 0.145.0 | 1 |
| grafana/ | ba93c9d192e5 | github.com/ | 0.145.0 | 1 |
| grafana/ | e5a9655dabef | github.com/ | 0.145.0 | 1 |
| grafana/ | ecc1b80b8ca2 | github.com/ | 0.145.0 | 1 |
| grafana/ | f9811e4e687f | github.com/ | 0.145.0 | 1 |
| grafana/ | fa801ab6e1ae | github.com/ | 0.145.0 | 1 |
| grafana/ | 09d8c3ce4f3a | github.com/ | 0.145.0 | 1 |
| haproxytech/ | 14e4afa90dfd | github.com/ | 0.145.0 | 1 |
| haproxytech/ | 7f3dc8c7e031 | github.com/ | 0.145.0 | 1 |
| haproxytech/ | 8951be4b4e1c | github.com/ | 0.145.0 | 1 |
| hfoxy4/ | 0bfb65aaad93 | github.com/ | 0.145.0 | 1 |
| hfoxy4/ | 0761fe08f14c | github.com/ | 0.145.0 | 1 |
| hiversh/ | 0e36d98402bc | github.com/ | 0.145.0 | 1 |
| hiversh/ | b5048c6342ce | github.com/ | 0.145.0 | 1 |
| hiversh/ | 2fbf9f264498 | github.com/ | 0.145.0 | 1 |
| hiversh/ | 4f43130f51e5 | github.com/ | 0.145.0 | 1 |
| hiversh/ | b0b85f8942c7 | github.com/ | 0.145.0 | 1 |
| hiversh/ | 50c07b84f298 | github.com/ | 0.145.0 | 1 |
| hiversh/ | 836a37641941 | github.com/ | 0.145.0 | 1 |
| hiversh/ | 958b7ebb4eb4 | github.com/ | 0.145.0 | 1 |
| hiversh/ | 63a5ae179a9f | github.com/ | 0.145.0 | 1 |
| intel/ | 3426deb77337 | github.com/ | 0.145.0 | 1 |
| jkaninda/ | 8cfda26ecb7d | github.com/ | 0.145.0 | 1 |
| junktext/ | a70936c04aed | github.com/ | 0.145.0 | 1 |
| kubeshop/ | 8b5bfd57a3ce | github.com/ | 0.145.0 | 1 |
| kubeshop/ | 126c713cf7d8 | github.com/ | 0.145.0 | 1 |
| kvalitetsit/ | f57e7553f5bd | github.com/ | 0.145.0 | 1 |
| l7mp/ | 0ea40a1d42d5 | github.com/ | 0.145.0 | 1 |
| l7mp/ | c34f7c931491 | github.com/ | 0.145.0 | 1 |
| l7mp/ | 4383766e66c5 | github.com/ | 0.145.0 | 1 |
| mongodb/ | cfe202a2a076 | github.com/ | 0.145.0 | 1 |
| muonsoft/ | c9afe1295484 | github.com/ | 0.145.0 | 1 |
| novosga/ | 9957d44343db | github.com/ | 0.145.0 | 1 |
| oamdev/ | 95fa412c934e | github.com/ | 0.145.0 | 1 |
| percona/ | 003f9c25f842 | github.com/ | 0.145.0 | 1 |
| projectdiscovery/ | d76713284ad0 | github.com/ | 0.145.0 | 1 |
| scholtz2/ | f12ce1cfb72e | github.com/ | 0.145.0 | 1 |
| scholtz2/ | 5aaa5d4ab8b8 | github.com/ | 0.145.0 | 1 |
| scholtz2/ | 64966de56d9f | github.com/ | 0.145.0 | 1 |
| scholtz2/ | e9af7d8ff6bb | github.com/ | 0.145.0 | 1 |
| scholtz2/ | 1ec63eca86b6 | github.com/ | 0.145.0 | 1 |