StackRadar

CVE-2026-11352

High

Advisory

Published 24 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.007
52nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
131
of 17,781 indexed, latest versions
Container images
120
deployed by those charts
Fix available
2 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 131 of 17,781 indexed charts deploy, on 120 images.

Affected packageAffected versionsFixed inImages
curlapk8.18.0-r0, 8.19.0-r0, 8.20.0-r0, 8.20.0-r18.21.0-r0, 8.22.0-r0113
curldeb8.18.0-1ubuntu2.1, 8.18.0-1ubuntu2.28.18.0-1ubuntu2.37
OSV records
ALPINE-CVE-2026-11352UBUNTU-CVE-2026-11352
Also known as
USN-8525-1

Charts affected

131 by stars
ChartLatestAffected imagesRadar Score
natsnatsVerified publisher2.14.61 of 3See more

nats nats 2.14.6

1 of the 3 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
natsio/nats-box:0.19.7ffce8bd10338
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

2,313
metabasepmint932.27.61 of 1See more

metabase pmint93 2.27.6

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
metabase/metabase:v0.61.1.x9491ed11c901
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

1,639
openebsopenebsOfficialVerified publisher4.6.11 of 35See more

openebs openebs 4.6.1

1 of the 35 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
openebs/provisioner-localpv:4.6.099f5116f5cb8
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

23,894
flux2fluxcd-community2.19.01 of 7See more

flux2 fluxcd-community 2.19.0

1 of the 7 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
ghcr.io/fluxcd/kustomize-controller:v1.9.23aecec8bafdb
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

2,951
atlantisatlantis6.15.01 of 1See more

atlantis atlantis 6.15.0

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
ghcr.io/runatlantis/atlantis:v0.47.1511231955463
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

1,891
penpotpenpotOfficialVerified publisher1.9.01 of 4See more

penpot penpot 1.9.0

1 of the 4 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
penpotapp/frontend:2.17.294fa2864d8fc
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

4,314
dragonflydragonflyVerified publisher1.8.41 of 3See more

dragonfly dragonfly 1.8.4

1 of the 3 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
dragonflyoss/scheduler:v2.5.2-rc.06d710dc2bae0
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

3,787
pulsarapache4.7.01 of 10See more

pulsar apache 4.7.0

1 of the 10 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
alpine/k8s:1.32.12048f8d9c8cc7
curl@8.18.0-r0
8.21.0-r0

Open the chart page →

9,864
oktetooktetoOfficialVerified publisher0.0.0-2026-08-031 of 10See more

okteto okteto 0.0.0-2026-08-03

1 of the 10 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
ghcr.io/okteto/buildkit:0.0.0-2026-08-0314527ca5d2a9
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

5,750
stacks-blockchain-apihirosystemsVerified publisher6.5.11 of 5See more

stacks-blockchain-api hirosystems 6.5.1

1 of the 5 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
google/cloud-sdk:alpinef7d3e6d6d4f4
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

8,364
caddyalekcVerified publisher0.9.01 of 1See more

caddy alekc 0.9.0

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
library/caddy:2.11.4-alpine5f5c8640aae0
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

845
syncthingk8s-home-lab-repo5.2.01 of 1See more

syncthing k8s-home-lab-repo 5.2.0

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
syncthing/syncthing:2.1.1775c4aac4862
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

1,230
home-assistantalekcVerified publisher2.11.21 of 1See more

home-assistant alekc 2.11.2

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

2,133
home-assistantandrenarchyVerified publisher14.103.01 of 1See more

home-assistant andrenarchy 14.103.0

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.1612d76760b54
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

2,133
kubernetes-ingresshaproxytechVerified publisher1.54.01 of 1See more

kubernetes-ingress haproxytech 1.54.0

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
haproxytech/kubernetes-ingress:3.2.14d90f628d659e
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

418
meshery-operatormesheryOfficialVerified publisher1.0.691 of 2See more

meshery-operator meshery 1.0.69

1 of the 2 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
alpine/k8s:1.35.6b7a12c5ddf26
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

2,415
flyteflyte1.16.81 of 11See more

flyte flyte 1.16.8

1 of the 11 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
redocly/redoc:latest2e26bb660574
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

3,281
geonode-k8sgeonode-k8sVerified publisher2.0.02 of 10See more

geonode-k8s geonode-k8s 2.0.0

2 of the 10 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
geonode/geoserver_data:2.28.4-latest435cbc5f3f05
curl@8.20.0-r1
8.21.0-r0
nginxinc/nginx-unprivileged:1.31.2-alpine3.236320020c7da8
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

13,953
athens-proxyathens-chartsOfficialVerified publisher0.17.11 of 1See more

athens-proxy athens-charts 0.17.1

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
gomods/athens:v0.18.197cc113b34b0
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

1,298
bookstackbookstack-mgVerified publisher0.3.11 of 2See more

bookstack bookstack-mg 0.3.1

1 of the 2 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
linuxserver/bookstack:26.05.202605282ebf97852661
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

1,896
dumpscriptcloudscriptVerified publisher1.8.31 of 1See more

dumpscript cloudscript 1.8.3

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
ghcr.io/cloudscript-technology/dumpscript:v0.0.42-alpine-edgefce5b6fd161c
curl@8.19.0-r0
8.21.0-r0

Open the chart page →

2,125
duplistatusduplistatusVerified publisher1.2.01 of 2See more

duplistatus duplistatus 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
wsjbr/duplistatus:1.4.25e594f5f09f6
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

1,870
bscdysnixVerified publisher0.6.591 of 4See more

bsc dysnix 0.6.59

1 of the 4 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
gcr.io/google.com/cloudsdktool/google-cloud-cli:alpine6d35276c2562
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

2,012
aegraviteeioVerified publisher3.0.21 of 1See more

ae graviteeio 3.0.2

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
graviteeio/ae-engine:3.0.24140932887e0
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

1,380
haproxyhaproxytechVerified publisher1.30.11 of 1See more

haproxy haproxytech 1.30.1

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
haproxytech/haproxy-alpine:3.4.37a3ef2dd8b5b
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

817
headscaleheadscaleVerified publisher1.0.191 of 3See more

headscale headscale 1.0.19

1 of the 3 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
alpine/k8s:1.36.244ef4942e171
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

3,383
home-assistanthome-assistantVerified publisher0.5.101 of 3See more

home-assistant home-assistant 0.5.10

1 of the 3 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.0372d991e5888
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

2,331
vaultvaultVerified publisher1.22.01 of 4See more

vault vault 1.22.0

1 of the 4 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
alpine/k8s:1.35.5d870622d0040
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

4,243
buildkitdwiremindVerified publisher0.33.01 of 1See more

buildkitd wiremind 0.33.0

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
moby/buildkit:v0.32.2-rootless504731e577c2
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

1,152
aramid-indexerbiatec-repoVerified publisher3.9.02 of 5See more

aramid-indexer biatec-repo 3.9.0

2 of the 5 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
scholtz2/aramid-conduit:v1.9.0-stable3a3b3d3277d2
curl@8.18.0-1ubuntu2.1
8.18.0-1ubuntu2.3
scholtz2/aramid-indexer:v3.9.0-stable6770214bc881
curl@8.18.0-1ubuntu2.1
8.18.0-1ubuntu2.3

Open the chart page →

13,357
self-hostbitwarden2.4.01 of 11See more

self-host bitwarden 2.4.0

1 of the 11 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
ghcr.io/bitwarden/web:2026.8.00767b242240d
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

5,190
syncthingbrandan-schmitz-helm-chartsVerified publisher2.1.01 of 1See more

syncthing brandan-schmitz-helm-charts 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
syncthing/syncthing:2.1.1775c4aac4862
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

1,230
buildkit-fleetbuildkit-fleetVerified publisher0.1.21 of 1See more

buildkit-fleet buildkit-fleet 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
moby/buildkit:v0.33.0-rootless80b15f0735e8
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

909
easyhaproxybyjgVerified publisher2.0.41 of 1See more

easyhaproxy byjg 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
byjg/easy-haproxy:6.1.1230fdb7b00ae
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

933
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latest612d76760b54
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

2,133
gluugluu-flexOfficialVerified publisher0.0.0-nightly1 of 9See more

gluu gluu-flex 0.0.0-nightly

1 of the 9 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
ghcr.io/gluufederation/flex/persistence-loader:0.0.0-nightlyc26589258dec
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

1,507
bazarrhalkeye0.2.01 of 1See more

bazarr halkeye 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
linuxserver/bazarr:latesta20fb11a440d
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

614
haproxy-unified-gatewayhaproxytechVerified publisher1.2.01 of 1See more

haproxy-unified-gateway haproxytech 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
haproxytech/haproxy-unified-gateway:1.0.7b9bffe2d0fd1
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

674
jupyterhub-outpostjupyter-jscVerified publisher2.4.11 of 1See more

jupyterhub-outpost jupyter-jsc 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

1,678
qbittorrentk8s-chartsVerified publisher3.1.01 of 2See more

qbittorrent k8s-charts 3.1.0

1 of the 2 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
ghcr.io/hotio/qbittorrent:release-5.2.007198d49e5b4
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

1,270
radarrk8s-home-lab-repo17.6.11 of 1See more

radarr k8s-home-lab-repo 17.6.1

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
ghcr.io/home-operations/radarr:6.2.1a566e7d364b9
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

752
sonarrk8s-home-lab-repo17.3.11 of 1See more

sonarr k8s-home-lab-repo 17.3.1

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
ghcr.io/home-operations/sonarr:4.0.171989718e9fce
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

765
chibisafel4gVerified publisher0.1.11 of 3See more

chibisafe l4g 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
library/caddy:2-alpine5f5c8640aae0
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

5,654
lgtm-stacklgtm-stackVerified publisher0.1.31 of 8See more

lgtm-stack lgtm-stack 0.1.3

1 of the 8 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

5,576
medusamedusaVerified publisher1.3.81 of 1See more

medusa medusa 1.3.8

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
linuxserver/medusa:v1.0.26-ls2884477fb1ce3ca
curl@8.20.0-r0
8.22.0-r0

Open the chart page →

977
metrics-server-exportermetrics-server-exporterVerified publisher2.4.01 of 1See more

metrics-server-exporter metrics-server-exporter 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
mrnim94/metrics-server-exporter:v2.4.086c4807a4bca
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

1,272
opentelemetry-demoopentelemetry-helmVerified publisher0.41.12 of 34See more

opentelemetry-demo opentelemetry-helm 0.41.1

2 of the 34 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
grafana/grafana:13.1.0121a7a9ece6d
curl@8.20.0-r1
8.21.0-r0
ghcr.io/open-telemetry/demo:3.0.0-telemetry-docs3519858704e7
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

22,420
opikopikOfficialVerified publisher2.2.592 of 13See more

opik opik 2.2.59

2 of the 13 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
ghcr.io/comet-ml/opik/opik-frontend:2.2.59bc2f49e9bb3e
curl@8.19.0-r0
8.22.0-r0
ghcr.io/comet-ml/opik/opik-python-backend:2.2.59269d0e55ea97
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

14,334
prowlarrpanzer1119Verified publisher0.4.181 of 2See more

prowlarr panzer1119 0.4.18

1 of the 2 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
linuxserver/prowlarr:2.4.0.5397-ls149a46d0ce0a823
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

1,001
home-assistantpree-helm-chartsVerified publisher1.80.01 of 1See more

home-assistant pree-helm-charts 1.80.0

1 of the 1 container images this version deploys carry CVE-2026-11352.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

2,133

Container images carrying it

120 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/home-assistant/home-assistant:2026.9.0372d991e5888
curl@8.20.0-r1
8.21.0-r0
1
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
curl@8.20.0-r1
8.21.0-r0
1
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
curl@8.20.0-r1
8.21.0-r0
1
ghcr.io/home-operations/prowlarr:2.4.0b7da6e9defbe
curl@8.20.0-r1
8.21.0-r0
1
ghcr.io/home-operations/qbittorrent:5.2.224f2d793cb7f
curl@8.20.0-r1
8.21.0-r0
1
ghcr.io/home-operations/radarr:6.2.1a566e7d364b9
curl@8.20.0-r1
8.21.0-r0
1
ghcr.io/home-operations/sonarr:4.0.171989718e9fce
curl@8.20.0-r1
8.21.0-r0
1
ghcr.io/hotio/qbittorrent:release-5.2.007198d49e5b4
curl@8.19.0-r0
8.22.0-r0
1
ghcr.io/linuxserver/syslog-ng:4.10.247fae7f540f9
curl@8.19.0-r0
8.22.0-r0
1
ghcr.io/mkutlak/alluredeck-ui:0.41.0c19509b1b336
curl@8.19.0-r0
8.22.0-r0
1
ghcr.io/okteto/buildkit:0.0.0-2026-08-0314527ca5d2a9
curl@8.20.0-r0
8.22.0-r0
1
ghcr.io/open-telemetry/demo:3.0.0-telemetry-docs3519858704e7
curl@8.19.0-r0
8.22.0-r0
1
ghcr.io/ptrvsrg/csi-driver-ipfs:latest97d2d9ccd7a5
curl@8.20.0-r1
8.21.0-r0
1
ghcr.io/radar-base/managementportal/management-portal:3.0.0c1b37e821f72
curl@8.18.0-1ubuntu2.1
8.18.0-1ubuntu2.3
1
ghcr.io/runatlantis/atlantis:v0.47.1511231955463
curl@8.20.0-r0
8.22.0-r0
1
ghcr.io/sergelogvinov/ipsec:5.236f4e651d1fe
curl@8.20.0-r1
8.21.0-r0
1
ghcr.io/teq-cloud/iteq-web:0.3.3-beta0acbe2f2e1ea
curl@8.20.0-r0
8.22.0-r0
1
ghcr.io/timothepoznanski/poznote:6.80.0045035db3a20
curl@8.20.0-r0
8.22.0-r0
1
quay.io/argoprojlabs/argocd-image-updater:v1.2.13c56f354fac5
curl@8.19.0-r0
8.22.0-r0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
curl@8.20.0-r0
8.22.0-r0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.