StackRadar

CVE-2026-11605

High

Advisory

Published 22 Jul 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
44th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
37
of 17,781 indexed, latest versions
Container images
33
deployed by those charts
Fix available
2 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 37 of 17,781 indexed charts deploy, on 33 images.

Affected packageAffected versionsFixed inImages
bind9deb1:9.18.19-1~deb12u1, 1:9.18.24-1, 1:9.18.33-1~deb12u2, 1:9.18.41-1~deb12u1+7 more1:9.18.49-1~deb12u2, 1:9.20.24-1ubuntu0.2, 1:9.20.26-1~deb13u120
bindapk9.20.13-r0, 9.20.16-r0, 9.20.18-r0, 9.20.20-r0+3 more9.20.26-r013
OSV records
ALPINE-CVE-2026-11605DEBIAN-CVE-2026-11605UBUNTU-CVE-2026-11605
Also known as
USN-8648-1

Charts affected

37 by stars
ChartLatestAffected imagesRadar Score
piholemojo2600Verified publisher2.38.01 of 1See more

pihole mojo2600 2.38.0

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
pihole/pihole:2026.07.2f7d1be836e3b
bind@9.20.24-r0
9.20.26-r0

Open the chart page →

571
maildocker-postfixVerified publisher5.1.01 of 1See more

mail docker-postfix 5.1.0

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
boky/postfix:5.1.0aafc77238423
bind9@1:9.20.15-1~deb13u1
1:9.20.26-1~deb13u1

Open the chart page →

5,366
budibasebudibase0.0.0-master1 of 7See more

budibase budibase 0.0.0-master

1 of the 7 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
budibase/proxy:3.41.38d780b6ee602
bind9@1:9.20.23-1~deb13u1
1:9.20.26-1~deb13u1

Open the chart page →

10,775
home-assistantalekcVerified publisher2.11.21 of 1See more

home-assistant alekc 2.11.2

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
bind@9.20.23-r0
9.20.26-r0

Open the chart page →

2,133
home-assistantandrenarchyVerified publisher14.103.01 of 1See more

home-assistant andrenarchy 14.103.0

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.1612d76760b54
bind@9.20.23-r0
9.20.26-r0

Open the chart page →

2,133
piholehelmforgeVerified publisher2.0.131 of 1See more

pihole helmforge 2.0.13

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
pihole/pihole:2026.07.2f7d1be836e3b
bind@9.20.24-r0
9.20.26-r0

Open the chart page →

571
coturnjaconiVerified publisher1.0.51 of 1See more

coturn jaconi 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
coturn/coturn:4.10.0-r1f4c2af06c3c5
bind9@1:9.20.21-1~deb13u1
1:9.20.26-1~deb13u1

Open the chart page →

2,901
photoprismandrenarchyVerified publisher8.15.01 of 1See more

photoprism andrenarchy 8.15.0

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
photoprism/photoprism:260728958642220223
bind9@1:9.20.18-1ubuntu2.1
1:9.20.24-1ubuntu0.2

Open the chart page →

8,825
unboundunbound-helmchartVerified publisher0.2.21 of 1See more

unbound unbound-helmchart 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
ghcr.io/pixelfederation/unbound:1.24.2_0fce820a03964
bind@9.20.20-r0
9.20.26-r0

Open the chart page →

1,494
home-assistanthome-assistantVerified publisher0.5.101 of 3See more

home-assistant home-assistant 0.5.10

1 of the 3 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.0372d991e5888
bind@9.20.23-r0
9.20.26-r0

Open the chart page →

2,331
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
bind@9.20.18-r0
9.20.26-r0

Open the chart page →

4,634
aramid-indexerbiatec-repoVerified publisher3.9.02 of 5See more

aramid-indexer biatec-repo 3.9.0

2 of the 5 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
scholtz2/aramid-conduit:v1.9.0-stable3a3b3d3277d2
bind9@1:9.20.18-1ubuntu2.1
1:9.20.24-1ubuntu0.2
scholtz2/aramid-indexer:v3.9.0-stable6770214bc881
bind9@1:9.20.18-1ubuntu2.1
1:9.20.24-1ubuntu0.2

Open the chart page →

13,357
cloudttycloudtty0.8.91 of 2See more

cloudtty cloudtty 0.8.9

1 of the 2 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
ghcr.io/cloudtty/cloudshell:v0.8.900984ba0f0eb
bind@9.20.18-r0
9.20.26-r0

Open the chart page →

3,951
dragonfly-stackdragonflyVerified publisher0.1.21 of 7See more

dragonfly-stack dragonfly 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
dragonflyoss/client:v0.1.82edf3e921f4e0
bind9@1:9.18.24-1
1:9.18.49-1~deb12u2

Open the chart page →

18,376
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latest612d76760b54
bind@9.20.23-r0
9.20.26-r0

Open the chart page →

2,133
dnsbl-exporterluzillaVerified publisher0.5.01 of 2See more

dnsbl-exporter luzilla 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
ghcr.io/luzilla/unbound:v0.12.04fd8da9dc13c
bind@9.20.22-r0
9.20.26-r0

Open the chart page →

1,146
piholepihole-helmVerified publisher1.6.01 of 1See more

pihole pihole-helm 1.6.0

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
pihole/pihole:2026.07.2f7d1be836e3b
bind@9.20.24-r0
9.20.26-r0

Open the chart page →

571
home-assistantpree-helm-chartsVerified publisher1.80.01 of 1See more

home-assistant pree-helm-charts 1.80.0

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
bind@9.20.23-r0
9.20.26-r0

Open the chart page →

2,133
fluent-bitromanow-helm-chartsVerified publisher1.7.31 of 1See more

fluent-bit romanow-helm-charts 1.7.3

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
fluent/fluent-bit:4.0-debuge76397ef3983
bind9@1:9.18.41-1~deb12u1
1:9.18.49-1~deb12u2

Open the chart page →

7,740
arbitrumchronicleVerified publisher0.3.41 of 1See more

arbitrum chronicle 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
offchainlabs/nitro-node:v3.7.6-c0fe95e9f779fa84b7b
bind9@1:9.18.33-1~deb12u2
1:9.18.49-1~deb12u2

Open the chart page →

6,998
dev-code-servercosmoVerified publisher0.0.71 of 2See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
bind9@1:9.18.33-1~deb12u2
1:9.18.49-1~deb12u2

Open the chart page →

14,559
truecommanddjjudas21Verified publisher0.1.01 of 1See more

truecommand djjudas21 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
ixsystems/truecommand:3.2.019c218455cd2
bind9@1:9.20.11-4
1:9.20.26-1~deb13u1

Open the chart page →

5,174
arbitrumdysnixVerified publisher0.1.11 of 1See more

arbitrum dysnix 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
offchainlabs/nitro-node:v3.1.0-7d1d84ce95865866129
bind9@1:9.18.24-1
1:9.18.49-1~deb12u2

Open the chart page →

9,244
home-assistantegebackVerified publisher2.0.351 of 1See more

home-assistant egeback 2.0.35

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
bind@9.20.23-r0
9.20.26-r0

Open the chart page →

2,158
rospoferama0.4.31 of 1See more

rospo ferama 0.4.3

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
ghcr.io/ferama/rospo:v0.12.0ab40c1745534
bind9@1:9.18.19-1~deb12u1
1:9.18.49-1~deb12u2

Open the chart page →

6,026
icinga2geek-cookbookVerified publisher4.2.01 of 1See more

icinga2 geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
jordan/icinga2:latestf75025fe8ea8
bind9@1:9.18.49-1~deb12u1
1:9.18.49-1~deb12u2

Open the chart page →

9,077
gridgain9gridgainVerified publisher1.1.101 of 2See more

gridgain9 gridgain 1.1.10

1 of the 2 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
gridgain/gridgain9:9.1.1895018390077b
bind@9.20.18-r0
9.20.26-r0

Open the chart page →

3,199
helixhelix1.4.31 of 2See more

helix helix 1.4.3

1 of the 2 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
bind9@1:9.18.47-1~deb12u1
1:9.18.49-1~deb12u2

Open the chart page →

5,568
jupyterhubhelmforgeVerified publisher1.0.61 of 3See more

jupyterhub helmforge 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
bind9@1:9.18.47-1~deb12u1
1:9.18.49-1~deb12u2

Open the chart page →

5,341
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
bind@9.20.23-r0
9.20.26-r0

Open the chart page →

2,444
node-debug-dashboardnode-debug-dashboardVerified publisher0.3.21 of 1See more

node-debug-dashboard node-debug-dashboard 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
ghcr.io/samr037/node-debug-dashboard:0.3.0c79b2e64a211
bind9@1:9.18.49-1~deb12u1
1:9.18.49-1~deb12u2

Open the chart page →

6,854
cloudflaredpascaliskeVerified publisher3.0.01 of 1See more

cloudflared pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
ghcr.io/crazy-max/cloudflared:2025.9.19b4e856d18f6
bind@9.20.13-r0
9.20.26-r0

Open the chart page →

2,028
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
bind@9.20.16-r0
9.20.26-r0

Open the chart page →

4,749
qubivaqubiva0.3.21 of 3See more

qubiva qubiva 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
bind9@1:9.20.23-1~deb13u1
1:9.20.26-1~deb13u1

Open the chart page →

4,272
piholesantisbon0.2.01 of 1See more

pihole santisbon 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
pihole/pihole:latestf7d1be836e3b
bind@9.20.24-r0
9.20.26-r0

Open the chart page →

571
photoprismschoolguys-helmcharts0.3.81 of 1See more

photoprism schoolguys-helmcharts 0.3.8

1 of the 1 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
photoprism/photoprism:260601650c6ad5a651
bind9@1:9.20.18-1ubuntu2.1
1:9.20.24-1ubuntu0.2

Open the chart page →

10,348
ssv-nodestakewise2.2.01 of 2See more

ssv-node stakewise 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-11605.

Container imageDigestPackageFixed in
bloxstaking/ssv-node:v2.2.0bf6d7d2fdc93
bind9@1:9.18.33-1~deb12u2
1:9.18.49-1~deb12u2

Open the chart page →

6,779

Container images carrying it

33 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
pihole/pihole:2026.07.2:latestf7d1be836e3b
bind@9.20.24-r0
9.20.26-r0
4
ghcr.io/home-assistant/home-assistant:2026.9.1:latest612d76760b54
bind@9.20.23-r0
9.20.26-r0
2
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
bind@9.20.23-r0
9.20.26-r0
2
bloxstaking/ssv-node:v2.2.0bf6d7d2fdc93
bind9@1:9.18.33-1~deb12u2
1:9.18.49-1~deb12u2
1
boky/postfix:5.1.0aafc77238423
bind9@1:9.20.15-1~deb13u1
1:9.20.26-1~deb13u1
1
budibase/proxy:3.41.38d780b6ee602
bind9@1:9.20.23-1~deb13u1
1:9.20.26-1~deb13u1
1
coturn/coturn:4.10.0-r1f4c2af06c3c5
bind9@1:9.20.21-1~deb13u1
1:9.20.26-1~deb13u1
1
dragonflyoss/client:v0.1.82edf3e921f4e0
bind9@1:9.18.24-1
1:9.18.49-1~deb12u2
1
fluent/fluent-bit:4.0-debuge76397ef3983
bind9@1:9.18.41-1~deb12u1
1:9.18.49-1~deb12u2
1
gridgain/gridgain9:9.1.1895018390077b
bind@9.20.18-r0
9.20.26-r0
1
homeassistant/home-assistant:2026.75a531753cea9
bind@9.20.23-r0
9.20.26-r0
1
ixsystems/truecommand:3.2.019c218455cd2
bind9@1:9.20.11-4
1:9.20.26-1~deb13u1
1
jordan/icinga2:latestf75025fe8ea8
bind9@1:9.18.49-1~deb12u1
1:9.18.49-1~deb12u2
1
offchainlabs/nitro-node:v3.7.6-c0fe95e9f779fa84b7b
bind9@1:9.18.33-1~deb12u2
1:9.18.49-1~deb12u2
1
offchainlabs/nitro-node:v3.1.0-7d1d84ce95865866129
bind9@1:9.18.24-1
1:9.18.49-1~deb12u2
1
photoprism/photoprism:260601650c6ad5a651
bind9@1:9.20.18-1ubuntu2.1
1:9.20.24-1ubuntu0.2
1
photoprism/photoprism:260728958642220223
bind9@1:9.20.18-1ubuntu2.1
1:9.20.24-1ubuntu0.2
1
scholtz2/aramid-conduit:v1.9.0-stable3a3b3d3277d2
bind9@1:9.20.18-1ubuntu2.1
1:9.20.24-1ubuntu0.2
1
scholtz2/aramid-indexer:v3.9.0-stable6770214bc881
bind9@1:9.20.18-1ubuntu2.1
1:9.20.24-1ubuntu0.2
1
ghcr.io/cloudtty/cloudshell:v0.8.900984ba0f0eb
bind@9.20.18-r0
9.20.26-r0
1
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
bind9@1:9.18.33-1~deb12u2
1:9.18.49-1~deb12u2
1
ghcr.io/crazy-max/cloudflared:2025.9.19b4e856d18f6
bind@9.20.13-r0
9.20.26-r0
1
ghcr.io/ferama/rospo:v0.12.0ab40c1745534
bind9@1:9.18.19-1~deb12u1
1:9.18.49-1~deb12u2
1
ghcr.io/home-assistant/home-assistant:2026.9.0372d991e5888
bind@9.20.23-r0
9.20.26-r0
1
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
bind@9.20.23-r0
9.20.26-r0
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
bind@9.20.16-r0
9.20.26-r0
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
bind@9.20.18-r0
9.20.26-r0
1
ghcr.io/luzilla/unbound:v0.12.04fd8da9dc13c
bind@9.20.22-r0
9.20.26-r0
1
ghcr.io/pixelfederation/unbound:1.24.2_0fce820a03964
bind@9.20.20-r0
9.20.26-r0
1
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
bind9@1:9.20.23-1~deb13u1
1:9.20.26-1~deb13u1
1
ghcr.io/samr037/node-debug-dashboard:0.3.0c79b2e64a211
bind9@1:9.18.49-1~deb12u1
1:9.18.49-1~deb12u2
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
bind9@1:9.18.47-1~deb12u1
1:9.18.49-1~deb12u2
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
bind9@1:9.18.47-1~deb12u1
1:9.18.49-1~deb12u2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.