CVE-2026-11856
CriticalAdvisory
Published 24 Jun 2026In the index since 5 Sept 2026
- Severity
- Critical
- worst across findings
- CVSS
- 9.8
- base score, highest
- EPSS
- 0.007
- 51st percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 1,693
- of 17,787 indexed, latest versions
- Container images
- 1,510
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
The matching OSV records carry no description.
Carried by container images the latest versions of 1,693 of 17,787 indexed charts deploy, on 1,510 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| curldeb | 1:8.14.1-2+deb13u3+e1, 7.35.0-1ubuntu2.1, 7.35.0-1ubuntu2.3, 7.35.0-1ubuntu2.16+109 more | 7.35.0-1ubuntu2.20+esm22, 7.47.0-1ubuntu2.19+esm18, 7.58.0-2ubuntu3.24+esm11, 7.68.0-1ubuntu2.25+esm6+4 more | 1,295 |
| curlapk | 8.12.1-r0, 8.17.0-r1, 8.18.0-r0, 8.19.0-r0+2 more | 8.21.0-r0, 8.22.0-r0 | 215 |
- OSV records
- ALPINE-CVE-2026-11856DEBIAN-CVE-2026-11856UBUNTU-CVE-2026-11856ECHO-895d-0fcf-45bd
- Also known as
- USN-8651-1
Charts affected
1,693 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| unifi-controllerqonstruktVerified publisher | 2.6.1 | 1 of 1See more | 10,469 |
| steampipe-powerpipe-kubernetessteampipe-powerpipe-kubernetesVerified publisher | 0.13.1 | 2 of 2See more | 5,468 |
| uffizzi-appuffizzi-app | 1.3.0 | 1 of 14See more | 19,337 |
| unboundunbound-helmchartVerified publisher | 0.2.2 | 1 of 1See more | 1,494 |
| athens-proxyvolker-raschekVerified publisher | 2.0.3 | 1 of 1See more | 2,039 |
| reposilitevolker-raschekVerified publisher | 1.0.0 | 1 of 1See more | 2,957 |
| dexwiremindVerified publisher | 2.15.7 | 1 of 2See more | 13,562 |
| grafana-pdf-exporterwiremindVerified publisher | 2.1.1 | 1 of 1See more | 9,746 |
| matrixzekker6Verified publisher | 3.30.0 | 1 of 4See more | 5,557 |
| eshoponabpabp-charts | 1.0.0 | 1 of 15See more | 19,799 |
| code-serveralekcVerified publisher | 0.1.1 | 1 of 1See more | 8,212 |
| vaultwardenandrenarchyVerified publisher | 6.27.0 | 1 of 1See more | 1,744 |
| athens-proxyathens-chartsOfficialVerified publisher | 0.17.1 | 1 of 1See more | 1,298 |
| auto-deploy-appav1o-chartsVerified publisher | 0.15.4 | 1 of 1See more | 11,007 |
| bookstackbookstack-mgVerified publisher | 0.3.1 | 1 of 2See more | 1,896 |
| backup-zenbzen | 0.1.4 | 1 of 1See more | 7,960 |
| geoservercloudcamptocamp2 | 3.0.1 | 7 of 7See more | 10,546 |
| collabora-codechrisingenhaag | 2.6.0 | 1 of 1See more | 4,180 |
| dumpscriptcloudscriptVerified publisher | 1.8.3 | 1 of 1See more | 2,125 |
| convertigoconvertigoOfficialVerified publisher | 8.4.3 | 2 of 5See more | 17,404 |
| cosmocosmo-platformOfficialVerified publisher | 0.20.0 | 2 of 10See more | 28,839 |
| dask-kubernetes-operatordask | 2026.3.0 | 1 of 1See more | 9,316 |
| zabbix-kubernetes-discoverydjerfyVerified publisher | 1.4.20 | 1 of 1See more | 4,147 |
| duplistatusduplistatusVerified publisher | 1.2.0 | 1 of 2See more | 1,870 |
| bscdysnixVerified publisher | 0.6.59 | 1 of 4See more | 2,012 |
| edgelessdbedgelesssysVerified publisher | 0.3.2 | 1 of 1See more | 4,830 |
| zabbix-agentfermosit | 0.0.5 | 1 of 1See more | 2,369 |
| keydbfinkinfridomVerified publisher | 0.48.3 | 1 of 1See more | 5,264 |
| rsshubgabe565Verified publisher | 0.8.0 | 1 of 3See more | 1,717 |
| calibregeek-cookbookVerified publisher | 5.4.2 | 1 of 1See more | 22,773 |
| network-ups-toolsgeek-cookbookVerified publisher | 6.4.2 | 1 of 1See more | 13,950 |
| plexgeek-cookbookVerified publisher | 6.4.3 | 1 of 1See more | 9,627 |
| signal-cli-rest-apigeek-cookbookVerified publisher | 1.2.2 | 1 of 1See more | 10,154 |
| tautulligeek-cookbookVerified publisher | 11.4.2 | 1 of 1See more | 10,628 |
| unifigeek-cookbookVerified publisher | 5.1.3 | 1 of 1See more | 11,839 |
| aegraviteeioVerified publisher | 3.0.2 | 1 of 1See more | 1,380 |
| apimgraviteeioVerified publisher | 4.12.19 | 2 of 4See more | 4,806 |
| haproxyhaproxytechVerified publisher | 1.30.1 | 1 of 1See more | 817 |
| headscaleheadscaleVerified publisher | 1.0.19 | 1 of 3See more | 3,383 |
| simple-krr-dashboardhelm-simple-krr-dashboardVerified publisher | 1.6.2 | 1 of 3See more | 2,234 |
| home-assistanthome-assistantVerified publisher | 0.5.10 | 1 of 3See more | 2,331 |
| infrahub-enterpriseinfrahub-enterpriseVerified publisher | 4.19.2 | 1 of 5See more | 10,530 |
| coreinstill-aiOfficialVerified publisher | 0.1.75 | 4 of 15See more | 30,816 |
| dayz-dedicated-serverjespernohrVerified publisher | 0.1.2 | 1 of 3See more | 4,309 |
| calibre-webk8s-home-lab-repo | 9.1.1 | 1 of 1See more | 4,477 |
| home-assistantk8s-home-lab-repo | 16.3.1 | 1 of 1See more | 4,634 |
| wireguardk8s-home-lab-repo | 1.6.0 | 1 of 1See more | 7,337 |
| webdavk8s-webdavVerified publisher | 0.0.7 | 1 of 1See more | 1,681 |
| radondb-mysqlkubesphere-testVerified publisher | 1.0.1 | 1 of 3See more | 7,342 |
| kubeservice-lxcfs-webhookkubservice-chartsVerified publisher | 1.6.0 | 1 of 6See more | 11,582 |
Container images carrying it
1,510 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| library/ | 09369da6b103 | curl | no fix listed | 1 |
| library/ | 1881968aff6f | curl | no fix listed | 1 |
| library/ | 2f07d83bf561 | curl | 8.22.0-r0 | 1 |
| library/ | 5616878291a2 | curl | 8.22.0-r0 | 1 |
| library/ | 6784fb0834aa | curl | no fix listed | 1 |
| library/ | 67f9a4f10d14 | curl | no fix listed | 1 |
| library/ | 9ff236ed47fe | curl | no fix listed | 1 |
| library/ | a8b39bd9cf0f | curl | 8.22.0-r0 | 1 |
| library/ | fb197595ebe7 | curl | no fix listed | 1 |
| library/ | 8f693eaa7e0a | curl | no fix listed | 1 |
| library/ | f5d1cc40abc1 | curl | no fix listed | 1 |
| library/ | 59fa733c9af6 | curl | no fix listed | 1 |
| library/ | 54451ecb8ab3 | curl | 8.22.0-r0 | 1 |
| library/ | 70c9cc675605 | curl | no fix listed | 1 |
| library/ | d41127070014 | curl | no fix listed | 1 |
| library/ | da5aee29682d | curl | no fix listed | 1 |
| library/ | 04ac44a2595b | curl | no fix listed | 1 |
| library/ | 0842dcd4c8f8 | curl | 7.81.0-1ubuntu1.26 | 1 |
| library/ | ef9723cf4fe4 | curl | 7.81.0-1ubuntu1.26 | 1 |
| library/ | 507a3eecf809 | curl | no fix listed | 1 |
| library/ | 8ae66efb09a2 | curl | no fix listed | 1 |
| library/ | ad4a8bae2eb4 | curl | no fix listed | 1 |
| library/ | f73396626d2f | curl | no fix listed | 1 |
| library/ | 55d1e5b2e601 | curl | 7.81.0-1ubuntu1.26 | 1 |
| library/ | dfa9ba46d14b | curl | 7.81.0-1ubuntu1.26 | 1 |
| librenms/ | 8194a4a9ff49 | curl | 8.22.0-r0 | 1 |
| lightbend/ | b0c9894ac8dd | curl | 7.47.0-1ubuntu2.19+esm18 | 1 |
| linuxserver/ | a20fb11a440d | curl | 8.22.0-r0 | 1 |
| linuxserver/ | 2ebf97852661 | curl | 8.22.0-r0 | 1 |
| linuxserver/ | a847b5b2d860 | curl | 7.58.0-2ubuntu3.24+esm11 | 1 |
| linuxserver/ | 241009026e6f | curl | 8.5.0-2ubuntu10.12 | 1 |
| linuxserver/ | 938810eca3d3 | curl | 7.68.0-1ubuntu2.25+esm6 | 1 |
| linuxserver/ | 45c5fe102ff3 | curl | 7.58.0-2ubuntu3.24+esm11 | 1 |
| linuxserver/ | a5e43a05ae79 | curl | 7.81.0-1ubuntu1.26 | 1 |
| linuxserver/ | b801bbcf6386 | curl | 7.58.0-2ubuntu3.24+esm11 | 1 |
| linuxserver/ | 0ac871624394 | curl | 7.58.0-2ubuntu3.24+esm11 | 1 |
| linuxserver/ | 2ce561a95e7b | curl | 7.58.0-2ubuntu3.24+esm11 | 1 |
| linuxserver/ | 9505c64720af | curl | 8.22.0-r0 | 1 |
| linuxserver/ | 9a997426d71e | curl | 8.5.0-2ubuntu10.12 | 1 |
| linuxserver/ | 2427dde159a2 | curl | 7.68.0-1ubuntu2.25+esm6 | 1 |
| linuxserver/ | f93d2560e233 | curl | 7.58.0-2ubuntu3.24+esm11 | 1 |
| linuxserver/ | 4477fb1ce3ca | curl | 8.22.0-r0 | 1 |
| linuxserver/ | 2fbb21fb4903 | curl | 7.58.0-2ubuntu3.24+esm11 | 1 |
| linuxserver/ | 2785a6ad64d3 | curl | 8.5.0-2ubuntu10.12 | 1 |
| linuxserver/ | 4a13ced2326c | curl | 7.68.0-1ubuntu2.25+esm6 | 1 |
| linuxserver/ | a46d0ce0a823 | curl | 8.22.0-r0 | 1 |
| linuxserver/ | dd24a5f3db32 | curl | 8.22.0-r0 | 1 |
| linuxserver/ | 02bc962946fe | curl | 8.22.0-r0 | 1 |
| linuxserver/ | 0ae315a3a456 | curl | 7.68.0-1ubuntu2.25+esm6 | 1 |
| linuxserver/ | ab105cc50322 | curl | 7.68.0-1ubuntu2.25+esm6 | 1 |