CVE-2026-11856

Critical

Advisory

Published 24 Jun 2026In the index since 5 Sept 2026

Severity: Critical; worst across findings
CVSS: 9.8; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,701; of 17,797 indexed, latest versions
Container images: 1,518; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,701 of 17,797 indexed charts deploy, on 1,518 images.

Affected package	Affected versions	Fixed in	Images
curldeb	1:8.14.1-2+deb13u3+e1, 7.35.0-1ubuntu2.1, 7.35.0-1ubuntu2.3, 7.35.0-1ubuntu2.16+109 more	7.35.0-1ubuntu2.20+esm22, 7.47.0-1ubuntu2.19+esm18, 7.58.0-2ubuntu3.24+esm11, 7.68.0-1ubuntu2.25+esm6+4 more	1,306
curlapk	8.12.1-r0, 8.17.0-r1, 8.18.0-r0, 8.19.0-r0+2 more	8.21.0-r0, 8.22.0-r0	212

OSV records: ALPINE-CVE-2026-11856 DEBIAN-CVE-2026-11856 UBUNTU-CVE-2026-11856 ECHO-895d-0fcf-45bd
Also known as: USN-8651-1

Charts affected

1,701 by stars

Chart

Latest

Affected images

Radar Score

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-11856.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	curl@7.81.0-1ubuntu1.25	7.81.0-1ubuntu1.26

Open the chart page →

7,936

Container images carrying it

1,518 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/jupyterhub/k8s-singleuser-sample :4.4.2	65e1b09fc8c9	curl@7.88.1-10+deb12u15	no fix listed	1
quay.io/mongodb/mongodb-enterprise-operator :1.8.2	a1c3843b03bc	curl@7.47.0-1ubuntu2.16	7.47.0-1ubuntu2.19+esm18	1
quay.io/opsmxpublic/spin-sample-pipeline :v1.0.1	c6a934439421	curl@7.47.0-1ubuntu2.18	7.47.0-1ubuntu2.19+esm18	1
quay.io/opsmxpublic/ubi8-oes-datascience :isd-spin-2025.10.01-af26a30d4-202511261054	d8f66f4117fe	curl@8.14.1-2+deb13u2	no fix listed	1
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	curl@7.88.1-10+deb12u1	no fix listed	1
registry.gitlab.com/crafty-controller/crafty-4 :latest	166a06f73d8c	curl@8.5.0-2ubuntu10.10	8.5.0-2ubuntu10.12	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-frontend :1.0.31	66353ce9bf98	curl@8.14.1-2+deb13u2	no fix listed	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer :1.0.31	0e3cd8c7776d	curl@7.88.1-10+deb12u14	no fix listed	1
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao :v2.5.5-gitlab2	5b7636dfba3f	curl@8.14.1-2+deb13u4	no fix listed	1
registry.gitlab.com/infinitydon/registry/open5gs-aio :v2.2.2	f6385712935f	curl@7.68.0-1ubuntu2.4	7.68.0-1ubuntu2.25+esm6	1
registry.gitlab.com/school_guy/docker-typo3 :13.4.30-197d868e	d76185d7270d	curl@7.88.1-10+deb12u14	no fix listed	1
registry.gitlab.com/shortlink-org/shortlink/bff :latest	f2194e526915	curl@8.17.0-r1	8.22.0-r0	1
registry.gitlab.com/shortlink-org/shortlink/link :latest	86d87291ffd4	curl@8.17.0-r1	8.22.0-r0	1
registry.gitlab.com/technostructures/posca/posca :latest	a693021686ca	curl@8.17.0-r1	8.22.0-r0	1
registry.gitlab.com/xrow-public/helm-smtp/postfix :1.3.3	7eea4f0883dd	curl@8.20.0-r0	8.22.0-r0	1
registry.k8s.io/git-sync/git-sync :v4.5.0	0e64aedb0d0a	curl@8.14.1-2	no fix listed	1
registry.k8s.io/git-sync/git-sync :v4.1.0	fd9722fd02e3	curl@7.88.1-10+deb12u4	no fix listed	1
registry.k8s.io/provider-os/manila-csi-plugin :v1.36.0	190976e2e2fe	curl@8.17.0-r1	8.22.0-r0	1