StackRadar

CVE-2026-12064

High

Advisory

Published 24 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
34th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,013
of 17,787 indexed, latest versions
Container images
877
deployed by those charts
Fix available
2 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,013 of 17,787 indexed charts deploy, on 877 images.

Affected packageAffected versionsFixed inImages
curldeb1:8.14.1-2+deb13u3+e1, 7.88.1-10, 7.88.1-10+deb12u1, 7.88.1-10+deb12u4+24 more8.14.1-2+e22, 8.14.1-2ubuntu1.5, 8.18.0-1ubuntu2.3659
curlapk8.12.1-r0, 8.17.0-r1, 8.18.0-r0, 8.19.0-r0+2 more8.21.0-r0, 8.22.0-r0218
OSV records
ALPINE-CVE-2026-12064DEBIAN-CVE-2026-12064UBUNTU-CVE-2026-12064ECHO-2ea7-d2c8-d549
Also known as
USN-8525-1

Charts affected

1,013 by stars
ChartLatestAffected imagesRadar Score
aws-web-service-proxifiedaws-web-service-proxified1.8.01 of 2See more

aws-web-service-proxified aws-web-service-proxified 1.8.0

1 of the 2 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/httpd:latest979c38c2228d
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

3,021
backstage-pyactionsbackstage-pyactionsVerified publisher0.1.01 of 1See more

backstage-pyactions backstage-pyactions 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
mawad98/backstage-pyactions:demo99422c56a274
curl@8.14.1-2+deb13u2
no fix listed

Open the chart page →

2,750
basic-auth-s3-nginxbasic-auth-s3-nginxVerified publisher1.0.01 of 1See more

basic-auth-s3-nginx basic-auth-s3-nginx 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
dachichang/basic-auth-s3-nginx:1.0.07ccac90a935e
curl@7.88.1-10+deb12u4
no fix listed

Open the chart page →

6,310
my-nginx-appbassant-nginx-app0.1.01 of 1See more

my-nginx-app bassant-nginx-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,839
mealiebdclark-helm-chartsVerified publisher0.1.151 of 1See more

mealie bdclark-helm-charts 0.1.15

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.25.16066c29eca95
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

4,042
pangolinbdcode0.14.11 of 1See more

pangolin bdcode 0.14.1

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
fosrl/pangolin:latest83a55f933b4d
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

1,810
tenzu-frontbiru-scop3.1.01 of 1See more

tenzu-front biru-scop 3.1.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
ghcr.io/biru-scop/tenzu-front:latest16759fa523f8
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

846
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
curl@7.88.1-10+deb12u8
no fix listed

Open the chart page →

10,171
bdbablackduck2026.6.31 of 9See more

bdba blackduck 2026.6.3

1 of the 9 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
fluent/fluent-bit:4.2.6a52221a2a3eb
curl@8.14.1-2+deb13u3
no fix listed

Open the chart page →

9,405
blackduck-alertblackduck8.4.02 of 4See more

blackduck-alert blackduck 8.4.0

2 of the 4 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
blackducksoftware/blackduck-alert:8.4.090cca32de2cc
curl@8.17.0-r1
8.22.0-r0
blackducksoftware/blackduck-alert-rabbitmq:8.4.08f422b18d171
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

4,295
bluespacebluespace0.3.01 of 1See more

bluespace bluespace 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,839
colosseumbook-k8sinfra-v21.0.182 of 5See more

colosseum book-k8sinfra-v2 1.0.18

2 of the 5 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-cms:loge74b43c7f492
curl@7.88.1-10+deb12u12
no fix listed
sysnet4admin/colosseum-prm:log5802bfcd7fed
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

26,266
jenkinsbook-k8sinfra-v25.1.121 of 2See more

jenkins book-k8sinfra-v2 5.1.12

1 of the 2 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
jenkins/jenkins:2.440.3-jdk17de4fea113221
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

7,627
Filebrowserbrandan-schmitz-helm-chartsVerified publisher1.3.11 of 1See more

Filebrowser brandan-schmitz-helm-charts 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.63.15-s6dbac07403040
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

995
flaresolverrbrandan-schmitz-helm-chartsVerified publisher1.4.01 of 1See more

flaresolverr brandan-schmitz-helm-charts 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
flaresolverr/flaresolverr:v3.5.0139dfee1c6f8
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

27,282
qbittorrentbrandan-schmitz-helm-chartsVerified publisher2.2.01 of 1See more

qbittorrent brandan-schmitz-helm-charts 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
linuxserver/qbittorrent:5.2.2dd24a5f3db32
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

956
sonarrbrandan-schmitz-helm-chartsVerified publisher2.0.101 of 1See more

sonarr brandan-schmitz-helm-charts 2.0.10

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
linuxserver/sonarr:version-4.0.17.295202bc962946fe
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

866
tenantsbrbarmex-tenant2.0.01 of 1See more

tenants brbarmex-tenant 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,839
tautullibryanalves0.1.01 of 1See more

tautulli bryanalves 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
tautulli/tautulli:latest670e68dd9efc
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,886
node-appbryopsida0.5.11 of 2See more

node-app bryopsida 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/node:ltsbe23f54a88d3
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

14,446
nginx-chartbtrepoVerified publisher0.1.01 of 1See more

nginx-chart btrepo 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,839
gotenbergbysamioVerified publisher0.2.01 of 1See more

gotenberg bysamio 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8-chromiuma40f92d7419a
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

8,991
caddycaddyVerified publisher0.0.41 of 1See more

caddy caddy 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/caddy:2.11.2-alpine834468128c76
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,677
camellia-redis-proxycamellia-redis-proxy1.4.01 of 2See more

camellia-redis-proxy camellia-redis-proxy 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
48n6e/camellia-redis-proxy:1.4.0-jdk-21-0.0.1a6ed886fddfc
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

7,329
httpd-ldapauth-proxycamptocamp31.0.21 of 1See more

httpd-ldapauth-proxy camptocamp3 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/httpd:2.4.631ae8051591a5
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

3,165
lamphttpdcamptocamp31.0.111 of 1See more

lamphttpd camptocamp3 1.0.11

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/httpd:2.4-alpine1b766f17b840
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

902
nginx-s3-gatewaycamptocamp31.0.01 of 1See more

nginx-s3-gateway camptocamp3 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
ghcr.io/nginxinc/nginx-s3-gateway/nginx-oss-s3-gateway:unprivileged-oss-202503313db8145349a3
curl@7.88.1-10+deb12u7
no fix listed

Open the chart page →

5,051
tetragon-policy-buildercamptocamp30.1.11 of 1See more

tetragon-policy-builder camptocamp3 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
ghcr.io/camptocamp/tetragon-policy-builder:master0e99f12bb040
curl@7.88.1-10+deb12u8
no fix listed

Open the chart page →

10,318
caninecanine0.1.101 of 7See more

canine canine 0.1.10

1 of the 7 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
ghcr.io/caninehq/canine:latesta058034ca006
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

13,363
opencvecfi20170.1.22 of 7See more

opencve cfi2017 0.1.2

2 of the 7 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/nginx:trixie05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
curl@7.88.1-10+deb12u15
no fix listed

Open the chart page →

14,964
nginx-chartchanhk10.1.01 of 1See more

nginx-chart chanhk1 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,839
charon-relaycharonOfficialVerified publisher0.8.01 of 2See more

charon-relay charon 0.8.0

1 of the 2 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
alpine/kubectl:1.35.2ec8f734b0a10
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

4,409
chart-dnazarenochart-dnazareno0.1.01 of 3See more

chart-dnazareno chart-dnazareno 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/phpmyadmin:5.2.16e75aa8f767c
curl@7.88.1-10+deb12u8
no fix listed

Open the chart page →

5,528
kitchenowlchart-kitchenowl0.1.122 of 2See more

kitchenowl chart-kitchenowl 0.1.12

2 of the 2 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
tombursch/kitchenowl-backend:v0.7.8b48e4ab727cd
curl@8.14.1-2+deb13u2
no fix listed
tombursch/kitchenowl-web:v0.7.8517f808eee66
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

4,783
home-assistant-otbrcharts-derwitt-devVerified publisher2.1.31 of 1See more

home-assistant-otbr charts-derwitt-dev 2.1.3

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
ghcr.io/wittdennis/homeassistant-otbr:4.2.31b53b0b3488e
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

2,358
paperless-ngxcharts-derwitt-devVerified publisher2.1.41 of 1See more

paperless-ngx charts-derwitt-dev 2.1.4

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

4,644
mysqld-exporterchoerodon0.1.01 of 1See more

mysqld-exporter choerodon 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,839
kubevirt-managerchristianhuthVerified publisher0.7.01 of 1See more

kubevirt-manager christianhuth 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
kubevirtmanager/kubevirt-manager:1.5.41b98f1b5977a
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,986
arbitrumchronicleVerified publisher0.3.41 of 1See more

arbitrum chronicle 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
offchainlabs/nitro-node:v3.7.6-c0fe95e9f779fa84b7b
curl@7.88.1-10+deb12u14
no fix listed

Open the chart page →

7,006
zksyncchronicleVerified publisher0.1.01 of 2See more

zksync chronicle 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
matterlabs/external-node:v24.0.06cbfea4c694a
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

5,550
cinnycinnyVerified publisher0.2.241 of 1See more

cinny cinny 0.2.24

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
ghcr.io/cinnyapp/cinny:v4.12.6a7805a8a60ff
curl@8.19.0-r0
8.22.0-r0

Open the chart page →

804
chekrckotzbauerVerified publisher0.5.31 of 2See more

chekr ckotzbauer 0.5.3

1 of the 2 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
nginxinc/nginx-unprivileged:mainline-alpinee93571f3d083
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

3,470
kamaji-etcdclastixVerified publisher0.17.01 of 4See more

kamaji-etcd clastix 0.17.0

1 of the 4 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
cfssl/cfssl:latestc9018c2ddf0b
curl@7.88.1-10+deb12u5
no fix listed

Open the chart page →

12,021
helmchartclouddrove1.4.01 of 1See more

helmchart clouddrove 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

1,839
lampcloudnativeapp1.1.01 of 3See more

lamp cloudnativeapp 1.1.0

1 of the 3 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/httpd:2.4-alpine1b766f17b840
curl@8.20.0-r1
8.21.0-r0

Open the chart page →

1,764
mercurecloudnativeapp1.0.21 of 1See more

mercure cloudnativeapp 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
dunglas/mercure:v0916834e49961
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

1,098
rundeckcloudnativeapp0.1.01 of 2See more

rundeck cloudnativeapp 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

23,683
cloudvaultcloudvaultOfficialVerified publisher1.0.21 of 3See more

cloudvault cloudvault 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
library/postgres:18.3-alpine54451ecb8ab3
curl@8.17.0-r1
8.22.0-r0

Open the chart page →

2,185
galaxycloudve6.8.61 of 3See more

galaxy cloudve 6.8.6

1 of the 3 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
curl@8.14.1-2+deb13u4
no fix listed

Open the chart page →

5,552
galaxy-depscloudve1.1.11 of 7See more

galaxy-deps cloudve 1.1.1

1 of the 7 container images this version deploys carry CVE-2026-12064.

Container imageDigestPackageFixed in
bitnamilegacy/kubectl:latestcd354d5b2556
curl@7.88.1-10+deb12u12
no fix listed

Open the chart page →

10,543

Container images carrying it

877 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
public.ecr.aws/jtekt-corporation/shinsei-manager-front:v1.5.5f8fb4eea4071
curl@7.88.1-10+deb12u5
no fix listed
1
public.ecr.aws/jtekt-corporation/time-series-storage-service:v1.5.1046ef5c9ed50
curl@7.88.1-10+deb12u4
no fix listed
1
public.ecr.aws/k2x0t8t6/kubeadapt/app/kubeadapt-k8s-pulse:v3.0.1dc5a516c2333
curl@7.88.1-10+deb12u14
no fix listed
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
curl@7.88.1-10+deb12u8
no fix listed
1
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
curl@7.88.1-10+deb12u5
no fix listed
1
quay.io/argoprojlabs/argocd-image-updater:v1.2.13c56f354fac5
curl@8.19.0-r0
8.22.0-r0
1
quay.io/argoprojlabs/gitops-promoter:v0.38.19c8a510dc25e
curl@8.14.1-2+deb13u4
no fix listed
1
quay.io/deployhub/ms-nginx:svccat-v11.0.815-g717581d2d3400664e8
curl@8.17.0-r1
8.22.0-r0
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
curl@8.14.1-2+deb13u4
no fix listed
1
quay.io/groundcover/tools:20260719b705e0cbe171
curl@1:8.14.1-2+deb13u3+e1
8.14.1-2+e22
1
quay.io/jupyterhub/k8s-hub:4.4.2108fbb01c3fe
curl@7.88.1-10+deb12u15
no fix listed
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
curl@7.88.1-10+deb12u14
no fix listed
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
curl@7.88.1-10+deb12u14
no fix listed
1
quay.io/jupyterhub/k8s-singleuser-sample:4.4.265e1b09fc8c9
curl@7.88.1-10+deb12u15
no fix listed
1
quay.io/opsmxpublic/ubi8-oes-datascience:isd-spin-2025.10.01-af26a30d4-202511261054d8f66f4117fe
curl@8.14.1-2+deb13u2
no fix listed
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
curl@7.88.1-10+deb12u1
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-frontend:1.0.3166353ce9bf98
curl@8.14.1-2+deb13u2
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
curl@7.88.1-10+deb12u14
no fix listed
1
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao:v2.5.5-gitlab25b7636dfba3f
curl@8.14.1-2+deb13u4
no fix listed
1
registry.gitlab.com/school_guy/docker-typo3:13.4.30-197d868ed76185d7270d
curl@7.88.1-10+deb12u14
no fix listed
1
registry.gitlab.com/shortlink-org/shortlink/bff:latestf2194e526915
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/shortlink-org/shortlink/link:latest86d87291ffd4
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/technostructures/posca/posca:latesta693021686ca
curl@8.17.0-r1
8.22.0-r0
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
curl@8.20.0-r0
8.22.0-r0
1
registry.k8s.io/git-sync/git-sync:v4.5.00e64aedb0d0a
curl@8.14.1-2
no fix listed
1
registry.k8s.io/git-sync/git-sync:v4.1.0fd9722fd02e3
curl@7.88.1-10+deb12u4
no fix listed
1
registry.k8s.io/provider-os/manila-csi-plugin:v1.36.0190976e2e2fe
curl@8.17.0-r1
8.22.0-r0
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.