StackRadar

CVE-2026-29167

Critical

Advisory

Published 8 Jun 2026In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.007
51st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
58
of 17,781 indexed, latest versions
Container images
56
deployed by those charts
Fix available
4 of 4
affected packages

Apache HTTP Server: mod_ldap per-dir use-after-free

Carried by container images the latest versions of 58 of 17,781 indexed charts deploy, on 56 images.

Affected packageAffected versionsFixed inImages
apache2deb2.4.41-4ubuntu3.11, 2.4.41-4ubuntu3.12, 2.4.41-4ubuntu3.14, 2.4.41-4ubuntu3.17+17 more2.4.41-4ubuntu3.23+esm6, 2.4.52-1ubuntu4.23, 2.4.58-1ubuntu8.15, 2.4.68-1~deb12u1+1 more43
apachebitnami2.4.54-157, 2.4.65-1, 2.4.68-1, 2.4.68-82.4.684
httpdrpm2.4.37-43.module+el8.5.0+13806+b30d9eec.1, 2.4.37-56.module+el8.8.0+18758+b3a9c8da.6, 2.4.37-65.module+el8.10.0+23815+1b5e1c66.7, 2.4.57-8.el9+4 more0:2.4.37-65.module+el8.10.0+24755+06195b95.10, 0:2.4.62-13.el9_8.69
mod_http2rpm1.15.7-10.module+el8.10.0+23369+11a81384.40:1.15.7-10.module+el8.10.0+24521+219dcfc5.71
OSV records
BIT-apache-2026-29167DEBIAN-CVE-2026-29167UBUNTU-CVE-2026-29167RHSA-2026:59347RHSA-2026:64794
Also known as
USN-8516-1, USN-8589-1

Charts affected

58 by stars
ChartLatestAffected imagesRadar Score
typo3schoolguys-helmcharts0.4.21 of 1See more

typo3 schoolguys-helmcharts 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-29167.

Container imageDigestPackageFixed in
registry.gitlab.com/school_guy/docker-typo3:13.4.30-197d868ed76185d7270d
apache2@2.4.67-1~deb12u2
2.4.68-1~deb12u1

Open the chart page →

4,836
testing-multitoolsomeblackmagic0.1.21 of 1See more

testing-multitool someblackmagic 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-29167.

Container imageDigestPackageFixed in
someblackmagic/k8s-testing-multitool:v0.1.06eca64b6b440
apache2@2.4.41-4ubuntu3.11
2.4.41-4ubuntu3.23+esm6

Open the chart page →

30,687
workshop-operatorstakaterVerified publisher0.0.381 of 2See more

workshop-operator stakater 0.0.38

1 of the 2 container images this version deploys carry CVE-2026-29167.

Container imageDigestPackageFixed in
stakater/workshop-operator:v0.0.3897bf456cc97c
httpd@2.4.37-43.module+el8.5.0+13806+b30d9eec.1
0:2.4.37-65.module+el8.10.0+24755+06195b95.10

Open the chart page →

6,671
nagvissvtech-public-helm-charts1.0.01 of 1See more

nagvis svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-29167.

Container imageDigestPackageFixed in
svtechnmaa/svtech_nagvis:v1.2.118394b08e6c3
apache2@2.4.57-2
2.4.68-1~deb12u1

Open the chart page →

9,102
rundecksvtech-public-helm-charts1.0.01 of 2See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-29167.

Container imageDigestPackageFixed in
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
apache2@2.4.41-4ubuntu3.17
2.4.41-4ubuntu3.23+esm6

Open the chart page →

18,756
nextcloudth-chartsVerified publisher0.4.01 of 1See more

nextcloud th-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-29167.

Container imageDigestPackageFixed in
library/nextcloud:31.0.6-apache588609d76b21
apache2@2.4.62-1~deb12u2
2.4.68-1~deb12u1

Open the chart page →

10,086
owncloudth-chartsVerified publisher0.2.11 of 1See more

owncloud th-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-29167.

Container imageDigestPackageFixed in
owncloud/server:10.15.051d9b74fc2a8
apache2@2.4.41-4ubuntu3.21
2.4.41-4ubuntu3.23+esm6

Open the chart page →

10,006
web-dvwaweb-dvwa1.16.01 of 2See more

web-dvwa web-dvwa 1.16.0

1 of the 2 container images this version deploys carry CVE-2026-29167.

Container imageDigestPackageFixed in
gulacedia/web-dvwa-new:v367b467d961ca
apache2@2.4.57-2
2.4.68-1~deb12u1

Open the chart page →

10,001

Container images carrying it

56 by charts deploying them

A fixed version is listed for 4 of the 4 affected packages.

Container imageDigestPackageFixed inUsed by
library/phpmyadmin:5.2.16e75aa8f767c
apache2@2.4.62-1~deb12u2
2.4.68-1~deb12u1
2
library/wordpress:6.8.3-apache:6.8-apache30bff39330d1
apache2@2.4.65-2
2.4.68-1~deb13u1
2
vdiogov/glpi-conteiner:latest6945f84f0058
apache2@2.4.61-1~deb12u1
2.4.68-1~deb12u1
2
yzhou442/equiz:latesta3f7ca69e28d
apache@2.4.54-157
2.4.68
2
akaunting/akaunting:3.0.1552811b36ec3a
apache2@2.4.57-2
2.4.68-1~deb12u1
1
bitnamilegacy/matomo:5.3.2-debian-12-r13f02c000c54b1
apache@2.4.65-1
2.4.68
1
bitnami/wordpress:latest8448af086f92
apache@2.4.68-8
2.4.68
1
checkmk/check-mk-community:2.5.0p6c11b422210c4
apache2@2.4.52-1ubuntu4.21
2.4.52-1ubuntu4.23
1
cloudtooling/moodle:5.2.3f4f04e0fc401
apache@2.4.68-1
2.4.68
1
codetogether/codetogether:latest4348c8a38752
httpd@2.4.57-11.el9_4
0:2.4.62-13.el9_8.6
1
dgraziotin/nginx-webdav-nononsense:1.23.138f2de42bed0
apache2@2.4.41-4ubuntu3.12
2.4.41-4ubuntu3.23+esm6
1
dokuwiki/dokuwiki:2025-05-14af08ecfdda239
apache2@2.4.65-2
2.4.68-1~deb13u1
1
dolibarr/dolibarr:22.0.47ad88fc9b13c
apache2@2.4.67-1~deb12u2
2.4.68-1~deb12u1
1
domainmod/domainmod:4.23.04017bfe4c597
apache2@2.4.57-2
2.4.68-1~deb12u1
1
dragonflyoss/client:v0.1.82edf3e921f4e0
apache2@2.4.59-1~deb12u1
2.4.68-1~deb12u1
1
espocrm/espocrm:9.3.101b5a24504ed9
apache2@2.4.67-1~deb13u3
2.4.68-1~deb13u1
1
gulacedia/web-dvwa-new:v367b467d961ca
apache2@2.4.57-2
2.4.68-1~deb12u1
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
apache2@2.4.66-1~deb12u1
2.4.68-1~deb12u1
1
jhoncytech/bookworm-apache-wordpress:latest18c3ca1f411e
apache2@2.4.57-2
2.4.68-1~deb12u1
1
jordan/icinga2:latestf75025fe8ea8
apache2@2.4.67-1~deb12u3
2.4.68-1~deb12u1
1
kfirfer/phppgadmin:7.13.0-22efb4a5d74a3
apache2@2.4.41-4ubuntu3.12
2.4.41-4ubuntu3.23+esm6
1
library/matomo:5.1.2-apache2415789e1602
apache2@2.4.62-1~deb12u2
2.4.68-1~deb12u1
1
library/nextcloud:31.0.6-apache588609d76b21
apache2@2.4.62-1~deb12u2
2.4.68-1~deb12u1
1
library/nextcloud:31.0.10-apacheb7faa1653c39
apache2@2.4.65-2
2.4.68-1~deb13u1
1
library/wordpress:6.4.3-apache8ae66efb09a2
apache2@2.4.57-2
2.4.68-1~deb12u1
1
library/wordpress:php8.1-apachef73396626d2f
apache2@2.4.65-2
2.4.68-1~deb13u1
1
martinhelmich/typo3:12.4c83a4f3fd7ae
apache2@2.4.66-1~deb12u1
2.4.68-1~deb12u1
1
mautic/mautic:7-apacheeb8cc73d97e1
apache2@2.4.67-1~deb12u2
2.4.68-1~deb12u1
1
mediagis/nominatim:3.7c15e941485ef
apache2@2.4.41-4ubuntu3.12
2.4.41-4ubuntu3.23+esm6
1
mediagis/nominatim:4.2d0eae7b51374
apache2@2.4.52-1ubuntu4.7
2.4.52-1ubuntu4.23
1
openstackhelm/heat:wallaby-ubuntu_focalf728510bab3c
apache2@2.4.41-4ubuntu3.14
2.4.41-4ubuntu3.23+esm6
1
openstackhelm/keystone:wallaby-ubuntu_focale07d75953d2e
apache2@2.4.41-4ubuntu3.14
2.4.41-4ubuntu3.23+esm6
1
owncloud/server:10.15.051d9b74fc2a8
apache2@2.4.41-4ubuntu3.21
2.4.41-4ubuntu3.23+esm6
1
owncloud/server:10.16.274c53d341076
apache2@2.4.52-1ubuntu4.20
2.4.52-1ubuntu4.23
1
phpmyadmin/phpmyadmin:5.2.342a200db07b4
apache2@2.4.65-2
2.4.68-1~deb13u1
1
roundcube/roundcubemail:1.6.16-apache-nonroot17d9d9580962
apache2@2.4.67-1~deb13u3
2.4.68-1~deb13u1
1
snipe/snipe-it:v8.3.1141ebf2386fe
apache2@2.4.58-1ubuntu8.8
2.4.58-1ubuntu8.15
1
snipe/snipe-it:v6.0.1455fb7636a98c
apache2@2.4.41-4ubuntu3.12
2.4.41-4ubuntu3.23+esm6
1
someblackmagic/k8s-testing-multitool:v0.1.06eca64b6b440
apache2@2.4.41-4ubuntu3.11
2.4.41-4ubuntu3.23+esm6
1
sonroyaalmerol/docker-sogo:5.12.43f60f3abe990
apache2@2.4.66-1~deb13u1
2.4.68-1~deb13u1
1
stakater/workshop-operator:v0.0.3897bf456cc97c
httpd@2.4.37-43.module+el8.5.0+13806+b30d9eec.1
0:2.4.37-65.module+el8.10.0+24755+06195b95.10
1
svtechnmaa/svtech_nagvis:v1.2.118394b08e6c3
apache2@2.4.57-2
2.4.68-1~deb12u1
1
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
apache2@2.4.41-4ubuntu3.17
2.4.41-4ubuntu3.23+esm6
1
ghcr.io/beslovas/duckdb-ui:1.3.272f35584026d
apache2@2.4.65-1~deb12u1
2.4.68-1~deb12u1
1
ghcr.io/k8s-at-home/apache-musicindex:v1.4.1-2c9bd82dc5fda
apache2@2.4.41-4ubuntu3.12
2.4.41-4ubuntu3.23+esm6
1
ghcr.io/monicahq/monica-next:main8be69156acbb
apache2@2.4.65-2
2.4.68-1~deb13u1
1
ghcr.io/nathanvaughn/webtrees:2.2.6034151b61a80
apache2@2.4.67-1~deb13u2
2.4.68-1~deb13u1
1
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
apache2@2.4.41-4ubuntu3.11
2.4.41-4ubuntu3.23+esm6
1
quay.io/ai-lab/llamacpp_python:latest70d138997acd
httpd@2.4.57-11.el9_4.1
0:2.4.62-13.el9_8.6
1
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
httpd@2.4.37-56.module+el8.8.0+18758+b3a9c8da.6
0:2.4.37-65.module+el8.10.0+24755+06195b95.10
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.