StackRadar

CVE-2026-32280

High

Advisory

Published 7 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
48th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
3,849
of 17,792 indexed, latest versions
Container images
4,396
deployed by those charts
Fix available
1 of 2
affected packages

Unexpected work during chain building in crypto/x509

Carried by container images the latest versions of 3,849 of 17,792 indexed charts deploy, on 4,396 images.

Affected packageAffected versionsFixed inImages
golang-1.19deb1.19.8-2no fix listed1
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+177 more1.25.94,396
OSV records
DEBIAN-CVE-2026-32280GO-2026-4947
Also known as
BIT-golang-2026-32280

Charts affected

3,849 by stars
ChartLatestAffected imagesRadar Score
configmapsecretsmozilla0.0.11 of 1See more

configmapsecrets mozilla 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
mzinc/configmapsecret-controller:v0.5.1eebbcbf2d1f7
stdlib@go1.16.1
1.25.9

Open the chart page →

2,109
tianjimsgbyte0.1.171 of 2See more

tianji msgbyte 0.1.17

1 of the 2 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
moonrailgun/tianji:1.11.2b528c8f8fcc4
stdlib@go1.20.12
1.25.9

Open the chart page →

4,562
ms-hello-webms-hello-test0.1.01 of 1See more

ms-hello-web ms-hello-test 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
irakli/ms-web-hello:latest966a4bfefe27
stdlib@go1.19.2
1.25.9

Open the chart page →

755
adguard-homemt1905024.0.121 of 2See more

adguard-home mt190502 4.0.12

1 of the 2 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
adguard/adguardhome:v0.107.737fbf01d73ecb
stdlib@go1.25.7
1.25.9

Open the chart page →

1,167
codimdmt1905027.2.21 of 3See more

codimd mt190502 7.2.2

1 of the 3 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/postgres:184ef4dbc939d6
stdlib@go1.24.6
1.25.9

Open the chart page →

1,667
commafeedmt1905028.2.01 of 3See more

commafeed mt190502 8.2.0

1 of the 3 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/postgres:184ef4dbc939d6
stdlib@go1.24.6
1.25.9

Open the chart page →

3,758
ghostmt1905028.25.12 of 3See more

ghost mt190502 8.25.1

2 of the 3 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
stdlib@go1.24.6
1.25.9
library/mysql:8b3b90af2a655
stdlib@go1.24.6
1.25.9

Open the chart page →

5,001
keycloakmt1905021.4.61 of 3See more

keycloak mt190502 1.4.6

1 of the 3 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/postgres:184ef4dbc939d6
stdlib@go1.24.6
1.25.9

Open the chart page →

2,942
maddymt1905024.1.21 of 1See more

maddy mt190502 4.1.2

1 of the 1 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
foxcpp/maddy:0.9.2a4b839985b9b
stdlib@go1.23.12
1.25.9

Open the chart page →

900
memosmt1905027.3.22 of 3See more

memos mt190502 7.3.2

2 of the 3 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/postgres:184ef4dbc939d6
stdlib@go1.24.6
1.25.9
neosmemo/memos:0.26.23eefcc231141
stdlib@go1.25.7
1.25.9

Open the chart page →

2,491
minifluxmt1905021.1.62 of 3See more

miniflux mt190502 1.1.6

2 of the 3 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/postgres:184ef4dbc939d6
stdlib@go1.24.6
1.25.9
miniflux/miniflux:2.2.18a3ca6bbc1f74
stdlib@go1.26.1
1.25.9

Open the chart page →

2,710
nightscoutmt1905021.1.01 of 3See more

nightscout mt190502 1.1.0

1 of the 3 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
stdlib@go1.21.12
1.25.9

Open the chart page →

6,659
open-webuimt1905022.3.101 of 3See more

open-webui mt190502 2.3.10

1 of the 3 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/postgres:184ef4dbc939d6
stdlib@go1.24.6
1.25.9

Open the chart page →

1,667
paperless-ngxmt1905027.6.142 of 4See more

paperless-ngx mt190502 7.6.14

2 of the 4 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/postgres:184ef4dbc939d6
stdlib@go1.24.6
1.25.9
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
stdlib@go1.24.4
1.25.9

Open the chart page →

12,072
umamimt1905028.1.41 of 3See more

umami mt190502 8.1.4

1 of the 3 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/postgres:184ef4dbc939d6
stdlib@go1.24.6
1.25.9

Open the chart page →

4,054
vaultwardenmt1905027.3.41 of 3See more

vaultwarden mt190502 7.3.4

1 of the 3 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/postgres:184ef4dbc939d6
stdlib@go1.24.6
1.25.9

Open the chart page →

4,774
vikunjamt1905027.1.22 of 3See more

vikunja mt190502 7.1.2

2 of the 3 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/postgres:184ef4dbc939d6
stdlib@go1.24.6
1.25.9
vikunja/vikunja:0.24.6ed1f3ed467fe
stdlib@go1.23.4
1.25.9

Open the chart page →

3,009
mongodbmulti-chart-app0.1.01 of 1See more

mongodb multi-chart-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/mongo:7b096b4cb9269
stdlib@go1.24.6
1.25.9

Open the chart page →

1,994
my-multi-chart-appmulti-chart-app0.1.01 of 2See more

my-multi-chart-app multi-chart-app 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/mongo:7b096b4cb9269
stdlib@go1.24.6
1.25.9

Open the chart page →

3,855
multusmultusVerified publisher0.2.02 of 2See more

multus multus 0.2.0

2 of the 2 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
ghcr.io/k8snetworkplumbingwg/multus-cni:v4.1.409fdfb7ce090
stdlib@go1.23.4
1.25.9
ghcr.io/k8snetworkplumbingwg/multus-dynamic-networks-controller:v0.3.72a2bb32c0ea8
stdlib@go1.22.12
1.25.9

Open the chart page →

1,866
devops-demomungari-development-charts1.0.42 of 4See more

devops-demo mungari-development-charts 1.0.4

2 of the 4 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/postgres:latest4ef4dbc939d6
stdlib@go1.24.6
1.25.9
ghcr.io/perceptolab/devops-demo-app:0.0.2cdc0658c40fb
stdlib@go1.18.4
1.25.9

Open the chart page →

9,004
pagesmuthu-pages1.0.01 of 3See more

pages muthu-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.25.9

Open the chart page →

20,262
approuvezmvisonneau0.1.11 of 1See more

approuvez mvisonneau 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
ghcr.io/mvisonneau/approuvez:v0.1.0441da62e6cb3
stdlib@go1.15.6
1.25.9

Open the chart page →

1,978
unpollermvisonneau0.1.01 of 1See more

unpoller mvisonneau 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
golift/unifi-poller:v2.9.2585a29a06d05
stdlib@go1.21.0
1.25.9

Open the chart page →

1,190
ingress-nginxmxytest4.15.12 of 2See more

ingress-nginx mxytest 4.15.1

2 of the 2 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.15.1594ceea76b01
stdlib@go1.26.1
1.25.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.901038e7de14b
stdlib@go1.26.1
1.25.9

Open the chart page →

1,541
danboorumy0nVerified publisher0.0.21 of 1See more

danbooru my0n 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
stdlib@go1.18
1.25.9

Open the chart page →

12,867
danbooru-stackmy0nVerified publisher0.0.31 of 4See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
stdlib@go1.18
1.25.9

Open the chart page →

12,867
authmyaVerified publisher22.4.31 of 1See more

auth mya 22.4.3

1 of the 1 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
cesanta/docker_auth:1.6.04d16885f3d4c
stdlib@go1.13.7
1.25.9

Open the chart page →

2,381
clickhousemyaVerified publisher0.2403.11 of 1See more

clickhouse mya 0.2403.1

1 of the 1 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:24.2ed9640bfff07
stdlib@go1.19.10
1.25.9

Open the chart page →

3,607
cognativemyaVerified publisher0.2403.33 of 3See more

cognative mya 0.2403.3

3 of the 3 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:24.2ed9640bfff07
stdlib@go1.19.10
1.25.9
grafana/grafana:10.4.0f9811e4e687f
stdlib@go1.21.8
1.25.9
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
stdlib@go1.21.7
1.25.9

Open the chart page →

7,375
giteamyaVerified publisher23.12.51 of 1See more

gitea mya 23.12.5

1 of the 1 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
gitea/gitea:1.21.6ac73e0da341f
stdlib@go1.21.7
1.25.9

Open the chart page →

3,436
redismyaVerified publisher22.4.101 of 2See more

redis mya 22.4.10

1 of the 2 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
quay.io/oliver006/redis_exporter:v1.35.1908dbee5c546
stdlib@go1.17.7
1.25.9

Open the chart page →

1,050
redis-queuemyaVerified publisher22.4.61 of 2See more

redis-queue mya 22.4.6

1 of the 2 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
quay.io/oliver006/redis_exporter:v1.35.1908dbee5c546
stdlib@go1.17.7
1.25.9

Open the chart page →

1,050
redis-raftmyaVerified publisher22.5.41 of 2See more

redis-raft mya 22.5.4

1 of the 2 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
quay.io/oliver006/redis_exporter:v1.35.1908dbee5c546
stdlib@go1.17.7
1.25.9

Open the chart page →

1,050
myhelmappmyhelmapp0.1.11 of 1See more

myhelmapp myhelmapp 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
tobirachel/node-project3:v17d9f37154994
stdlib@go1.17.5
1.25.9

Open the chart page →

3,368
Practica_4_helmmy-heml-appVerified publisher0.1.03 of 7See more

Practica_4_helm my-heml-app 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.09fb4c11e6a49
stdlib@go1.18.10
1.25.9
library/mongo:5.0.6-focal8e70544b6c76
stdlib@go1.16.7
1.25.9
library/mysql:8.0.28fc77d54cacef
stdlib@go1.16.7
1.25.9

Open the chart page →

27,861
grafana-chartmy-personal-grafana0.1.01 of 1See more

grafana-chart my-personal-grafana 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
stdlib@go1.25.7
1.25.9

Open the chart page →

728
influxdbmy-personal-influxdb20.1.01 of 1See more

influxdb my-personal-influxdb2 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/influxdb:2.7b8d940ca9376
stdlib@go1.18.2
1.25.9

Open the chart page →

3,896
phonebook-chartmy-phonebook-chart0.1.01 of 3See more

phonebook-chart my-phonebook-chart 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
stdlib@go1.18.2
1.25.9

Open the chart page →

3,032
mychartmysqlweb0.1.01 of 1See more

mychart mysqlweb 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
qichenxu4pd/mysqlweb:1.2d758d41d9c6b
stdlib@go1.18.2
1.25.9

Open the chart page →

1,156
myweatherhelmmyweather1.3.111 of 7See more

myweatherhelm myweather 1.3.11

1 of the 7 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/rabbitmq:3-managemente582c0bc7766
stdlib@go1.22.2
1.25.9

Open the chart page →

18,114
fargate-sidecar-injectormziyaboVerified publisher0.1.51 of 1See more

fargate-sidecar-injector mziyabo 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
mziyabo/fargate-eks-sidecar-injector:latest3067dce17983
stdlib@go1.19.13
1.25.9

Open the chart page →

1,393
victoria-metrics-singlenaps0.0.61 of 1See more

victoria-metrics-single naps 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
victoriametrics/victoria-metrics:v1.34.7b50d5c0153f9
stdlib@go1.14.1
1.25.9

Open the chart page →

1,315
pagesnarain1.0.01 of 3See more

pages narain 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.25.9

Open the chart page →

20,262
pagesnarasimha-pages1.0.01 of 3See more

pages narasimha-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.25.9

Open the chart page →

20,262
traefik-forward-auth-openidnas-helm-chartsVerified publisher1.0.11 of 1See more

traefik-forward-auth-openid nas-helm-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
thomseddon/traefik-forward-auth:latestb364aa6a4117
stdlib@go1.13.15
1.25.9

Open the chart page →

2,197
nats-kafkanatsVerified publisher0.15.41 of 1See more

nats-kafka nats 0.15.4

1 of the 1 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
natsio/nats-kafka:1.4.2bb241956b0dc
stdlib@go1.20
1.25.9

Open the chart page →

1,731
nats-operatornatsVerified publisher0.8.31 of 1See more

nats-operator nats 0.8.3

1 of the 1 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
natsio/nats-operator:0.8.31261dae38389
stdlib@go1.16.10
1.25.9

Open the chart page →

2,354
account-servernatz-operatorVerified publisher0.9.51 of 1See more

account-server natz-operator 0.9.5

1 of the 1 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
ghcr.io/zeiss/natz-operator/account-server:0.9.5b380b5f17c3f
stdlib@go1.23.3
1.25.9

Open the chart page →

745
pagesnavin-brixton1.0.01 of 3See more

pages navin-brixton 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-32280.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.25.9

Open the chart page →

20,262

Container images carrying it

4,396 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
aquasec/harbor-scanner-trivy:0.20.07ea4aa3d2eb6
stdlib@go1.16.4
1.25.9
1
aquasec/kube-bench:v0.6.176672264accce
stdlib@go1.20.4
1.25.9
1
aquasec/kube-bench:v0.15.07a8fa32dce21
stdlib@go1.26.0
1.25.9
1
aquasec/kube-bench:v0.6.9c329d73fea58
stdlib@go1.19
1.25.9
1
aquasec/postee:2.12.0-amd640795cba777e7
stdlib@go1.18.10
1.25.9
1
aquasec/postee-ui:2.12.0-amd64c0467c3941dc
stdlib@go1.18.10
1.25.9
1
aquasec/starboard-operator:0.15.4be34f709e1ce
stdlib@go1.17.8
1.25.9
1
aquasec/tracee:0.24.1cfbbfee972e6
stdlib@go1.24.9
1.25.9
1
aquasec/trivy:0.43.1944a04445179
stdlib@go1.19.10
1.25.9
1
aquasec/trivy:0.32.0973d0df16189
stdlib@go1.19
1.25.9
1
aquasec/trivy:0.69.3bcc376de8d77
stdlib@go1.25.7
1.25.9
1
archivebox/archivebox:0.7.41a5a37331091
stdlib@go1.24.6
1.25.9
1
arconixforge/mongodb-secure-backup:v1.1c08d7c438966
stdlib@go1.22.10
1.25.9
1
aristidetm/basic-notebook:3.6.5469dbc951224
stdlib@go1.22.5
1.25.9
1
artifacthub/db-migrator:v1.19.02a746b289fcd
stdlib@go1.22.4
1.25.9
1
artifacthub/hub:v1.19.0111918d8c399
stdlib@go1.22.4
1.25.9
1
artifacthub/scanner:v1.23.02d8365601f0e
stdlib@go1.25.7
1.25.9
1
artifacthub/scanner:v1.19.0323d026e78c3
stdlib@go1.21.8
1.25.9
1
artifacthub/tracker:v1.23.05368d21a6e5c
stdlib@go1.24.4
1.25.9
1
artifacthub/tracker:v1.19.06596c8c4d955
stdlib@go1.22.4
1.25.9
1
artur9010/wait-for:v1.0.06b4de3ce8b0e
stdlib@go1.22.4
1.25.9
1
arunvelsriram/utils:latest655ad18fd8d6
stdlib@go1.23.8
1.25.9
1
assistiot/authorization_db:latestc3adbab6a3e7
stdlib@go1.18.2
1.25.9
1
assistiot/cybersecurity-monitoring_id-wzh:latest0aacefac9677
stdlib@go1.14.12
1.25.9
1
assistiot/cybersecurity-monitoring_ir-cas:latest6a107f224c34
stdlib@go1.18.2
1.25.9
1
assistiot/data_integrity_verification:1.0.0eb7f5d765ab6
stdlib@go1.17.13
1.25.9
1
assistiot/distributed_broker:1.0.033e02dad168f
stdlib@go1.17.13
1.25.9
1
assistiot/dlt_based_fl:1.1.04bc3d92788ed
stdlib@go1.17.13
1.25.9
1
assistiot/fl_orchestrator:dbmongo4-latestd157fbe150e3
stdlib@go1.17.10
1.25.9
1
assistiot/identity-manager_db:latest0d3e6d35f168
stdlib@go1.18.2
1.25.9
1
assistiot/logging_auditing:1.0.0790dbb198e86
stdlib@go1.17.13
1.25.9
1
assistiot/open_api_backend:1.1.230812ba93555
stdlib@go1.18.6
1.25.9
1
assistiot/smart-orchestrator_helm:latest9bb46ea14e8e
stdlib@go1.22.1
1.25.9
1
astarte/astarte-kubernetes-operator:26.5.1e3ff1b3c0c98
stdlib@go1.24.13
1.25.9
1
atlassian/bamboo:12.1.114af4bb6c8d46
stdlib@go1.22.2
1.25.9
1
atlassian/bamboo-agent-base:12.1.1151c2d7274eef
stdlib@go1.22.2
1.25.9
1
automatischio/automatisch:0.15.03bace7a12d5f
stdlib@go1.23.8
1.25.9
1
avaprotocol/ap-avs:1.2.0c430ea5c37d6
stdlib@go1.22.5
1.25.9
1
aveshasystems/spiffe-csi-driver:0.2.753fc6d009e04
stdlib@go1.22.2
1.25.9
1
b3log/siyuan:v3.1.2595c0d129bc19
stdlib@go1.24.1
1.25.9
1
baserow/backend:1.31.1e0b3c8130b91
stdlib@go1.19.8
1.25.9
1
baserow/baserow:1.30.1df0c42eb67e8
stdlib@go1.21.5
1.25.9
1
bbernhard/signal-cli-rest-api:0.57549ad08d7e14
stdlib@go1.17.8
1.25.9
1
beanbag/reviewboard:latest6b840f546e1c
stdlib@go1.18.1
1.25.9
1
bedag/goblackhole:0.2.0447a88598f4c
stdlib@go1.16.6
1.25.9
1
beopenit/door-agent:v3.0.5d24c323fe7c3
stdlib@go1.23.12
1.25.9
1
beopenit/door-cd-operator:v3.0.4d3999cb8d026
stdlib@go1.23.9
1.25.9
1
beopenit/door-helm:v3.0.1b4d9f9bee224
stdlib@go1.19.13
1.25.9
1
beopenit/onboarding-operator-kubernetes:v3.0.275a48144e682
stdlib@go1.18.10
1.25.9
1
berkeleyskypilot/skypilot:0.13.03bc8bf8f4d83
stdlib@go1.24.11
1.25.9
1

syft 1.42.1 · advisories as of 17 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.