CVE-2026-32776
MediumAdvisory
Published 16 Mar 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.5
- base score, highest
- EPSS
- 0.002
- 6th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 1,385
- of 17,787 indexed, latest versions
- Container images
- 1,376
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
The matching OSV records carry no description.
Carried by container images the latest versions of 1,385 of 17,787 indexed charts deploy, on 1,376 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| expatdeb | 2.1.0-4ubuntu1, 2.1.0-4ubuntu1.4, 2.1.0-7ubuntu0.16.04.2, 2.1.0-7ubuntu0.16.04.3+33 more | 2.8.2-1~deb13u1 | 1,144 |
| expatapk | 2.5.0-r4, 2.6.2-r0, 2.6.3-r0, 2.6.4-r0+8 more | 2.7.5-r0 | 232 |
- OSV records
- ALPINE-CVE-2026-32776CGA-mxh2-cg9w-8rh2DEBIAN-CVE-2026-32776UBUNTU-CVE-2026-32776
- Also known as
- CGA-r2qv-8vvf-wqph
Charts affected
1,385 by stars
Container images carrying it
1,376 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| apache/ | 7cdfd8deec92 | expat | no fix listed | 2 |
| apache/ | 319cd8a81ed1 | expat | no fix listed | 2 |
| apache/ | ae0b86d3c4d0 | expat | no fix listed | 2 |
| cfssl/ | c9018c2ddf0b | expat | no fix listed | 2 |
| chromedp/ | 313ed7255ae1 | expat | 2.8.2-1~deb13u1 | 2 |
| cribl/ | 044f9a5fac9a | expat | no fix listed | 2 |
| excalidraw/ | f7ee194addd6 | expat | 2.7.5-r0 | 2 |
| fireflyiii/ | fe4ecec4c2ba | expat | 2.8.2-1~deb13u1 | 2 |
| fireflyiii/ | ab52bf932546 | expat | 2.8.2-1~deb13u1 | 2 |
| freeradius/ | 21c8bfa904d8 | expat | no fix listed | 2 |
| geoservercloud/ | 756559ee788a | expat | no fix listed | 2 |
| geoservercloud/ | 99540eef78ad | expat | no fix listed | 2 |
| geoservercloud/ | 5c254c53a357 | expat | no fix listed | 2 |
| geoservercloud/ | c687b1cbc891 | expat | no fix listed | 2 |
| geoservercloud/ | 5288f320cf36 | expat | no fix listed | 2 |
| geoservercloud/ | a30a60ac6cd0 | expat | no fix listed | 2 |
| gjeanmart/ | 926264c8f2d1 | expat | no fix listed | 2 |
| hjacobs/ | 4b2147f47425 | expat | no fix listed | 2 |
| homebridge/ | 77c685a40911 | expat | no fix listed | 2 |
| hookiesolutions/ | 0629694246ba | expat | no fix listed | 2 |
| hyperledger/ | a674d35eec9a | expat | no fix listed | 2 |
| istio/ | dbb7726d1bf0 | expat | no fix listed | 2 |
| istio/ | a78b7a165744 | expat | no fix listed | 2 |
| jenkins/ | b470bcdc4ecd | expat | no fix listed | 2 |
| jenkins/ | c4098086090c | expat | 2.8.2-1~deb13u1 | 2 |
| jlesage/ | 3d6cb102bd9b | expat | 2.7.5-r0 | 2 |
| kurento/ | 03c0d34d0828 | expat | no fix listed | 2 |
| langgenius/ | 09b7e8705673 | expat | no fix listed | 2 |
| library/ | 5aa8400b4b3b | expat | no fix listed | 2 |
| library/ | 7cbcec0086ac | expat | no fix listed | 2 |
| library/ | 6e23479198b9 | expat | 2.8.2-1~deb13u1 | 2 |
| library/ | 98f8ec75657d | expat | no fix listed | 2 |
| library/ | 9dd288848f44 | expat | 2.8.2-1~deb13u1 | 2 |
| library/ | 6e75aa8f767c | expat | no fix listed | 2 |
| library/ | eedf63967cdb | expat | no fix listed | 2 |
| library/ | 611107e29cce | expat | 2.7.5-r0 | 2 |
| library/ | 935b3f84c1e4 | expat | no fix listed | 2 |
| library/ | f020c06da226 | expat | no fix listed | 2 |
| library/ | 30bff39330d1 | expat | 2.8.2-1~deb13u1 | 2 |
| library/ | f258365d4882 | expat | no fix listed | 2 |
| lightstep/ | 11c5569aaf3b | expat | no fix listed | 2 |
| louislam/ | 917318f9d7be | expat | no fix listed | 2 |
| louislam/ | 9aeb4e51d038 | expat | no fix listed | 2 |
| louislam/ | a8610b3b4c38 | expat | no fix listed | 2 |
| mbentley/ | f4e682274bed | expat | no fix listed | 2 |
| memgraph/ | bd3fe13228f4 | expat | no fix listed | 2 |
| mesosphere/ | 073db43d0b8b | expat | no fix listed | 2 |
| moreillon/ | c9f85db3baa5 | expat | no fix listed | 2 |
| moreillon/ | e1c9bfab5c16 | expat | no fix listed | 2 |
| moreillon/ | b067dbbbb6af | expat | no fix listed | 2 |