StackRadar

CVE-2026-33812

Unscored

Advisory

Published 21 Apr 2026In the index since 5 Sept 2026
Severity
Unscored
worst across findings
CVSS
—
base score, highest
EPSS
0.001
2nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
108
of 17,781 indexed, latest versions
Container images
106
deployed by those charts
Fix available
1 of 1
affected package

Excessive memory allocation when decoding malicious SFNT in golang.org/x/image

Carried by container images the latest versions of 108 of 17,781 indexed charts deploy, on 106 images.

Affected packageAffected versionsFixed inImages
golang.org/x/imagegolangv0.0.0-20190802002840-cff245a6509b, v0.0.0-20191009234506-e7c1f5e7dbb8, v0.0.0-20201208152932-35266b937fa6, v0.0.0-20210216034530-4410531fe030+35 more0.39.0106
OSV records
GO-2026-4962

Charts affected

108 by stars
ChartLatestAffected imagesRadar Score
artifact-hubartifact-hubVerified publisher1.23.03 of 7See more

artifact-hub artifact-hub 1.23.0

3 of the 7 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
artifacthub/hub:v1.23.07d3a91c539dc
golang.org/x/image@v0.25.0
0.39.0
artifacthub/scanner:v1.23.02d8365601f0e
golang.org/x/image@v0.25.0
0.39.0
artifacthub/tracker:v1.23.05368d21a6e5c
golang.org/x/image@v0.25.0
0.39.0

Open the chart page →

10,755
imgproxyimgproxy1.1.01 of 1See more

imgproxy imgproxy 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
ghcr.io/imgproxy/imgproxy:v3.30.074c1bee92e04
golang.org/x/image@v0.31.0
0.39.0

Open the chart page →

2,321
supabasetokens-studioVerified publisher1.0.01 of 14See more

supabase tokens-studio 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
darthsim/imgproxy:v3.26476cb08c816a
golang.org/x/image@v0.21.0
0.39.0

Open the chart page →

23,123
minifluxgabe565Verified publisher0.9.21 of 2See more

miniflux gabe565 0.9.2

1 of the 2 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
ghcr.io/miniflux/miniflux:2.2.5bacc9b78ec61
golang.org/x/image@v0.23.0
0.39.0

Open the chart page →

1,247
openclawopenclawVerified publisher1.91.31 of 2See more

openclaw openclaw 1.91.3

1 of the 2 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/helm-openclaw/openclaw:1.91.3ed44d81a65de
golang.org/x/image@v0.20.0
0.39.0

Open the chart page →

2,977
ilumilumOfficialVerified publisher6.7.31 of 19See more

ilum ilum 6.7.3

1 of the 19 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
gitea/gitea:1.22.376f516a1a8c2
golang.org/x/image@v0.18.0
0.39.0

Open the chart page →

23,228
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
openmined/syft-seaweedfs:0.9.53a4144c0bb82
golang.org/x/image@v0.15.0
0.39.0

Open the chart page →

17,245
gatustwin1.5.01 of 1See more

gatus twin 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
twinproduction/gatus:v5.34.03fff895e77d3
golang.org/x/image@v0.18.0
0.39.0

Open the chart page →

721
codercoderOfficialVerified publisher1.44.61 of 2See more

coder coder 1.44.6

1 of the 2 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
coderenvs/coder-service:1.44.61deffc4670e6
golang.org/x/image@v0.0.0-20210216034530-4410531fe030
0.39.0

Open the chart page →

6,849
filebrowserutkuozdemirVerified publisher1.0.01 of 1See more

filebrowser utkuozdemir 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.23.086e8449ff8ff
golang.org/x/image@v0.0.0-20220413100746-70e8d0d3baa9
0.39.0

Open the chart page →

3,073
goldpingerokgoloveVerified publisher6.2.01 of 1See more

goldpinger okgolove 6.2.0

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
bloomberg/goldpinger:3.10.08520120f5598
golang.org/x/image@v0.13.0
0.39.0

Open the chart page →

715
mattermostphntom3.24.01 of 2See more

mattermost phntom 3.24.0

1 of the 2 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
phntom/mattermost-team-edition:9.3.051cf9da4aa2e
golang.org/x/image@v0.8.0
0.39.0

Open the chart page →

8,722
listmonkdeliveryheroVerified publisher0.1.121 of 1See more

listmonk deliveryhero 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
listmonk/listmonk:v2.1.0d2eac77ddfad
golang.org/x/image@v0.0.0-20210628002857-a66eb6448b8d
0.39.0

Open the chart page →

2,537
coreinstill-aiOfficialVerified publisher0.1.752 of 15See more

core instill-ai 0.1.75

2 of the 15 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
instill/mgmt-backend:d0933d4ebe12f77a3f9
golang.org/x/image@v0.27.0
0.39.0
instill/model-backend:611f0f2e980125e5ba5
golang.org/x/image@v0.19.0
0.39.0

Open the chart page →

30,816
pocketbasetechwolf12Verified publisher0.29.31 of 1See more

pocketbase techwolf12 0.29.3

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
ghcr.io/techwolf12/pocketbase:0.29.3106099641679
golang.org/x/image@v0.29.0
0.39.0

Open the chart page →

1,446
anteonanteonVerified publisher2.6.41 of 13See more

anteon anteon 2.6.4

1 of the 13 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
chrislusf/seaweedfs:3.64634b094b2183
golang.org/x/image@v0.15.0
0.39.0

Open the chart page →

22,202
dbrepodbrepo1.13.31 of 25See more

dbrepo dbrepo 1.13.3

1 of the 25 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
bitnamilegacy/seaweedfs:3.87.0-debian-12-r10cb31d0fc356
golang.org/x/image@v0.24.0
0.39.0

Open the chart page →

52,635
navidromeemmas-chartsVerified publisher0.0.61 of 1See more

navidrome emmas-charts 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
deluan/navidrome:0.50.02cf4442b0099
golang.org/x/image@v0.14.0
0.39.0

Open the chart page →

2,129
memosgabe565Verified publisher0.17.01 of 1See more

memos gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
ghcr.io/usememos/memos:0.24.04723d86e6797
golang.org/x/image@v0.21.0
0.39.0

Open the chart page →

1,323
filebrowsergeek-cookbookVerified publisher1.4.21 of 1See more

filebrowser geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.18.04fcd47af573c
golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8
0.39.0

Open the chart page →

3,474
focalboardgeek-cookbookVerified publisher4.4.21 of 1See more

focalboard geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
mattermost/focalboard:0.9.031078df7a3c8
golang.org/x/image@v0.0.0-20210220032944-ac19c3e999fb
0.39.0

Open the chart page →

3,631
stashgeek-cookbookVerified publisher3.4.21 of 1See more

stash geek-cookbook 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
stashapp/stash:latest24dbd7607174
golang.org/x/image@v0.0.0-20190802002840-cff245a6509b
0.39.0

Open the chart page →

15,856
tailscalekubernetes-homelab-helm-chartsVerified publisher0.1.21 of 2See more

tailscale kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
tailscale/tailscale:v1.96.5dbeff02d2337
golang.org/x/image@v0.27.0
0.39.0

Open the chart page →

1,037
photoprismmmontesVerified publisher0.14.01 of 1See more

photoprism mmontes 0.14.0

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
photoprism/photoprism:251130db16ee6b1ba3
golang.org/x/image@v0.33.0
0.39.0

Open the chart page →

11,103
model-manager-loadermodel-manager-loader1.27.01 of 1See more

model-manager-loader model-manager-loader 1.27.0

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
public.ecr.aws/cloudnatix/llmariner/model-manager-loader:1.27.026ac7263a823
golang.org/x/image@v0.22.0
0.39.0

Open the chart page →

2,680
openccuopenccuVerified publisher3.89.81 of 1See more

openccu openccu 3.89.8

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
ghcr.io/openccu/openccu:3.89.8.20260719b2de2ff6e8e0
golang.org/x/image@v0.27.0
0.39.0

Open the chart page →

1,916
kyoorubxkubeVerified publisher0.1.101 of 9See more

kyoo rubxkube 0.1.10

1 of the 9 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
ghcr.io/zoriya/kyoo_transcoder:4.7.12dadea51a91e
golang.org/x/image@v0.23.0
0.39.0

Open the chart page →

30,234
artifact-hubsoftonic1.19.03 of 8See more

artifact-hub softonic 1.19.0

3 of the 8 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
artifacthub/hub:v1.19.0111918d8c399
golang.org/x/image@v0.10.0
0.39.0
artifacthub/scanner:v1.19.0323d026e78c3
golang.org/x/image@v0.10.0
0.39.0
artifacthub/tracker:v1.19.06596c8c4d955
golang.org/x/image@v0.10.0
0.39.0

Open the chart page →

14,491
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
darthsim/imgproxy:v3.30.13b709e4a0e5e
golang.org/x/image@v0.31.0
0.39.0

Open the chart page →

18,075
quialexmorbo-quiVerified publisher0.1.01 of 1See more

qui alexmorbo-qui 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
ghcr.io/autobrr/qui:v1.14.110b7945d4f09
golang.org/x/image@v0.35.0
0.39.0

Open the chart page →

1,623
ddosifyanteonVerified publisher1.7.51 of 13See more

ddosify anteon 1.7.5

1 of the 13 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
chrislusf/seaweedfs:3.56ed80f00fde46
golang.org/x/image@v0.11.0
0.39.0

Open the chart page →

25,669
apishiftapishiftVerified publisher0.3.01 of 4See more

apishift apishift 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
quay.io/everythingascode/apishift-backend:v0.3.014ff275b2e61
golang.org/x/image@v0.21.0
0.39.0

Open the chart page →

2,902
platform-apiappscodeVerified publisher2026.9.111 of 3See more

platform-api appscode 2026.9.11

1 of the 3 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
ghcr.io/appscode/gotenberg:8.25f9104080d9a7
golang.org/x/image@v0.32.0
0.39.0

Open the chart page →

37,268
bitpokebitpokeVerified publisher1.8.191 of 1See more

bitpoke bitpoke 1.8.19

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
gcr.io/press-labs-public/dashboard:1.8.19b88f88070fb0
golang.org/x/image@v0.0.0-20220302094943-723b81ca9867
0.39.0

Open the chart page →

2,312
goldpingerchristianhuthVerified publisher1.4.01 of 1See more

goldpinger christianhuth 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
bloomberg/goldpinger:3.11.2a1fb87c2e9d9
golang.org/x/image@v0.35.0
0.39.0

Open the chart page →

280
cortezacorteza1.0.121 of 3See more

corteza corteza 1.0.12

1 of the 3 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
cortezaproject/corteza:2024.9.4cb9f200de5d2
golang.org/x/image@v0.18.0
0.39.0

Open the chart page →

8,368
corteza-all-in-onecorteza0.1.01 of 2See more

corteza-all-in-one corteza 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
cortezaproject/corteza:2024.9.08eb7a26605c9
golang.org/x/image@v0.15.0
0.39.0

Open the chart page →

4,644
ociscosmicrocks0.7.01 of 2See more

ocis cosmicrocks 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
owncloud/ocis:7.1.388e7c854517d
golang.org/x/image@v0.22.0
0.39.0

Open the chart page →

1,925
cospacecospace0.0.341 of 3See more

cospace cospace 0.0.34

1 of the 3 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
ghcr.io/twigex/cospace:lateste5ecfd607e42
golang.org/x/image@v0.0.0-20210607152325-775e3b0c77b9
0.39.0

Open the chart page →

2,253
csghubcsghubVerified publisher2.4.32 of 34See more

csghub csghub 2.4.3

2 of the 34 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
casbin/casdoor:3.62.0e08231f16c00
golang.org/x/image@v0.18.0
0.39.0
opencsghq/csghub-portal:v2.4.0-ee93ad59164d87
golang.org/x/image@v0.28.0
0.39.0

Open the chart page →

58,897
csgshipcsghubVerified publisher0.4.61 of 10See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
casbin/casdoor:3.62.17729da148c61
golang.org/x/image@v0.18.0
0.39.0

Open the chart page →

11,335
photoprismdjjudas21Verified publisher99.99.991 of 1See more

photoprism djjudas21 99.99.99

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
photoprism/photoprism:240711-cefc6fd632ca74
golang.org/x/image@v0.18.0
0.39.0

Open the chart page →

16,954
commentoduyet0.2.01 of 2See more

commento duyet 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
registry.gitlab.com/commento/commento:v1.8.0e0ab1fc86761
golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8
0.39.0

Open the chart page →

2,679
Navidromeemmas-chartsVerified publisher0.0.41 of 1See more

Navidrome emmas-charts 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
deluan/navidrome:0.49.311a24da08977
golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8
0.39.0

Open the chart page →

2,837
kube-ecp-stackemqx-operator2.5.11 of 16See more

kube-ecp-stack emqx-operator 2.5.1

1 of the 16 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
emqx/ecp-main:2.5.1fa876f71e5d6
golang.org/x/image@v0.18.0
0.39.0

Open the chart page →

23,685
testnet-homepageethereum-helm-chartsVerified publisher0.2.31 of 1See more

testnet-homepage ethereum-helm-charts 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
skylenet/ethereum-testnet-homepage:latest8698903e379f
golang.org/x/image@v0.0.0-20210220032944-ac19c3e999fb
0.39.0

Open the chart page →

2,681
siyuanextrim-helm-chartsVerified publisher0.1.11 of 2See more

siyuan extrim-helm-charts 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
b3log/siyuan:v3.1.2595c0d129bc19
golang.org/x/image@v0.24.0
0.39.0

Open the chart page →

1,247
mission-controlflanksourceVerified publisher0.1.3361 of 8See more

mission-control flanksource 0.1.336

1 of the 8 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
ghcr.io/flanksource/postgres:17.6-497383cebcf66281fc1
golang.org/x/image@v0.32.0
0.39.0

Open the chart page →

8,902
dendritegeek-cookbookVerified publisher6.4.01 of 1See more

dendrite geek-cookbook 6.4.0

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
ghcr.io/matrix-org/dendrite-monolith:v0.9.43267d27d392f
golang.org/x/image@v0.0.0-20220413100746-70e8d0d3baa9
0.39.0

Open the chart page →

2,143
gatusgeek-cookbookVerified publisher1.1.21 of 1See more

gatus geek-cookbook 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-33812.

Container imageDigestPackageFixed in
twinproduction/gatus:v3.8.049dc0d9b2e2c
golang.org/x/image@v0.0.0-20210628002857-a66eb6448b8d
0.39.0

Open the chart page →

1,881

Container images carrying it

106 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/usememos/memos:0.24.04723d86e6797
golang.org/x/image@v0.21.0
0.39.0
1
ghcr.io/zoriya/kyoo_transcoder:4.7.12dadea51a91e
golang.org/x/image@v0.23.0
0.39.0
1
quay.io/everythingascode/apishift-backend:v0.3.014ff275b2e61
golang.org/x/image@v0.21.0
0.39.0
1
registry.gitlab.com/commento/commento:v1.8.0e0ab1fc86761
golang.org/x/image@v0.0.0-20191009234506-e7c1f5e7dbb8
0.39.0
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
golang.org/x/image@v0.20.0
0.39.0
1
registry.gitlab.com/xrow-public/helm-openclaw/openclaw:1.91.3ed44d81a65de
golang.org/x/image@v0.20.0
0.39.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.