CVE-2026-34986
HighAdvisory
Published 3 Apr 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.007
- 49th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 405
- of 17,781 indexed, latest versions
- Container images
- 402
- deployed by those charts
- Fix available
- 2 of 3
- affected packages
Go JOSE Panics in JWE decryption
Carried by container images the latest versions of 405 of 17,781 indexed charts deploy, on 402 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| github.com/ | v4.0.1, v4.0.2, v4.0.4, v4.0.5+4 more | 4.1.4 | 280 |
| github.com/ | v3.0.0, v3.0.1, v3.0.1-0.20221117193127-916db76e8214, v3.0.2+2 more | 3.0.5 | 169 |
| github.com/ | v2.6.3+incompatible | no fix listed | 4 |
- OSV records
- GHSA-78h2-9frx-2jm8
- Also known as
- GO-2026-4945
Charts affected
405 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| istio-service-meshwbstack | 0.0.1 | 1 of 1See more | 6,232 |
| argo-eventswenerme | 2.4.27 | 1 of 1See more | 969 |
| wexa-studiowexa-studio | 1.2.0 | 4 of 15See more | 14,983 |
| registrywiremindVerified publisher | 0.1.1 | 1 of 1See more | 1,187 |
| ygdrassil-monitoringygdrassilVerified publisher | 0.4.0 | 1 of 10See more | 9,381 |
Container images carrying it
402 by charts deploying them
A fixed version is listed for 2 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| 1password/ | 6297ca6136c0 | github.com/ | 4.1.4 | 1 |
| aerospike/ | be40d709c583 | github.com/ | 4.1.4 | 1 |
| alpine/ | 6dbe6f391eda | github.com/ | 4.1.4 | 1 |
| alpine/ | 7a319b15cfc9 | github.com/ | 4.1.4 | 1 |
| alpine/ | 7e1e7d5b7a96 | github.com/ | 4.1.4 | 1 |
| alpine/ | 9c4976d47656 | github.com/ | 4.1.4 | 1 |
| alpine/ | bd01dae02676 | github.com/ | 3.0.5 | 1 |
| alpine/ | cd560fce90f7 | github.com/ | 4.1.4 | 1 |
| alpine/ | e5c0b053fed7 | github.com/ | 4.1.4 | 1 |
| alpine/ | eec354133193 | github.com/ | 4.1.4 | 1 |
| apecloud/ | 98abc64aa985 | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| aquasec/ | bcc376de8d77 | github.com/ | 4.1.4 | 1 |
| artifacthub/ | 2d8365601f0e | github.com/ | 4.1.4 | 1 |
| artifacthub/ | 5368d21a6e5c | github.com/ | 4.1.4 | 1 |
| artifacthub/ | 6596c8c4d955 | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| bitnamilegacy/ | 33ae872fc99d | github.com/ | 3.0.5 | 1 |
| bitnamilegacy/ | cb8ab5515676 | github.com/ | 3.0.5 | 1 |
| bitnamilegacy/ | 5501c419f42e | github.com/ | 4.1.4 | 1 |
| bitnamilegacy/ | 6dabb4a2088c | github.com/ | 4.1.4 | 1 |
| bitnamilegacy/ | 8935e75fa5d1 | github.com/ | 4.1.4 | 1 |
| bitnamilegacy/ | 952f86d1116c | github.com/ | 4.1.4 | 1 |
| bitnamilegacy/ | ba9f3b4b0b00 | github.com/ | 4.1.4 | 1 |
| bitnamilegacy/ | c0ede65eb88e | github.com/ | 4.1.4 | 1 |
| bitnamilegacy/ | cce234b4381a | github.com/ | 4.1.4 | 1 |
| bitnamilegacy/ | d7cd0e172c4c | github.com/ | 4.1.4 | 1 |
| bitnamilegacy/ | 0cb31d0fc356 | github.com/ | 4.1.4 | 1 |
| casbin/ | 7729da148c61 | github.com/ | 4.1.4 | 1 |
| casbin/ | e08231f16c00 | github.com/ | 4.1.4 | 1 |
| castopod/ | 4e4f0440520f | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| cesanta/ | 98e0307e0d2d | github.com/ | 3.0.5 | 1 |
| cloudflare/ | 14d9c6b01b29 | github.com/ | 4.1.4 | 1 |
| cloudflare/ | 5d5f70a59d5e | github.com/ | 4.1.4 | 1 |
| cloudflare/ | c18744ae1767 | github.com/ | 3.0.5 | 1 |
| cloudflare/ | eb5c9324efe3 | github.com/ | 4.1.4 | 1 |
| coderenvs/ | 1deffc4670e6 | github.com/ | 3.0.5 | 1 |
| cybrarist/ | e9e2447ac666 | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| darthsim/ | 3b709e4a0e5e | github.com/ | 4.1.4 | 1 |
| darthsim/ | 7d12c7c8fc66 | github.com/ | 4.1.4 | 1 |
| defactops/ | 825cdf9ba706 | github.com/ | 3.0.5 | 1 |
| devopsfaith/ | 4c678c224f67 | github.com/ | 3.0.5 | 1 |
| devopsfaith/ | 9219cda867e2 | github.com/ | 3.0.5 | 1 |
| dexidp/ | 43655afd1a8f | github.com/ | 4.1.4 | 1 |
| dgraph/ | b57fa31f9b7f | github.com/ | 4.1.4 | 1 |
| dragonflyoss/ | edf3e921f4e0 | github.com/ | 3.0.5 | 1 |
| dragonflyoss/ | c3ef7f10698d | github.com/ | 3.0.5 | 1 |
| dragonflyoss/ | 523785c77787 | github.com/ | 3.0.5 | 1 |
| emqxecp/ | 4c31d9bec846 | github.com/ | 4.1.4 | 1 |
| envoyproxy/ | ec1f06ee29a7 | github.com/ | 4.1.4 | 1 |
| evcc/ | ddf2a25afce5 | github.com/ | 4.1.4 | 1 |
| falcosecurity/ | 1976da721518 | github.com/ | 4.1.4 | 1 |