CVE-2026-34986
HighAdvisory
Published 3 Apr 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.007
- 49th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 410
- of 17,787 indexed, latest versions
- Container images
- 405
- deployed by those charts
- Fix available
- 2 of 3
- affected packages
Go JOSE Panics in JWE decryption
Carried by container images the latest versions of 410 of 17,787 indexed charts deploy, on 405 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| github.com/ | v4.0.1, v4.0.2, v4.0.4, v4.0.5+4 more | 4.1.4 | 282 |
| github.com/ | v3.0.0, v3.0.1, v3.0.1-0.20221117193127-916db76e8214, v3.0.2+2 more | 3.0.5 | 170 |
| github.com/ | v2.6.3+incompatible | no fix listed | 4 |
- OSV records
- GHSA-78h2-9frx-2jm8
- Also known as
- GO-2026-4945
Charts affected
410 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| typhoontyphoonVerified publisher | 0.2.3 | 1 of 2See more | 1,672 |
| opencloudunxwaresVerified publisher | 0.2.3 | 2 of 13See more | 45,392 |
| vals-operatorvals-operatorVerified publisher | 0.8.1 | 1 of 1See more | 696 |
| vault-raft-snapshot-agentvault-raft-snapshot-agentVerified publisher | 0.6.9 | 1 of 1See more | 1,114 |
| ciliumvks-helm-chartsVerified publisher | 1.17.14 | 1 of 3See more | 4,124 |
| istio-service-meshwbstack | 0.0.1 | 1 of 1See more | 6,272 |
| argo-eventswenerme | 2.4.27 | 1 of 1See more | 969 |
| wexa-studiowexa-studio | 1.2.0 | 4 of 15See more | 14,618 |
| registrywiremindVerified publisher | 0.1.1 | 1 of 1See more | 1,187 |
| ygdrassil-monitoringygdrassilVerified publisher | 0.4.0 | 1 of 10See more | 9,381 |
Container images carrying it
405 by charts deploying them
A fixed version is listed for 2 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 62517726d0c4 | github.com/ | 3.0.5 | 1 |
| ghcr.io/ | 22f84e3615c8 | github.com/ | 4.1.4 | 1 |
| ghcr.io/ | 91fca773a63f | github.com/ | 4.1.4 | 1 |
| ghcr.io/ | 89969b78fb07 | github.com/ | 4.1.4 | 1 |
| ghcr.io/ | bf816072380e | github.com/ | 4.1.4 | 1 |
| ghcr.io/ | d7bdfa7b41da | github.com/ | 4.1.4 | 1 |
| ghcr.io/ | 8e3cb38953a3 | github.com/ | 4.1.4 | 1 |
| ghcr.io/ | 647e45284a80 | github.com/ | 3.0.5 | 1 |
| ghcr.io/ | 9f157fe035f1 | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| ghcr.io/ | 322f5f8cc105 | github.com/ | 3.0.5 | 1 |
| ghcr.io/ | e5ecfd607e42 | github.com/ | 3.0.5 | 1 |
| ghcr.io/ | 23f4da194134 | github.com/ | 4.1.4 | 1 |
| ghcr.io/ | 4fdf4edfda45 | github.com/ | 3.0.5 | 1 |
| public.ecr.aws/ | b9537499ff9e | github.com/ | 4.1.4 | 1 |
| public.ecr.aws/ | f24ecd37fbaa | github.com/ | 4.1.4 | 1 |
| public.ecr.aws/ | f4925b15ce94 | github.com/ | 4.1.4 | 1 |
| public.ecr.aws/ | e8014c6c58b6 | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| public.ecr.aws/ | 08c90bd040bf | github.com/ | 4.1.4 | 1 |
| quay.io/ | 95b5cf7ba6fe | github.com/ | 4.1.4 | 1 |
| quay.io/ | a36ab0c0860c | github.com/ | 4.1.4 | 1 |
| quay.io/ | acaf37352569 | github.com/ | 3.0.5 | 1 |
| quay.io/ | 577fc18f86ad | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| quay.io/ | 6efd1cb89dc1 | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| quay.io/ | 91b9825f09a8 | github.com/ | 3.0.5 | 1 |
| quay.io/ | a83d2699ae53 | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| quay.io/ | 66388d1b2f08 | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| quay.io/ | 6ab0da144235 | github.com/ | 3.0.5 | 1 |
| quay.io/ | c46aa0ded8ed | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| quay.io/ | 773886ec9337 | github.com/ | 4.1.4 | 1 |
| quay.io/ | 819c7281f5a4 | github.com/ | 3.0.5 | 1 |
| quay.io/ | cb4e4ffc5789 | github.com/ | 4.1.4 | 1 |
| quay.io/ | 13aaae779248 | github.com/ | 3.0.5 | 1 |
| quay.io/ | b741efae8d31 | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| quay.io/ | 81316365dc0b | github.com/ | 4.1.4 | 1 |
| quay.io/ | 9c0527cab629 | github.com/ | 3.0.5 | 1 |
| quay.io/ | ae5e14401cde | github.com/ | 4.1.4 | 1 |
| quay.io/ | 0dcdb1c1e747 | github.com/ | no fix listed | 1 |
| quay.io/ | 7652b1285f50 | github.com/ | 4.1.4 | 1 |
| quay.io/ | ec6ab507c5da | github.com/ | 3.0.5 | 1 |
| quay.io/ | 150f76e844d9 | github.com/ | 4.1.4 | 1 |
| quay.io/ | b05101723412 | github.com/ | 4.1.4 | 1 |
| quay.io/ | 56e3daedf765 | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| quay.io/ | 68336da945bd | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| quay.io/ | 9ed7eaf72050 | github.com/ github.com/ | 3.0.5 4.1.4 | 1 |
| quay.io/ | c241c971aef8 | github.com/ | 3.0.5 | 1 |
| quay.io/ | 6ff40fa6257f | github.com/ | 4.1.4 | 1 |
| quay.io/ | bca5dfcc67ca | github.com/ | 4.1.4 | 1 |
| quay.io/ | 23329c3368e4 | github.com/ | 3.0.5 | 1 |
| quay.io/ | f97c36882244 | github.com/ | 4.1.4 | 1 |
| quay.io/ | 7b4202c25b67 | github.com/ | 3.0.5 | 1 |