CVE-2026-38974
MediumAdvisory
Published 15 Jul 2026In the index since 8 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.002
- 9th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 5
- of 17,781 indexed, latest versions
- Container images
- 8
- deployed by those charts
- Fix available
- None
- affected package
The matching OSV records carry no description.
Carried by container images the latest versions of 5 of 17,781 indexed charts deploy, on 8 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| dulwichdeb | 0.21.6-1build2, 0.22.7-1 | no fix listed | 8 |
- OSV records
- DEBIAN-CVE-2026-38974UBUNTU-CVE-2026-38974
Charts affected
5 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| dependabot-gitlabdependabot-gitlabVerified publisher | 6.3.0 | 1 of 3See more | 4,556 |
| redminemt190502 | 7.3.4 | 1 of 3See more | 7,527 |
| redmineredmine-helm-chartVerified publisher | 0.2.6 | 1 of 1See more | 4,240 |
| osdfir-infrastructureosdfir-infrastructureVerified publisher | 2.15.0 | 5 of 40See more | 71,208 |
| redminerestic-pvc-backupVerified publisher | 0.2.6 | 1 of 1See more | 4,240 |
Container images carrying it
8 by charts deploying them
A fixed version is listed for 0 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| library/ | f474a901faec | dulwich | no fix listed | 2 |
| andrcuns/ | 43060f159f4c | dulwich | no fix listed | 1 |
| library/ | 04ac44a2595b | dulwich | no fix listed | 1 |
| ghcr.io/ | 1269d3d8d2c2 | dulwich | no fix listed | 1 |
| ghcr.io/ | b175cc61959a | dulwich | no fix listed | 1 |
| ghcr.io/ | a6d5abe94706 | dulwich | no fix listed | 1 |
| ghcr.io/ | 7fc7ec101f08 | dulwich | no fix listed | 1 |
| ghcr.io/ | 75537ea8c851 | dulwich | no fix listed | 1 |