CVE-2026-41988

High

Advisory

Published 22 Apr 2026In the index since 5 Sept 2026

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

Carried by container images the latest versions of 604 of 17,790 indexed charts deploy, on 601 images.

Affected package	Affected versions	Fixed in	Images
uuidnpm	2.0.2, 2.0.3, 3.0.1, 3.1.0+15 more	11.1.1, 13.0.1	599
node-uuiddeb	1.4.0-1, 1.4.7-5, 3.3.2-2, 8.3.2+~8.3.3-4+1 more	no fix listed	7

OSV records: GHSA-w5hq-g745-h8pq DEBIAN-CVE-2026-41988 UBUNTU-CVE-2026-41988
Also known as: CVE-2026-41907

604 by stars

Chart

Latest

Affected images

Radar Score

1,752

1 of the 10 container images this version deploys carry CVE-2026-41988.

Container image	Digest	Package	Fixed in
opensearchproject/opensearch-dashboards :2.18.0	0ecd8444add2	uuid@9.0.0	11.1.1

9,395

helloworldyotron-helm-charts

1 of the 1 container images this version deploys carry CVE-2026-41988.

Container image	Digest	Package	Fixed in
a5hut0sh/helloworld :1.0	2ae77620e616	uuid@3.3.2	11.1.1

1,309

1 of the 2 container images this version deploys carry CVE-2026-41988.

Container image	Digest	Package	Fixed in
zl0i/alertmanager-matrix-forwarder :v1.0.0	e94047931739	uuid@3.4.0	11.1.1

3,118

601 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
registry.gitlab.com/timvisee/send :v3.4.20	47986cf6ef69	uuid@3.3.2	11.1.1	1