StackRadar

CVE-2026-42009

High

Advisory

Published 30 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.013
70th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,803
of 17,828 indexed, latest versions
Container images
1,877
deployed by those charts
Fix available
2 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,803 of 17,828 indexed charts deploy, on 1,877 images.

Affected packageAffected versionsFixed inImages
gnutls28deb3.4.10-4ubuntu1.3, 3.4.10-4ubuntu1.4, 3.4.10-4ubuntu1.5, 3.4.10-4ubuntu1.7+47 more3.4.10-4ubuntu1.9+esm3, 3.5.18-1ubuntu1.6+esm3, 3.6.13-2ubuntu1.12+esm2, 3.7.3-4ubuntu1.9+6 more1,835
gnutlsapk3.8.5-r0, 3.8.8-r0, 3.8.11-r0, 3.8.12-r03.8.13-r042
OSV records
ALPINE-CVE-2026-42009DEBIAN-CVE-2026-42009UBUNTU-CVE-2026-42009
Also known as
USN-8284-1, USN-8502-1

Charts affected

1,803 by stars
ChartLatestAffected imagesRadar Score
api-snapyoukadevVerified publisher0.1.11 of 1See more

api-snap youkadev 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-42009.

Container imageDigestPackageFixed in
youkadev/api-snap:0.1.14db0f9428e67
gnutls28@3.7.9-2+deb12u2
3.7.9-2+deb12u7

Open the chart page →

2,638
clickhousezloi-space1.2.02 of 3See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-42009.

Container imageDigestPackageFixed in
yandex/clickhouse-client:21.3863f94a0f607
gnutls28@3.5.18-1ubuntu1.5
3.5.18-1ubuntu1.6+esm3
yandex/clickhouse-server:21.3.204eccfffb01d7
gnutls28@3.6.13-2ubuntu1.6
3.6.13-2ubuntu1.12+esm2

Open the chart page →

9,297
zoo-project-druzoo-projectOfficialVerified publisher0.10.41 of 6See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-42009.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a9a507cb7e2dd
gnutls28@3.7.3-4ubuntu1.9
no fix listed

Open the chart page →

7,966

Container images carrying it

1,877 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
geoservercloud/geoserver-cloud-webui:1.0-RC228c3e5a8c5a3
gnutls28@3.6.13-2ubuntu1.6
3.6.13-2ubuntu1.12+esm2
1
geoservercloud/geoserver-cloud-wfs:1.0-RC28c70ee06d5ab
gnutls28@3.6.13-2ubuntu1.6
3.6.13-2ubuntu1.12+esm2
1
geoservercloud/geoserver-cloud-wms:1.0-RC242775ba6a4da
gnutls28@3.6.13-2ubuntu1.6
3.6.13-2ubuntu1.12+esm2
1
gethue/hue:4.11.011b649636e68
gnutls28@3.6.13-2ubuntu1.7
3.6.13-2ubuntu1.12+esm2
1
gethue/hue:4.10.05702b2c37ff9
gnutls28@3.5.18-1ubuntu1.4
3.5.18-1ubuntu1.6+esm3
1
gethue/hue:latest7d5c1b9f8a79
gnutls28@3.7.3-4ubuntu1.6
3.7.3-4ubuntu1.9
1
getsentry/relay:24.10.0ba7bf9163219
gnutls28@3.7.9-2+deb12u3
3.7.9-2+deb12u7
1
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
gnutls28@3.7.9-2+deb12u6
3.7.9-2+deb12u7
1
gitea/gitea:1.22.376f516a1a8c2
gnutls@3.8.5-r0
3.8.13-r0
1
gitlab/gitlab-runner:v15.3.0860d4a3fec7a
gnutls28@3.6.13-2ubuntu1.6
3.6.13-2ubuntu1.12+esm2
1
glasskube/operator:0.12.2be5133100d63
gnutls28@3.7.3-4ubuntu1.2
3.7.3-4ubuntu1.9
1
gobitfly/eth2-beaconchain-explorer:latest1d08a7986348
gnutls28@3.7.3-4ubuntu1.6
3.7.3-4ubuntu1.9
1
golenski/fibonacci-msg-relay:1.0.0c863dcb0c513
gnutls28@3.7.9-2
3.7.9-2+deb12u7
1
golenski/fibonacci-task-manager:2.0.03a2b36df247b
gnutls28@3.7.9-2
3.7.9-2+deb12u7
1
golenski/fibonacci-worker:2.0.0954caf4aaf6a
gnutls28@3.7.9-2
3.7.9-2+deb12u7
1
gopaddle/gopaddle:5.0435359250b63
gnutls28@3.7.3-4ubuntu1.5
3.7.3-4ubuntu1.9
1
gotenberg/gotenberg:8.30206a6c708fc6
gnutls28@3.8.9-3+deb13u2
3.8.9-3+deb13u4
1
gotenberg/gotenberg:8.0.1cf0b9a7ca3cf
gnutls28@3.7.9-2+deb12u1
3.7.9-2+deb12u7
1
gotson/komga:0.99.49b15ea6bfc30
gnutls28@3.5.18-1ubuntu1.4
3.5.18-1ubuntu1.6+esm3
1
gradiant/open5gs-dbctl:0.10.3332031245fce
gnutls28@3.8.3-1.1ubuntu3.3
3.8.3-1.1ubuntu3.6
1
grafana/agent:v0.44.23364714a2f64
gnutls28@3.8.3-1.1ubuntu3.2
3.8.3-1.1ubuntu3.6
1
grafana/alloy:v1.5.101a63f4e032c
gnutls28@3.8.3-1.1ubuntu3.2
3.8.3-1.1ubuntu3.6
1
grafana/alloy:v1.4.306bdcbb51fc2
gnutls28@3.8.3-1.1ubuntu3.2
3.8.3-1.1ubuntu3.6
1
grafana/alloy:v1.18.10f4434c92b3e
gnutls28@3.8.3-1.1ubuntu3.6
3.8.3-1.1ubuntu3.6+Fips1.2
1
grafana/alloy:v1.18.0491b0578c049
gnutls28@3.8.3-1.1ubuntu3.6
3.8.3-1.1ubuntu3.6+Fips1.2
1
grafana/alloy:v1.16.384b76d56c594
gnutls28@3.8.3-1.1ubuntu3.6
3.8.3-1.1ubuntu3.6+Fips1.2
1
grafana/alloy:v1.11.38c7256f412fe
gnutls28@3.8.3-1.1ubuntu3.4
3.8.3-1.1ubuntu3.6
1
grafana/alloy:v1.19.2b8ec653c4423
gnutls28@3.8.3-1.1ubuntu3.6
3.8.3-1.1ubuntu3.6+Fips1.2
1
grafana/alloy:v1.14.0f50931848bd8
gnutls28@3.8.3-1.1ubuntu3.5
3.8.3-1.1ubuntu3.6
1
grafana/beyla:1.3.336d07f8d276e
gnutls28@3.7.9-2+deb12u2
3.7.9-2+deb12u7
1
grafana/fluent-plugin-loki:latest4f0438bdebb5
gnutls28@3.7.9-2+deb12u5
3.7.9-2+deb12u7
1
grafana/mcp-grafana:0.14.042f541f22063
gnutls28@3.7.9-2+deb12u6
3.7.9-2+deb12u7
1
grafana/promtail:3.5.165bfae480b57
gnutls28@3.8.3-1.1ubuntu3.3
3.8.3-1.1ubuntu3.6
1
grafana/promtail:3.6.18dcfdf466da0
gnutls28@3.8.3-1.1ubuntu3.4
3.8.3-1.1ubuntu3.6
1
graphprotocol/graph-node:latestb0436347fb24
gnutls28@3.7.9-2+deb12u3
3.7.9-2+deb12u7
1
graphprotocol/graph-node:v0.37.0f4452cdedd68
gnutls28@3.7.9-2+deb12u3
3.7.9-2+deb12u7
1
graylog/graylog:6.1.1019de1aff48c2
gnutls28@3.7.3-4ubuntu1.6
3.7.3-4ubuntu1.9
1
graylog/graylog:7.1.9598bd41fefd5
gnutls28@3.8.3-1.1ubuntu3.6
3.8.3-1.1ubuntu3.6+Fips1.2
1
graylog/graylog:7.2.0-beta.3-1bf3e1e7b7352
gnutls28@3.8.3-1.1ubuntu3.6
3.8.3-1.1ubuntu3.6+Fips1.2
1
graylog/graylog-enterprise:7.1.88a1f641cd7aa
gnutls28@3.8.3-1.1ubuntu3.6
3.8.3-1.1ubuntu3.6+Fips1.2
1
grpl/grapple-cli:0.2.127c00aafee6629
gnutls28@3.8.3-1.1ubuntu3.1
3.8.3-1.1ubuntu3.6
1
guacamole/guacamole:1.5.50f62f6d17ab3
gnutls28@3.7.3-4ubuntu1.4
3.7.3-4ubuntu1.9
1
guillh/web3-prometheus-exporter:0.3.04fb99dbc32b2
gnutls28@3.7.9-2+deb12u3
3.7.9-2+deb12u7
1
gulacedia/web-dvwa-new:v367b467d961ca
gnutls28@3.7.9-2
3.7.9-2+deb12u7
1
hamidyousefi93/saam-test:latestc34f071f6ed0
gnutls28@3.7.9-2
3.7.9-2+deb12u7
1
hamzaarshad10/querybackend:1.6.22c1c3b86a8e7
gnutls28@3.7.9-2+deb12u3
3.7.9-2+deb12u7
1
hamzaarshad10/querypodpy:1.7154f38e8668e
gnutls28@3.7.9-2+deb12u3
3.7.9-2+deb12u7
1
hansehe/locust:1.1.0bc8e45262bc4
gnutls28@3.7.9-2+deb12u4
3.7.9-2+deb12u7
1
haohanyang/compass-web:0.5.054f2112602ee
gnutls28@3.7.9-2+deb12u6
3.7.9-2+deb12u7
1
haohanyang/compass-web:0.1.1e3952b14ae8e
gnutls28@3.7.9-2+deb12u3
3.7.9-2+deb12u7
1

syft 1.42.1 · advisories as of 21 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.