CVE-2026-42009

High

Advisory

Published 30 Apr 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.013; 70th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,798; of 17,821 indexed, latest versions
Container images: 1,877; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,798 of 17,821 indexed charts deploy, on 1,877 images.

Affected package	Affected versions	Fixed in	Images
gnutls28deb	3.4.10-4ubuntu1.3, 3.4.10-4ubuntu1.4, 3.4.10-4ubuntu1.5, 3.4.10-4ubuntu1.7+47 more	3.4.10-4ubuntu1.9+esm3, 3.5.18-1ubuntu1.6+esm3, 3.6.13-2ubuntu1.12+esm2, 3.7.3-4ubuntu1.9+6 more	1,835
gnutlsapk	3.8.5-r0, 3.8.8-r0, 3.8.11-r0, 3.8.12-r0	3.8.13-r0	42

OSV records: ALPINE-CVE-2026-42009 DEBIAN-CVE-2026-42009 UBUNTU-CVE-2026-42009
Also known as: USN-8284-1, USN-8502-1

Charts affected

1,798 by stars

Chart	Latest	Affected images	Radar Score

Container images carrying it

1,877 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/yurymkomarov/docker/kubernetes-kiosk-chromium :0.1.2	7bff29dcec72	gnutls28@3.7.9-2+deb12u6	3.7.9-2+deb12u7	1
ghcr.io/zazukoians/qlever-server :v0.10.1	1de7869ab46e	gnutls28@3.8.3-1.1ubuntu3.6	3.8.3-1.1ubuntu3.6+Fips1.2	1
ghcr.io/zoriya/kyoo_autosync :4.7.1	fbba58ddb1a6	gnutls28@3.7.9-2+deb12u3	3.7.9-2+deb12u7	1
ghcr.io/zoriya/kyoo_back :4.7.1	416e980f76a6	gnutls28@3.7.9-2+deb12u3	3.7.9-2+deb12u7	1
ghcr.io/zoriya/kyoo_migrations :4.7.1	f7e607f24071	gnutls28@3.7.9-2+deb12u3	3.7.9-2+deb12u7	1
ghcr.io/zoriya/kyoo_scanner :4.7.1	7dc0ee57b628	gnutls28@3.7.9-2+deb12u3	3.7.9-2+deb12u7	1
ghcr.io/zystem-io/zymtrace-pub-gateway :26.9.2	ae9ae0925ff8	gnutls28@3.7.3-4ubuntu1.7	3.7.3-4ubuntu1.9	1
mcr.microsoft.com/azure-application-gateway/kubernetes-ingress :1.6.0	bccaa701e2df	gnutls28@3.6.13-2ubuntu1.7	3.6.13-2ubuntu1.12+esm2	1
mcr.microsoft.com/mssql/server :2017-latest	13221ac5f673	gnutls28@3.5.18-1ubuntu1.6	3.5.18-1ubuntu1.6+esm3	1
mcr.microsoft.com/mssql/server :2022-latest	4402d880dd4c	gnutls28@3.7.3-4ubuntu1.9	no fix listed	1
mcr.microsoft.com/mssql/server :2019-CU16-ubuntu-20.04	49a57dc220b1	gnutls28@3.6.13-2ubuntu1.6	3.6.13-2ubuntu1.12+esm2	1
mcr.microsoft.com/mssql/server :latest	4bab24f36c1e	gnutls28@3.8.3-1.1ubuntu3.6	3.8.3-1.1ubuntu3.6+Fips1.2	1
mcr.microsoft.com/mssql/server :2025-CU5-ubuntu-24.04	cee0f4db03b5	gnutls28@3.8.3-1.1ubuntu3.5	3.8.3-1.1ubuntu3.6	1
mcr.microsoft.com/mssql/server :2017-latest	fbf79e0fea59	gnutls28@3.5.18-1ubuntu1.6	3.5.18-1ubuntu1.6+esm3	1
mcr.microsoft.com/playwright/mcp :v0.0.43	e101b832b34d	gnutls28@3.7.9-2+deb12u5	3.7.9-2+deb12u7	1
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor :1.66.9	138c8b82c398	gnutls28@3.8.3-1.1ubuntu3.6	3.8.3-1.1ubuntu3.6+Fips1.2	1
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor :latest	f669a6eacf8c	gnutls28@3.8.3-1.1ubuntu3.6	3.8.3-1.1ubuntu3.6+Fips1.2	1
public.ecr.aws/aktosecurity/akto-api-security-testing-db-layer :1.74.4_local	1ed844ecab29	gnutls28@3.8.3-1.1ubuntu3.4	3.8.3-1.1ubuntu3.6	1
public.ecr.aws/aktosecurity/akto-api-testing :latest	97d830d5538a	gnutls28@3.8.3-1.1ubuntu3.6	3.8.3-1.1ubuntu3.6+Fips1.2	1
public.ecr.aws/aktosecurity/redis	47200b041382	gnutls28@3.7.9-2+deb12u5	3.7.9-2+deb12u7	1
public.ecr.aws/datadog/agent :7.73.0	f4925b15ce94	gnutls28@3.8.3-1.1ubuntu3.4	3.8.3-1.1ubuntu3.6	1
public.ecr.aws/datadog/cloudprem :v0.1.33	bda08753668d	gnutls28@3.8.3-1.1ubuntu3.6	3.8.3-1.1ubuntu3.6+Fips1.2	1
public.ecr.aws/flanksource/incident-manager-ui :v1.4.317	fea799d4fb2f	gnutls28@3.7.9-2+deb12u4	3.7.9-2+deb12u7	1
public.ecr.aws/g4a0y2u8/unifie-store :staging-19925	a2057fabc948	gnutls28@3.7.9-2+deb12u2	3.7.9-2+deb12u7	1
public.ecr.aws/groundcovercom/grafana-groundcover :v0.0.54-grafana11.3.7	ee9d973e3952	gnutls28@3.7.3-4ubuntu1.6	3.7.3-4ubuntu1.9	1
public.ecr.aws/jtekt-corporation/image-storage-service :v1.16.17	b1493760c716	gnutls28@3.7.9-2+deb12u3	3.7.9-2+deb12u7	1
public.ecr.aws/jtekt-corporation/image-storage-service-gui :v1.9.4	34823c8abe00	gnutls28@3.7.9-2+deb12u3	3.7.9-2+deb12u7	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	gnutls28@3.7.9-2+deb12u2	3.7.9-2+deb12u7	1
public.ecr.aws/jtekt-corporation/shinsei-manager-front :v1.5.5	f8fb4eea4071	gnutls28@3.7.9-2+deb12u1	3.7.9-2+deb12u7	1
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	gnutls28@3.7.9-2	3.7.9-2+deb12u7	1
public.ecr.aws/k2x0t8t6/kubeadapt/app/kubeadapt-k8s-pulse :v3.0.1	dc5a516c2333	gnutls28@3.7.9-2+deb12u6	3.7.9-2+deb12u7	1
public.ecr.aws/k6v9y5g3/cluster-agent :master.575	36d051110158	gnutls28@3.7.9-2+deb12u3	3.7.9-2+deb12u7	1
public.ecr.aws/k6v9y5g3/cluster-agent :cost_k8s_process.576	9e14a72b066d	gnutls28@3.7.9-2+deb12u3	3.7.9-2+deb12u7	1
public.ecr.aws/outerbounds/metaflow_metadata_service :v2.4.13	f7567ce3419d	gnutls28@3.7.9-2	3.7.9-2+deb12u7	1
public.ecr.aws/spotinst/spot-network-client :1.0.14	86380a01587d	gnutls28@3.8.3-1.1ubuntu3.4	3.8.3-1.1ubuntu3.6	1
public.ecr.aws/spotinst/spot-network-client :1.0.0-8-lb_endpoint-d0ec127	efcecf98b912	gnutls28@3.5.18-1ubuntu1.5	3.5.18-1ubuntu1.6+esm3	1
public.ecr.aws/supportpal/helpdesk-monolithic :4.0.4	573779e57fae	gnutls28@3.6.13-2ubuntu1.3	3.6.13-2ubuntu1.12+esm2	1
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	gnutls28@3.7.9-2+deb12u1	3.7.9-2+deb12u7	1
quay.io/aerokube/jumphost :1.0.1	70fd7c00418d	gnutls28@3.7.3-4ubuntu1.4	3.7.3-4ubuntu1.9	1
quay.io/aerokube/keygen :1.0.1	578934444f04	gnutls28@3.7.3-4ubuntu1.4	3.7.3-4ubuntu1.9	1
quay.io/argoproj/argocd :v2.4.11	5b6701d8fb31	gnutls28@3.7.3-4ubuntu1.1	3.7.3-4ubuntu1.9	1
quay.io/argoproj/argocd :v3.0.3	95b5cf7ba6fe	gnutls28@3.8.3-1.1ubuntu3.3	3.8.3-1.1ubuntu3.6	1
quay.io/argoproj/argocd :v3.1.1	a36ab0c0860c	gnutls28@3.8.3-1.1ubuntu3.4	3.8.3-1.1ubuntu3.6	1
quay.io/argoproj/argocd :v2.8.6	acaf37352569	gnutls28@3.7.3-4ubuntu1.2	3.7.3-4ubuntu1.9	1
quay.io/cilium/cilium :v1.15.1	351d6685dc6f	gnutls28@3.7.3-4ubuntu1.4	3.7.3-4ubuntu1.9	1
quay.io/cilium/cilium :v1.18.2	858f807ea4e2	gnutls28@3.8.3-1.1ubuntu3.4	3.8.3-1.1ubuntu3.6	1
quay.io/cilium/cilium :v1.17.14	cdcfab5b4466	gnutls28@3.8.3-1.1ubuntu3.5	3.8.3-1.1ubuntu3.6	1
quay.io/cilium/cilium-envoy :v1.35.9-1773656288-7b052e66eb2cfc5ac130ce0a5be66202a10d83be	60031f396695	gnutls28@3.8.3-1.1ubuntu3.5	3.8.3-1.1ubuntu3.6	1
quay.io/cilium/cilium-envoy :v1.34.7-1757592137-1a52bb680a956879722f48c591a2ca90f7791324	7932d656b63f	gnutls28@3.8.3-1.1ubuntu3.4	3.8.3-1.1ubuntu3.6	1
quay.io/clustersecret/clustersecret :0.0.14	a9f835d1b241	gnutls28@3.7.9-2+deb12u3	3.7.9-2+deb12u7	1