CVE-2026-42009

High

Advisory

Published 30 Apr 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.013; 70th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,754; of 17,790 indexed, latest versions
Container images: 1,836; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,754 of 17,790 indexed charts deploy, on 1,836 images.

Affected package	Affected versions	Fixed in	Images
gnutls28deb	3.4.10-4ubuntu1.3, 3.4.10-4ubuntu1.4, 3.4.10-4ubuntu1.5, 3.4.10-4ubuntu1.7+47 more	3.4.10-4ubuntu1.9+esm3, 3.5.18-1ubuntu1.6+esm3, 3.6.13-2ubuntu1.12+esm2, 3.7.3-4ubuntu1.9+6 more	1,795
gnutlsapk	3.8.5-r0, 3.8.8-r0, 3.8.11-r0, 3.8.12-r0	3.8.13-r0	41

OSV records: ALPINE-CVE-2026-42009 DEBIAN-CVE-2026-42009 UBUNTU-CVE-2026-42009
Also known as: USN-8284-1, USN-8502-1

Charts affected

1,754 by stars

Chart

Latest

Affected images

Radar Score

xlinexline

0.0.1

1 of 1 See more

xline xline 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-42009.

Container image	Digest	Package	Fixed in
ghcr.io/liangyuanpeng/xline :latest	3d2eceb44a3b	gnutls28@3.8.3-1.1ubuntu3.1	3.8.3-1.1ubuntu3.6

Open the chart page →

2,136

api-snapyoukadev

0.1.1

1 of 1 See more

api-snap youkadev 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-42009.

Container image	Digest	Package	Fixed in
youkadev/api-snap :0.1.1	4db0f9428e67	gnutls28@3.7.9-2+deb12u2	3.7.9-2+deb12u7

Open the chart page →

2,674

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-42009.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	gnutls28@3.5.18-1ubuntu1.5	3.5.18-1ubuntu1.6+esm3
yandex/clickhouse-server :21.3.20	4eccfffb01d7	gnutls28@3.6.13-2ubuntu1.6	3.6.13-2ubuntu1.12+esm2

Open the chart page →

9,250

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-42009.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	gnutls28@3.7.3-4ubuntu1.9	no fix listed

Open the chart page →

7,916

Container images carrying it

1,836 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
apachepulsar/pulsar :2.8.2	d538416d5afe	gnutls28@3.6.13-2ubuntu1.6	3.6.13-2ubuntu1.12+esm2	1
apache/ranger :2.7.0	76c176e8a0e4	gnutls28@3.7.3-4ubuntu1.6	3.7.3-4ubuntu1.9	1
apache/rocketmq :5.3.0	434d8398f996	gnutls28@3.8.3-1.1ubuntu3.1	3.8.3-1.1ubuntu3.6	1
apache/rocketmq-exporter :0.0.2	c8fb51195444	gnutls28@3.7.3-4ubuntu1.3	3.7.3-4ubuntu1.9	1
apache/skywalking-oap-server :9.2.0	133d35d2c263	gnutls28@3.7.3-4ubuntu1	3.7.3-4ubuntu1.9	1
apache/skywalking-oap-server :8.9.1	b4ec8c18d079	gnutls28@3.6.13-2ubuntu1.6	3.6.13-2ubuntu1.12+esm2	1
apache/skywalking-ui :9.2.0	295f1dc87d98	gnutls28@3.7.3-4ubuntu1	3.7.3-4ubuntu1.9	1
apache/skywalking-ui :8.9.1	80530f0308a5	gnutls28@3.6.13-2ubuntu1.6	3.6.13-2ubuntu1.12+esm2	1
apache/superset :4.0.1	ab9467fd712c	gnutls28@3.7.9-2+deb12u2	3.7.9-2+deb12u7	1
apache/tika :2.9.0.0	92d055a84e9e	gnutls28@3.7.3-4ubuntu1.2	3.7.3-4ubuntu1.9	1
apecloud/aperag :v0.0.0-nightly	8ac9947a2c84	gnutls28@3.8.9-3+deb13u2	3.8.9-3+deb13u4	1
archivebox/archivebox :0.7.4	1a5a37331091	gnutls28@3.7.9-2+deb12u6	3.7.9-2+deb12u7	1
aristidetm/basic-notebook :3.6.5	469dbc951224	gnutls28@3.7.9-2+deb12u2	3.7.9-2+deb12u7	1
arthurjguerra18/revwallet :v0.7.12	f540af20b307	gnutls28@3.7.9-2+deb12u3	3.7.9-2+deb12u7	1
artur9010/wait-for :v1.0.0	6b4de3ce8b0e	gnutls28@3.7.9-2+deb12u2	3.7.9-2+deb12u7	1
arunvelsriram/utils :latest	655ad18fd8d6	gnutls28@3.8.3-1.1ubuntu3.4	3.8.3-1.1ubuntu3.6	1
assistiot/cybersecurity-monitoring_ir-cas :latest	6a107f224c34	gnutls28@3.6.13-2ubuntu1.8	3.6.13-2ubuntu1.12+esm2	1
assistiot/fl_orchestrator :dbmongo4-latest	d157fbe150e3	gnutls28@3.6.13-2ubuntu1.6	3.6.13-2ubuntu1.12+esm2	1
assistiot/identity-manager_db :latest	0d3e6d35f168	gnutls28@3.7.9-2	3.7.9-2+deb12u7	1
assistiot/location_processing :latest	e9bae124095f	gnutls28@3.7.3-4ubuntu1.1	3.7.3-4ubuntu1.9	1
assistiot/open_api_backend :1.1.2	30812ba93555	gnutls28@3.7.3-4ubuntu1.3	3.7.3-4ubuntu1.9	1
assistiot/sdn_controller :2.4.0	ea254b6d8a31	gnutls28@3.6.13-2ubuntu1.6	3.6.13-2ubuntu1.12+esm2	1
assistiot/smart-orchestrator_mcs :latest	7d6a0d534c7f	gnutls28@3.7.9-2+deb12u2	3.7.9-2+deb12u7	1
assistiot/smart-orchestrator_scheduler :latest	38b003e55ff3	gnutls28@3.7.9-2+deb12u2	3.7.9-2+deb12u7	1
assistiot/smart-orchestrator_scheduler_mc :latest	b1dbe4d62a03	gnutls28@3.7.9-2	3.7.9-2+deb12u7	1
assistiot/video_augmentation :runner-cpu-latest	e5ae539ce2cb	gnutls28@3.6.13-2ubuntu1.8	3.6.13-2ubuntu1.12+esm2	1
atlassian/bamboo :12.1.11	4af4bb6c8d46	gnutls28@3.8.3-1.1ubuntu3.6	3.8.3-1.1ubuntu3.6+Fips1.2	1
atlassian/bamboo-agent-base :12.1.11	51c2d7274eef	gnutls28@3.8.3-1.1ubuntu3.6	3.8.3-1.1ubuntu3.6+Fips1.2	1
atlassian/bitbucket :10.2.7	05933f2b1cfd	gnutls28@3.8.3-1.1ubuntu3.6	3.8.3-1.1ubuntu3.6+Fips1.2	1
atlassian/confluence-server :7.10.0	3b9222ab32ef	gnutls28@3.7.3-4ubuntu1.1	3.7.3-4ubuntu1.9	1
atlassian/crowd :7.2.3	c81cc7d6bc9e	gnutls28@3.8.3-1.1ubuntu3.6	3.8.3-1.1ubuntu3.6+Fips1.2	1
atlassian/crowd :5.2.2	ebf761c7d437	gnutls28@3.8.3-1.1ubuntu3.6	3.8.3-1.1ubuntu3.6+Fips1.2	1
atlassian/jira-software :8.14.0	37bc46cbec1a	gnutls28@3.7.3-4ubuntu1.4	3.7.3-4ubuntu1.9	1
atlassian/jira-software :9.7.2	64a75aa4ec4e	gnutls28@3.8.3-1.1ubuntu3.3	3.8.3-1.1ubuntu3.6	1
atlassian/jira-software :11.3.11	e5548cd4eea8	gnutls28@3.8.3-1.1ubuntu3.6	3.8.3-1.1ubuntu3.6+Fips1.2	1
avaprotocol/ap-avs :1.2.0	c430ea5c37d6	gnutls28@3.7.9-2+deb12u3	3.7.9-2+deb12u7	1
avinash263/pyredis263 :latest	aa2b8727f1a6	gnutls28@3.7.9-2	3.7.9-2+deb12u7	1
avzini/web-app :latest	f40b30210ed0	gnutls28@3.7.9-2	3.7.9-2+deb12u7	1
baserow/backend :1.31.1	e0b3c8130b91	gnutls28@3.7.9-2+deb12u3	3.7.9-2+deb12u7	1
baserow/baserow :1.30.1	df0c42eb67e8	gnutls28@3.7.9-2+deb12u3	3.7.9-2+deb12u7	1
bbernhard/signal-cli-rest-api :0.57	549ad08d7e14	gnutls28@3.6.13-2ubuntu1.6	3.6.13-2ubuntu1.12+esm2	1
beanbag/reviewboard :latest	6b840f546e1c	gnutls28@3.7.3-4ubuntu1.9	no fix listed	1
berkeleyskypilot/skypilot-nightly :latest	8da2f3cda472	gnutls28@3.8.9-3	3.8.9-3+deb13u4	1
beyzkaya/blog-backend :v1.0.1	12a6a3d1c5f9	gnutls28@3.7.9-2+deb12u4	3.7.9-2+deb12u7	1
bicarus/elrond-rosetta :v1.3.50.0	b1dab0721e1c	gnutls28@3.6.13-2ubuntu1.6	3.6.13-2ubuntu1.12+esm2	1
bicarus/mx-notifier :1.1.8	bed688d16762	gnutls28@3.6.13-2ubuntu1.6	3.6.13-2ubuntu1.12+esm2	1
bitnamilegacy/cassandra :4.1.7-debian-12-r3	2b7a217999a1	gnutls28@3.7.9-2+deb12u3	3.7.9-2+deb12u7	1
bitnamilegacy/clickhouse :24.12.3-debian-12-r1	3cf6544f6c6c	gnutls28@3.7.9-2+deb12u3	3.7.9-2+deb12u7	1
bitnamilegacy/clickhouse :24.12.4	c7e70bf1d3fb	gnutls28@3.7.9-2+deb12u3	3.7.9-2+deb12u7	1
bitnamilegacy/clickhouse :24.6.2-debian-12-r3	dcc172c6c55f	gnutls28@3.7.9-2+deb12u3	3.7.9-2+deb12u7	1