StackRadar

CVE-2026-42256

Medium

Advisory

Published 4 May 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.003
22nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
17
of 17,781 indexed, latest versions
Container images
17
deployed by those charts
Fix available
1 of 2
affected packages

net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication

Carried by container images the latest versions of 17 of 17,781 indexed charts deploy, on 17 images.

Affected packageAffected versionsFixed inImages
ruby3.1deb3.1.2-7+deb12u1no fix listed1
net-imapgem0.4.9.1, 0.5.4, 0.5.8, 0.5.9+2 more0.4.24, 0.5.14, 0.6.416
OSV records
DEBIAN-CVE-2026-42256GHSA-87pf-fpwv-p7m7

Charts affected

17 by stars
ChartLatestAffected imagesRadar Score
zammadzammadOfficialVerified publisher18.0.51 of 5See more

zammad zammad 18.0.5

1 of the 5 container images this version deploys carry CVE-2026-42256.

Container imageDigestPackageFixed in
ghcr.io/zammad/zammad:7.1.3-0011e65123a43ecc
net-imap@0.5.8
0.5.14

Open the chart page →

6,887
chatwootchatwootVerified publisher2.0.241 of 3See more

chatwoot chatwoot 2.0.24

1 of the 3 container images this version deploys carry CVE-2026-42256.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v4.15.167ebc751c171
net-imap@0.5.8
0.5.14

Open the chart page →

9,203
dependabot-gitlabdependabot-gitlabVerified publisher6.3.01 of 3See more

dependabot-gitlab dependabot-gitlab 6.3.0

1 of the 3 container images this version deploys carry CVE-2026-42256.

Container imageDigestPackageFixed in
andrcuns/dependabot-gitlab:7.7.0-alpha.143060f159f4c
net-imap@0.6.2
0.6.4

Open the chart page →

4,556
docusealzekker6Verified publisher1.130.01 of 1See more

docuseal zekker6 1.130.0

1 of the 1 container images this version deploys carry CVE-2026-42256.

Container imageDigestPackageFixed in
docuseal/docuseal:3.2.4a8f063f916e3
net-imap@0.6.2
0.6.4

Open the chart page →

112
manyfoldself-hosters-by-nightVerified publisher0.7.41 of 1See more

manyfold self-hosters-by-night 0.7.4

1 of the 1 container images this version deploys carry CVE-2026-42256.

Container imageDigestPackageFixed in
ghcr.io/manyfold3d/manyfold-solo:0.147.2ed5a792b0e8d
net-imap@0.5.8
0.5.14

Open the chart page →

480
redminemt1905027.3.41 of 3See more

redmine mt190502 7.3.4

1 of the 3 container images this version deploys carry CVE-2026-42256.

Container imageDigestPackageFixed in
library/redmine:6.1.204ac44a2595b
net-imap@0.5.8
0.5.14

Open the chart page →

7,527
opentelemetry-demoopentelemetry-helmVerified publisher0.41.11 of 34See more

opentelemetry-demo opentelemetry-helm 0.41.1

1 of the 34 container images this version deploys carry CVE-2026-42256.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.0.0-emaild674d4081ca4
net-imap@0.6.2
0.6.4

Open the chart page →

22,420
antigenic-docuseal-helm-chartantigenic-docuseal-helm-chartVerified publisher0.2.01 of 1See more

antigenic-docuseal-helm-chart antigenic-docuseal-helm-chart 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-42256.

Container imageDigestPackageFixed in
docuseal/docuseal:2.4.17493fd7f6728
net-imap@0.6.2
0.6.4

Open the chart page →

2,766
caninecanine0.1.101 of 7See more

canine canine 0.1.10

1 of the 7 container images this version deploys carry CVE-2026-42256.

Container imageDigestPackageFixed in
ghcr.io/caninehq/canine:latesta058034ca006
net-imap@0.4.9.1
0.4.24

Open the chart page →

14,130
monitoring-stackdata354-helmVerified publisher1.4.21 of 4See more

monitoring-stack data354-helm 1.4.2

1 of the 4 container images this version deploys carry CVE-2026-42256.

Container imageDigestPackageFixed in
grafana/fluent-plugin-loki:latest8a3882e8c28b
net-imap@0.5.8
0.5.14

Open the chart page →

3,176
elk-stackelk-stack-test1.0.21 of 9See more

elk-stack elk-stack-test 1.0.2

1 of the 9 container images this version deploys carry CVE-2026-42256.

Container imageDigestPackageFixed in
library/logstash:9.1.233eae14f0867
net-imap@0.5.9
0.5.14

Open the chart page →

2,942
icinga2geek-cookbookVerified publisher4.2.01 of 1See more

icinga2 geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-42256.

Container imageDigestPackageFixed in
jordan/icinga2:latestf75025fe8ea8
ruby3.1@3.1.2-7+deb12u1
no fix listed

Open the chart page →

9,077
octoboxhalkeye0.1.11 of 1See more

octobox halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-42256.

Container imageDigestPackageFixed in
octoboxio/octobox:latestd909041c46eb
net-imap@0.6.2
0.6.4

Open the chart page →

3,255
manyfoldjeffrescVerified publisher1.0.31 of 1See more

manyfold jeffresc 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-42256.

Container imageDigestPackageFixed in
ghcr.io/manyfold3d/manyfold:0.136.0d14ca4d82475
net-imap@0.6.3
0.6.4

Open the chart page →

1,960
deltabadgerk8s-chartsVerified publisher2.0.01 of 1See more

deltabadger k8s-charts 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-42256.

Container imageDigestPackageFixed in
ghcr.io/deltabadger/deltabadger:2.23.3bffe3c22fabc
net-imap@0.5.8
0.5.14

Open the chart page →

5,669
fluentdsinextraVerified publisher1.4.51 of 1See more

fluentd sinextra 1.4.5

1 of the 1 container images this version deploys carry CVE-2026-42256.

Container imageDigestPackageFixed in
ghcr.io/sergelogvinov/fluentd:1.19.33273d13f1e75
net-imap@0.5.8
0.5.14

Open the chart page →

1,085
maybe-financevicsuferVerified publisher0.2.71 of 3See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-42256.

Container imageDigestPackageFixed in
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
net-imap@0.5.4
0.5.14

Open the chart page →

10,795

Container images carrying it

17 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
andrcuns/dependabot-gitlab:7.7.0-alpha.143060f159f4c
net-imap@0.6.2
0.6.4
1
chatwoot/chatwoot:v4.15.167ebc751c171
net-imap@0.5.8
0.5.14
1
docuseal/docuseal:2.4.17493fd7f6728
net-imap@0.6.2
0.6.4
1
docuseal/docuseal:3.2.4a8f063f916e3
net-imap@0.6.2
0.6.4
1
grafana/fluent-plugin-loki:latest8a3882e8c28b
net-imap@0.5.8
0.5.14
1
jordan/icinga2:latestf75025fe8ea8
ruby3.1@3.1.2-7+deb12u1
no fix listed
1
library/logstash:9.1.233eae14f0867
net-imap@0.5.9
0.5.14
1
library/redmine:6.1.204ac44a2595b
net-imap@0.5.8
0.5.14
1
octoboxio/octobox:latestd909041c46eb
net-imap@0.6.2
0.6.4
1
ghcr.io/caninehq/canine:latesta058034ca006
net-imap@0.4.9.1
0.4.24
1
ghcr.io/deltabadger/deltabadger:2.23.3bffe3c22fabc
net-imap@0.5.8
0.5.14
1
ghcr.io/manyfold3d/manyfold:0.136.0d14ca4d82475
net-imap@0.6.3
0.6.4
1
ghcr.io/manyfold3d/manyfold-solo:0.147.2ed5a792b0e8d
net-imap@0.5.8
0.5.14
1
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
net-imap@0.5.4
0.5.14
1
ghcr.io/open-telemetry/demo:3.0.0-emaild674d4081ca4
net-imap@0.6.2
0.6.4
1
ghcr.io/sergelogvinov/fluentd:1.19.33273d13f1e75
net-imap@0.5.8
0.5.14
1
ghcr.io/zammad/zammad:7.1.3-0011e65123a43ecc
net-imap@0.5.8
0.5.14
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.