StackRadar

CVE-2026-42305

High

Advisory

Published 28 May 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.8
base score, highest
EPSS
0.006
49th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
42
of 17,781 indexed, latest versions
Container images
57
deployed by those charts
Fix available
1 of 2
affected packages

Dulwich has an arbitrary file write via NTFS-hostile tree entries on Windows

Carried by container images the latest versions of 42 of 17,781 indexed charts deploy, on 57 images.

Affected packageAffected versionsFixed inImages
dulwichpypi0.20.3, 0.20.31, 0.20.50, 0.21.3+8 more1.2.557
dulwichdeb0.21.6-1build2no fix listed6
OSV records
GHSA-897w-fcg9-f6xjUBUNTU-CVE-2026-42305
Also known as
PYSEC-2026-2463

Charts affected

42 by stars
ChartLatestAffected imagesRadar Score
kube-downscalerdeliveryheroVerified publisher0.7.61 of 1See more

kube-downscaler deliveryhero 0.7.6

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
dulwich@0.21.5
1.2.5

Open the chart page →

4,293
redashredash4.2.01 of 3See more

redash redash 4.2.0

1 of the 3 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
redash/redash:25.8.000d813437db5
dulwich@0.21.7
1.2.5

Open the chart page →

5,987
dependabot-gitlabdependabot-gitlabVerified publisher6.3.01 of 3See more

dependabot-gitlab dependabot-gitlab 6.3.0

1 of the 3 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
andrcuns/dependabot-gitlab:7.7.0-alpha.143060f159f4c
dulwich@0.21.6-1build2
dulwich@0.21.6
no fix listed
1.2.5

Open the chart page →

4,556
py-kube-downscalerpy-kube-downscalerVerified publisher0.3.121 of 1See more

py-kube-downscaler py-kube-downscaler 0.3.12

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
ghcr.io/caas-team/py-kube-downscaler:26.4.0af05a098b0d2
dulwich@1.1.0
1.2.5

Open the chart page →

731
netscaler-ingress-controllernetscalerOfficialVerified publisher4.2.261 of 1See more

netscaler-ingress-controller netscaler 4.2.26

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
quay.io/netscaler/netscaler-k8s-ingress-controller:4.2.26a68453858339
dulwich@0.22.8
1.2.5

Open the chart page →

142
netboxstartechnicaVerified publisher5.1.01 of 4See more

netbox startechnica 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
dulwich@0.21.7
1.2.5

Open the chart page →

1,650
netscaler-cpx-with-ingress-controllernetscalerOfficialVerified publisher4.1.171 of 2See more

netscaler-cpx-with-ingress-controller netscaler 4.1.17

1 of the 2 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
quay.io/netscaler/netscaler-k8s-ingress-controller:4.1.1755b12c2a8440
dulwich@0.20.3
1.2.5

Open the chart page →

394
squestchristianhuthVerified publisher6.6.71 of 4See more

squest christianhuth 6.6.7

1 of the 4 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
dulwich@0.21.7
1.2.5

Open the chart page →

9,971
hpe-greenlake-file-csi-driverhpe-storageVerified publisher2.6.41 of 7See more

hpe-greenlake-file-csi-driver hpe-storage 2.6.4

1 of the 7 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
quay.io/hpestorage/filex-csi-driver:2.6.4b7f960bbf472
dulwich@0.21.7
1.2.5

Open the chart page →

6,095
kuma-ingress-watcherkuma-ingress-watcherVerified publisher1.4.01 of 1See more

kuma-ingress-watcher kuma-ingress-watcher 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
ghcr.io/squent/kuma-ingress-watcher:1.7.014d45b2a1f00
dulwich@0.22.7
1.2.5

Open the chart page →

2,662
locustlocustVerified publisher0.1.41 of 1See more

locust locust 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
hansehe/locust:1.1.0bc8e45262bc4
dulwich@0.21.7
1.2.5

Open the chart page →

2,757
redminemt1905027.3.41 of 3See more

redmine mt190502 7.3.4

1 of the 3 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
library/redmine:6.1.204ac44a2595b
dulwich@0.22.7
1.2.5

Open the chart page →

7,527
redmineredmine-helm-chartVerified publisher0.2.61 of 1See more

redmine redmine-helm-chart 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
library/redmine:6.1.3-trixief474a901faec
dulwich@0.22.7
1.2.5

Open the chart page →

4,240
kube-resource-reportrlex0.10.11 of 2See more

kube-resource-report rlex 0.10.1

1 of the 2 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
hjacobs/kube-resource-report:22.11.0c173cd02f5af
dulwich@0.20.50
1.2.5

Open the chart page →

1,266
airbyteairbyte-v2Verified publisher2.2.01 of 10See more

airbyte airbyte-v2 2.2.0

1 of the 10 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
airbyte/manifest-server:7.23.73b3a670af168
dulwich@0.22.8
1.2.5

Open the chart page →

12,473
camerahubcamerahub0.10.211 of 2See more

camerahub camerahub 0.10.21

1 of the 2 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
camerahub/camerahub:0.36.23a5af37dd6e1b
dulwich@0.21.3
1.2.5

Open the chart page →

2,507
kube-ops-viewchristianhuthVerified publisher8.3.31 of 1See more

kube-ops-view christianhuth 8.3.3

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
hjacobs/kube-ops-view:23.5.0a4fae38f93d7
dulwich@0.21.5
1.2.5

Open the chart page →

1,227
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
dulwich@0.22.8
1.2.5

Open the chart page →

5,062
deployhubdeployhubVerified publisher10.0.4157 of 11See more

deployhub deployhub 10.0.415

7 of the 11 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
dulwich@0.24.10
1.2.5
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
dulwich@0.24.10
1.2.5
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
dulwich@0.24.10
1.2.5
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
dulwich@0.24.10
1.2.5
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
dulwich@0.24.10
1.2.5
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
dulwich@0.24.10
1.2.5
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
dulwich@0.24.10
1.2.5

Open the chart page →

11,160
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
dulwich@0.21.7
1.2.5

Open the chart page →

9,607
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
dulwich@0.21.7
1.2.5

Open the chart page →

9,607
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
dulwich@0.22.7
1.2.5

Open the chart page →

19,224
autonodelabeldjjudas21Verified publisher0.0.101 of 1See more

autonodelabel djjudas21 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
djjudas21/autonodelabel:0.0.6f17233350c4f
dulwich@0.21.5
1.2.5

Open the chart page →

1,304
huntingfactlyVerified publisher0.4.141 of 1See more

hunting factly 0.4.14

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
dulwich@0.20.50
1.2.5

Open the chart page →

4,085
kube-downscalerhelm-charts-nr0.7.61 of 1See more

kube-downscaler helm-charts-nr 0.7.6

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
dulwich@0.21.5
1.2.5

Open the chart page →

4,293
shynetjuniorjpdj0.1.301 of 1See more

shynet juniorjpdj 0.1.30

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
milesmcc/shynet:v0.13.1ba54f7797a6b
dulwich@0.20.50
1.2.5

Open the chart page →

2,581
lnbitskronkltdVerified publisher0.1.01 of 1See more

lnbits kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
lnbitsdocker/lnbits-legend:latest26fae6327477
dulwich@0.21.7
1.2.5

Open the chart page →

1,444
kube-janitorkube-janitor0.3.31 of 1See more

kube-janitor kube-janitor 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
hjacobs/kube-janitor:23.7.0fbb303ed463c
dulwich@0.21.5
1.2.5

Open the chart page →

4,293
lnbitslnbits0.2.11 of 1See more

lnbits lnbits 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
lnbitsdocker/lnbits-legend:0.10.6a11aaa6d2b21
dulwich@0.21.5
1.2.5

Open the chart page →

1,949
errbotmidokura-communityVerified publisher0.0.51 of 1See more

errbot midokura-community 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
errbotio/errbot:6.1.900ee4e0953ab
dulwich@0.20.31
1.2.5

Open the chart page →

2,233
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.05 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

5 of the 40 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
dulwich@0.21.6-1build2
dulwich@0.21.6
no fix listed
1.2.5
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestb175cc61959a
dulwich@0.21.6-1build2
dulwich@0.21.6
no fix listed
1.2.5
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
dulwich@0.21.6-1build2
dulwich@0.21.6
no fix listed
1.2.5
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
dulwich@0.21.6-1build2
dulwich@0.21.6
no fix listed
1.2.5
ghcr.io/openrelik/openrelik-worker-plaso:latest75537ea8c851
dulwich@0.21.6-1build2
dulwich@0.21.6
no fix listed
1.2.5

Open the chart page →

71,208
phronetisphronetis0.1.271 of 2See more

phronetis phronetis 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
knspar/phronetis:0.1.4609499d2dc91a
dulwich@0.22.8
1.2.5

Open the chart page →

16,196
kubecostradar-baseVerified publisher1.0.01 of 7See more

kubecost radar-base 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
gcr.io/kubecost1/kubecost-modeling:v0.1.22a461dc5cb96a
dulwich@0.22.7
1.2.5

Open the chart page →

9,355
redminerestic-pvc-backupVerified publisher0.2.61 of 1See more

redmine restic-pvc-backup 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
library/redmine:6.1.3-trixief474a901faec
dulwich@0.22.7
1.2.5

Open the chart page →

4,240
kube-web-viewrlex0.5.01 of 1See more

kube-web-view rlex 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
hjacobs/kube-web-view:23.8.0431f1bf013d0
dulwich@0.21.5
1.2.5

Open the chart page →

4,908
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
dulwich@0.21.7
1.2.5

Open the chart page →

9,607
agentdatarss30.1.01 of 1See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
dulwich@0.22.8
1.2.5

Open the chart page →

3,512
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
dulwich@0.22.8
1.2.5

Open the chart page →

4,718
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
dulwich@0.20.50
1.2.5

Open the chart page →

5,565
cost-analyzersoftonic2.5.51 of 6See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
gcr.io/kubecost1/kubecost-modeling:v0.1.24a2259b098b13
dulwich@0.22.8
1.2.5

Open the chart page →

7,901
downscalersqream-chartsVerified publisher1.0.01 of 1See more

downscaler sqream-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.05d328c003efe
dulwich@0.20.50
1.2.5

Open the chart page →

1,009
servicexssl-hep1.8.511 of 16See more

servicex ssl-hep 1.8.5

11 of the 16 container images this version deploys carry CVE-2026-42305.

Container imageDigestPackageFixed in
sslhep/servicex_app:v1.8.51d12f943cec5
dulwich@0.22.8
1.2.5
sslhep/servicex_code_gen_atlas_xaod:v1.8.5e7aff7f97b89
dulwich@0.22.8
1.2.5
sslhep/servicex_code_gen_func_adl_uproot:v1.8.5b01b8ee966ed
dulwich@0.22.8
1.2.5
sslhep/servicex_code_gen_python:v1.8.50e4175a4e1eb
dulwich@0.22.8
1.2.5
sslhep/servicex_code_gen_raw_uproot:v1.8.5671980005c57
dulwich@0.22.8
1.2.5
sslhep/servicex_code_gen_topcp:v1.8.5596db2abdd09
dulwich@0.22.8
1.2.5
sslhep/servicex-did-finder:v1.8.5ab0090083567
dulwich@0.22.8
1.2.5
sslhep/servicex-did-finder-atlasopenmagic:v1.8.554aaf1721d03
dulwich@0.25.2
1.2.5
sslhep/servicex-did-finder-cernopendata:v1.8.52cb88ceab5bb
dulwich@0.22.8
1.2.5
sslhep/servicex-did-finder-xrootd:v1.8.5c284442b44e3
dulwich@0.22.8
1.2.5
sslhep/x509-secrets:v1.8.5d9e9ecb12d59
dulwich@0.22.8
1.2.5

Open the chart page →

66,266

Container images carrying it

57 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
dulwich@0.24.10
1.2.5
1
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
dulwich@0.24.10
1.2.5
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
dulwich@0.24.10
1.2.5
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
dulwich@0.24.10
1.2.5
1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
dulwich@0.24.10
1.2.5
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
dulwich@0.24.10
1.2.5
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
dulwich@0.24.10
1.2.5
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.