CVE-2026-42504

High

Advisory

Published 2 Jun 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.006; 45th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,158; of 17,813 indexed, latest versions
Container images: 4,758; deployed by those charts
Fix available: 1 of 2; affected packages

Quadratic complexity in WordDecoder.DecodeHeader in mime

Carried by container images the latest versions of 4,158 of 17,813 indexed charts deploy, on 4,758 images.

Affected package	Affected versions	Fixed in	Images
golang-1.19deb	1.19.8-2	no fix listed	1
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+184 more	1.25.11	4,758

OSV records: DEBIAN-CVE-2026-42504 GO-2026-5038
Also known as: BIT-golang-2026-42504

Charts affected

4,158 by stars

Chart

Latest

Affected images

Radar Score

loki-standaloneot-container-kit

1.0.2

2 of 5 See more

loki-standalone ot-container-kit 1.0.2

2 of the 5 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
quay.io/opstree/loki :3.6-debian13	bdfee214c7ea	stdlib@go1.26.2	1.25.11
quay.io/opstree/memcached-exporter :0.15.5-debian13	cf8f8410eaad	stdlib@go1.26.2	1.25.11

Open the chart page →

3,667

mongodb-operatorot-container-kit

0.3.1

1 of 1 See more

mongodb-operator ot-container-kit 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
quay.io/opstree/mongodb-operator :v0.3.0	879b9bead838	stdlib@go1.17.8	1.25.11

Open the chart page →

1,874

mysqlot-container-kit

0.1.0

1 of 1 See more

mysql ot-container-kit 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

463

otel-operatorot-container-kit

1.0.1

1 of 1 See more

otel-operator ot-container-kit 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
quay.io/opstree/opentelemetry-operator :0.149.0-debian13	a21405ab9a9a	stdlib@go1.25.9	1.25.11

Open the chart page →

290

ot-karpenterot-container-kit

0.3.0

1 of 1 See more

ot-karpenter ot-container-kit 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
public.ecr.aws/karpenter/controller :1.1.1	fe383abf1dbc	stdlib@go1.23.2	1.25.11

Open the chart page →

495

pgaot-container-kit

1.0.3

4 of 6 See more

pga ot-container-kit 1.0.3

4 of the 6 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
grafana/grafana :11.1.0	079600c9517b	stdlib@go1.22.4	1.25.11
quay.io/prometheus-operator/prometheus-operator :v0.75.1	a7cc63108511	stdlib@go1.22.4	1.25.11
quay.io/prometheus/node-exporter :v1.8.1	fa7fa12a57ef	stdlib@go1.22.3	1.25.11
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.12.0	b401fae262a5	stdlib@go1.21.8	1.25.11

Open the chart page →

5,153

tempo-standaloneot-container-kit

1.0.1

1 of 1 See more

tempo-standalone ot-container-kit 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
quay.io/opstree/tempo :2.10.4-debian13	cb734024b3fd	stdlib@go1.26.2	1.25.11

Open the chart page →

612

vmot-container-kit

0.0.3

4 of 7 See more

vm ot-container-kit 0.0.3

4 of the 7 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
grafana/grafana :11.1.4	886b56d5534e	stdlib@go1.22.4	1.25.11
victoriametrics/operator :v0.47.2	71be93cfafb6	stdlib@go1.23.0	1.25.11
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	stdlib@go1.22.5	1.25.11
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.13.0	639a1e2da549	stdlib@go1.22.5	1.25.11

Open the chart page →

5,428

vm-standaloneot-container-kit

0.0.4

4 of 6 See more

vm-standalone ot-container-kit 0.0.4

4 of the 6 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
quay.io/opstree/grafana :12.4.3	b61c1ed2f015	stdlib@go1.26.2	1.25.11
quay.io/opstree/kube-state-metrics :2.18.0-debian13	53525d253793	stdlib@go1.25.9	1.25.11
quay.io/opstree/node-exporter :1.11.1-alpine3.23	3b6b3a7eb001	stdlib@go1.26.2	1.25.11
quay.io/opstree/victoriametrics-operator :v0.69.0	66fe5216c278	stdlib@go1.26.2	1.25.11

Open the chart page →

3,507

otel-add-onotel-add-on

0.1.4

1 of 1 See more

otel-add-on otel-add-on 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/kedify/otel-add-on :v0.1.4	a6f2155bd822	stdlib@go1.24.3	1.25.11

Open the chart page →

734

otsots

1.8.4

1 of 2 See more

ots ots 1.8.4

1 of the 2 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/luzifer/ots :v1.21.5	c94f6c9ed173	stdlib@go1.26.2	1.25.11

Open the chart page →

367

adotowan-charts

0.1.0

1 of 1 See more

adot owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-observability/aws-otel-collector :v0.43.3	8aa9ea5f67b8	stdlib@go1.24.3	1.25.11

Open the chart page →

1,033

httpbunowan-charts

0.1.0

1 of 1 See more

httpbun owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
sharat87/httpbun :latest	405332d9050a	stdlib@go1.25.1	1.25.11

Open the chart page →

314

minioowan-charts

0.1.2

1 of 2 See more

minio owan-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/georgmangold/console :v1.8.1	58f4f180aa6e	stdlib@go1.24.4	1.25.11

Open the chart page →

1,083

kubernetes-taggeroxyno-zeta

1.1.2

1 of 1 See more

kubernetes-tagger oxyno-zeta 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
oxynozeta/kubernetes-tagger :1.3.0	a153c386f5af	stdlib@go1.17	1.25.11

Open the chart page →

1,827

arpap2p-avs

0.1.3

1 of 2 See more

arpa p2p-avs 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/arpa-network/node-client :latest	657a2c9f6e6d	stdlib@go1.22.5	1.25.11

Open the chart page →

1,997

automatap2p-avs

0.1.0

1 of 2 See more

automata p2p-avs 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/automata-network/multi-prover-avs/operator :v0.6.0	752f1aa02438	stdlib@go1.22.1	1.25.11

Open the chart page →

3,695

avap2p-avs

0.1.0

1 of 1 See more

ava p2p-avs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
avaprotocol/ap-avs :1.2.0	c430ea5c37d6	stdlib@go1.22.5	1.25.11

Open the chart page →

3,362

eigendap2p-avs

0.1.1

2 of 3 See more

eigenda p2p-avs 0.1.1

2 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/layr-labs/eigenda/opr-node :0.8.4	6650119a385f	stdlib@go1.21.1	1.25.11
ghcr.io/layr-labs/eigenda/opr-nodeplugin :0.8.4	e459ad3ae758	stdlib@go1.21.1	1.25.11

Open the chart page →

2,336

predicatep2p-avs

0.1.4

1 of 1 See more

predicate p2p-avs 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/predicatelabs/operator :v1.0.5	b62113fe1b27	stdlib@go1.23.5	1.25.11

Open the chart page →

893

p4p4

0.1.0

3 of 7 See more

p4 p4 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
codeurjc/toposervice :v1.23	9fb4c11e6a49	stdlib@go1.18.10	1.25.11
library/mongo :5.0-focal	5e15a3f014ed	stdlib@go1.25.9	1.25.11
library/mysql :8	b3b90af2a655	stdlib@go1.24.6	1.25.11

Open the chart page →

27,879

myappp4-helm

0.1.0

1 of 6 See more

19,768

pacmanpacman-mh

0.1.28

1 of 2 See more

pacman pacman-mh 0.1.28

1 of the 2 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mongo :7.0.28-jammy	88785f6f665a	stdlib@go1.24.0	1.25.11

Open the chart page →

3,627

pagespages

1.0.0

1 of 3 See more

20,285

pagespages10

1.0.0

1 of 3 See more

20,285

pagespages111

1.0.0

1 of 3 See more

pages pages111 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespages2

1.0.0

1 of 3 See more

20,285

pagespages-alexchmielu

1.0.0

1 of 3 See more

pages pages-alexchmielu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespages-alps

1.0.0

1 of 3 See more

pages pages-alps 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespages-alstom

1.0.0

1 of 3 See more

pages pages-alstom 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespages-ambala

1.0.0

1 of 3 See more

pages pages-ambala 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespages-andromeda

1.0.0

1 of 3 See more

pages pages-andromeda 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespagesbadami

1.0.0

1 of 3 See more

pages pagesbadami 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespages-blackburn

1.0.0

1 of 3 See more

pages pages-blackburn 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespages-botes

1.0.0

1 of 3 See more

pages pages-botes 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespages-brian

1.0.0

1 of 3 See more

pages pages-brian 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespages-buckll

1.0.0

1 of 3 See more

pages pages-buckll 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespages-camden

1.0.0

1 of 3 See more

pages pages-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespages-camden771

1.0.0

1 of 3 See more

pages pages-camden771 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespages-diarmuidkeane

1.0.0

1 of 3 See more

pages pages-diarmuidkeane 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespages-draco

1.0.0

1 of 3 See more

pages pages-draco 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespages-ellora

1.0.0

1 of 3 See more

pages pages-ellora 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespages-finchley

1.0.0

1 of 3 See more

pages pages-finchley 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespages-fornax

1.0.0

1 of 3 See more

pages pages-fornax 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespages-harsh

1.0.0

1 of 3 See more

pages pages-harsh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespagesk

1.0.0

1 of 3 See more

20,285

pagespages-microservice-ashim

1.0.0

1 of 3 See more

pages pages-microservice-ashim 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespages-mihai

1.0.0

1 of 3 See more

pages pages-mihai 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespages-nivesh

1.0.0

1 of 3 See more

pages pages-nivesh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

pagespagessandeepgudu

1.0.0

1 of 3 See more

pages pagessandeepgudu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.11

Open the chart page →

20,285

Container images carrying it

4,758 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
intel/intel-deviceplugin-operator :0.36.0	9879685d0b5b	stdlib@go1.26.3	1.25.11	1
intel/intel-gaudi-resource-driver :v0.3.0	ac758c14c2de	stdlib@go1.23.4	1.25.11	1
intel/intel-gpu-plugin :0.20.0	143f0a45e174	stdlib@go1.15.10	1.25.11	1
intel/intel-gpu-resource-driver :v0.7.0	e158711e32ce	stdlib@go1.23.4	1.25.11	1
intel/intel-qat-resource-driver :v0.1.0	ac7616986a2b	stdlib@go1.22.4	1.25.11	1
intel/multimodal-data-visualization :3.0	3426deb77337	stdlib@go1.17.11	1.25.11	1
intel/trusted-certificate-issuer :0.5.0	591a9db4a427	stdlib@go1.19.3	1.25.11	1
invisibl/gravity-init :v1.0.9	1a970f84178b	stdlib@go1.17.12	1.25.11	1
invisibl/identity-manager :1.0.0	1029f4fe20eb	stdlib@go1.17.11	1.25.11	1
invisibl/identity-manager-demo :v1.0.0	cf5400cb935a	stdlib@go1.19.2	1.25.11	1
iofog/router :2.0.1	7260cf861479	stdlib@go1.15	1.25.11	1
iomesh/blockdevice-monitor :v0.2.1	376577ed98ac	stdlib@go1.21.5	1.25.11	1
iomesh/blockdevice-monitor :v0.1.0	d86dab5611a7	stdlib@go1.20.3	1.25.11	1
iomesh/blockdevice-monitor-prober :v0.2.1	026a1d87f6e9	stdlib@go1.21.5	1.25.11	1
iomesh/blockdevice-monitor-prober :v0.1.0	584dbe19db7e	stdlib@go1.20.3	1.25.11	1
iomesh/csi-driver :v2.8.0	1a151f602451	stdlib@go1.21.11	1.25.11	1
iomesh/csi-driver :v2.7.2	5d3f9bf9240b	stdlib@go1.16.7	1.25.11	1
iomesh/deck :v0.2.0	282d6c419ed3	stdlib@go1.22.6	1.25.11	1
iomesh/deck :v0.1.0	a31e26b6ae22	stdlib@go1.21.10	1.25.11	1
iomesh/deck-plugin-iomesh :v0.1.0	0b13bf217110	stdlib@go1.21.10	1.25.11	1
iomesh/deck-plugin-iomesh :v0.2.0	df149e4ab39f	stdlib@go1.22.6	1.25.11	1
iomesh/node-disk-manager :1.8.0	002c4b92fd34	stdlib@go1.14.7	1.25.11	1
iomesh/node-disk-manager :1.8.0-2	292ad270082e	stdlib@go1.14.7	1.25.11	1
iomesh/node-disk-operator :1.8.0-1	de4aa40684ad	stdlib@go1.14.7	1.25.11	1
iomesh/node-disk-operator :1.8.0	f6c76380db34	stdlib@go1.14.7	1.25.11	1
iomesh/operator :v1.1.0	60081c9b2f52	stdlib@go1.21.4	1.25.11	1
iomesh/operator :v1.2.0	ba4dd6be7e59	stdlib@go1.21.4	1.25.11	1
iomesh/post-delete-hook :v1.2.0	e3b92f838f4b	stdlib@go1.21.4	1.25.11	1
iomesh/post-delete-hook :v1.1.0	eea5651f3270	stdlib@go1.21.4	1.25.11	1
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	stdlib@go1.14.12	1.25.11	1
iotaledger/goshimmer :v0.8.6	b02a8f77474f	stdlib@go1.17.2	1.25.11	1
iotaledger/hornet :2.0	01206f1ba89c	stdlib@go1.21.10	1.25.11	1
iotaledger/inx-dashboard :1.0	12c669cb8748	stdlib@go1.21.1	1.25.11	1
ipfs/go-ipfs :v0.13.1	17259397f587	stdlib@go1.18.3	1.25.11	1
ipfs/ipfs-cluster :1.0.2	1511f6d57994	stdlib@go1.18.3	1.25.11	1
ipfs/kubo :v0.41.0	0661819c2e09	stdlib@go1.26.2	1.25.11	1
ipfs/kubo :v0.17.0	803fac58ba15	stdlib@go1.19.1	1.25.11	1
ipfs/kubo :latest	b293923d66e4	stdlib@go1.19.8	1.25.11	1
ipfs/kubo :v0.24.0	e3de33bd746b	stdlib@go1.19.8	1.25.11	1
ipushc/cassandra-web :latest	fa3e0c66c289	stdlib@go1.20.2	1.25.11	1
irakli/ms-web-hello :latest	966a4bfefe27	stdlib@go1.19.2	1.25.11	1
isebben/smart-proxy :latest	ab59a71ee9f4	stdlib@go1.24.13	1.25.11	1
ispras/svacer :11-2-0	42aa9fa9f189	stdlib@go1.24.3	1.25.11	1
istio/install-cni :1.10.3	2232f365aed6	stdlib@go1.16.6	1.25.11	1
istio/install-cni :1.23.6	ab34c4740f44	stdlib@go1.23.7	1.25.11	1
istio/install-cni :1.29.0	ce27c9ce43c8	stdlib@go1.25.7	1.25.11	1
istio/operator :1.10.3	655eefa11c84	stdlib@go1.16.6	1.25.11	1
istio/operator :1.12.0	6cfce8a071b9	stdlib@go1.17.3	1.25.11	1
istio/operator :1.18.2	70f9d1fe5fff	stdlib@go1.20.6	1.25.11	1
istio/pilot :1.10.0	294ca55bd1cc	stdlib@go1.16.4	1.25.11	1