CVE-2026-42504

High

Advisory

Published 2 Jun 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.006; 45th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,027; of 17,787 indexed, latest versions
Container images: 4,617; deployed by those charts
Fix available: 1 of 2; affected packages

Quadratic complexity in WordDecoder.DecodeHeader in mime

Carried by container images the latest versions of 4,027 of 17,787 indexed charts deploy, on 4,617 images.

Affected package	Affected versions	Fixed in	Images
golang-1.19deb	1.19.8-2	no fix listed	1
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+182 more	1.25.11	4,617

OSV records: DEBIAN-CVE-2026-42504 GO-2026-5038
Also known as: BIT-golang-2026-42504

Charts affected

4,027 by stars

Chart

Latest

Affected images

Radar Score

kubebrowsekubebrowse

1.7.0

3 of 5 See more

kubebrowse kubebrowse 1.7.0

3 of the 5 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
minio/minio :latest	14cea493d9a3	stdlib@go1.24.6	1.25.11
ghcr.io/browsersec/kubebrowse :sha-09dfa1f	b853e9e6372a	stdlib@go1.24.3	1.25.11
ghcr.io/browsersec/kubebrowse-frontend :chore-improve-back	bd6bea5e487c	stdlib@go1.25.0	1.25.11

Open the chart page →

4,141

kubefedkubefed

0.10.0

1 of 2 See more

kubefed kubefed 0.10.0

1 of the 2 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
quay.io/kubernetes-multicluster/kubefed :v0.10.0	c4635c95730e	stdlib@go1.16.6	1.25.11

Open the chart page →

2,419

kubernetes-events-exporterkubernetes-events-exporter

0.1.2

1 of 1 See more

kubernetes-events-exporter kubernetes-events-exporter 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/ownkube/kubernetes-events-exporter :0.1.2	bcb7f0f733f5	stdlib@go1.26.2	1.25.11

Open the chart page →

496

owncloudkubernetes-homelab-helm-charts

0.1.0

2 of 3 See more

owncloud kubernetes-homelab-helm-charts 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mariadb :10.11	ce66c7be32a0	stdlib@go1.24.6	1.25.11
owncloud/server :10.16.2	74c53d341076	stdlib@go1.26.3	1.25.11

Open the chart page →

9,858

tailscalekubernetes-homelab-helm-charts

0.1.2

1 of 2 See more

tailscale kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
tailscale/tailscale :v1.96.5	dbeff02d2337	stdlib@go1.26.1	1.25.11

Open the chart page →

1,037

kubernetes-stateless-chartkubernetes-stateless-chart

1.0.3

1 of 1 See more

kubernetes-stateless-chart kubernetes-stateless-chart 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
portainer/portainer-ce :2.18.4-alpine	3e61aaee1341	stdlib@go1.19.4	1.25.11

Open the chart page →

3,274

kubescoutkubescoute

0.1.1

1 of 1 See more

kubescout kubescoute 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/haedalwang/kubescout :0.1.1	07d51f838f0d	stdlib@go1.25.5	1.25.11

Open the chart page →

714

kubeseal-webguikubeseal-webgui

6.0.4

1 of 2 See more

kubeseal-webgui kubeseal-webgui 6.0.4

1 of the 2 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/jaydee94/kubeseal-webgui/api :4.5.3	3cceb9462ae1	stdlib@go1.24.4	1.25.11

Open the chart page →

4,095

kubeseckubesec

1.1.0

1 of 1 See more

kubesec kubesec 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
kubesec/kubesec :latest	025a365d9f18	stdlib@go1.23.3	1.25.11

Open the chart page →

1,075

kube-site-followerkube-site-follower

0.1.14

1 of 2 See more

kube-site-follower kube-site-follower 0.1.14

1 of the 2 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/cloudnative-pg/cloudnative-pg :1.25.0	a27779ed1085	stdlib@go1.23.4	1.25.11

Open the chart page →

902

juicefskubesphere-stable

0.16.2

1 of 4 See more

juicefs kubesphere-stable 0.16.2

1 of the 4 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
juicedata/juicefs-csi-driver :v0.20.0	43978fc60798	stdlib@go1.18.10	1.25.11

Open the chart page →

2,489

mesherykubesphere-stable

0.5.0

12 of 13 See more

meshery kubesphere-stable 0.5.0

12 of the 13 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
layer5/meshery :stable-latest	78a8be21bef3	stdlib@go1.23.9	1.25.11
layer5/meshery-app-mesh :stable-latest	77d59943b3d6	stdlib@go1.19.5	1.25.11
layer5/meshery-consul :stable-latest	25a4cc38abcd	stdlib@go1.19.13	1.25.11
layer5/meshery-cpx :stable-latest	8c20a8a1d6a4	stdlib@go1.13.1	1.25.11
layer5/meshery-istio :stable-latest	fde47c141ec6	stdlib@go1.23.9	1.25.11
layer5/meshery-kuma :stable-latest	9d25f029a8a2	stdlib@go1.23.4	1.25.11
layer5/meshery-linkerd :stable-latest	b99c73bac1f5	stdlib@go1.23.6	1.25.11
layer5/meshery-nginx-sm :stable-latest	b3864dfd47ad	stdlib@go1.19.11	1.25.11
layer5/meshery-nsm :stable-latest	ebd6a8faf21f	stdlib@go1.15.12	1.25.11
layer5/meshery-operator :stable-latest	6f58a28fe422	stdlib@go1.23.9	1.25.11
layer5/meshery-osm :stable-latest	ec898e5786c6	stdlib@go1.19.8	1.25.11
layer5/meshery-traefik-mesh :stable-latest	797fa7a03570	stdlib@go1.19.11	1.25.11

Open the chart page →

24,690

aws-efs-csi-driverkubesphere-test

0.1.0

1 of 3 See more

aws-efs-csi-driver kubesphere-test 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
amazon/aws-efs-csi-driver :v0.3.0	b55277652ea8	stdlib@go1.13.4	1.25.11

Open the chart page →

2,603

hertzbeatkubesphere-test

1.4.1

1 of 4 See more

hertzbeat kubesphere-test 1.4.1

1 of the 4 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mysql :8	b3b90af2a655	stdlib@go1.24.6	1.25.11

Open the chart page →

7,710

kube-state-metricskubestar-state-metrics

0.1.10

1 of 1 See more

kube-state-metrics kubestar-state-metrics 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.6.0	bdab4e49d71d	stdlib@go1.18.5	1.25.11

Open the chart page →

1,575

kubetailkubetail

0.26.0

3 of 3 See more

kubetail kubetail 0.26.0

3 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/kubetail-org/kubetail-cluster-agent :0.7.1	a5eee8cab215	stdlib@go1.24.2	1.25.11
ghcr.io/kubetail-org/kubetail-cluster-api :0.8.2	8e6acd0da9ac	stdlib@go1.25.8	1.25.11
ghcr.io/kubetail-org/kubetail-dashboard :0.17.0	8617f0a7f703	stdlib@go1.25.8	1.25.11

Open the chart page →

1,850

kube-vault-controllerkube-vault-controller

1.2.0

1 of 1 See more

kube-vault-controller kube-vault-controller 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
kupnu4x/kube-vault-controller :1.2.0	3be59109f3d6	stdlib@go1.21.1	1.25.11

Open the chart page →

1,550

kube-vip-cloud-providerkube-vip

0.2.10

1 of 1 See more

kube-vip-cloud-provider kube-vip 0.2.10

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
kubevip/kube-vip-cloud-provider :v0.0.12	f8f4e3401f76	stdlib@go1.24.2	1.25.11

Open the chart page →

791

kubemodkubmod

0.5.2

2 of 2 See more

kubemod kubmod 0.5.2

2 of the 2 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
kubemod/kubemod :v0.19.1	1f8154f7e80c	stdlib@go1.18	1.25.11
kubemod/kubemod-crt :v1.3.0	028347c9fa77	stdlib@go1.18.1	1.25.11

Open the chart page →

4,542

kubeservice-cosign-webhookkubservice-charts

1.1.1

5 of 5 See more

kubeservice-cosign-webhook kubservice-charts 1.1.1

5 of the 5 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
dongjiang1989/cosign-webhook :v1.1.0	2a3ead6a55dc	stdlib@go1.19.12	1.25.11
quay.io/jetstack/cert-manager-cainjector :v1.13.1	72072d492b43	stdlib@go1.20.8	1.25.11
quay.io/jetstack/cert-manager-controller :v1.13.1	6b83f55bd99e	stdlib@go1.20.8	1.25.11
quay.io/jetstack/cert-manager-ctl :v1.13.1	c10bde7ff9ad	stdlib@go1.20.8	1.25.11
quay.io/jetstack/cert-manager-webhook :v1.13.1	48ea4a77dfa7	stdlib@go1.20.8	1.25.11

Open the chart page →

7,087

kubeservice-cpupools-controllerkubservice-charts

0.1.1

2 of 2 See more

kubeservice-cpupools-controller kubservice-charts 0.1.1

2 of the 2 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
dongjiang1989/cpusets-controller :v1.1.1	dc5bd483874c	stdlib@go1.19.10	1.25.11
dongjiang1989/cpusets-device-plugin :v1.1.1	923085c65123	stdlib@go1.19.10	1.25.11

Open the chart page →

3,118

kubeservice-custom-limitrangekubservice-charts

1.3.0

5 of 5 See more

kubeservice-custom-limitrange kubservice-charts 1.3.0

5 of the 5 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/kubeservice-stack/customlimitrange-manager :v1.3.0	d3ed97d142d4	stdlib@go1.24.1	1.25.11
quay.io/jetstack/cert-manager-cainjector :v1.13.1	72072d492b43	stdlib@go1.20.8	1.25.11
quay.io/jetstack/cert-manager-controller :v1.13.1	6b83f55bd99e	stdlib@go1.20.8	1.25.11
quay.io/jetstack/cert-manager-ctl :v1.13.1	c10bde7ff9ad	stdlib@go1.20.8	1.25.11
quay.io/jetstack/cert-manager-webhook :v1.13.1	48ea4a77dfa7	stdlib@go1.20.8	1.25.11

Open the chart page →

5,941

kubeservice-ebpf-exporterkubservice-charts

1.2.1

1 of 1 See more

kubeservice-ebpf-exporter kubservice-charts 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/cloudflare/ebpf_exporter :v2.3.0	75370b2ec2bb	stdlib@go1.21.5	1.25.11

Open the chart page →

545

kubeservice-namespace-node-affinitykubservice-charts

1.1.2

5 of 5 See more

kubeservice-namespace-node-affinity kubservice-charts 1.1.2

5 of the 5 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
dongjiang1989/ns-node-affinity :latest	451f7823723c	stdlib@go1.18.5	1.25.11
quay.io/jetstack/cert-manager-cainjector :v1.13.1	72072d492b43	stdlib@go1.20.8	1.25.11
quay.io/jetstack/cert-manager-controller :v1.13.1	6b83f55bd99e	stdlib@go1.20.8	1.25.11
quay.io/jetstack/cert-manager-ctl :v1.13.1	c10bde7ff9ad	stdlib@go1.20.8	1.25.11
quay.io/jetstack/cert-manager-webhook :v1.13.1	48ea4a77dfa7	stdlib@go1.20.8	1.25.11

Open the chart page →

6,872

kubeservice-scheduler-pluskubservice-charts

0.2.1

1 of 2 See more

kubeservice-scheduler-plus kubservice-charts 0.2.1

1 of the 2 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
dongjiang1989/crane-scheduler-controller :main	f0055c05dbee	stdlib@go1.19.9	1.25.11

Open the chart page →

1,801

ingress-annotatorkuoss

0.3.0

1 of 1 See more

ingress-annotator kuoss 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/kuoss/ingress-annotator :v0.3.0	ae179f65d869	stdlib@go1.24.6	1.25.11

Open the chart page →

480

kube-fencingkvaps

2.4.1

2 of 2 See more

kube-fencing kvaps 2.4.1

2 of the 2 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/kvaps/kube-fencing-controller :v2.4.0	313edfec2fca	stdlib@go1.18.8	1.25.11
ghcr.io/kvaps/kube-fencing-switcher :v2.4.0	f8c378e63b78	stdlib@go1.18.8	1.25.11

Open the chart page →

2,536

linstorkvaps

1.14.0

4 of 11 See more

linstor kvaps 1.14.0

4 of the 11 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/kvaps/linstor-controller :v1.14.0	00ce11c31087	stdlib@go1.15.14	1.25.11
ghcr.io/kvaps/linstor-csi :v1.14.0	087618d16b83	stdlib@go1.15.14	1.25.11
ghcr.io/kvaps/linstor-ha-controller :v1.14.0	8e7b44bbd123	stdlib@go1.15.14	1.25.11
ghcr.io/kvaps/linstor-stork :v1.14.0	5e409a6332b4	stdlib@go1.15.14	1.25.11

Open the chart page →

15,547

kymaroskymaros

0.6.9

1 of 1 See more

kymaros kymaros 0.6.9

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/kymaroshq/kymaros :0.6.9	fb3b88633381	stdlib@go1.25.9	1.25.11

Open the chart page →

269

chibisafel4g

0.1.1

2 of 3 See more

chibisafe l4g 0.1.1

2 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
chibisafe/chibisafe-server :latest	3da4fcbc1a18	stdlib@go1.20.12	1.25.11
library/caddy :2-alpine	5f5c8640aae0	stdlib@go1.26.3	1.25.11

Open the chart page →

5,654

authz-pdplabs64io-helm-charts

0.6.0

1 of 1 See more

authz-pdp labs64io-helm-charts 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/cerbos/cerbos :0.51.0	8d35a64e4a99	stdlib@go1.25.6	1.25.11

Open the chart page →

800

checkoutlabs64io-helm-charts

0.8.0

1 of 3 See more

checkout labs64io-helm-charts 0.8.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/postgres :18	4ef4dbc939d6	stdlib@go1.24.6	1.25.11

Open the chart page →

1,626

payment-gatewaylabs64io-helm-charts

0.8.0

1 of 2 See more

payment-gateway labs64io-helm-charts 0.8.0

1 of the 2 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/postgres :18	4ef4dbc939d6	stdlib@go1.24.6	1.25.11

Open the chart page →

2,657

lagoon-remotelagoon-charts

0.106.0

1 of 1 See more

lagoon-remote lagoon-charts 0.106.0

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
uselagoon/docker-host :v3.6.1	2c89ed939b8b	stdlib@go1.24.3	1.25.11

Open the chart page →

2,113

landelijketabellencataloguslandelijketabellencatalogus

1.0.0

1 of 3 See more

landelijketabellencatalogus landelijketabellencatalogus 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/landelijketabellencatalogus-php :latest	26d91dcbba56	stdlib@go1.13.10	1.25.11

Open the chart page →

7,510

lgtmlgtm

0.27.0

1 See more

lgtm lgtm 0.27.0

1 container image this version deploys carries CVE-2026-42504.

Container image	Digest	Package	Fixed in
grafana/grafana :13.2.1-distroless	3600073f45a9	stdlib@go1.26.3	1.25.11

Open the chart page →

—

lgtm-stacklgtm-stack

0.1.3

3 of 8 See more

lgtm-stack lgtm-stack 0.1.3

3 of the 8 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
grafana/grafana :13.1.0	121a7a9ece6d	stdlib@go1.25.7	1.25.11
minio/mc :RELEASE.2024-01-16T16-06-34Z	591b097ea2d4	stdlib@go1.21.6	1.25.11
minio/minio :RELEASE.2024-01-18T22-51-28Z	551682a57a94	stdlib@go1.21.6	1.25.11

Open the chart page →

5,576

keptn-cert-managerlifecycle-toolkit

0.3.0

1 of 1 See more

keptn-cert-manager lifecycle-toolkit 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/keptn/certificate-operator :v3.0.0	b82064b0e339	stdlib@go1.23.3	1.25.11

Open the chart page →

507

keptn-lifecycle-operatorlifecycle-toolkit

0.6.0

1 of 1 See more

keptn-lifecycle-operator lifecycle-toolkit 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/keptn/lifecycle-operator :v2.0.0	866ced256a8c	stdlib@go1.23.3	1.25.11

Open the chart page →

595

keptn-metrics-operatorlifecycle-toolkit

0.5.0

1 of 1 See more

keptn-metrics-operator lifecycle-toolkit 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/keptn/metrics-operator :v2.1.0	dc48471c7cf8	stdlib@go1.23.3	1.25.11

Open the chart page →

825

kube-iptables-tailerlifen-charts

0.2.3

1 of 1 See more

kube-iptables-tailer lifen-charts 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
honestica/kube-iptables-tailer :master-91	a393242fb939	stdlib@go1.13.8	1.25.11

Open the chart page →

4,418

linkerd-jaegerlinkerd2-edge

30.14.11-edge

2 of 4 See more

linkerd-jaeger linkerd2-edge 30.14.11-edge

2 of the 4 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
jaegertracing/all-in-one :1.31	04d224a9999b	stdlib@go1.17.6	1.25.11
otel/opentelemetry-collector-contrib :0.83.0	71fcef33ae71	stdlib@go1.20.7	1.25.11

Open the chart page →

4,389

litlyxlitlyx

0.2.0

1 of 5 See more

litlyx litlyx 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
library/mongo :8.0.11	dca8d11fe467	stdlib@go1.23.8	1.25.11

Open the chart page →

7,874

go-hello-worldloafoe

0.14.0

1 of 1 See more

go-hello-world loafoe 0.14.0

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/go-hello-world :v2.13.0	d3fb171f20e1	stdlib@go1.25.3	1.25.11

Open the chart page →

672

jspolicyloft

0.2.2

1 of 1 See more

jspolicy loft 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
loftsh/jspolicy :0.2.2	25deb9bd2683	stdlib@go1.17.13	1.25.11

Open the chart page →

2,309

vcluster-eksloft

0.0.0-ci.3

3 of 4 See more

vcluster-eks loft 0.0.0-ci.3

3 of the 4 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
public.ecr.aws/eks-distro/etcd-io/etcd :v3.5.6-eks-1-24-7	efa6dee17ed2	stdlib@go1.16.15	1.25.11
public.ecr.aws/eks-distro/kubernetes/kube-apiserver :v1.24.9-eks-1-24-7	72e06b605692	stdlib@go1.18.9	1.25.11
public.ecr.aws/eks-distro/kubernetes/kube-controller-manager :v1.24.9-eks-1-24-7	eaea8c230432	stdlib@go1.18.9	1.25.11

Open the chart page →

3,304

vcluster-k0sloft

0.0.0-ci.3

1 of 2 See more

vcluster-k0s loft 0.0.0-ci.3

1 of the 2 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
k0sproject/k0s :v1.26.0-k0s.0	f04635825d51	stdlib@go1.19.4	1.25.11

Open the chart page →

3,136

log2rbac-operatorlog2rbac-operator

0.0.5

1 of 1 See more

log2rbac-operator log2rbac-operator 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
jkremser/log2rbac :v0.0.5	e35cf56ef183	stdlib@go1.17.6	1.25.11

Open the chart page →

1,938

logclilogcli

0.1.0

1 of 1 See more

logcli logcli 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
grafana/logcli :main-c90366d-amd64	3d85bb66e39b	stdlib@go1.16.2	1.25.11

Open the chart page →

2,947

lumenvoxlumenvox

7.1.0

10 of 11 See more

lumenvox lumenvox 7.1.0

10 of the 11 container images this version deploys carry CVE-2026-42504.

Container image	Digest	Package	Fixed in
lumenvox/admin-portal :7.1	12310cf52f79	stdlib@go1.26.2	1.25.11
lumenvox/archive :7.1	5114f08ab8ef	stdlib@go1.26.2	1.25.11
lumenvox/cloud-init-tools :7.1	de940e2ec601	stdlib@go1.26.2	1.25.11
lumenvox/configuration :7.1	82bf01d9ebec	stdlib@go1.26.2	1.25.11
lumenvox/deployment :7.1	dadac2a74be6	stdlib@go1.26.2	1.25.11
lumenvox/file-store :7.1	38aa8711c9ef	stdlib@go1.26.2	1.25.11
lumenvox/license :7.1	35d0b1ac053e	stdlib@go1.26.2	1.25.11
lumenvox/management-api :7.1	6420a6e7d6c2	stdlib@go1.26.2	1.25.11
lumenvox/resource :7.1	93fd6ff1d62c	stdlib@go1.26.2	1.25.11
lumenvox/storage :7.1	c961fe78e2ca	stdlib@go1.26.2	1.25.11

Open the chart page →

4,283

Container images carrying it

4,617 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/devtron/google-chat-alert-manager :v2.0.2	39f2c6e0af38	stdlib@go1.18	1.25.11	3
quay.io/devtron/hyperion :0874dcaf-280-39287	01d5d8c4cecb	stdlib@go1.25.6	1.25.11	3
quay.io/devtron/image-scanner :b278f42b-334-11119	88c64b1b6ec8	stdlib@go1.16.10	1.25.11	3
quay.io/devtron/image-scanner :94237c18-109-39420	98580969b333	stdlib@go1.25.5	1.25.11	3
quay.io/devtron/inception :7beef376-948-31378	4c3b91bebd3d	stdlib@go1.14.15	1.25.11	3
quay.io/devtron/jcmhproxy-ingress :v0.14.6	4286bcccda3e	stdlib@go1.19.13	1.25.11	3
quay.io/devtron/k8s-utils :807ca3c2-488-14005	f296c2ec5db7	stdlib@go1.20.4	1.25.11	3
quay.io/devtron/kubelink :94237c18-314-39417	9d25865295af	stdlib@go1.25.0	1.25.11	3
quay.io/devtron/kubelink :09867a9c-564-39289	ea6dd1e4ce71	stdlib@go1.25.0	1.25.11	3
quay.io/devtron/kubewatch :09867a9c-419-39288	d30a7c640c63	stdlib@go1.25.5	1.25.11	3
quay.io/devtron/kubewatch :49f906a5-419-14814	eec0305b594c	stdlib@go1.20.7	1.25.11	3
quay.io/devtron/lens :3b3d6d0e-333-39292	e886b8d2b54b	stdlib@go1.25.5	1.25.11	3
quay.io/devtron/nats :2.9.3-alpine	f0cf3c3ab495	stdlib@go1.19.2	1.25.11	3
quay.io/devtron/nats-box :latest	48cdd3054b20	stdlib@go1.19.2	1.25.11	3
quay.io/devtron/nats-server-config-reloader :0.6.2	b5252e783fb2	stdlib@go1.15.14	1.25.11	3
quay.io/devtron/prometheus-nats-exporter :0.9.0	94044746cbce	stdlib@go1.16.15	1.25.11	3
quay.io/devtron/silver-surfer :e3b9a2f6-1191-38789	9640e2dc4316	stdlib@go1.21.5	1.25.11	3
quay.io/devtron/winter-soldier :abf5a822-196-14744	093844c46c19	stdlib@go1.18.10	1.25.11	3
quay.io/dexidp/dex :v2.25.0	7bcf286807b8	stdlib@go1.14.9	1.25.11	3
quay.io/kubernetes_incubator/nfs-provisioner :v2.3.0	f402e6039b3c	stdlib@go1.13.4	1.25.11	3
quay.io/metallb/controller :v0.13.10	1b33357b3595	stdlib@go1.19.5	1.25.11	3
quay.io/oliver006/redis_exporter :v1.35.1	908dbee5c546	stdlib@go1.17.7	1.25.11	3
quay.io/openshift/origin-oauth-proxy :4.14	a7dff785d821	stdlib@go1.20.10	1.25.11	3
quay.io/prometheus/alertmanager :v0.26.0	361db356b330	stdlib@go1.20.7	1.25.11	3
quay.io/prometheus/node-exporter :v1.1.2	22fbde17ab64	stdlib@go1.15.8	1.25.11	3
quay.io/prometheus/node-exporter :v1.6.1	81f94e50ea37	stdlib@go1.20.6	1.25.11	3
quay.io/prometheus/node-exporter :v1.2.2	a990408ed288	stdlib@go1.16.7	1.25.11	3
quay.io/prometheus-operator/prometheus-config-reloader :v0.91.0	7d9e4eea5f11	stdlib@go1.25.9	1.25.11	3
quay.io/prometheus-operator/prometheus-config-reloader :v0.74.0	d55631c7a740	stdlib@go1.22.3	1.25.11	3
quay.io/prometheus-operator/prometheus-operator :v0.90.1	52a6a92d915e	stdlib@go1.25.8	1.25.11	3
quay.io/prometheus-operator/prometheus-operator :v0.50.0	ab4f480f2cc6	stdlib@go1.16	1.25.11	3
quay.io/prometheus/prometheus :v2.41.0	1a3e9a878e50	stdlib@go1.19.4	1.25.11	3
quay.io/prometheus/prometheus :v2.55.0	378f4e037035	stdlib@go1.23.2	1.25.11	3
quay.io/prometheus/prometheus :v2.26.0	38d40a760569	stdlib@go1.16.2	1.25.11	3
quay.io/prometheus/prometheus :v3.10.0	7571a304e67f	stdlib@go1.26.0	1.25.11	3
quay.io/prometheus/prometheus :v2.31.1	a8779cfe553e	stdlib@go1.17.3	1.25.11	3
quay.io/prometheus/prometheus :v2.43.0	f5c29683a301	stdlib@go1.19.7	1.25.11	3
quay.io/prometheus/pushgateway :v1.10.0	7a4d0696a24e	stdlib@go1.23.1	1.25.11	3
quay.io/prometheus/pushgateway :v1.8.0	c159e946abf4	stdlib@go1.22.1	1.25.11	3
quay.io/redhat-cop/kube-rbac-proxy :v0.11.0	c68135620167	stdlib@go1.15.15	1.25.11	3
quay.io/sighup/permission-manager :v1.7.1-rc1	f5e6a5dcee33	stdlib@go1.16.8	1.25.11	3
registry.gitlab.com/gitlab-org/gitlab-runner :alpine-v19.3.1	af0325804248	stdlib@go1.26.3	1.25.11	3
registry.k8s.io/ingress-nginx/controller :v1.5.1	4ba73c697770	stdlib@go1.19.2	1.25.11	3
registry.k8s.io/ingress-nginx/controller :v1.8.1	e5c4824e7375	stdlib@go1.20.5	1.25.11	3
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.4.1	36d05b4077fb	stdlib@go1.22.2	1.25.11	3
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.5.2	e8825994b7a2	stdlib@go1.24.1	1.25.11	3
registry.k8s.io/kubectl :v1.31.0	99b37df34bc4	stdlib@go1.22.5	1.25.11	3
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.17.0	2bbc91556733	stdlib@go1.24.6	1.25.11	3
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.19.0	6b2f0b6f2f86	stdlib@go1.26.2	1.25.11	3
registry.k8s.io/sig-storage/csi-attacher :v4.3.0	4eb73137b663	stdlib@go1.20.3	1.25.11	3