StackRadar

CVE-2026-42504

High

Advisory

Published 2 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,204
of 17,828 indexed, latest versions
Container images
4,808
deployed by those charts
Fix available
1 of 2
affected packages

Quadratic complexity in WordDecoder.DecodeHeader in mime

Carried by container images the latest versions of 4,204 of 17,828 indexed charts deploy, on 4,808 images.

Affected packageAffected versionsFixed inImages
golang-1.19deb1.19.8-2no fix listed1
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+185 more1.25.114,808
OSV records
DEBIAN-CVE-2026-42504GO-2026-5038
Also known as
BIT-golang-2026-42504

Charts affected

4,204 by stars
ChartLatestAffected imagesRadar Score
zahori-schedulerzahoriVerified publisher1.0.11 of 1See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container imageDigestPackageFixed in
zahoriaut/zahori-scheduler:1.0.047d0979b1184
stdlib@go1.20.5
1.25.11

Open the chart page →

2,482
posthogzeet0.23.21 of 9See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2026-42504.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.19.07a85f522c5bc
stdlib@go1.17.13
1.25.11

Open the chart page →

3,702
zookeeper-exporterzookeeper-exporter0.1.01 of 1See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container imageDigestPackageFixed in
dabealu/zookeeper-exporter:latest86106fec315f
stdlib@go1.14.15
1.25.11

Open the chart page →

1,249
zoo-project-druzoo-projectOfficialVerified publisher0.10.41 of 6See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-42504.

Container imageDigestPackageFixed in
library/postgres:18.4-alpine3.249a8afca54e78
stdlib@go1.24.6
1.25.11

Open the chart page →

8,105

Container images carrying it

4,808 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
gcr.io/press-labs-public/dashboard:1.8.19b88f88070fb0
stdlib@go1.21.1
1.25.11
1
gcr.io/projectsigstore/cosigned784518ff3ee7
stdlib@go1.17.9
1.25.11
1
gcr.io/projectsigstore/policy-webhook82940e8c3e0d
stdlib@go1.17.9
1.25.11
1
gcr.io/spotit-today/spot-ocean-admission-controller:0.1.64f634aeb31b8
stdlib@go1.24.13
1.25.11
1
ghcr.io/0xerr0r/blocky:v0.29.0a6d99f323d30
stdlib@go1.26.0
1.25.11
1
ghcr.io/0xerr0r/blocky:v0.18b15824464acb
stdlib@go1.17.7
1.25.11
1
ghcr.io/abstract-foundation/zksync-external-node-sidecar:v1.0.03e705d0eb1ce
stdlib@go1.18.10
1.25.11
1
ghcr.io/actions/gha-runner-scale-set-controller:0.14.21b4c7f62e971
stdlib@go1.26.3
1.25.11
1
ghcr.io/adfinis/kubernetes-etcd-backup:v1.4.68ec6c4812a7e
stdlib@go1.23.7
1.25.11
1
ghcr.io/aetrius/msockperf-client/msockperf-client:main820af919c5e2
stdlib@go1.22.1
1.25.11
1
ghcr.io/aeyrtonvs/k8s-drain-surge:0.0.338bce7856b5c
stdlib@go1.25.10
1.25.11
1
ghcr.io/afairgiant/medikeep:v0.70.04c28334f3c79
stdlib@go1.19.8
1.25.11
1
ghcr.io/agjmills/sentry-operator:v1.2.500389ef6a00e
stdlib@go1.24.2
1.25.11
1
ghcr.io/ajnart/homarr:0.16.0737ec361ed24
stdlib@go1.22.5
1.25.11
1
ghcr.io/ajnart/homarr:lateste103abadfb52
stdlib@go1.22.5
1.25.11
1
ghcr.io/akash-network/node:0.36.08763983b31f1
stdlib@go1.21.10
1.25.11
1
ghcr.io/alekc/kpubber:v0.0.2a462d5797e14
stdlib@go1.16.9
1.25.11
1
ghcr.io/alex123012/annotations-exporter:v0.5.04c2b8dbc798e
stdlib@go1.19.3
1.25.11
1
ghcr.io/alexbakker/alertmanager-ntfy:1.0.12f4db8064595
stdlib@go1.24.4
1.25.11
1
ghcr.io/alexellis/registry-creds:0.3.2-rc1f5c72501e559
stdlib@go1.19.5
1.25.11
1
ghcr.io/alpineworks/ip:v1.0.04e0d4d51f0bc
stdlib@go1.24.2
1.25.11
1
ghcr.io/alpineworks/katalog-agent:v1.0.48f50bd568c2b
stdlib@go1.23.3
1.25.11
1
ghcr.io/alpineworks/katalog-backend:v1.0.77e7a26393cd1
stdlib@go1.23.3
1.25.11
1
ghcr.io/alpineworks/katalog-migrations:v1.0.562c44a384e13
stdlib@go1.23.1
1.25.11
1
ghcr.io/alpineworks/versitygw-webhook-pulsar-proxy:v1.0.06e9ced773732
stdlib@go1.24.4
1.25.11
1
ghcr.io/analogj/scrutiny:master-omnibus18689773150d
stdlib@go1.20.14
1.25.11
1
ghcr.io/analogj/scrutiny:v0.9.2-web71be54e99608
stdlib@go1.25.5
1.25.11
1
ghcr.io/andibraeu/cert-manager-webhook-inwx:v0.9.0f015e745983e
stdlib@go1.25.7
1.25.11
1
ghcr.io/andylibrian/terjang:latest20a46b199247
stdlib@go1.16.4
1.25.11
1
ghcr.io/angelnu/chirpstack-packet-multiplexer:latest0c84c2d71006
stdlib@go1.13.15
1.25.11
1
ghcr.io/angelnu/dnsmadeeasy-webhook:v1.9.0a5ca158b1f02
stdlib@go1.24.1
1.25.11
1
ghcr.io/angelnu/gateway-admision-controller:v3.12.06f6ab596afd5
stdlib@go1.24.2
1.25.11
1
ghcr.io/angelscloud/prometheus-optimizer:latest744bc929a579
stdlib@go1.21.4
1.25.11
1
ghcr.io/aplulu/hakoniwa:0.1.0accf0b921388
stdlib@go1.25.5
1.25.11
1
ghcr.io/appscode/ace:v0.2.0b8e03da90e70
stdlib@go1.25.9
1.25.11
1
ghcr.io/appscode/acerproxy:v0.2.021de3771fdd5
stdlib@go1.25.5
1.25.11
1
ghcr.io/appscode/aceshifter:v0.0.3e5f5c254a55a
stdlib@go1.25.8
1.25.11
1
ghcr.io/appscode/appcatalog:v0.0.109709a346888
stdlib@go1.20.5
1.25.11
1
ghcr.io/appscode/auditor:v0.0.1c62c89ee706d
stdlib@go1.19.4
1.25.11
1
ghcr.io/appscode/aws-credential-manager:v0.1.00511bbe501c3
stdlib@go1.25.9
1.25.11
1
ghcr.io/appscode/azure-credential-manager:v0.1.0f5c797f7fbe7
stdlib@go1.25.9
1.25.11
1
ghcr.io/appscode/b3:v2023.03.235f5a40fc1702
stdlib@go1.20.2
1.25.11
1
ghcr.io/appscode/b3:v2026.9.1178a9fb785ec5
stdlib@go1.25.3
1.25.11
1
ghcr.io/appscode/capa-vpc-peering-operator:v0.0.4b1557553a2b3
stdlib@go1.21.5
1.25.11
1
ghcr.io/appscode/capi-ops-manager:v0.0.57465f35b684c
stdlib@go1.23.2
1.25.11
1
ghcr.io/appscode/cert-manager-webhook-ace:v0.0.2dc6b5fdcec06
stdlib@go1.25.5
1.25.11
1
ghcr.io/appscode/cloudflare-dns-proxy:v0.0.5dfbef0285e14
stdlib@go1.25.5
1.25.11
1
ghcr.io/appscode/cluster-connector:v0.0.140efd9d9ef6ca
stdlib@go1.25.5
1.25.11
1
ghcr.io/appscode/docker-machine-operator:v0.0.481f6007abb4e
stdlib@go1.22.4
1.25.11
1
ghcr.io/appscode/falco-ui-server:v0.0.66ec488d89b56
stdlib@go1.25.5
1.25.11
1

syft 1.42.1 · advisories as of 22 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.