StackRadar

CVE-2026-42504

High

Advisory

Published 2 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,204
of 17,828 indexed, latest versions
Container images
4,808
deployed by those charts
Fix available
1 of 2
affected packages

Quadratic complexity in WordDecoder.DecodeHeader in mime

Carried by container images the latest versions of 4,204 of 17,828 indexed charts deploy, on 4,808 images.

Affected packageAffected versionsFixed inImages
golang-1.19deb1.19.8-2no fix listed1
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+185 more1.25.114,808
OSV records
DEBIAN-CVE-2026-42504GO-2026-5038
Also known as
BIT-golang-2026-42504

Charts affected

4,204 by stars
ChartLatestAffected imagesRadar Score
zahori-schedulerzahoriVerified publisher1.0.11 of 1See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container imageDigestPackageFixed in
zahoriaut/zahori-scheduler:1.0.047d0979b1184
stdlib@go1.20.5
1.25.11

Open the chart page →

2,482
posthogzeet0.23.21 of 9See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2026-42504.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.19.07a85f522c5bc
stdlib@go1.17.13
1.25.11

Open the chart page →

3,702
zookeeper-exporterzookeeper-exporter0.1.01 of 1See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container imageDigestPackageFixed in
dabealu/zookeeper-exporter:latest86106fec315f
stdlib@go1.14.15
1.25.11

Open the chart page →

1,249
zoo-project-druzoo-projectOfficialVerified publisher0.10.41 of 6See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-42504.

Container imageDigestPackageFixed in
library/postgres:18.4-alpine3.249a8afca54e78
stdlib@go1.24.6
1.25.11

Open the chart page →

8,105

Container images carrying it

4,808 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/appscode/fileserver:v0.0.2b1857871e06c
stdlib@go1.25.4
1.25.11
1
ghcr.io/appscode/gcp-credential-manager:v0.1.0b58345fe8209
stdlib@go1.25.8
1.25.11
1
ghcr.io/appscode/gh-ci-webhook:v0.0.2036ce246d884e
stdlib@go1.24.0
1.25.11
1
ghcr.io/appscode/gotenberg:8.25f9104080d9a7
stdlib@go1.25.4
1.25.11
1
ghcr.io/appscode/grafana:v2025.2.367d18880448c
stdlib@go1.17.1
1.25.11
1
ghcr.io/appscode/grafana-tools:v0.0.22c7b9b0a9101
stdlib@go1.20.2
1.25.11
1
ghcr.io/appscode/inbox-agent:v0.0.66b99ee9feece
stdlib@go1.25.10
1.25.11
1
ghcr.io/appscode/kube-bind-server:v0.0.11762f3f6bb71
stdlib@go1.20.2
1.25.11
1
ghcr.io/appscode/kubectl-nonroot:v1.248ee5bdd68977
stdlib@go1.20.7
1.25.11
1
ghcr.io/appscode/kube-rbac-proxy:v0.18.27de54b6dedc8
stdlib@go1.23.3
1.25.11
1
ghcr.io/appscode/kube-rbac-proxy:v0.15.0d8cc6ffb9819
stdlib@go1.21.3
1.25.11
1
ghcr.io/appscode/kube-ui-server:v0.0.1340775d6850b5
stdlib@go1.19.5
1.25.11
1
ghcr.io/appscode/license-proxyserver:v0.0.372a5c874d854
stdlib@go1.19.6
1.25.11
1
ghcr.io/appscode/license-proxyserver:v0.0.8d6c2532ea386
stdlib@go1.22.1
1.25.11
1
ghcr.io/appscode/offline-license-server:v0.0.76e4b66308d8f6
stdlib@go1.25.5
1.25.11
1
ghcr.io/appscode/panopticon:v0.0.62cdae231ed8a
stdlib@go1.19.4
1.25.11
1
ghcr.io/appscode/scanner:v0.0.2116907aae5de1
stdlib@go1.25.5
1.25.11
1
ghcr.io/appscode/secrets-store-csi-driver-provider-virtual-secrets:v0.2.07afb394f9f97
stdlib@go1.24.1
1.25.11
1
ghcr.io/appscode/smtprelay:v0.0.479c9c76a78e6
stdlib@go1.23.2
1.25.11
1
ghcr.io/appscode/supervisor:v0.0.21a58f56724da
stdlib@go1.19.4
1.25.11
1
ghcr.io/appscode/taskqueue:v0.0.36877c958a3c6
stdlib@go1.25.5
1.25.11
1
ghcr.io/appscode/trickster:v2.0.0cdbbed831f28
stdlib@go1.25.5
1.25.11
1
ghcr.io/appscode/trivydb:0.0.367ffb0309acb
stdlib@go1.20.2
1.25.11
1
ghcr.io/aquasecurity/trivy-operator:0.16.0a608b798fda5
stdlib@go1.20.4
1.25.11
1
ghcr.io/argelbargel/vault-raft-snapshot-agent:v0.12.5345174727a2b
stdlib@go1.23.10
1.25.11
1
ghcr.io/argonix-io/argonix-api:1.0.047ddfba4a6ed
stdlib@go1.22.7
1.25.11
1
ghcr.io/argonix-io/argonix-api-frontend:1.0.05608d452c4fd
stdlib@go1.23.12
1.25.11
1
ghcr.io/arpa-network/node-client:latest657a2c9f6e6d
stdlib@go1.22.5
1.25.11
1
ghcr.io/aserto-dev/topaz:0.32.594c708ecf7dc4
stdlib@go1.24.2
1.25.11
1
ghcr.io/ashvinbambhaniya/nexus-tasks-backend:2.0.0f80349eb018b
stdlib@go1.26.0
1.25.11
1
ghcr.io/astradns/astradns-agent:v0.2.9-unbound6ba69487f1b0
stdlib@go1.26.1
1.25.11
1
ghcr.io/astradns/astradns-operator:v0.2.909e58b62416a
stdlib@go1.26.1
1.25.11
1
ghcr.io/astriaorg/astria-indexer:0.1.05cf1e5709820
stdlib@go1.23.1
1.25.11
1
ghcr.io/astriaorg/astria-indexer-api:0.1.03490d9900af1
stdlib@go1.23.1
1.25.11
1
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
stdlib@go1.20.12
1.25.11
1
ghcr.io/astriaorg/flame:0.1.0c8af1c5aae40
stdlib@go1.22.12
1.25.11
1
ghcr.io/astriaorg/ria-faucet:0.0.1a06c8ebef427
stdlib@go1.17.13
1.25.11
1
ghcr.io/astriaorg/seq-faucet:0.9.0bf3cb9b505b6
stdlib@go1.22.6
1.25.11
1
ghcr.io/atolat/open-cache:latestd6105dd73eb4
stdlib@go1.25.8
1.25.11
1
ghcr.io/atrox/alertmanager-discord:v1.0.0ac011a4b6df1
stdlib@go1.20.5
1.25.11
1
ghcr.io/aureum-cloud/cloudflare-ddns:latestaeb75d1605f4
stdlib@go1.23.12
1.25.11
1
ghcr.io/aureum-cloud/frp-operator:v1.0.196b01d7e7025
stdlib@go1.24.13
1.25.11
1
ghcr.io/autobrr/autobrr:v1.10.0d4022cd32df5
stdlib@go1.19.3
1.25.11
1
ghcr.io/autobrr/qui:v1.14.110b7945d4f09
stdlib@go1.25.7
1.25.11
1
ghcr.io/automata-network/multi-prover-avs/operator:v0.6.0752f1aa02438
stdlib@go1.22.1
1.25.11
1
ghcr.io/automation64/toolbox/oraclelinux-9-toolbox:latest7af2216c7b9e
stdlib@go1.25.1
1.25.11
1
ghcr.io/avistotelecom/kubebrowser:0.10.0a354b8dc7e6a
stdlib@go1.24.1
1.25.11
1
ghcr.io/axonops/axonops-developer-operator:v0.1.0b3d6600c8ba5
stdlib@go1.22.10
1.25.11
1
ghcr.io/axonops/axonops-operator:0.1.0e0cdb993f0b1
stdlib@go1.25.9
1.25.11
1
ghcr.io/bamaas/gofit:0.0.132b6a174b419
stdlib@go1.22.11
1.25.11
1

syft 1.42.1 · advisories as of 22 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.