StackRadar

CVE-2026-42504

High

Advisory

Published 2 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,204
of 17,828 indexed, latest versions
Container images
4,808
deployed by those charts
Fix available
1 of 2
affected packages

Quadratic complexity in WordDecoder.DecodeHeader in mime

Carried by container images the latest versions of 4,204 of 17,828 indexed charts deploy, on 4,808 images.

Affected packageAffected versionsFixed inImages
golang-1.19deb1.19.8-2no fix listed1
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+185 more1.25.114,808
OSV records
DEBIAN-CVE-2026-42504GO-2026-5038
Also known as
BIT-golang-2026-42504

Charts affected

4,204 by stars
ChartLatestAffected imagesRadar Score
zahori-schedulerzahoriVerified publisher1.0.11 of 1See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container imageDigestPackageFixed in
zahoriaut/zahori-scheduler:1.0.047d0979b1184
stdlib@go1.20.5
1.25.11

Open the chart page →

2,482
posthogzeet0.23.21 of 9See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2026-42504.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.19.07a85f522c5bc
stdlib@go1.17.13
1.25.11

Open the chart page →

3,702
zookeeper-exporterzookeeper-exporter0.1.01 of 1See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42504.

Container imageDigestPackageFixed in
dabealu/zookeeper-exporter:latest86106fec315f
stdlib@go1.14.15
1.25.11

Open the chart page →

1,249
zoo-project-druzoo-projectOfficialVerified publisher0.10.41 of 6See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-42504.

Container imageDigestPackageFixed in
library/postgres:18.4-alpine3.249a8afca54e78
stdlib@go1.24.6
1.25.11

Open the chart page →

8,105

Container images carrying it

4,808 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/prometheus-operator/prometheus-operator:v0.74.06b3f6d8b4c0a
stdlib@go1.22.3
1.25.11
1
quay.io/prometheus-operator/prometheus-operator:v0.85.0890b3bb05cf4
stdlib@go1.24.6
1.25.11
1
quay.io/prometheus-operator/prometheus-operator:v0.57.0a2d502c204f9
stdlib@go1.17.10
1.25.11
1
quay.io/prometheus-operator/prometheus-operator:v0.75.1a7cc63108511
stdlib@go1.22.4
1.25.11
1
quay.io/prometheus-operator/prometheus-operator:v0.88.0b4f51de53357
stdlib@go1.25.5
1.25.11
1
quay.io/prometheus-operator/prometheus-operator:v0.54.0be2aef39a2f8
stdlib@go1.17.6
1.25.11
1
quay.io/prometheus-operator/prometheus-operator:v0.61.1cd7d1a82ef00
stdlib@go1.19.3
1.25.11
1
quay.io/prometheus/prometheus:v3.0.03b9b2a15d376
stdlib@go1.23.3
1.25.11
1
quay.io/prometheus/prometheus:v2.39.14748e26f9369
stdlib@go1.19.2
1.25.11
1
quay.io/prometheus/prometheus:v2.37.056e7f18e05dd
stdlib@go1.18.4
1.25.11
1
quay.io/prometheus/prometheus:v3.2.05888c188cf09
stdlib@go1.23.6
1.25.11
1
quay.io/prometheus/prometheus:v3.5.063805ebb8d2b
stdlib@go1.24.5
1.25.11
1
quay.io/prometheus/prometheus:v3.2.16927e0919a14
stdlib@go1.23.6
1.25.11
1
quay.io/prometheus/prometheus:v2.33.591100b06e86d
stdlib@go1.17.8
1.25.11
1
quay.io/prometheus/prometheus:v3.4.19abc6cf6aea7
stdlib@go1.24.3
1.25.11
1
quay.io/prometheus/prometheus:v2.34.0b37103e03399
stdlib@go1.17.8
1.25.11
1
quay.io/prometheus/prometheus:v3.11.3c0b857aead0d
stdlib@go1.26.2
1.25.11
1
quay.io/prometheus/prometheus:v3.11.2cd37346c9745
stdlib@go1.26.2
1.25.11
1
quay.io/prometheus/prometheus:v2.53.1f20d3127bf28
stdlib@go1.22.5
1.25.11
1
quay.io/prometheus/pushgateway:v1.11.103738d278e08
stdlib@go1.24.1
1.25.11
1
quay.io/prometheus/pushgateway:v1.6.05111de00e969
stdlib@go1.20.4
1.25.11
1
quay.io/prometheus/statsd-exporter:v0.30.0378cb79c4ac7
stdlib@go1.26.3
1.25.11
1
quay.io/prometheus/statsd-exporter:v0.27.29ed70604d941
stdlib@go1.22.8
1.25.11
1
quay.io/prometheus/statsd-exporter:v0.22.8f53cca722a03
stdlib@go1.18.6
1.25.11
1
quay.io/rabbitmqoperator/messaging-topology-operator:1.18.1f97c36882244
stdlib@go1.24.6
1.25.11
1
quay.io/reactiveops/rbac-manager:v1.9.587e3f461446f
stdlib@go1.25.5
1.25.11
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
stdlib@go1.20.8
1.25.11
1
quay.io/redhat-cop/cert-utils-operator:v1.3.120290e7b2800a
stdlib@go1.19.13
1.25.11
1
quay.io/redhat-cop/patch-operator:v0.1.11030ade9b9428
stdlib@go1.21.9
1.25.11
1
quay.io/redhat-developer/servicebinding-operator16286ac84ddd
stdlib@go1.20.6
1.25.11
1
quay.io/reiml/smtp-gotify:latest80ffa9d2044a
stdlib@go1.23.9
1.25.11
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
stdlib@go1.16
1.25.11
1
quay.io/rimusz/hostpath-provisioner:v0.2.587f0398ec7ff
stdlib@go1.16.7
1.25.11
1
quay.io/sergeyshevch/s3manager:feature_refactoringff59fcdf44eb
stdlib@go1.18
1.25.11
1
quay.io/skopeo/stable:v1.134853591bd1d2
stdlib@go1.21.0
1.25.11
1
quay.io/solo-io/certgen:0.0.0-forkb17a8c7d1f32
stdlib@go1.18.1
1.25.11
1
quay.io/solo-io/discovery:0.0.0-fork5b62aaade3c9
stdlib@go1.18.1
1.25.11
1
quay.io/solo-io/gloo:0.0.0-fork9a6c84560d44
stdlib@go1.18.1
1.25.11
1
quay.io/solo-io/gloo-envoy-wrapper:0.0.0-fork26ae185e835a
stdlib@go1.18.1
1.25.11
1
quay.io/spotahome/redis-operator:latest8c772955184e
stdlib@go1.20.7
1.25.11
1
quay.io/superq/draytek-exporter:v0.2.03b577bdceaae
stdlib@go1.25.4
1.25.11
1
quay.io/superq/smokeping-prober:v0.7.125d07dfc1d7e
stdlib@go1.20.5
1.25.11
1
quay.io/thanos/thanos:v0.40.1aae7b2b030ed
stdlib@go1.25.3
1.25.11
1
quay.io/thanos/thanos:v0.17.1e362f02ed304
stdlib@go1.15
1.25.11
1
quay.io/thanos/thanos:v0.36.1e542959e1b36
stdlib@go1.21.13
1.25.11
1
quay.io/tigera/operator:v1.20.1379efe0c2541
stdlib@go1.15.2
1.25.11
1
quay.io/tigera/operator:v1.15.1c6591da87aa8
stdlib@go1.15.2
1.25.11
1
quay.io/titansoft/imagepullsecret-patcher:v0.1421e6d6a155dc
stdlib@go1.13.15
1.25.11
1
quay.io/uswitch/kiam:v4.0be3a5846922d
stdlib@go1.13.8
1.25.11
1
quay.io/vouch/vouch-proxy:0.39d34e220de3cf
stdlib@go1.18.10
1.25.11
1

syft 1.42.1 · advisories as of 22 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.