StackRadar

CVE-2026-42507

Medium

Advisory

Published 2 Jun 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.004
31st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,204
of 17,828 indexed, latest versions
Container images
4,808
deployed by those charts
Fix available
1 of 2
affected packages

Arbitrary inputs are included in errors without any escaping in net/textproto

Carried by container images the latest versions of 4,204 of 17,828 indexed charts deploy, on 4,808 images.

Affected packageAffected versionsFixed inImages
golang-1.19deb1.19.8-2no fix listed1
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+185 more1.25.114,808
OSV records
DEBIAN-CVE-2026-42507GO-2026-5039
Also known as
BIT-golang-2026-42507

Charts affected

4,204 by stars
ChartLatestAffected imagesRadar Score
zahori-schedulerzahoriVerified publisher1.0.11 of 1See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
zahoriaut/zahori-scheduler:1.0.047d0979b1184
stdlib@go1.20.5
1.25.11

Open the chart page →

2,482
posthogzeet0.23.21 of 9See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.19.07a85f522c5bc
stdlib@go1.17.13
1.25.11

Open the chart page →

3,702
zookeeper-exporterzookeeper-exporter0.1.01 of 1See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
dabealu/zookeeper-exporter:latest86106fec315f
stdlib@go1.14.15
1.25.11

Open the chart page →

1,249
zoo-project-druzoo-projectOfficialVerified publisher0.10.41 of 6See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
library/postgres:18.4-alpine3.249a8afca54e78
stdlib@go1.24.6
1.25.11

Open the chart page →

8,105

Container images carrying it

4,808 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/akhilrex/podgrab:1.0.0bce133f3f511
stdlib@go1.15.2
1.25.11
2
ghcr.io/alpineworks/flux-suspension-exporter:v1.0.0341f0a6cd2b6
stdlib@go1.24.0
1.25.11
2
ghcr.io/appscode/grafana-tools:v0.0.1f60324bca644
stdlib@go1.19.4
1.25.11
2
ghcr.io/appscode/kube-auth-manager:v0.0.1789692ab9193
stdlib@go1.20.2
1.25.11
2
ghcr.io/appscode/kubectl-nonroot:1.3183d43cc41590
stdlib@go1.24.9
1.25.11
2
ghcr.io/appscode/kube-rbac-proxy:v0.11.00df4ae70e3bd
stdlib@go1.15.14
1.25.11
2
ghcr.io/appscode/service-provider:v0.0.2f6e481386d70
stdlib@go1.25.5
1.25.11
2
ghcr.io/astriaorg/astria-geth:latest4249e403225a
stdlib@go1.22.12
1.25.11
2
ghcr.io/bank-vaults/vault-operator:v1.24.06f622c5fb8a9
stdlib@go1.26.3
1.25.11
2
ghcr.io/banzaicloud/logging-operator:3.17.101b530cf7c07f
stdlib@go1.17.13
1.25.11
2
ghcr.io/banzaicloud/tcheck:latest0147d87c2019
stdlib@go1.15.2
1.25.11
2
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
stdlib@go1.24.3
1.25.11
2
ghcr.io/buoyantio/prometheus:v2.55.12659f4c2ebb7
stdlib@go1.23.2
1.25.11
2
ghcr.io/celestiaorg/celestia-node:v0.27.5-mocha4768ea1c5fd2
stdlib@go1.24.7
1.25.11
2
ghcr.io/chaos-mesh/chaos-coredns:v0.2.838bfdf5e3774
stdlib@go1.25.5
1.25.11
2
ghcr.io/chaos-mesh/chaos-coredns:v0.2.678dc63bc5b89
stdlib@go1.19.7
1.25.11
2
ghcr.io/cloudnative-pg/cloudnative-pg:1.25.1b5210df46c05
stdlib@go1.24.0
1.25.11
2
ghcr.io/containerd/nydus-snapshotter:v0.9.056f8617363b4
stdlib@go1.18.10
1.25.11
2
ghcr.io/cosmos/gaia:v25.1.0f115777d1112
stdlib@go1.24.5
1.25.11
2
ghcr.io/cubed-it/inlets:4.0.0f02325f099bc
stdlib@go1.13.15
1.25.11
2
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
stdlib@go1.18
1.25.11
2
ghcr.io/danopstech/speedtest_exporter:v0.0.599efbe55412b
stdlib@go1.16.6
1.25.11
2
ghcr.io/dellnoantechnp/bitnami/redis:8.4.029064423c369
stdlib@go1.25.6
1.25.11
2
ghcr.io/dergeberl/kubeteach:v0.2.3-alphacf4428a3c79e
stdlib@go1.19.2
1.25.11
2
ghcr.io/dexidp/dex:v2.28.15e88f2205de1
stdlib@go1.16.2
1.25.11
2
ghcr.io/eosc-lot-1/curl-jq:8156beafae7ca
stdlib@go1.21.10
1.25.11
2
ghcr.io/glassflow/glassflow-etl-k8s-operator:v3.2.1e70364e88629
stdlib@go1.25.0
1.25.11
2
ghcr.io/google/fleetspeak:v0.1.17cd264d33efd4
stdlib@go1.22.5
1.25.11
2
ghcr.io/gotify/server:3.1.144fc5bbd1c06
stdlib@go1.26.0
1.25.11
2
ghcr.io/grafana/helm-chart-toolbox-kubectl:0.1.1c137478627cc
stdlib@go1.23.6
1.25.11
2
ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0bcf63357191b
stdlib@go1.18.2
1.25.11
2
ghcr.io/jkroepke/kube-webhook-certgen:1.7.47a62bba56a7c
stdlib@go1.25.5
1.25.11
2
ghcr.io/jkroepke/kube-webhook-certgen:1.8.38ce13c365c8e
stdlib@go1.26.3
1.25.11
2
ghcr.io/jont828/cluster-api-visualizer:v1.5.0678ba6833297
stdlib@go1.24.11
1.25.11
2
ghcr.io/k8snetworkplumbingwg/multus-cni:v4.1.409fdfb7ce090
stdlib@go1.23.4
1.25.11
2
ghcr.io/keptn/certificate-operator:v3.0.0b82064b0e339
stdlib@go1.23.3
1.25.11
2
ghcr.io/keptn/lifecycle-operator:v2.0.0866ced256a8c
stdlib@go1.23.3
1.25.11
2
ghcr.io/keptn/metrics-operator:v2.1.0dc48471c7cf8
stdlib@go1.23.3
1.25.11
2
ghcr.io/kluster-manager/cluster-auth:v0.5.1fba6fb872281
stdlib@go1.25.7
1.25.11
2
ghcr.io/konpyutaika/docker-images/nifikop:v1.14.1-release6bb00c592a82
stdlib@go1.24.4
1.25.11
2
ghcr.io/libredb/libredb-studio:0.16.2c398419c29a7
stdlib@go1.24.4
1.25.11
2
ghcr.io/matrix-org/sliding-sync:v0.99.19b940cab56435
stdlib@go1.20.14
1.25.11
2
ghcr.io/nucleuscloud/neosync/api:0.5.41e2abb798f29f
stdlib@go1.24.5
1.25.11
2
ghcr.io/nucleuscloud/neosync/worker:0.5.4196f42450c5b1
stdlib@go1.24.5
1.25.11
2
ghcr.io/parca-dev/parca:v0.20.00d1df8f436f7
stdlib@go1.21.1
1.25.11
2
ghcr.io/rabbitmq/messaging-topology-operator:1.19.124c4649ef3ef
stdlib@go1.25.9
1.25.11
2
ghcr.io/salaboy/fmtok8s-agenda-service:v0.0.1-native6c5efe150958
stdlib@go1.18.10
1.25.11
2
ghcr.io/salaboy/fmtok8s-c4p-service:v0.0.1-native3f7cc45fd20b
stdlib@go1.19.7
1.25.11
2
ghcr.io/shopify/toxiproxy:2.7.0fc2d40f4904c
stdlib@go1.19.13
1.25.11
2
ghcr.io/sigstore/scaffolding/createcerts7f59f7c08d1a
stdlib@go1.25.0
1.25.11
2

syft 1.42.1 · advisories as of 22 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.