StackRadar

CVE-2026-42507

Medium

Advisory

Published 2 Jun 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.004
33rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,281
of 17,844 indexed, latest versions
Container images
4,855
deployed by those charts
Fix available
1 of 2
affected packages

Arbitrary inputs are included in errors without any escaping in net/textproto

Carried by container images the latest versions of 4,281 of 17,844 indexed charts deploy, on 4,855 images.

Affected packageAffected versionsFixed inImages
golang-1.19deb1.19.8-2no fix listed1
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+185 more1.25.114,855
OSV records
DEBIAN-CVE-2026-42507GO-2026-5039
Also known as
BIT-golang-2026-42507

Charts affected

4,281 by stars
ChartLatestAffected imagesRadar Score
process-exporterkir4hVerified publisher1.0.11 of 1See more

process-exporter kir4h 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ncabatoff/process-exporterdigest-pinned6f0549dc24e9
stdlib@go1.23.1
1.25.11

Open the chart page →

737
typebotiokitsune-itopsVerified publisher0.1.41 of 4See more

typebotio kitsune-itops 0.1.4

1 of the 4 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
stdlib@go1.24.6
1.25.11

Open the chart page →

312
cdashkitwareVerified publisher0.20.01 of 3See more

cdash kitware 0.20.0

1 of the 3 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2024.12.18-debian-12-r0cce234b4381a
stdlib@go1.22.10
1.25.11

Open the chart page →

12,076
kloudlite-platformkloudlite1.1.51 of 3See more

kloudlite-platform kloudlite 1.1.5

1 of the 3 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
natsio/nats-box:0.14.1a67913df95f1
stdlib@go1.21.3
1.25.11

Open the chart page →

1,983
klumklumVerified publisher1.17.11 of 1See more

klum klum 1.17.1

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/jadolg/klum:v0.8.17c66cc93f9d03
stdlib@go1.26.3
1.25.11

Open the chart page →

352
klustre-csi-pluginklustre-csi-plugin0.1.11 of 2See more

klustre-csi-plugin klustre-csi-plugin 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.10.1f25af73ee708
stdlib@go1.21.5
1.25.11

Open the chart page →

1,501
knative-servingknative-servingVerified publisher1.18.37 of 7See more

knative-serving knative-serving 1.18.3

7 of the 7 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
gcr.io/knative-releases/knative.dev/net-istio/cmd/controllerdigest-pinned0d5f740b4224
stdlib@go1.24.6
1.25.11
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhookdigest-pinned697668be7893
stdlib@go1.24.6
1.25.11
gcr.io/knative-releases/knative.dev/serving/cmd/activatordigest-pinned031408ec516f
stdlib@go1.24.3
1.25.11
gcr.io/knative-releases/knative.dev/serving/cmd/autoscalerdigest-pinned3502bb5aa60f
stdlib@go1.24.3
1.25.11
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler-hpadigest-pinned7405faeb7636
stdlib@go1.24.3
1.25.11
gcr.io/knative-releases/knative.dev/serving/cmd/controllerdigest-pinned5b93308a392c
stdlib@go1.24.3
1.25.11
gcr.io/knative-releases/knative.dev/serving/cmd/webhookdigest-pinned50831d9aaa69
stdlib@go1.24.3
1.25.11

Open the chart page →

3,828
kollektorkollektorVerified publisher1.0.51 of 1See more

kollektor kollektor 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
pannoi/kollektor:1.0.59559617788fc
stdlib@go1.20.14
1.25.11

Open the chart page →

720
ingress-nginxkomailo-helm-charts1.0.02 of 2See more

ingress-nginx komailo-helm-charts 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.11.3d56f135b6462
stdlib@go1.22.8
1.25.11
registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.4a9f03b34a3cb
stdlib@go1.22.8
1.25.11

Open the chart page →

1,577
metallbkomailo-helm-charts1.2.43 of 4See more

metallb komailo-helm-charts 1.2.4

3 of the 4 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
quay.io/metallb/controller:v0.16.1f51ab515de9c
stdlib@go1.25.9
1.25.11
quay.io/metallb/frr-k8s:v0.0.251cb06fb2d553
stdlib@go1.25.8
1.25.11
quay.io/metallb/speaker:v0.16.116561e96531e
stdlib@go1.25.9
1.25.11

Open the chart page →

2,239
komiserkomiser-eks3.1.101 of 1See more

komiser komiser-eks 3.1.10

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
tailwarden/komiser:3.1.103f68c8ae7993
stdlib@go1.22.0
1.25.11

Open the chart page →

1,284
komoplanekomodorVerified publisher0.1.81 of 1See more

komoplane komodor 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
komodorio/komoplane:0.2.19678d02c3f2e
stdlib@go1.26.2
1.25.11

Open the chart page →

963
simple-oauth2-proxykostiantyn-matsebora-helm-chartsVerified publisher0.3.71 of 1See more

simple-oauth2-proxy kostiantyn-matsebora-helm-charts 0.3.7

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
quay.io/oauth2-proxy/oauth2-proxy:v7.7.09ed7eaf72050
stdlib@go1.22.8
1.25.11

Open the chart page →

930
kovi-tile38kovi-charts0.1.11 of 1See more

kovi-tile38 kovi-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
tile38/tile38:1.33.4afb7e82f9485
stdlib@go1.23.2
1.25.11

Open the chart page →

1,209
kpingkpingOfficialVerified publisher0.3.51 of 1See more

kping kping 0.3.5

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
kayrosuno/kping:latestf3bd44b29b0d
stdlib@go1.26.1
1.25.11

Open the chart page →

2,372
cadvisorkrakazyabraVerified publisher1.0.11 of 1See more

cadvisor krakazyabra 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
gcr.io/cadvisor/cadvisor:v0.40.0135327c978de
stdlib@go1.13.15
1.25.11

Open the chart page →

3,181
krakenkraken0.2.01 of 7See more

kraken kraken 0.2.0

1 of the 7 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
library/redis:5.0fc5ecd863862
stdlib@go1.16.7
1.25.11

Open the chart page →

1,731
aggregation-layer-examplekrateo0.1.11 of 1See more

aggregation-layer-example krateo 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/aggregation-layer-example:0.1.06a0ed8196346
stdlib@go1.19.5
1.25.11

Open the chart page →

1,506
appkrateo1.2.861 of 1See more

app krateo 1.2.86

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/app:1.2.86aaa3fe7d5c74
stdlib@go1.22.9
1.25.11

Open the chart page →

3,390
authnkrateo0.23.01 of 1See more

authn krateo 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/authn:0.23.0791c8f9d885a
stdlib@go1.24.2
1.25.11

Open the chart page →

674
autopilotkrateo1.0.01 of 2See more

autopilot krateo 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
library/postgres:16a3b7f434b2dc
stdlib@go1.24.6
1.25.11

Open the chart page →

1,319
azuredevops-providerkrateo0.23.11 of 2See more

azuredevops-provider krateo 0.23.1

1 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/azuredevops-provider:0.23.150f8f704df3d
stdlib@go1.23.12
1.25.11

Open the chart page →

401
azuredevops-provider-chartkrateo0.16.11 of 2See more

azuredevops-provider-chart krateo 0.16.1

1 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/azuredevops-provider:0.16.1d251f3e44714
stdlib@go1.19.5
1.25.11

Open the chart page →

1,032
azuredevops-provider-kogkrateo0.1.01 of 1See more

azuredevops-provider-kog krateo 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/azuredevops-rest-dynamic-controller-plugin:0.0.586f36ba6fcc5
stdlib@go1.24.2
1.25.11

Open the chart page →

419
azure-pricing-rest-dynamic-controller-pluginkrateo0.1.11 of 1See more

azure-pricing-rest-dynamic-controller-plugin krateo 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/azure-pricing-rest-dynamic-controller-plugin:0.1.068bd2c3fbf57
stdlib@go1.23.6
1.25.11

Open the chart page →

447
backendkrateo0.15.31 of 1See more

backend krateo 0.15.3

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/backend:0.15.383743fcca3a7
stdlib@go1.23.3
1.25.11

Open the chart page →

904
bffkrateo0.8.81 of 1See more

bff krateo 0.8.8

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/bff:0.8.7799eeacbf9a0
stdlib@go1.23.3
1.25.11

Open the chart page →

486
capi-watcherkrateo0.1.01 of 1See more

capi-watcher krateo 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/capi-watcher:0.1.0fa01a157d972
stdlib@go1.19.2
1.25.11

Open the chart page →

1,063
composition-watcherkrateo0.1.51 of 1See more

composition-watcher krateo 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/composition-watcher:0.1.4ef3b17c07cfc
stdlib@go1.23.2
1.25.11

Open the chart page →

498
core-providerkrateo1.0.02 of 2See more

core-provider krateo 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/chart-inspector:1.0.0264ba5302f8e
stdlib@go1.25.6
1.25.11
ghcr.io/krateoplatformops/core-provider:1.0.0363cdedfa59f
stdlib@go1.25.6
1.25.11

Open the chart page →

1,781
deviserkrateo0.7.11 of 1See more

deviser krateo 0.7.1

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/deviser:0.7.18310717431b2
stdlib@go1.26.3
1.25.11

Open the chart page →

233
etcdkrateo11.1.31 of 1See more

etcd krateo 11.1.3

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/etcd:3.5.19-debian-12-r00d68858b2699
stdlib@go1.23.7
1.25.11

Open the chart page →

2,555
eventrouterkrateo0.6.51 of 1See more

eventrouter krateo 0.6.5

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/eventstack/eventrouter:0.6.030121418adfa
stdlib@go1.25.5
1.25.11

Open the chart page →

308
eventrouter-kafka-producerkrateo0.1.11 of 1See more

eventrouter-kafka-producer krateo 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/eventrouter-kafka-producer:0.1.155b18c0dda37
stdlib@go1.19.2
1.25.11

Open the chart page →

1,618
events-ingesterkrateo0.5.31 of 1See more

events-ingester krateo 0.5.3

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/events-ingester:0.5.3e917b25f6b49
stdlib@go1.26.3
1.25.11

Open the chart page →

233
events-presenterkrateo0.9.31 of 1See more

events-presenter krateo 0.9.3

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/events-presenter:0.9.381b8ad5e4178
stdlib@go1.26.3
1.25.11

Open the chart page →

257
eventssekrateo0.5.91 of 1See more

eventsse krateo 0.5.9

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/eventstack/eventsse:0.5.8b65eb9c88669
stdlib@go1.25.4
1.25.11

Open the chart page →

417
finops-composition-definition-parserkrateo0.1.41 of 1See more

finops-composition-definition-parser krateo 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/finops-composition-definition-parser:0.1.2d9d82c32f418
stdlib@go1.24.2
1.25.11

Open the chart page →

928
finops-database-handler-uploaderkrateo0.2.11 of 1See more

finops-database-handler-uploader krateo 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/finops-database-handler-uploader:0.2.131ee1096bc9c
stdlib@go1.25.4
1.25.11

Open the chart page →

325
finops-example-pricing-vm-azurekrateo0.2.141 of 1See more

finops-example-pricing-vm-azure krateo 0.2.14

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/kubectl:1.32.0d69cd9c163db
stdlib@go1.23.3
1.25.11

Open the chart page →

1,221
finops-http-rest-queuekrateo0.1.01 of 1See more

finops-http-rest-queue krateo 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/finops-http-rest-queue:0.1.0eaa0801e29a7
stdlib@go1.22.1
1.25.11

Open the chart page →

763
finops-moving-window-microservicekrateo0.1.01 of 1See more

finops-moving-window-microservice krateo 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/finops-moving-window-microservice:0.1.01c9a888ee58f
stdlib@go1.24.2
1.25.11

Open the chart page →

671
finops-nats-subscriberkrateo0.1.01 of 1See more

finops-nats-subscriber krateo 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/finops-nats-subscriber:0.1.0761d96bf2d9c
stdlib@go1.22.1
1.25.11

Open the chart page →

879
finops-notebookskrateo0.1.11 of 1See more

finops-notebooks krateo 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/kubectl:1.33.1393d2a3f53a5
stdlib@go1.24.3
1.25.11

Open the chart page →

4,339
finops-operator-exporterkrateo0.5.21 of 1See more

finops-operator-exporter krateo 0.5.2

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/finops-operator-exporter:0.5.17444eb2107f6
stdlib@go1.24.2
1.25.11

Open the chart page →

430
finops-operator-focuskrateo0.4.31 of 1See more

finops-operator-focus krateo 0.4.3

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/finops-operator-focus:0.4.346a16edcb62e
stdlib@go1.23.0
1.25.11

Open the chart page →

516
finops-operator-scraperkrateo0.5.11 of 1See more

finops-operator-scraper krateo 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/finops-operator-scraper:0.5.15523ff02e511
stdlib@go1.23.0
1.25.11

Open the chart page →

516
finops-operator-vm-managerkrateo0.1.21 of 2See more

finops-operator-vm-manager krateo 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/finops-operator-vm-manager:0.1.215f804bdd1e8
stdlib@go1.21.12
1.25.11

Open the chart page →

589
frontend-providerkrateo0.3.01 of 1See more

frontend-provider krateo 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/frontend-provider:0.3.084c3219b00a2
stdlib@go1.21.6
1.25.11

Open the chart page →

950
github-providerkrateo0.2.21 of 1See more

github-provider krateo 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/krateoplatformops/github-provider:0.2.2c9438109f23d
stdlib@go1.23.0
1.25.11

Open the chart page →

524

Container images carrying it

4,855 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/snapshot-controller:v8.2.1472fa35a89da
stdlib@go1.23.6
1.25.11
1
registry.k8s.io/sig-storage/snapshot-controller:v4.2.195587f8777d7
stdlib@go1.16.2
1.25.11
1
registry.k8s.io/sig-storage/snapshot-controller:v6.2.198bab4eaf23c
stdlib@go1.19
1.25.11
1
registry.k8s.io/sig-storage/snapshot-controller:v6.3.1ce6ca3c0e30b
stdlib@go1.20.5
1.25.11
1
registry.k8s.io/sig-storage/volume-data-source-validator:v1.0.0d35884236461
stdlib@go1.17.3
1.25.11
1

syft 1.42.1 · advisories as of 25 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.