StackRadar

CVE-2026-42507

Medium

Advisory

Published 2 Jun 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.004
33rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,281
of 17,844 indexed, latest versions
Container images
4,855
deployed by those charts
Fix available
1 of 2
affected packages

Arbitrary inputs are included in errors without any escaping in net/textproto

Carried by container images the latest versions of 4,281 of 17,844 indexed charts deploy, on 4,855 images.

Affected packageAffected versionsFixed inImages
golang-1.19deb1.19.8-2no fix listed1
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+185 more1.25.114,855
OSV records
DEBIAN-CVE-2026-42507GO-2026-5039
Also known as
BIT-golang-2026-42507

Charts affected

4,281 by stars
ChartLatestAffected imagesRadar Score
grafana-chartmy-personal-grafana0.1.01 of 1See more

grafana-chart my-personal-grafana 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
grafana/grafana:latestac461fb352ab
stdlib@go1.26.3
1.25.11

Open the chart page →

627
influxdbmy-personal-influxdb20.1.01 of 1See more

influxdb my-personal-influxdb2 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
library/influxdb:2.7b8d940ca9376
stdlib@go1.18.2
1.25.11

Open the chart page →

4,009
phonebook-chartmy-phonebook-chart0.1.01 of 3See more

phonebook-chart my-phonebook-chart 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
stdlib@go1.18.2
1.25.11

Open the chart page →

3,046
mychartmysqlweb0.1.01 of 1See more

mychart mysqlweb 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
qichenxu4pd/mysqlweb:1.2d758d41d9c6b
stdlib@go1.18.2
1.25.11

Open the chart page →

1,164
myweatherhelmmyweather1.3.111 of 7See more

myweatherhelm myweather 1.3.11

1 of the 7 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
library/rabbitmq:3-managemente582c0bc7766
stdlib@go1.22.2
1.25.11

Open the chart page →

18,917
fargate-sidecar-injectormziyaboVerified publisher0.1.51 of 1See more

fargate-sidecar-injector mziyabo 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
mziyabo/fargate-eks-sidecar-injector:latest3067dce17983
stdlib@go1.19.13
1.25.11

Open the chart page →

1,419
victoria-metrics-singlenaps0.0.61 of 1See more

victoria-metrics-single naps 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
victoriametrics/victoria-metrics:v1.34.7b50d5c0153f9
stdlib@go1.14.1
1.25.11

Open the chart page →

1,316
pagesnarain1.0.01 of 3See more

pages narain 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.25.11

Open the chart page →

20,585
pagesnarasimha-pages1.0.01 of 3See more

pages narasimha-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.25.11

Open the chart page →

20,585
traefik-forward-auth-openidnas-helm-chartsVerified publisher1.0.11 of 1See more

traefik-forward-auth-openid nas-helm-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
thomseddon/traefik-forward-auth:latestb364aa6a4117
stdlib@go1.13.15
1.25.11

Open the chart page →

2,193
nats-kafkanatsVerified publisher0.15.41 of 1See more

nats-kafka nats 0.15.4

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
natsio/nats-kafka:1.4.2bb241956b0dc
stdlib@go1.20
1.25.11

Open the chart page →

1,743
nats-operatornatsVerified publisher0.8.31 of 1See more

nats-operator nats 0.8.3

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
natsio/nats-operator:0.8.31261dae38389
stdlib@go1.16.10
1.25.11

Open the chart page →

2,359
account-servernatz-operatorVerified publisher0.9.51 of 1See more

account-server natz-operator 0.9.5

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/zeiss/natz-operator/account-server:0.9.5b380b5f17c3f
stdlib@go1.23.3
1.25.11

Open the chart page →

741
navidromenavidrome0.2.51 of 1See more

navidrome navidrome 0.2.5

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
deluan/navidrome:0.41.1fc4d8b6ad9f9
stdlib@go1.16.2
1.25.11

Open the chart page →

3,329
pagesnavin-brixton1.0.01 of 3See more

pages navin-brixton 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.25.11

Open the chart page →

20,585
incorencsaVerified publisher1.38.02 of 29See more

incore ncsa 1.38.0

2 of the 29 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
bitnamilegacy/keycloak:24.0.4cc599cbd15ff
stdlib@go1.21.10
1.25.11
bitnamilegacy/mongodb:4.4.5e3c9d6b4bc92
stdlib@go1.15.8
1.25.11

Open the chart page →

15,973
jupyterhub-metricsncsaVerified publisher1.3.04 of 5See more

jupyterhub-metrics ncsa 1.3.0

4 of the 5 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
grafana/grafana:latestac461fb352ab
stdlib@go1.26.3
1.25.11
library/postgres:15-alpinea46e076249ce
stdlib@go1.24.6
1.25.11
timescale/timescaledb:latest-pg156343bdc87ca1
stdlib@go1.24.6
1.25.11
ghcr.io/ncsa/jupyterhub-metrics/collector:1.3.0dcb8c731bb1b
stdlib@go1.25.6
1.25.11

Open the chart page →

3,310
uptime-kumancsaVerified publisher1.7.31 of 1See more

uptime-kuma ncsa 1.7.3

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.5c74379ac4509
stdlib@go1.20.5
1.25.11

Open the chart page →

31,812
neo4j-reverse-proxyneo4j-helm-chartsVerified publisher2026.9.01 of 1See more

neo4j-reverse-proxy neo4j-helm-charts 2026.9.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
neo4j/helm-charts-reverse-proxy:2026.09.00c6c9ee5f7dc
stdlib@go1.24.13
1.25.11

Open the chart page →

475
redisneomanexlabsVerified publisher1.1.01 of 1See more

redis neomanexlabs 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
library/redis:7.4.2-alpine02419de7eddf
stdlib@go1.18.2
1.25.11

Open the chart page →

1,449
neosyncneosyncVerified publisher0.5.412 of 3See more

neosync neosync 0.5.41

2 of the 3 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/nucleuscloud/neosync/api:0.5.41e2abb798f29f
stdlib@go1.24.5
1.25.11
ghcr.io/nucleuscloud/neosync/worker:0.5.4196f42450c5b1
stdlib@go1.24.5
1.25.11

Open the chart page →

7,533
apineosync-apiVerified publisher0.5.411 of 1See more

api neosync-api 0.5.41

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/nucleuscloud/neosync/api:0.5.41e2abb798f29f
stdlib@go1.24.5
1.25.11

Open the chart page →

3,000
workerneosync-workerVerified publisher0.5.411 of 1See more

worker neosync-worker 0.5.41

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/nucleuscloud/neosync/worker:0.5.4196f42450c5b1
stdlib@go1.24.5
1.25.11

Open the chart page →

2,977
bluesky-pdsnerkho-helm-charts0.4.21 of 1See more

bluesky-pds nerkho-helm-charts 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4.204cbc6e3ea157d
stdlib@go1.25.6
1.25.11

Open the chart page →

2,464
core-keeper-dedicatednerkho-helm-charts0.1.11 of 1See more

core-keeper-dedicated nerkho-helm-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
escaping/core-keeper-dedicated:latest87fa79255962
stdlib@go1.24.4
1.25.11

Open the chart page →

4,118
kubernetes-operatornetbird0.3.11 of 1See more

kubernetes-operator netbird 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
netbirdio/kubernetes-operator:0.3.157740157b4d7
stdlib@go1.26.2
1.25.11

Open the chart page →

214
netbirdnetbird1.9.03 of 4See more

netbird netbird 1.9.0

3 of the 4 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
netbirdio/management:0.46.0b0adc4ad4ec6
stdlib@go1.23.9
1.25.11
netbirdio/relay:0.46.0d32f82514a24
stdlib@go1.23.9
1.25.11
netbirdio/signal:0.46.0e8f392611152
stdlib@go1.23.9
1.25.11

Open the chart page →

6,663
netris-dpu-agentnetrisai0.1.01 of 1See more

netris-dpu-agent netrisai 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
netrisai/bare-metal-dpu-agent:4.7.0.003c271efe749d0
stdlib@go1.26.1
1.25.11

Open the chart page →

1,701
iamdnetsocVerified publisher0.6.11 of 2See more

iamd netsoc 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/netsoc/iamd:1.1.22fe6b69b20d7
stdlib@go1.16.6
1.25.11

Open the chart page →

2,889
shhdnetsocVerified publisher0.1.71 of 1See more

shhd netsoc 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/netsoc/shhd:0.1.60bb44992b62c
stdlib@go1.17
1.25.11

Open the chart page →

3,987
webspacednetsocVerified publisher0.2.82 of 2See more

webspaced netsoc 0.2.8

2 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/devplayer0/kubelan:0.2.3b776dae45d08
stdlib@go1.16.5
1.25.11
ghcr.io/netsoc/webspaced:0.5.1edc238a538a0
stdlib@go1.16.8
1.25.11

Open the chart page →

5,196
neurofaceneurofaceVerified publisher1.4.21 of 3See more

neuroface neuroface 1.4.2

1 of the 3 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
openvino/model_server:2025.2.11e7cd1d70cc1
stdlib@go1.24.4
1.25.11

Open the chart page →

7,882
agent-controlnewrelic0.0.921 of 1See more

agent-control newrelic 0.0.92

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
newrelic/newrelic-agent-control-cli:0.48.01a448492b55a
stdlib@go1.24.6
1.25.11

Open the chart page →

4,024
agent-control-cdnewrelic1.0.03 of 3See more

agent-control-cd newrelic 1.0.0

3 of the 3 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/fluxcd/flux-cli:v2.5.1274a179fd402
stdlib@go1.23.6
1.25.11
ghcr.io/fluxcd/helm-controller:v1.2.062eaa9c9a929
stdlib@go1.23.6
1.25.11
ghcr.io/fluxcd/source-controller:v1.5.000cd9316a379
stdlib@go1.23.6
1.25.11

Open the chart page →

5,558
nexus-freenexus-freeVerified publisher1.0.31 of 1See more

nexus-free nexus-free 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
quay.io/fossa/postgres:17.2-15af45ac79f38
stdlib@go1.18.2
1.25.11

Open the chart page →

1,122
nexus-tasksnexus-tasks2.0.01 of 5See more

nexus-tasks nexus-tasks 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/ashvinbambhaniya/nexus-tasks-backend:2.0.0f80349eb018b
stdlib@go1.26.0
1.25.11

Open the chart page →

3,920
nginx-examplengrok-ingress-helm0.3.01 of 2See more

nginx-example ngrok-ingress-helm 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
wernight/ngrok:latestd211f29ebcfe
stdlib@go1.21.6
1.25.11

Open the chart page →

2,804
digikamnicholaswildeVerified publisher1.0.01 of 1See more

digikam nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/digikam:version-7.3.055b4c7f320ae
stdlib@go1.16.9
1.25.11

Open the chart page →

25,009
doublecommandernicholaswildeVerified publisher1.0.21 of 1See more

doublecommander nicholaswilde 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/doublecommander:version-0.8.2-1d92969a929c2
stdlib@go1.16.9
1.25.11

Open the chart page →

26,161
filezillanicholaswildeVerified publisher1.0.11 of 1See more

filezilla nicholaswilde 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/filezilla:version-3.51.0-r15103cdd266ce
stdlib@go1.15.12
1.25.11

Open the chart page →

3,207
golinksnicholaswildeVerified publisher1.0.01 of 1See more

golinks nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/nicholaswilde/golinks:version-154c5818e67b26324c5
stdlib@go1.16.5
1.25.11

Open the chart page →

1,119
notesnicholaswildeVerified publisher1.0.01 of 1See more

notes nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/nicholaswilde/notes:version-ee287b9ab9bc16465bc
stdlib@go1.16.5
1.25.11

Open the chart page →

1,485
olivetinnicholaswildeVerified publisher1.0.21 of 1See more

olivetin nicholaswilde 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/nicholaswilde/olivetin:version-2021-07-19e1d5c8a01008
stdlib@go1.16.5
1.25.11

Open the chart page →

1,678
podgrabnicholaswildeVerified publisher0.1.01 of 1See more

podgrab nicholaswilde 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/akhilrex/podgrab:1.0.0bce133f3f511
stdlib@go1.15.2
1.25.11

Open the chart page →

2,398
remminanicholaswildeVerified publisher0.1.41 of 1See more

remmina nicholaswilde 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/remmina:version-1.2.0-rcgit.29dfsg-1ubuntu105955792e00f
stdlib@go1.17.11
1.25.11

Open the chart page →

23,057
sqlitebrowsernicholaswildeVerified publisher1.0.11 of 1See more

sqlitebrowser nicholaswilde 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/sqlitebrowser:version-3.12.2-02876202105241947ubuntu18.04.1426e79828c4b
stdlib@go1.16.12
1.25.11

Open the chart page →

24,291
staticnicholaswildeVerified publisher1.0.01 of 1See more

static nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/nicholaswilde/static:version-ee8a20cd1d47c730bc4
stdlib@go1.16.5
1.25.11

Open the chart page →

1,156
todonicholaswildeVerified publisher0.1.01 of 1See more

todo nicholaswilde 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/nicholaswilde/todo:941c0d3-ls1d7ba1341a940
stdlib@go1.14.15
1.25.11

Open the chart page →

1,231
twtxtnicholaswildeVerified publisher1.0.01 of 1See more

twtxt nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/nicholaswilde/twtxt:version-0.1.158736a73ca10
stdlib@go1.16.5
1.25.11

Open the chart page →

2,340
wikinicholaswildeVerified publisher1.0.01 of 1See more

wiki nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/nicholaswilde/wiki:version-900b76a6c4f261d8f5e
stdlib@go1.16.5
1.25.11

Open the chart page →

1,791

Container images carrying it

4,855 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/snapshot-controller:v8.2.1472fa35a89da
stdlib@go1.23.6
1.25.11
1
registry.k8s.io/sig-storage/snapshot-controller:v4.2.195587f8777d7
stdlib@go1.16.2
1.25.11
1
registry.k8s.io/sig-storage/snapshot-controller:v6.2.198bab4eaf23c
stdlib@go1.19
1.25.11
1
registry.k8s.io/sig-storage/snapshot-controller:v6.3.1ce6ca3c0e30b
stdlib@go1.20.5
1.25.11
1
registry.k8s.io/sig-storage/volume-data-source-validator:v1.0.0d35884236461
stdlib@go1.17.3
1.25.11
1

syft 1.42.1 · advisories as of 25 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.