StackRadar

CVE-2026-42507

Medium

Advisory

Published 2 Jun 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.004
33rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,351
of 17,957 indexed, latest versions
Container images
4,892
deployed by those charts
Fix available
1 of 2
affected packages

Arbitrary inputs are included in errors without any escaping in net/textproto

Carried by container images the latest versions of 4,351 of 17,957 indexed charts deploy, on 4,892 images.

Affected packageAffected versionsFixed inImages
golang-1.19deb1.19.8-2no fix listed1
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+186 more1.25.114,892
OSV records
DEBIAN-CVE-2026-42507GO-2026-5039
Also known as
BIT-golang-2026-42507

Charts affected

4,351 by stars
ChartLatestAffected imagesRadar Score
bucket-backup-restorebucket-backup-restore0.1.01 of 2See more

bucket-backup-restore bucket-backup-restore 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
abohatyrenko/bucket-backup-restore:latestfa98af15a13e
stdlib@go1.21.4
1.25.11

Open the chart page →

2,060
agentbuildkite0.6.41 of 1See more

agent buildkite 0.6.4

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
buildkite/agent:3.25.0aec38cfaae0e
stdlib@go1.14.7
1.25.11

Open the chart page →

2,674
buildkite-agent-metricsbuildkite-agent-metrics0.1.01 of 1See more

buildkite-agent-metrics buildkite-agent-metrics 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
public.ecr.aws/buildkite/agent-metrics:v5.11.016e7f5c7161e
stdlib@go1.25.1
1.25.11

Open the chart page →

1,589
buildkit-fleetbuildkit-fleetVerified publisher0.1.21 of 1See more

buildkit-fleet buildkit-fleet 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
moby/buildkit:v0.33.0-rootless80b15f0735e8
stdlib@go1.25.7
1.25.11

Open the chart page →

920
argocd-source-trackercableship0.0.91 of 1See more

argocd-source-tracker cableship 0.0.9

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/cableship/argocd-source-tracker:0.0.6ff7dd45aa774
stdlib@go1.24.2
1.25.11

Open the chart page →

1,695
chart-sentinelcableship0.0.121 of 1See more

chart-sentinel cableship 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/cableship/chart-sentinel:0.1.0a037f1042b28
stdlib@go1.24.2
1.25.11

Open the chart page →

1,695
pgcagriekinVerified publisher2.2.11 of 2See more

pg cagriekin 2.2.1

1 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
cagriekin/pg-ha:2.0.2-pg186559f9b476e1
stdlib@go1.24.4
1.25.11

Open the chart page →

1,863
pgvectorcagriekinVerified publisher2.2.12 of 3See more

pgvector cagriekin 2.2.1

2 of the 3 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
cagriekin/pg-ha:2.0.2-pg186559f9b476e1
stdlib@go1.24.4
1.25.11
pgvector/pgvector:0.8.5-pg18-trixie9d2e61c7352b
stdlib@go1.24.6
1.25.11

Open the chart page →

3,816
camel-dashboard-operatorcamel-dashboardVerified publisher0.1.01 of 1See more

camel-dashboard-operator camel-dashboard 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
quay.io/camel-tooling/camel-dashboard-operator:latest5e867d01846e
stdlib@go1.25.9
1.25.11

Open the chart page →

569
blackbox-exportercamptocamp31.0.01 of 1See more

blackbox-exporter camptocamp3 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
prom/blackbox-exporter:v0.25.0b04a9fef4fa0
stdlib@go1.22.2
1.25.11

Open the chart page →

913
capsulecapsuleOfficialVerified publisher0.14.61 of 2See more

capsule capsule 0.14.6

1 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
clastix/kubectl:v1.3122918a06c253
stdlib@go1.22.5
1.25.11

Open the chart page →

1,254
capsule-proxycapsule-proxyOfficialVerified publisher0.14.11 of 2See more

capsule-proxy capsule-proxy 0.14.1

1 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
clastix/kubectl:v1.3122918a06c253
stdlib@go1.22.5
1.25.11

Open the chart page →

1,275
fluxcd-webuiccowleyVerified publisher0.0.21 of 2See more

fluxcd-webui ccowley 0.0.2

1 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
adrianberger/fluxcd-webui:latest76848c0d2780
stdlib@go1.16.2
1.25.11

Open the chart page →

3,547
celestia-nodecelestia-node0.1.71 of 1See more

celestia-node celestia-node 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-node:v0.16.041177982c584
stdlib@go1.23.0
1.25.11

Open the chart page →

1,850
cert-estuarycert-estuaryVerified publisher0.2.11 of 1See more

cert-estuary cert-estuary 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/hsn723/cert-estuary:0.2.00c4b6132b0ad
stdlib@go1.26.2
1.25.11

Open the chart page →

283
finops-stackcert-managerVerified publisher0.0.57 of 12See more

finops-stack cert-manager 0.0.5

7 of the 12 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
grafana/grafana:11.1.3b23b588cf7cb
stdlib@go1.22.4
1.25.11
ghcr.io/kyverno/background-controller:v1.12.506ed5db6cd33
stdlib@go1.21.12
1.25.11
ghcr.io/kyverno/cleanup-controller:v1.12.5b914032ef9ad
stdlib@go1.21.12
1.25.11
ghcr.io/kyverno/kyverno:v1.12.5a61c7022abcf
stdlib@go1.21.12
1.25.11
ghcr.io/kyverno/kyverno-cli:v1.12.5832a32779e6d
stdlib@go1.21.12
1.25.11
ghcr.io/kyverno/kyvernopre:v1.12.563f7eaf5aa8a
stdlib@go1.21.12
1.25.11
ghcr.io/kyverno/reports-controller:v1.12.5c62e3347611c
stdlib@go1.21.12
1.25.11

Open the chart page →

12,956
cert-manager-webhook-arvancloudcert-manager-webhook-arvancloudVerified publisher0.1.11 of 1See more

cert-manager-webhook-arvancloud cert-manager-webhook-arvancloud 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/mohammadv184/cert-manager-webhook-arvancloud:latest179bee5ef8b2
stdlib@go1.24.4
1.25.11

Open the chart page →

1,089
cert-manager-webhook-gandicert-manager-webhook-gandi0.6.01 of 1See more

cert-manager-webhook-gandi cert-manager-webhook-gandi 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/sintef/cert-manager-webhook-gandi:0.6.06819b34ccac8
stdlib@go1.22.0
1.25.11

Open the chart page →

1,047
cert-vaultcert-vaultOfficialVerified publisher2.12.04 of 7See more

cert-vault cert-vault 2.12.0

4 of the 7 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
bitnamilegacy/postgres-exporter:0.17.1-debian-12-r20cca9d93a617
stdlib@go1.23.7
1.25.11
bitnamilegacy/redis:7.4.2-debian-12-r66a5b1d0b5942
stdlib@go1.23.7
1.25.11
bitnamilegacy/redis-exporter:1.69.0-debian-12-r1a006df1fd47e
stdlib@go1.23.7
1.25.11
library/postgres:17f4c66b820c6f
stdlib@go1.24.6
1.25.11

Open the chart page →

16,802
chatclichatcliVerified publisher1.212.11 of 2See more

chatcli chatcli 1.212.1

1 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
registry.k8s.io/kubectl:v1.31.10e0b2d217d1d2
stdlib@go1.23.10
1.25.11

Open the chart page →

1,038
chatcli-operatorchatcli-operatorVerified publisher1.212.11 of 2See more

chatcli-operator chatcli-operator 1.212.1

1 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
registry.k8s.io/kubectl:v1.31.10e0b2d217d1d2
stdlib@go1.23.10
1.25.11

Open the chart page →

1,031
passbolt-hachristianhuthVerified publisher6.0.13 of 4See more

passbolt-ha christianhuth 6.0.1

3 of the 4 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
bitnamilegacy/mysql:9.4.0-debian-12-r1ec13e229247a
stdlib@go1.24.6
1.25.11
bitnamilegacy/os-shell:12-debian-12-r50e328cff6e450
stdlib@go1.24.6
1.25.11
passbolt/passbolt:3.4.0-ce-non-root655547e17263
stdlib@go1.14.4
1.25.11

Open the chart page →

11,556
squestchristianhuthVerified publisher6.6.82 of 4See more

squest christianhuth 6.6.8

2 of the 4 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
bitnamilegacy/mariadb:12.0.2-debian-12-r0888cdaae3cb9
stdlib@go1.25.0
1.25.11
bitnamilegacy/redis:8.2.1-debian-12-r025bf63f3caf7
stdlib@go1.25.0
1.25.11

Open the chart page →

10,858
typo3christianhuthVerified publisher7.8.11 of 2See more

typo3 christianhuth 7.8.1

1 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
bitnamilegacy/mysql:9.4.0-debian-12-r1ec13e229247a
stdlib@go1.24.6
1.25.11

Open the chart page →

9,250
challengerchronicleVerified publisher0.1.21 of 1See more

challenger chronicle 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/chronicleprotocol/challenger-go:0.1.2c8d5a3c0e966
stdlib@go1.22.12
1.25.11

Open the chart page →

991
spectrechronicleVerified publisher0.3.91 of 1See more

spectre chronicle 0.3.9

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/chronicleprotocol/spectre:0.68.34e872bc016e8
stdlib@go1.25.5
1.25.11

Open the chart page →

1,645
access-managerckotzbauerVerified publisher0.14.31 of 1See more

access-manager ckotzbauer 0.14.3

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/ckotzbauer/access-managerdigest-pinneddd584fcda0ff
stdlib@go1.22.1
1.25.11

Open the chart page →

648
clairclair0.0.31 of 1See more

clair clair 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
quay.io/projectquay/clair:4.7.28d38ffa8fad7
stdlib@go1.20.9
1.25.11

Open the chart page →

3,336
clamav-restclamav-rest-apiVerified publisher0.1.01 of 1See more

clamav-rest clamav-rest-api 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ajilaag/clamav-rest:latestad689c7b75b1
stdlib@go1.26.0
1.25.11

Open the chart page →

515
claude-code-hubclaude-code-hub0.1.01 of 4See more

claude-code-hub claude-code-hub 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
library/postgres:18-alpine6c538e7206ea
stdlib@go1.24.6
1.25.11

Open the chart page →

2,200
cloudbees-sidecar-injectorcloudbees2.3.32 of 2See more

cloudbees-sidecar-injector cloudbees 2.3.3

2 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
cloudbees/cert-requester:2.3.31d44fb4f799b
stdlib@go1.20.1
1.25.11
cloudbees/sidecar-injector:2.3.38f102ef0383a
stdlib@go1.20.1
1.25.11

Open the chart page →

3,262
cloudflow-enterprise-componentscloudflow-helm-charts0.0.0-NIGHTLY011220202 of 9See more

cloudflow-enterprise-components cloudflow-helm-charts 0.0.0-NIGHTLY01122020

2 of the 9 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
jimmidyson/configmap-reload:v0.4.017d34fd73f9e
stdlib@go1.14.4
1.25.11
prom/prometheus:v2.21.0d43417c260e5
stdlib@go1.15.2
1.25.11

Open the chart page →

4,269
cnpg-sandboxcloudnative-pgVerified publisher0.6.13 of 6See more

cnpg-sandbox cloudnative-pg 0.6.1

3 of the 6 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
grafana/grafana:8.3.5cd7cb4345aa7
stdlib@go1.17.6
1.25.11
ghcr.io/cloudnative-pg/cloudnative-pg:1.17.14dd365800b62
stdlib@go1.18.6
1.25.11
quay.io/prometheus-operator/prometheus-operator:v0.54.0be2aef39a2f8
stdlib@go1.17.6
1.25.11

Open the chart page →

7,639
pgbenchcloudnative-pgVerified publisher0.1.01 of 1See more

pgbench cloudnative-pg 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/cloudnative-pg/postgresql:14.5b3b30d04b362
stdlib@go1.16.7
1.25.11

Open the chart page →

2,792
bastioncloudposse0.2.01 of 2See more

bastion cloudposse 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
cloudposse/bastion:latest0d9507e8a760
stdlib@go1.13.3
1.25.11

Open the chart page →

1,757
grafanacloudposse0.2.61 of 1See more

grafana cloudposse 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
grafana/grafana:latestac461fb352ab
stdlib@go1.26.3
1.25.11

Open the chart page →

635
cloudttycloudtty0.8.102 of 2See more

cloudtty cloudtty 0.8.10

2 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/cloudtty/cloudshell:v0.8.1023e8d178e02c
stdlib@go1.25.2
1.25.11
ghcr.io/cloudtty/cloudshell-operator:v0.8.1014f036e33ef1
stdlib@go1.21.11
1.25.11

Open the chart page →

3,353
cluster-api-visualizercluster-api-visualizer1.5.01 of 1See more

cluster-api-visualizer cluster-api-visualizer 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/jont828/cluster-api-visualizer:v1.5.0678ba6833297
stdlib@go1.24.11
1.25.11

Open the chart page →

553
clustereye-stackclustereyeVerified publisher0.1.11 of 5See more

clustereye-stack clustereye 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
library/postgres:17-alpinef02121de6f74
stdlib@go1.24.6
1.25.11

Open the chart page →

4,776
clusternet-hubclusternet1.0.01 of 1See more

clusternet-hub clusternet 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/clusternet/clusternet-hub:v1.0.059f75504c5d4
stdlib@go1.23.8
1.25.11

Open the chart page →

1,588
clusternet-schedulerclusternet1.0.01 of 1See more

clusternet-scheduler clusternet 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/clusternet/clusternet-scheduler:v1.0.0a6ae5aff81ce
stdlib@go1.23.8
1.25.11

Open the chart page →

1,588
cluster-setupcluster-setup1.5.07 of 8See more

cluster-setup cluster-setup 1.5.0

7 of the 8 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.43.10881d3c9359b
stdlib@go1.24.3
1.25.11
public.ecr.aws/docker/library/redis:7.2.8-alpinec88ea2979a49
stdlib@go1.18.2
1.25.11
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
stdlib@go1.22.7
1.25.11
quay.io/jetstack/cert-manager-cainjector:v1.17.2ec56edb1161d
stdlib@go1.23.8
1.25.11
quay.io/jetstack/cert-manager-controller:v1.17.22c314feeb5e8
stdlib@go1.23.8
1.25.11
quay.io/jetstack/cert-manager-startupapicheck:v1.17.2e18989b4f912
stdlib@go1.23.8
1.25.11
quay.io/jetstack/cert-manager-webhook:v1.17.237b16a9dff00
stdlib@go1.23.8
1.25.11

Open the chart page →

10,726
cockroachdb-chartcockroachdbv226.3.21 of 1See more

cockroachdb-chart cockroachdbv2 26.3.2

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
cockroachdb/cockroach-self-signer-cert:1.10b0fcc6c8147a
stdlib@go1.26.2
1.25.11

Open the chart page →

292
istio-allcode4devsVerified publisher1.2.04 of 6See more

istio-all code4devs 1.2.0

4 of the 6 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
istio/install-cni:1.24.2-distrolessaef4825e110f
stdlib@go1.23.2
1.25.11
istio/pilot:1.24.2-distroless137e44e3d1d2
stdlib@go1.23.2
1.25.11
quay.io/kiali/kiali:v1.89.30dcdb1c1e747
stdlib@go1.22.5
1.25.11
quay.io/prometheus/prometheus:v2.54.1f6639335d34a
stdlib@go1.22.6
1.25.11

Open the chart page →

4,892
istio-control-planecode4devsVerified publisher1.0.02 of 3See more

istio-control-plane code4devs 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
istio/install-cni:1.24.2-distrolessaef4825e110f
stdlib@go1.23.2
1.25.11
istio/pilot:1.24.2-distroless137e44e3d1d2
stdlib@go1.23.2
1.25.11

Open the chart page →

2,418
maintenancecodewithemadVerified publisher0.1.61 of 1See more

maintenance codewithemad 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
library/caddy:2.9-alpineb4e3952384eb
stdlib@go1.23.4
1.25.11

Open the chart page →

1,539
dawarichcogitriVerified publisher2.9.21 of 3See more

dawarich cogitri 2.9.2

1 of the 3 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
freikin/dawarich:1.15.2e58334ca5697
stdlib@go1.24.4
1.25.11

Open the chart page →

6,479
contactcataloguscontact-catalogus1.0.01 of 3See more

contactcatalogus contact-catalogus 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/contactcatalogus-php:latesteeb625bd660c
stdlib@go1.13.10
1.25.11

Open the chart page →

7,341
cortex-tenantcortex-tenantVerified publisher0.8.11 of 1See more

cortex-tenant cortex-tenant 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/blind-oracle/cortex-tenant:v2.0.09f8896ffc15b
stdlib@go1.25.1
1.25.11

Open the chart page →

790
cosmo-controller-managercosmoVerified publisher0.9.01 of 2See more

cosmo-controller-manager cosmo 0.9.0

1 of the 2 container images this version deploys carry CVE-2026-42507.

Container imageDigestPackageFixed in
ghcr.io/cosmo-workspace/cosmo-controller-manager:v0.9.08c7fa5552028
stdlib@go1.20.5
1.25.11

Open the chart page →

1,966

Container images carrying it

4,892 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

No deployed image carries CVE-2026-42507.

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.