StackRadarChart IndexLive demo

CVE-2026-42507

Medium

Advisory

Published 2 Jun 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.004; 33rd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,359; of 17,926 indexed, latest versions
Container images: 4,906; deployed by those charts
Fix available: 1 of 2; affected packages

Arbitrary inputs are included in errors without any escaping in net/textproto

Carried by container images the latest versions of 4,359 of 17,926 indexed charts deploy, on 4,906 images.

Affected package	Affected versions	Fixed in	Images
golang-1.19deb	1.19.8-2	no fix listed	1
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+186 more	1.25.11	4,906

OSV records: DEBIAN-CVE-2026-42507 GO-2026-5039
Also known as: BIT-golang-2026-42507

Charts affected

4,359 by stars

Chart

Latest

Affected images

Radar Score

version-checkerymrs

1 of 1 See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container image	Digest	Package	Fixed in
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	stdlib@go1.15.2	1.25.11

Open the chart page →

3,019

prometheus-monitoring-stackyotron-helm-charts

1 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

1 of the 3 container images this version deploys carry CVE-2026-42507.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	ac461fb352ab	stdlib@go1.26.3	1.25.11

Open the chart page →

787

zahori-consulzahori

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-42507.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	stdlib@go1.20.4	1.25.11
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	stdlib@go1.20.4	1.25.11

Open the chart page →

5,084

zahori-moonzahori

3 of 3 See more

zahori-moon zahori 1.0.1

3 of the 3 container images this version deploys carry CVE-2026-42507.

Container image	Digest	Package	Fixed in
quay.io/aerokube/moon :2.5.1	a8837b00ba1c	stdlib@go1.20.4	1.25.11
quay.io/aerokube/moon-conf :2.5.1	9ca307b30080	stdlib@go1.20.4	1.25.11
quay.io/aerokube/moon-ui :2.0.5	89990b146824	stdlib@go1.20.5	1.25.11

Open the chart page →

2,908

zahori-schedulerzahori

1 of 1 See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-scheduler :1.0.0	47d0979b1184	stdlib@go1.20.5	1.25.11

Open the chart page →

2,536

jenkinszanise-jenkins-helm-chart

1 of 1 See more

jenkins zanise-jenkins-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container image	Digest	Package	Fixed in
jenkins/jenkins :lts	c1e4c349365f	stdlib@go1.25.3	1.25.11

Open the chart page →

2,643

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2026-42507.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	stdlib@go1.17.13	1.25.11

Open the chart page →

3,751

zookeeper-exporterzookeeper-exporter

1 of 1 See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42507.

Container image	Digest	Package	Fixed in
dabealu/zookeeper-exporter :latest	86106fec315f	stdlib@go1.14.15	1.25.11

Open the chart page →

1,249

zoo-project-druzoo-project

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-42507.

Container image	Digest	Package	Fixed in
library/postgres :18.4-alpine3.24	9a8afca54e78	stdlib@go1.24.6	1.25.11

Open the chart page →

8,370

Container images carrying it

4,906 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
registry.k8s.io/sig-storage/objectstorage-sidecar :v0.2.2	c7166a73a303	stdlib@go1.24.11	1.25.11	1
registry.k8s.io/sig-storage/snapshot-controller :v8.2.1	472fa35a89da	stdlib@go1.23.6	1.25.11	1
registry.k8s.io/sig-storage/snapshot-controller :v4.2.1	95587f8777d7	stdlib@go1.16.2	1.25.11	1
registry.k8s.io/sig-storage/snapshot-controller :v6.2.1	98bab4eaf23c	stdlib@go1.19	1.25.11	1
registry.k8s.io/sig-storage/snapshot-controller :v6.3.1	ce6ca3c0e30b	stdlib@go1.20.5	1.25.11	1
registry.k8s.io/sig-storage/volume-data-source-validator :v1.0.0	d35884236461	stdlib@go1.17.3	1.25.11	1