StackRadar

CVE-2026-46597

High

Advisory

Published 22 May 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
40th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,533
of 17,832 indexed, latest versions
Container images
2,854
deployed by those charts
Fix available
1 of 1
affected package

golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic

Carried by container images the latest versions of 2,533 of 17,832 indexed charts deploy, on 2,854 images.

Affected packageAffected versionsFixed inImages
golang.org/x/cryptogolangv0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+153 more0.52.02,854
OSV records
GHSA-q4h4-gmj2-qvw2
Also known as
GO-2026-5013

Charts affected

2,533 by stars
ChartLatestAffected imagesRadar Score
miniomilvus-helm8.0.201 of 1See more

minio milvus-helm 8.0.20

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2024-05-28T17-19-04Z391d1d45fdbe
golang.org/x/crypto@v0.23.0
0.52.0

Open the chart page →

1,685
pulsarv2milvus-helm2.7.82 of 4See more

pulsarv2 milvus-helm 2.7.8

2 of the 4 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
prom/prometheus:v2.17.242d2395cd719
golang.org/x/crypto@v0.0.0-20191206172530-e9b2fee46413
0.52.0
streamnative/apache-pulsar-grafana-dashboard-k8s:0.0.10ebcf7f033b54
golang.org/x/crypto@v0.0.0-20191011191535-87dc89f01550
0.52.0

Open the chart page →

15,889
minio-operatorminio-operator4.3.71 of 2See more

minio-operator minio-operator 4.3.7

1 of the 2 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
minio/operator:v4.3.754393e03f3b2
golang.org/x/crypto@v0.0.0-20210421170649-83a5a9bb288b
0.52.0

Open the chart page →

6,101
aws-api-gateway-operatormintel0.1.21 of 11See more

aws-api-gateway-operator mintel 0.1.2

1 of the 11 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
library/docker:20.10-dindaf96c680a7e1
golang.org/x/crypto@v0.2.0
0.52.0

Open the chart page →

10,727
standard-application-stackmintel11.5.01 of 12See more

standard-application-stack mintel 11.5.0

1 of the 12 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
library/docker:20.10-dindaf96c680a7e1
golang.org/x/crypto@v0.2.0
0.52.0

Open the chart page →

10,727
jupyterhubmizzoukube0.0.1-set.by.chartpress1 of 7See more

jupyterhub mizzoukube 0.0.1-set.by.chartpress

1 of the 7 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
registry.k8s.io/kube-scheduler:v1.28.73ae5620a33bb
golang.org/x/crypto@v0.16.0
0.52.0

Open the chart page →

1,897
cert-manager-webhook-duckdnsmmontesVerified publisher1.2.31 of 1See more

cert-manager-webhook-duckdns mmontes 1.2.3

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ebrianne/cert-manager-webhook-duckdns:v1.2.39cd17700c9ec
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0

Open the chart page →

2,856
cockroachdb-operatormmontesVerified publisher0.1.01 of 1See more

cockroachdb-operator mmontes 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
cockroachdb/cockroach-operator:v2.1.0983312754620
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0

Open the chart page →

7,821
mongodbmmontesVerified publisher0.5.01 of 1See more

mongodb mmontes 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
library/mongo:4.4.1305678ae4e5e1
golang.org/x/crypto@v0.0.0-20200302210943-78000ba7a073
0.52.0

Open the chart page →

7,204
corednsmoikot1.13.31 of 1See more

coredns moikot 1.13.3

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
coredns/coredns:1.7.073ca82b4ce82
golang.org/x/crypto@v0.0.0-20200323165209-0ec3e9974c59
0.52.0

Open the chart page →

2,556
pritunl-vpnmoinologics0.0.11 of 1See more

pritunl-vpn moinologics 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
goofball222/pritunl:1.32.3602.807bf26032dfce
golang.org/x/crypto@v0.6.0
0.52.0

Open the chart page →

2,472
backendmojaloop0.1.02 of 6See more

backend mojaloop 0.1.0

2 of the 6 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
bitnamilegacy/kafka-exporter-archived:1.3.2e527fbf75dce
golang.org/x/crypto@v0.0.0-20210616213533-5ff15b29337e
0.52.0
bitnamilegacy/mysqld-exporter:0.13.0a7e14cc919cb
golang.org/x/crypto@v0.0.0-20201208171446-5f87f3452ae9
0.52.0

Open the chart page →

16,374
reporting-nifi-processor-svcmojaloop0.0.21 of 3See more

reporting-nifi-processor-svc mojaloop 0.0.2

1 of the 3 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
library/mongo:6.0.271a63fc2438e
golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d
0.52.0

Open the chart page →

6,276
eks-pod-identity-webhookmondu-aiVerified publisher0.3.11 of 1See more

eks-pod-identity-webhook mondu-ai 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/mondu-ai/eks-pod-identity-webhook:latestc2ac3bad857d
golang.org/x/crypto@v0.44.0
0.52.0

Open the chart page →

474
mongodb-admin-interfacemongo-db-admin-interfaceVerified publisher0.1.01 of 2See more

mongodb-admin-interface mongo-db-admin-interface 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
library/mongo:5.041108d183e97
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

5,276
enterprise-operatormongodb-helm-charts1.33.01 of 1See more

enterprise-operator mongodb-helm-charts 1.33.0

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
quay.io/mongodb/mongodb-enterprise-operator-ubi:1.33.0b05101723412
golang.org/x/crypto@v0.37.0
0.52.0

Open the chart page →

1,592
mongodb-query-exportermongodb-query-exporterVerified publisher5.1.01 of 1See more

mongodb-query-exporter mongodb-query-exporter 5.1.0

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/raffis/mongodb-query-exporter:v5.1.0ca6ac8a5b329
golang.org/x/crypto@v0.13.0
0.52.0

Open the chart page →

989
mongodb-secure-backupmongodb-secure-backup1.0.01 of 2See more

mongodb-secure-backup mongodb-secure-backup 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
arconixforge/mongodb-secure-backup:v1.1c08d7c438966
golang.org/x/crypto@v0.32.0
0.52.0

Open the chart page →

1,034
mongopingmongoping1.3.11 of 1See more

mongoping mongoping 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
udhos/mongoping:1.3.103b08b63f524
golang.org/x/crypto@v0.38.0
0.52.0

Open the chart page →

1,284
camera-viewermoreillonVerified publisher0.2.11 of 4See more

camera-viewer moreillon 0.2.1

1 of the 4 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:6.0.4-debian-11-r10016dce036593
golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d
0.52.0

Open the chart page →

11,927
face-recognitionmoreillonVerified publisher0.2.41 of 3See more

face-recognition moreillon 0.2.4

1 of the 3 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:6.0.4-debian-11-r10016dce036593
golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d
0.52.0

Open the chart page →

9,242
mqtt-loggermoreillonVerified publisher0.3.12 of 5See more

mqtt-logger moreillon 0.3.1

2 of the 5 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
bitnamilegacy/influxdb:2.6.1-debian-11-r18d17df1f9d745
golang.org/x/crypto@v0.0.0-20220331220935-ae2d96664a29
0.52.0
bitnamilegacy/mongodb:6.0.4-debian-11-r10016dce036593
golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d
0.52.0

Open the chart page →

11,204
user-manager-mongodbmoreillonVerified publisher0.6.21 of 4See more

user-manager-mongodb moreillon 0.6.2

1 of the 4 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:6.0.10-debian-11-r842319decb591
golang.org/x/crypto@v0.12.0
0.52.0

Open the chart page →

26,209
backupmorremeyer4.0.01 of 1See more

backup morremeyer 4.0.0

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
restic/restic:0.15.2579e4e6a4931
golang.org/x/crypto@v0.7.0
0.52.0

Open the chart page →

2,303
hcloud-ccm-networksmorremeyer2.0.01 of 1See more

hcloud-ccm-networks morremeyer 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
hetznercloud/hcloud-cloud-controller-manager:v1.16.08c07e6d7a76c
golang.org/x/crypto@v0.10.0
0.52.0

Open the chart page →

1,754
chirpstackmosquitto-helm-chart0.5.01 of 8See more

chirpstack mosquitto-helm-chart 0.5.0

1 of the 8 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
chirpstack/chirpstack-application-server:3fb7667fe037f
golang.org/x/crypto@v0.0.0-20200709230013-948cd5f35899
0.52.0

Open the chart page →

98,993
chirpstack-event-forwardmosquitto-helm-chart0.1.21 of 1See more

chirpstack-event-forward mosquitto-helm-chart 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/liangyuanpeng/chirpstack-event-forward:v0.1.223dc6274cc4b
golang.org/x/crypto@v0.0.0-20210817164053-32db794688a5
0.52.0

Open the chart page →

1,855
replacermosquitto-helm-chart0.2.01 of 3See more

replacer mosquitto-helm-chart 0.2.0

1 of the 3 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/liangyuanpeng/replacer:v1.1.00b2a41c2a43e
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0

Open the chart page →

3,933
configmapsecretsmozilla0.0.11 of 1See more

configmapsecrets mozilla 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
mzinc/configmapsecret-controller:v0.5.1eebbcbf2d1f7
golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83
0.52.0

Open the chart page →

2,110
adguard-homemt1905024.0.121 of 2See more

adguard-home mt190502 4.0.12

1 of the 2 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
adguard/adguardhome:v0.107.737fbf01d73ecb
golang.org/x/crypto@v0.48.0
0.52.0

Open the chart page →

1,168
maddymt1905024.1.21 of 1See more

maddy mt190502 4.1.2

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
foxcpp/maddy:0.9.2a4b839985b9b
golang.org/x/crypto@v0.32.0
0.52.0

Open the chart page →

1,045
memosmt1905027.3.21 of 3See more

memos mt190502 7.3.2

1 of the 3 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
neosmemo/memos:0.26.23eefcc231141
golang.org/x/crypto@v0.47.0
0.52.0

Open the chart page →

2,687
minifluxmt1905021.1.61 of 3See more

miniflux mt190502 1.1.6

1 of the 3 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
miniflux/miniflux:2.2.18a3ca6bbc1f74
golang.org/x/crypto@v0.49.0
0.52.0

Open the chart page →

2,335
nightscoutmt1905021.1.01 of 3See more

nightscout mt190502 1.1.0

1 of the 3 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
golang.org/x/crypto@v0.25.0
0.52.0

Open the chart page →

6,706
vikunjamt1905027.1.21 of 3See more

vikunja mt190502 7.1.2

1 of the 3 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
vikunja/vikunja:0.24.6ed1f3ed467fe
golang.org/x/crypto@v0.27.0
0.52.0

Open the chart page →

3,061
unpollermvisonneau0.1.01 of 1See more

unpoller mvisonneau 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
golift/unifi-poller:v2.9.2585a29a06d05
golang.org/x/crypto@v0.13.0
0.52.0

Open the chart page →

1,191
authmyaVerified publisher22.4.31 of 1See more

auth mya 22.4.3

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
cesanta/docker_auth:1.6.04d16885f3d4c
golang.org/x/crypto@v0.0.0-20190820162420-60c769a6c586
0.52.0

Open the chart page →

2,382
cognativemyaVerified publisher0.2403.32 of 3See more

cognative mya 0.2403.3

2 of the 3 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
grafana/grafana:10.4.0f9811e4e687f
golang.org/x/crypto@v0.18.0
0.52.0
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
golang.org/x/crypto@v0.20.0
0.52.0

Open the chart page →

7,439
giteamyaVerified publisher23.12.51 of 1See more

gitea mya 23.12.5

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
gitea/gitea:1.21.6ac73e0da341f
golang.org/x/crypto@v0.18.0
0.52.0

Open the chart page →

3,438
myhelmappmyhelmapp0.1.11 of 1See more

myhelmapp myhelmapp 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
tobirachel/node-project3:v17d9f37154994
golang.org/x/crypto@v0.0.0-20211108221036-ceb1ce70b4fa
0.52.0

Open the chart page →

3,369
Practica_4_helmmy-heml-appVerified publisher0.1.01 of 7See more

Practica_4_helm my-heml-app 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
library/mongo:5.0.6-focal8e70544b6c76
golang.org/x/crypto@v0.0.0-20200302210943-78000ba7a073
0.52.0

Open the chart page →

28,081
influxdbmy-personal-influxdb20.1.01 of 1See more

influxdb my-personal-influxdb2 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
library/influxdb:2.7b8d940ca9376
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

3,943
traefik-forward-auth-openidnas-helm-chartsVerified publisher1.0.11 of 1See more

traefik-forward-auth-openid nas-helm-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
thomseddon/traefik-forward-auth:latestb364aa6a4117
golang.org/x/crypto@v0.0.0-20190701094942-4def268fd1a4
0.52.0

Open the chart page →

2,198
nats-kafkanatsVerified publisher0.15.41 of 1See more

nats-kafka nats 0.15.4

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
natsio/nats-kafka:1.4.2bb241956b0dc
golang.org/x/crypto@v0.15.0
0.52.0

Open the chart page →

1,732
account-servernatz-operatorVerified publisher0.9.51 of 1See more

account-server natz-operator 0.9.5

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/zeiss/natz-operator/account-server:0.9.5b380b5f17c3f
golang.org/x/crypto@v0.33.0
0.52.0

Open the chart page →

746
incorencsaVerified publisher1.38.01 of 29See more

incore ncsa 1.38.0

1 of the 29 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:4.4.5e3c9d6b4bc92
golang.org/x/crypto@v0.0.0-20190530122614-20be4c3c3ed5
0.52.0

Open the chart page →

15,616
jupyterhub-metricsncsaVerified publisher1.3.01 of 5See more

jupyterhub-metrics ncsa 1.3.0

1 of the 5 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
timescale/timescaledb:latest-pg156343bdc87ca1
golang.org/x/crypto@v0.32.0
0.52.0

Open the chart page →

3,213
uptime-kumancsaVerified publisher1.7.31 of 1See more

uptime-kuma ncsa 1.7.3

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.5c74379ac4509
golang.org/x/crypto@v0.51.0
0.52.0

Open the chart page →

31,207
neosyncneosyncVerified publisher0.5.412 of 3See more

neosync neosync 0.5.41

2 of the 3 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/nucleuscloud/neosync/api:0.5.41e2abb798f29f
golang.org/x/crypto@v0.36.0
0.52.0
ghcr.io/nucleuscloud/neosync/worker:0.5.4196f42450c5b1
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

7,374
apineosync-apiVerified publisher0.5.411 of 1See more

api neosync-api 0.5.41

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/nucleuscloud/neosync/api:0.5.41e2abb798f29f
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

2,911

Container images carrying it

2,854 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/csi-attacher:v4.10.0be59d0556508
golang.org/x/crypto@v0.38.0
0.52.0
1
registry.k8s.io/sig-storage/csi-resizer:v2.0.04a95d94e57ad
golang.org/x/crypto@v0.37.0
0.52.0
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.8.03e2bf2eaef9f
golang.org/x/crypto@v0.36.0
0.52.0
1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.03ce0fdba4d8e
golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975
0.52.0
1

syft 1.42.1 · advisories as of 23 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.