StackRadar

CVE-2026-46597

High

Advisory

Published 22 May 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
40th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,533
of 17,832 indexed, latest versions
Container images
2,854
deployed by those charts
Fix available
1 of 1
affected package

golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic

Carried by container images the latest versions of 2,533 of 17,832 indexed charts deploy, on 2,854 images.

Affected packageAffected versionsFixed inImages
golang.org/x/cryptogolangv0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+153 more0.52.02,854
OSV records
GHSA-q4h4-gmj2-qvw2
Also known as
GO-2026-5013

Charts affected

2,533 by stars
ChartLatestAffected imagesRadar Score
workerneosync-workerVerified publisher0.5.411 of 1See more

worker neosync-worker 0.5.41

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/nucleuscloud/neosync/worker:0.5.4196f42450c5b1
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

2,888
bluesky-pdsnerkho-helm-charts0.4.21 of 1See more

bluesky-pds nerkho-helm-charts 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4.204cbc6e3ea157d
golang.org/x/crypto@v0.41.0
0.52.0

Open the chart page →

2,402
netbirdnetbird1.9.03 of 4See more

netbird netbird 1.9.0

3 of the 4 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
netbirdio/management:0.46.0b0adc4ad4ec6
golang.org/x/crypto@v0.37.0
0.52.0
netbirdio/relay:0.46.0d32f82514a24
golang.org/x/crypto@v0.37.0
0.52.0
netbirdio/signal:0.46.0e8f392611152
golang.org/x/crypto@v0.37.0
0.52.0

Open the chart page →

6,533
iamdnetsocVerified publisher0.6.11 of 2See more

iamd netsoc 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/netsoc/iamd:1.1.22fe6b69b20d7
golang.org/x/crypto@v0.0.0-20210616213533-5ff15b29337e
0.52.0

Open the chart page →

2,892
shhdnetsocVerified publisher0.1.71 of 1See more

shhd netsoc 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/netsoc/shhd:0.1.60bb44992b62c
golang.org/x/crypto@v0.0.0-20210711020723-a769d52b0f97
0.52.0

Open the chart page →

3,989
webspacednetsocVerified publisher0.2.81 of 2See more

webspaced netsoc 0.2.8

1 of the 2 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/netsoc/webspaced:0.5.1edc238a538a0
golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83
0.52.0

Open the chart page →

5,196
neurofaceneurofaceVerified publisher1.4.21 of 3See more

neuroface neuroface 1.4.2

1 of the 3 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
openvino/model_server:2025.2.11e7cd1d70cc1
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

7,733
agent-controlnewrelic0.0.921 of 1See more

agent-control newrelic 0.0.92

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
newrelic/newrelic-agent-control-cli:0.48.01a448492b55a
golang.org/x/crypto@v0.40.0
0.52.0

Open the chart page →

3,944
agent-control-cdnewrelic1.0.03 of 3See more

agent-control-cd newrelic 1.0.0

3 of the 3 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/fluxcd/flux-cli:v2.5.1274a179fd402
golang.org/x/crypto@v0.33.0
0.52.0
ghcr.io/fluxcd/helm-controller:v1.2.062eaa9c9a929
golang.org/x/crypto@v0.32.0
0.52.0
ghcr.io/fluxcd/source-controller:v1.5.000cd9316a379
golang.org/x/crypto@v0.32.0
0.52.0

Open the chart page →

5,521
nexus-tasksnexus-tasks2.0.01 of 5See more

nexus-tasks nexus-tasks 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/ashvinbambhaniya/nexus-tasks-backend:2.0.0f80349eb018b
golang.org/x/crypto@v0.49.0
0.52.0

Open the chart page →

3,934
nginx-examplengrok-ingress-helm0.3.01 of 2See more

nginx-example ngrok-ingress-helm 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
wernight/ngrok:latestd211f29ebcfe
golang.org/x/crypto@v0.17.0
0.52.0

Open the chart page →

2,756
digikamnicholaswildeVerified publisher1.0.01 of 1See more

digikam nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/digikam:version-7.3.055b4c7f320ae
golang.org/x/crypto@v0.0.0-20210322153248-0c34fe9e7dc2
0.52.0

Open the chart page →

24,433
doublecommandernicholaswildeVerified publisher1.0.21 of 1See more

doublecommander nicholaswilde 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/doublecommander:version-0.8.2-1d92969a929c2
golang.org/x/crypto@v0.0.0-20210322153248-0c34fe9e7dc2
0.52.0

Open the chart page →

25,598
podgrabnicholaswildeVerified publisher0.1.01 of 1See more

podgrab nicholaswilde 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/akhilrex/podgrab:1.0.0bce133f3f511
golang.org/x/crypto@v0.0.0-20200820211705-5c72a883971a
0.52.0

Open the chart page →

2,402
remminanicholaswildeVerified publisher0.1.41 of 1See more

remmina nicholaswilde 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/remmina:version-1.2.0-rcgit.29dfsg-1ubuntu105955792e00f
golang.org/x/crypto@v0.0.0-20211202192323-5770296d904e
0.52.0

Open the chart page →

22,488
sqlitebrowsernicholaswildeVerified publisher1.0.11 of 1See more

sqlitebrowser nicholaswilde 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/sqlitebrowser:version-3.12.2-02876202105241947ubuntu18.04.1426e79828c4b
golang.org/x/crypto@v0.0.0-20210322153248-0c34fe9e7dc2
0.52.0

Open the chart page →

23,709
twtxtnicholaswildeVerified publisher1.0.01 of 1See more

twtxt nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/nicholaswilde/twtxt:version-0.1.158736a73ca10
golang.org/x/crypto@v0.0.0-20200709230013-948cd5f35899
0.52.0

Open the chart page →

2,334
cert-managernicklasfrahm-cert-managerVerified publisher0.1.24 of 4See more

cert-manager nicklasfrahm-cert-manager 0.1.2

4 of the 4 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-cainjector:v1.18.2af59e01ad975
golang.org/x/crypto@v0.38.0
0.52.0
quay.io/jetstack/cert-manager-controller:v1.18.281316365dc0b
golang.org/x/crypto@v0.38.0
0.52.0
quay.io/jetstack/cert-manager-startupapicheck:v1.18.21075e0974151
golang.org/x/crypto@v0.38.0
0.52.0
quay.io/jetstack/cert-manager-webhook:v1.18.29431f0d8b510
golang.org/x/crypto@v0.38.0
0.52.0

Open the chart page →

2,856
ciliumnicklasfrahm-ciliumVerified publisher0.7.42 of 6See more

cilium nicklasfrahm-cilium 0.7.4

2 of the 6 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
quay.io/cilium/cilium:v1.18.2858f807ea4e2
golang.org/x/crypto@v0.40.0
0.52.0
quay.io/cilium/operator-generic:v1.18.2cb4e4ffc5789
golang.org/x/crypto@v0.40.0
0.52.0

Open the chart page →

7,326
metrics-servernicklasfrahm-metrics-serverVerified publisher0.1.11 of 1See more

metrics-server nicklasfrahm-metrics-server 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
registry.k8s.io/metrics-server/metrics-server:v0.8.089258156d0e9
golang.org/x/crypto@v0.38.0
0.52.0

Open the chart page →

799
terraform-backendnimbolus0.3.21 of 2See more

terraform-backend nimbolus 0.3.2

1 of the 2 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/nimbolus/terraform-backend:0.2.2bf876252fbe1
golang.org/x/crypto@v0.43.0
0.52.0

Open the chart page →

2,539
yopassnimbolus0.6.11 of 2See more

yopass nimbolus 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
jhaals/yopass:11.17.026873480863b
golang.org/x/crypto@v0.28.0
0.52.0

Open the chart page →

1,852
cloudnative-pgnineinfra-charts0.19.11 of 1See more

cloudnative-pg nineinfra-charts 0.19.1

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/cloudnative-pg/cloudnative-pg:1.21.19f707d91de1c
golang.org/x/crypto@v0.14.0
0.52.0

Open the chart page →

1,188
minio-operatornineinfra-charts5.0.91 of 1See more

minio-operator nineinfra-charts 5.0.9

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
minio/operator:v5.0.9170b154d2c61
golang.org/x/crypto@v0.11.0
0.52.0

Open the chart page →

3,436
nineinfranineinfra-charts0.7.01 of 1See more

nineinfra nineinfra-charts 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
nineinfra/nineinfra:v0.7.0d4aad414eccd
golang.org/x/crypto@v0.14.0
0.52.0

Open the chart page →

1,121
supersetnineinfra-charts0.11.21 of 4See more

superset nineinfra-charts 0.11.2

1 of the 4 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
apache/superset:dockerizeafe59523a6c8
golang.org/x/crypto@v0.9.0
0.52.0

Open the chart page →

1,440
cosmoshub-rpcnodeifyVerified publisher1.0.71 of 2See more

cosmoshub-rpc nodeify 1.0.7

1 of the 2 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/cosmos/gaia:v25.1.0f115777d1112
golang.org/x/crypto@v0.38.0
0.52.0

Open the chart page →

1,871
cosmos-nodenodeifyVerified publisher2.6.01 of 2See more

cosmos-node nodeify 2.6.0

1 of the 2 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/cosmos/gaia:v25.1.0f115777d1112
golang.org/x/crypto@v0.38.0
0.52.0

Open the chart page →

1,871
firehose-corenodeifyVerified publisher1.2.61 of 2See more

firehose-core nodeify 1.2.6

1 of the 2 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/firehose-core:v1.12.391fca773a63f
golang.org/x/crypto@v0.40.0
0.52.0

Open the chart page →

6,699
firehose-ethereumnodeifyVerified publisher1.7.11 of 2See more

firehose-ethereum nodeify 1.7.1

1 of the 2 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/go-ethereum:geth-v1.16.9-fh3.08e3cb38953a3
golang.org/x/crypto@v0.37.0
0.52.0

Open the chart page →

5,813
substreams-tier-2nodeifyVerified publisher1.1.31 of 1See more

substreams-tier-2 nodeify 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/firehose-ethereum:v2.14.3bf816072380e
golang.org/x/crypto@v0.0.0-20220817201139-bc19a97f63c8
0.52.0

Open the chart page →

4,826
grafananodepulse7.1.01 of 1See more

grafana nodepulse 7.1.0

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
grafana/grafana:10.2.36b5b37eb35bb
golang.org/x/crypto@v0.16.0
0.52.0

Open the chart page →

3,028
prometheusnodepulse25.0.06 of 6See more

prometheus nodepulse 25.0.0

6 of the 6 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
quay.io/prometheus-operator/prometheus-config-reloader:v0.67.014feefde1b80
golang.org/x/crypto@v0.11.0
0.52.0
quay.io/prometheus/alertmanager:v0.26.0361db356b330
golang.org/x/crypto@v0.8.0
0.52.0
quay.io/prometheus/node-exporter:v1.6.181f94e50ea37
golang.org/x/crypto@v0.8.0
0.52.0
quay.io/prometheus/prometheus:v2.47.0c5dd35038287
golang.org/x/crypto@v0.11.0
0.52.0
quay.io/prometheus/pushgateway:v1.6.05111de00e969
golang.org/x/crypto@v0.8.0
0.52.0
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.0ec5d6f6be228
golang.org/x/crypto@v0.9.0
0.52.0

Open the chart page →

7,761
kafka-helm-chartnotesprojectchart0.1.01 of 1See more

kafka-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
golang.org/x/crypto@v0.0.0-20211202192323-5770296d904e
0.52.0

Open the chart page →

4,559
vault-helm-chartnotesprojectchart0.1.01 of 1See more

vault-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
library/vault:1.13.3f98ac9dd97b0
golang.org/x/crypto@v0.6.0
0.52.0

Open the chart page →

2,258
notification-componentnotification-component1.0.01 of 4See more

notification-component notification-component 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/notification-component-php:latestcd9656e6bc2c
golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904
0.52.0

Open the chart page →

7,540
giteanovum-rgi-charts2.1.31 of 3See more

gitea novum-rgi-charts 2.1.3

1 of the 3 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
gitea/gitea:1.13.0d5ab14cd29af
golang.org/x/crypto@v0.0.0-20200820211705-5c72a883971a
0.52.0

Open the chart page →

4,863
nfs-server-provisionernovum-rgi-charts1.1.21 of 1See more

nfs-server-provisioner novum-rgi-charts 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
quay.io/kubernetes_incubator/nfs-provisioner:v2.3.0f402e6039b3c
golang.org/x/crypto@v0.0.0-20190701094942-4def268fd1a4
0.52.0

Open the chart page →

2,808
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
linuxserver/cloud9:latest45c5fe102ff3
golang.org/x/crypto@v0.0.0-20211202192323-5770296d904e
0.52.0

Open the chart page →

27,407
nai-knative-servingnutanix-helm-releasesVerified publisher1.13.11 of 4See more

nai-knative-serving nutanix-helm-releases 1.13.1

1 of the 4 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
gcr.io/knative-releases/knative.dev/serving/cmd/controller:v1.13.153d9aa4d2c7a
golang.org/x/crypto@v0.18.0
0.52.0

Open the chart page →

3,766
nutanix-flow-cninutanix-helm-releasesVerified publisher1.1.02 of 7See more

nutanix-flow-cni nutanix-helm-releases 1.1.0

2 of the 7 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
library/nats:2.10-alpineb83efabe3e7d
golang.org/x/crypto@v0.37.0
0.52.0
natsio/nats-box:0.14.1a67913df95f1
golang.org/x/crypto@v0.13.0
0.52.0

Open the chart page →

4,999
lensoci-ai-incubations0.1.147 of 16See more

lens oci-ai-incubations 0.1.14

7 of the 16 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
alpine/k8s:1.31.106dbe6f391eda
golang.org/x/crypto@v0.38.0
0.52.0
grafana/grafana:12.1.1a1701c218024
golang.org/x/crypto@v0.39.0
0.52.0
quay.io/jetstack/cert-manager-controller:v1.13.29c67cf8c92d8
golang.org/x/crypto@v0.14.0
0.52.0
quay.io/jetstack/cert-manager-webhook:v1.13.20a9470447ebf
golang.org/x/crypto@v0.14.0
0.52.0
quay.io/prometheus-operator/prometheus-config-reloader:v0.85.0ebb560bcb6bd
golang.org/x/crypto@v0.41.0
0.52.0
quay.io/prometheus/prometheus:v3.5.063805ebb8d2b
golang.org/x/crypto@v0.39.0
0.52.0
quay.io/prometheus/pushgateway:v1.11.103738d278e08
golang.org/x/crypto@v0.35.0
0.52.0

Open the chart page →

17,349
oci-prometheus-sd-proxyoci-prometheus-sd-proxy1.0.01 of 1See more

oci-prometheus-sd-proxy oci-prometheus-sd-proxy 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
ghcr.io/amaanx86/oci-prometheus-sd-proxy:latest297a8379a328
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

285
ocisocis-community0.1.01 of 1See more

ocis ocis-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
owncloud/ocis:8.0.1b38fd8fdd58f
golang.org/x/crypto@v0.47.0
0.52.0

Open the chart page →

2,359
argocd-agent-addonocm-helm-chartsVerified publisher0.29.01 of 2See more

argocd-agent-addon ocm-helm-charts 0.29.0

1 of the 2 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-operator:v0.18.0a09814522a72
golang.org/x/crypto@v0.47.0
0.52.0

Open the chart page →

671
cluster-managerocm-helm-chartsVerified publisher1.3.11 of 1See more

cluster-manager ocm-helm-charts 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
quay.io/open-cluster-management/registration-operator:v1.3.1df6c926a2b54
golang.org/x/crypto@v0.49.0
0.52.0

Open the chart page →

836
dynamic-scoring-frameworkocm-helm-chartsVerified publisher0.1.01 of 2See more

dynamic-scoring-framework ocm-helm-charts 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
quay.io/open-cluster-management/dynamic-scoring-addon:latest7e571a08ec1a
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

996
klusterletocm-helm-chartsVerified publisher1.3.11 of 1See more

klusterlet ocm-helm-charts 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
quay.io/open-cluster-management/registration-operator:v1.3.1df6c926a2b54
golang.org/x/crypto@v0.49.0
0.52.0

Open the chart page →

836
kueue-addonocm-helm-chartsVerified publisher0.1.41 of 1See more

kueue-addon ocm-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
quay.io/open-cluster-management/kueue-addon:v0.1.47f728514fead
golang.org/x/crypto@v0.37.0
0.52.0

Open the chart page →

1,632
multicluster-controlplaneocm-helm-chartsVerified publisher0.8.01 of 1See more

multicluster-controlplane ocm-helm-charts 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-46597.

Container imageDigestPackageFixed in
quay.io/open-cluster-management/multicluster-controlplane:latest9888240f644b
golang.org/x/crypto@v0.49.0
0.52.0

Open the chart page →

635

Container images carrying it

2,854 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/csi-attacher:v4.10.0be59d0556508
golang.org/x/crypto@v0.38.0
0.52.0
1
registry.k8s.io/sig-storage/csi-resizer:v2.0.04a95d94e57ad
golang.org/x/crypto@v0.37.0
0.52.0
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.8.03e2bf2eaef9f
golang.org/x/crypto@v0.36.0
0.52.0
1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.03ce0fdba4d8e
golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975
0.52.0
1

syft 1.42.1 · advisories as of 23 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.