StackRadar

CVE-2026-56859

High

Advisory

Published 13 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,700
of 17,985 indexed, latest versions
Container images
5,367
deployed by those charts
Fix available
1 of 2
affected packages

Add recursion depth guard during decode in encoding/xml

Carried by container images the latest versions of 4,700 of 17,985 indexed charts deploy, on 5,367 images.

Affected packageAffected versionsFixed inImages
golang-1.19deb1.19.8-2no fix listed1
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+195 more1.25.135,367
OSV records
DEBIAN-CVE-2026-56859GO-2026-6088
Also known as
BIT-golang-2026-56859

Charts affected

4,700 by stars
ChartLatestAffected imagesRadar Score
elchi-stackelchi2.0.05 of 10See more

elchi-stack elchi 2.0.0

5 of the 10 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
grafana/grafana:12.2.074144189b384
stdlib@go1.24.6
1.25.13
jhonbrownn/elchi-collector:v0.1.132ce57f86de2e
stdlib@go1.26.5
1.25.13
library/mongo:6.0.12646902910d6a
stdlib@go1.18.2
1.25.13
otel/opentelemetry-collector-contrib:0.89.0995f17004231
stdlib@go1.21.4
1.25.13
victoriametrics/victoria-metrics:v1.93.577a9815d0640
stdlib@go1.21.1
1.25.13

Open the chart page →

15,507
navidromeemmas-chartsVerified publisher0.0.61 of 1See more

navidrome emmas-charts 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
deluan/navidrome:0.50.02cf4442b0099
stdlib@go1.21.0
1.25.13

Open the chart page →

2,134
enbuildenbuildVerified publisher0.0.503 of 6See more

enbuild enbuild 0.0.50

3 of the 6 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
stdlib@go1.25.7
1.25.13
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
stdlib@go1.25.7
1.25.13
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb:4.4.5cf72810d33f5
stdlib@go1.15.8
1.25.13

Open the chart page →

34,195
eoapieoapiOfficialVerified publisher0.16.31 of 7See more

eoapi eoapi 0.16.3

1 of the 7 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
alpine/kubectl:1.34.18413f8890d19
stdlib@go1.24.6
1.25.13

Open the chart page →

5,814
nexus-operatorepmdedp-devVerified publisher2.11.0-MDTU-DDM-SNAPSHOT.11 of 1See more

nexus-operator epmdedp-dev 2.11.0-MDTU-DDM-SNAPSHOT.1

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
epamedp/nexus-operator:2.11.0-MDTU-DDM-SNAPSHOT.1449a53804699
stdlib@go1.17.2
1.25.13

Open the chart page →

2,263
paraerudikaVerified publisher0.3.01 of 1See more

para erudika 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
erudikaltd/para:latest_stable235e0bc53da2
stdlib@go1.26.5
1.25.13

Open the chart page →

1,517
httpbingoestahnVerified publisher0.1.11 of 1See more

httpbingo estahn 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
mccutchen/go-httpbin:v2.2.25994403ef75b
stdlib@go1.16.2
1.25.13

Open the chart page →

1,362
beaconchain-explorerethereum-helm-chartsVerified publisher0.1.61 of 2See more

beaconchain-explorer ethereum-helm-charts 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
gobitfly/eth2-beaconchain-explorer:latest1d08a7986348
stdlib@go1.23.5
1.25.13

Open the chart page →

3,332
ethereumjsethereum-helm-chartsVerified publisher0.1.21 of 2See more

ethereumjs ethereum-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ethpandaops/ethereumjs:masterfb84b718500f
stdlib@go1.23.12
1.25.13

Open the chart page →

1,809
genesis-generatorethereum-helm-chartsVerified publisher0.2.31 of 2See more

genesis-generator ethereum-helm-charts 0.2.3

1 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
skylenet/ethereum-genesis-generator:latest210353ce7c89
stdlib@go1.17.13
1.25.13

Open the chart page →

3,616
ipfs-clusterethereum-helm-chartsVerified publisher0.1.143 of 3See more

ipfs-cluster ethereum-helm-charts 0.1.14

3 of the 3 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ipfs/ipfs-cluster:latesta83266c524f1
stdlib@go1.26.3
1.25.13
ipfs/kubo:latestb293923d66e4
stdlib@go1.26.5
1.25.13
lachlanevenson/k8s-kubectl:v1.25.4af5cea3f2e40
stdlib@go1.19.3
1.25.13

Open the chart page →

4,815
iobrokereugen0.2.61 of 1See more

iobroker eugen 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
stdlib@go1.19.8
1.25.13

Open the chart page →

12,153
evccevccVerified publisher1.0.471 of 1See more

evcc evcc 1.0.47

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
evcc/evcc:0.300.8ddf2a25afce5
stdlib@go1.25.6
1.25.13

Open the chart page →

1,230
event-exporterevent-exporterVerified publisher0.1.171 of 1See more

event-exporter event-exporter 0.1.17

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
kubestar/event-exporter:latest656606941255
stdlib@go1.20.14
1.25.13

Open the chart page →

1,216
events-exporterevents-exporter0.0.41 of 1See more

events-exporter events-exporter 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/nabokihms/events_exporter:latest68d44646e8b2
stdlib@go1.19.5
1.25.13

Open the chart page →

2,144
github-actions-runner-operatorevryfs-ossVerified publisher2.8.11 of 1See more

github-actions-runner-operator evryfs-oss 2.8.1

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
quay.io/evryfs/github-actions-runner-operator:v0.11.16b084e0bd082
stdlib@go1.21.1
1.25.13

Open the chart page →

1,232
ext-postgres-operatorext-postgres-operatorVerified publisher3.0.01 of 1See more

ext-postgres-operator ext-postgres-operator 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/movetokube/postgres-operator:2.4.0def57d85a2da
stdlib@go1.25.5
1.25.13

Open the chart page →

408
akauntingf3k-techVerified publisher1.3121.01 of 4See more

akaunting f3k-tech 1.3121.0

1 of the 4 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
bitnamilegacy/mariadb:latestbbd4e17f1ef8
stdlib@go1.24.5
1.25.13

Open the chart page →

4,520
vidcheckfactlyVerified publisher0.5.21 of 2See more

vidcheck factly 0.5.2

1 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
factly/vidcheck-server:0.12.087064eb0463c
stdlib@go1.14.2
1.25.13

Open the chart page →

3,623
ecr-cleanupfairwinds-stableVerified publisher1.2.81 of 1See more

ecr-cleanup fairwinds-stable 1.2.8

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
danielfm/kube-ecr-cleanup-controller:0.1.1012485563b1d0
stdlib@go1.19.6
1.25.13

Open the chart page →

1,010
falco-operatorfalcosecurity0.3.11 of 1See more

falco-operator falcosecurity 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
falcosecurity/falco-operator:0.4.18a99fcc57a57
stdlib@go1.26.0
1.25.13

Open the chart page →

394
fastapi-microservice-appfast-api-microservice-app1.3.01 of 4See more

fastapi-microservice-app fast-api-microservice-app 1.3.0

1 of the 4 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
library/mongo:7.09854f7139445
stdlib@go1.26.5
1.25.13

Open the chart page →

10,366
featurehubfeaturehub4.1.63 of 7See more

featurehub featurehub 4.1.6

3 of the 7 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
library/nats:2.10.5-alpine85319e5e541b
stdlib@go1.21.4
1.25.13
natsio/nats-box:0.14.1a67913df95f1
stdlib@go1.21.3
1.25.13
natsio/nats-server-config-reloader:0.13.0b3359eeb10bf
stdlib@go1.20.5
1.25.13

Open the chart page →

9,384
federidfederidOfficialVerified publisher0.1.21 of 1See more

federid federid 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
federid/webhook:0.1.0fbfb7c6510a7
stdlib@go1.23.3
1.25.13

Open the chart page →

2,234
fencemasterfencemasterVerified publisher0.1.131 of 1See more

fencemaster fencemaster 0.1.13

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/rvbsalgado/fencemaster:1.0.0-rc.207056a6aae439
stdlib@go1.25.8
1.25.13

Open the chart page →

258
taigafermosit0.0.112 of 7See more

taiga fermosit 0.0.11

2 of the 7 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
taigaio/taiga-back:latest4beed8f62c9f
stdlib@go1.24.4
1.25.13
taigaio/taiga-protected:latestfd4568a97a59
stdlib@go1.24.4
1.25.13

Open the chart page →

9,315
ferriskeyferriskey0.8.01 of 3See more

ferriskey ferriskey 0.8.0

1 of the 3 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
library/postgres:17d74eeac9a635
stdlib@go1.24.6
1.25.13

Open the chart page →

2,107
ai-gatewayferro-labsOfficialVerified publisher1.2.01 of 1See more

ai-gateway ferro-labs 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/ferro-labs/ai-gateway:1.2.0baa285ec0fc9
stdlib@go1.25.12
1.25.13

Open the chart page →

127
file-manager-serverfile-manager-server1.11.01 of 1See more

file-manager-server file-manager-server 1.11.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
public.ecr.aws/cloudnatix/llmariner/file-manager-server:1.11.0301216788e93
stdlib@go1.23.11
1.25.13

Open the chart page →

775
fission-corefission-chartsVerified publisher1.14.13 of 3See more

fission-core fission-charts 1.14.1

3 of the 3 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
fission/fission-bundle:1.14.13fcfd8a0fa5d
stdlib@go1.15.14
1.25.13
fission/pre-upgrade-checks:1.14.1fa0f24cdb9cd
stdlib@go1.15.14
1.25.13
fission/reporter:1.14.104c6e06af175
stdlib@go1.15.14
1.25.13

Open the chart page →

7,105
openldapfluktuid0.1.11 of 2See more

openldap fluktuid 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
osixia/openldap:1.5.018742e9c449c
stdlib@go1.15.5
1.25.13

Open the chart page →

3,315
flyway-operatorflyway-operatorVerified publisher0.2.131 of 1See more

flyway-operator flyway-operator 0.2.13

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/davidkarlsen/flyway-operator:0.2.1366f60b461c0d
stdlib@go1.24.4
1.25.13

Open the chart page →

636
contentserverfoomoVerified publisher0.7.01 of 1See more

contentserver foomo 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
foomo/contentserver:1.21.0824f41463e9b
stdlib@go1.26.5
1.25.13

Open the chart page →

321
free5gcfree5gcVerified publisher0.1.311 of 12See more

free5gc free5gc 0.1.3

11 of the 12 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
free5gc/amf:v3.4.31bc96ff5a2a6
stdlib@go1.21.8
1.25.13
free5gc/ausf:v3.4.3687ff4daf5da
stdlib@go1.21.8
1.25.13
free5gc/chf:v3.4.3e2a4dd98a4ed
stdlib@go1.21.8
1.25.13
free5gc/nrf:v3.4.399e46b860efb
stdlib@go1.21.8
1.25.13
free5gc/nssf:v3.4.3dfe8c68c04b4
stdlib@go1.21.8
1.25.13
free5gc/pcf:v3.4.3f712e8ecd927
stdlib@go1.21.8
1.25.13
free5gc/smf:v3.4.360e38baa4b10
stdlib@go1.21.8
1.25.13
free5gc/udm:v3.4.32f68df062a50
stdlib@go1.21.8
1.25.13
free5gc/udr:v3.4.3c0783bcdcbdc
stdlib@go1.21.8
1.25.13
free5gc/upf:v3.4.3b6b362a39fdd
stdlib@go1.21.8
1.25.13
free5gc/webui:v3.4.39adeb18492cb
stdlib@go1.21.8
1.25.13

Open the chart page →

10,615
fsmfsmOfficialVerified publisher0.2.112 of 5See more

fsm fsm 0.2.11

2 of the 5 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
flomesh/fsm-ingress-pipy:0.2.11cc39c96711c4
stdlib@go1.19.13
1.25.13
flomesh/fsm-manager:0.2.1122f849c70b25
stdlib@go1.19.13
1.25.13

Open the chart page →

4,230
adguard-homegabe565Verified publisher0.3.251 of 2See more

adguard-home gabe565 0.3.25

1 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
adguard/adguardhome:v0.107.56c64a0b37f7b9
stdlib@go1.23.5
1.25.13

Open the chart page →

812
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latestd89226851697
stdlib@go1.25.6
1.25.13

Open the chart page →

2,605
memosgabe565Verified publisher0.17.01 of 1See more

memos gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/usememos/memos:0.24.04723d86e6797
stdlib@go1.23.6
1.25.13

Open the chart page →

1,592
dexgabibbo974.0.41 of 1See more

dex gabibbo97 4.0.4

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.28.15e88f2205de1
stdlib@go1.16.2
1.25.13

Open the chart page →

3,406
garmgarmVerified publisher4.2.01 of 3See more

garm garm 4.2.0

1 of the 3 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/igrikus/garm-operator:4.2.09e24d8a6a3b2
stdlib@go1.26.2
1.25.13

Open the chart page →

840
gateboardgateboard1.12.51 of 1See more

gateboard gateboard 1.12.5

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
udhos/gateboard:1.12.53acc0e7599bf
stdlib@go1.25.3
1.25.13

Open the chart page →

1,520
gateboard-discoverygateboard1.9.51 of 1See more

gateboard-discovery gateboard 1.9.5

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
udhos/gateboard-discovery:1.9.55567c9363c4c
stdlib@go1.25.3
1.25.13

Open the chart page →

1,254
gboxgboxVerified publisher1.0.51 of 2See more

gbox gbox 1.0.5

1 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
gboxproxy/gbox:v1.0.63a9f4a711d5c
stdlib@go1.17.9
1.25.13

Open the chart page →

2,566
adguard-homegeek-cookbookVerified publisher5.5.21 of 2See more

adguard-home geek-cookbook 5.5.2

1 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
adguard/adguardhome:v0.107.7b9974aed13d0
stdlib@go1.17.9
1.25.13

Open the chart page →

1,739
alertmanager-botgeek-cookbookVerified publisher6.4.21 of 1See more

alertmanager-bot geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
metalmatze/alertmanager-bot:0.4.3426bc2ca7586
stdlib@go1.13.15
1.25.13

Open the chart page →

3,585
bazarrgeek-cookbookVerified publisher10.6.21 of 1See more

bazarr geek-cookbook 10.6.2

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/bazarr:v1.0.3fdb5501cdfb9
stdlib@go1.16.8
1.25.13

Open the chart page →

18,125
filebrowsergeek-cookbookVerified publisher1.4.21 of 1See more

filebrowser geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.18.04fcd47af573c
stdlib@go1.16.9
1.25.13

Open the chart page →

3,485
focalboardgeek-cookbookVerified publisher4.4.21 of 1See more

focalboard geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
mattermost/focalboard:0.9.031078df7a3c8
stdlib@go1.16.5
1.25.13

Open the chart page →

3,672
influxdb-exportergeek-cookbookVerified publisher1.2.21 of 1See more

influxdb-exporter geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
prom/influxdb-exporter:v0.9.0f63fd77c05ee
stdlib@go1.17.8
1.25.13

Open the chart page →

1,054
network-ups-toolsgeek-cookbookVerified publisher6.4.21 of 1See more

network-ups-tools geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/network-ups-tools:v2.7.4-2479-g86a32237cbd5d4cc1245
stdlib@go1.15
1.25.13

Open the chart page →

14,250

Container images carrying it

5,367 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

No deployed image carries CVE-2026-56859.

syft 1.42.1 · advisories as of 2 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.