StackRadar

CVE-2026-56859

High

Advisory

Published 13 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,700
of 17,985 indexed, latest versions
Container images
5,367
deployed by those charts
Fix available
1 of 2
affected packages

Add recursion depth guard during decode in encoding/xml

Carried by container images the latest versions of 4,700 of 17,985 indexed charts deploy, on 5,367 images.

Affected packageAffected versionsFixed inImages
golang-1.19deb1.19.8-2no fix listed1
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+195 more1.25.135,367
OSV records
DEBIAN-CVE-2026-56859GO-2026-6088
Also known as
BIT-golang-2026-56859

Charts affected

4,700 by stars
ChartLatestAffected imagesRadar Score
yugawareyugabyteVerified publisher2026.1.21 of 5See more

yugaware yugabyte 2026.1.2

1 of the 5 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
library/postgres:14.232f439458ab6a
stdlib@go1.24.6
1.25.13

Open the chart page →

1,959
tailscale-relayzeet0.1.51 of 1See more

tailscale-relay zeet 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
zeetdev/tailscale-relay:v1.24.21967aa2840b6
stdlib@go1.18.1-ts710a0d8610
1.25.13

Open the chart page →

2,163
crowdsec-web-uizekker6Verified publisher0.53.01 of 1See more

crowdsec-web-ui zekker6 0.53.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/theduffman85/crowdsec-web-ui:2026.9.2714d62ccd80c
stdlib@go1.24.4
1.25.13

Open the chart page →

1,432
cloudflare-zero-trust-operatorzelic-io0.7.11 of 1See more

cloudflare-zero-trust-operator zelic-io 0.7.1

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/bojanzelic/cloudflare-zero-trust-operator:0.7.1f4b2dbc19a78
stdlib@go1.23.4
1.25.13

Open the chart page →

606
velero-notificationszokeber-velero-notificationsVerified publisher0.1.101 of 2See more

velero-notifications zokeber-velero-notifications 0.1.10

1 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/zokeber/velero-notifications:0.0.176d84f6c4ce20
stdlib@go1.25.8
1.25.13

Open the chart page →

759
backendzymtraceOfficialVerified publisher26.10.01 of 6See more

backend zymtrace 26.10.0

1 of the 6 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
library/postgres:17.4304ab8135187
stdlib@go1.18.2
1.25.13

Open the chart page →

9,978
aaqaaqVerified publisher0.3.01 of 1See more

aaq aaq 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
quay.io/kubevirt/aaq-operator:v1.7.0d28a2daa5b15
stdlib@go1.24.12
1.25.13

Open the chart page →

1,053
abstract-nodeabstract-nodeVerified publisher0.1.491 of 2See more

abstract-node abstract-node 0.1.49

1 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/abstract-foundation/zksync-external-node-sidecar:v1.0.03e705d0eb1ce
stdlib@go1.18.10
1.25.13

Open the chart page →

4,803
accurateaccurateOfficialVerified publisher0.8.01 of 1See more

accurate accurate 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/cybozu-go/accurate:2.0.0be4a2680bef4
stdlib@go1.26.3
1.25.13

Open the chart page →

89
rabbitmq-cluster-operatoradeptia-automate-operator5.2.02 of 2See more

rabbitmq-cluster-operator adeptia-automate-operator 5.2.0

2 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
adeptiainc/adeptia-connect-rabbitmq-cluster-operator:5.2cf610f8c614c
stdlib@go1.25.7
1.25.13
adeptiainc/adeptia-connect-rabbitmq-messaging-topology-operator:5.27cdf6ac2e738
stdlib@go1.25.7
1.25.13

Open the chart page →

556
jenkinsaditisingh-jenkins1.0.01 of 1See more

jenkins aditisingh-jenkins 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
stdlib@go1.25.3
1.25.13

Open the chart page →

2,887
activepiecesadnoctemVerified publisher0.6.01 of 1See more

activepieces adnoctem 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
activepieces/activepieces:0.91.058414dfc94c4
stdlib@go1.23.5
1.25.13

Open the chart page →

1,533
gobackupadnoctemVerified publisher0.4.01 of 1See more

gobackup adnoctem 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
huacnlee/gobackup:v3.1.1560be93229a5
stdlib@go1.26.3
1.25.13

Open the chart page →

1,944
linkwardenadnoctemVerified publisher0.5.11 of 2See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/linkwarden/linkwarden:v2.16.30664c28a039b
stdlib@go1.23.7
1.25.13

Open the chart page →

4,477
popeyeadnoctemVerified publisher0.3.01 of 1See more

popeye adnoctem 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
derailed/popeye:v0.22.18e68e22c7663
stdlib@go1.23.5
1.25.13

Open the chart page →

1,456
uptime-kumaadnoctemVerified publisher0.4.11 of 1See more

uptime-kuma adnoctem 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
stdlib@go1.20.5
1.25.13

Open the chart page →

33,379
adresserviceadresservice1.1.01 of 5See more

adresservice adresservice 1.1.0

1 of the 5 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/adresservice-php:latestc5075f0320cd
stdlib@go1.13.10
1.25.13

Open the chart page →

7,506
bootaerokube1.0.13 of 4See more

boot aerokube 1.0.1

3 of the 4 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
quay.io/aerokube/boot:1.0.13c269612053f
stdlib@go1.22.2
1.25.13
quay.io/aerokube/keygen:1.0.1578934444f04
stdlib@go1.20.5
1.25.13
quay.io/aerokube/reloader:1.0.1e4a3661416a5
stdlib@go1.22.2
1.25.13

Open the chart page →

8,414
browser-opsaerokube2.6.71 of 1See more

browser-ops aerokube 2.6.7

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
quay.io/aerokube/browser-ops:2.6.7807c1bb67086
stdlib@go1.22.2
1.25.13

Open the chart page →

558
moonaerokube1.1.373 of 3See more

moon aerokube 1.1.37

3 of the 3 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
aerokube/moon:1.9.17da76ca51220d
stdlib@go1.22.3
1.25.13
aerokube/moon-api:1.9.176b6323e75785
stdlib@go1.22.3
1.25.13
aerokube/selenoid-ui:1.10.113f3e299509fd
stdlib@go1.21.5
1.25.13

Open the chart page →

2,468
aerospike-kubernetes-operatoraerospike4.5.01 of 1See more

aerospike-kubernetes-operator aerospike 4.5.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
aerospike/aerospike-kubernetes-operator:4.5.070a9eeb991b8
stdlib@go1.25.10
1.25.13

Open the chart page →

697
msockperfaetrius2.0.81 of 2See more

msockperf aetrius 2.0.8

1 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/aetrius/msockperf-client/msockperf-client:main820af919c5e2
stdlib@go1.22.1
1.25.13

Open the chart page →

4,643
agendaserviceagendaservice1.0.01 of 3See more

agendaservice agendaservice 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
conduction/agendaservice-php:latest9cfeeb6c7c20
stdlib@go1.13.10
1.25.13

Open the chart page →

7,268
agentgateway-route-reconcileragentgateway-route-reconciler0.3.11 of 1See more

agentgateway-route-reconciler agentgateway-route-reconciler 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/ricardozd/agentgateway-route-reconciler:0.3.1846f6e407c96
stdlib@go1.24.13
1.25.13

Open the chart page →

262
agentkube-operatoragentkube-operator0.3.01 of 1See more

agentkube-operator agentkube-operator 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.43.0f5c29683a301
stdlib@go1.19.7
1.25.13

Open the chart page →

1,729
mt-channel-brokerahhhhVerified publisher0.1.03 of 3See more

mt-channel-broker ahhhh 0.1.0

3 of the 3 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
gcr.io/knative-releases/knative.dev/eventing/cmd/broker/filterdigest-pinnedd675f211a40f
stdlib@go1.22.8
1.25.13
gcr.io/knative-releases/knative.dev/eventing/cmd/broker/ingressdigest-pinnedec4b544499ba
stdlib@go1.22.8
1.25.13
gcr.io/knative-releases/knative.dev/eventing/cmd/mtchannel_brokerdigest-pinned395f4ff1bd34
stdlib@go1.22.8
1.25.13

Open the chart page →

2,631
net-istioahhhhVerified publisher0.1.12 of 2See more

net-istio ahhhh 0.1.1

2 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
gcr.io/knative-releases/knative.dev/net-istio/cmd/controllerdigest-pinnede70bc675f977
stdlib@go1.22.8
1.25.13
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhookdigest-pinned7d76a6d42d13
stdlib@go1.22.8
1.25.13

Open the chart page →

1,148
net-kourierahhhhVerified publisher0.18.11 of 1See more

net-kourier ahhhh 0.18.1

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourierdigest-pinned15a601147ef4
stdlib@go1.24.2
1.25.13

Open the chart page →

527
airbyte-keycloakairbyteVerified publisher0.1.21 of 2See more

airbyte-keycloak airbyte 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
library/postgres:17f4c66b820c6f
stdlib@go1.24.6
1.25.13

Open the chart page →

1,460
pod-sweeperairbyteVerified publisher1.5.11 of 1See more

pod-sweeper airbyte 1.5.1

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
airbyte/pod-sweeper:1.5.198d2c39d512e
stdlib@go1.23.4
1.25.13

Open the chart page →

5,227
airbyteairbyte-v2Verified publisher2.3.03 of 10See more

airbyte airbyte-v2 2.3.0

3 of the 10 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
airbyte/db:2.3.000cc017f0393
stdlib@go1.24.6
1.25.13
airbyte/minio:RELEASE.2023-11-20T22-40-07Zfdae972eaf0e
stdlib@go1.21.4
1.25.13
temporalio/auto-setup:1.27.2b44cbfeb43db
stdlib@go1.23.2
1.25.13

Open the chart page →

13,605
airports-kafkaairports-kafka0.1.01 of 2See more

airports-kafka airports-kafka 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
stdlib@go1.17.10
1.25.13

Open the chart page →

4,683
airports-postgresairports-postgres0.1.01 of 1See more

airports-postgres airports-postgres 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
postgis/postgis:latest01a6a70e41e6
stdlib@go1.18.2
1.25.13

Open the chart page →

1,031
akeyless-csi-providerakeyless-services-helmVerified publisher1.0.41 of 1See more

akeyless-csi-provider akeyless-services-helm 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
akeyless/akeyless-csi-provider:lateste48bddc5dd72
stdlib@go1.26.4
1.25.13

Open the chart page →

334
akeyless-gatewayakeyless-services-helmVerified publisher3.6.01 of 2See more

akeyless-gateway akeyless-services-helm 3.6.0

1 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
akeyless/gateway:5.4.0d4768a9b089c
stdlib@go1.26.3
1.25.13

Open the chart page →

1,618
akeyless-secrets-injectionakeyless-services-helmVerified publisher2.3.01 of 1See more

akeyless-secrets-injection akeyless-services-helm 2.3.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
akeyless/k8s-webhook-server:0.39.0996cd9afb3b4
stdlib@go1.26.4
1.25.13

Open the chart page →

413
akriakri0.12.551 of 3See more

akri akri 0.12.55

1 of the 3 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.1.164d8c73dca98
stdlib@go1.16.9
1.25.13

Open the chart page →

1,551
aktoakto0.2.01 of 7See more

akto akto 0.2.0

1 of the 7 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
keelhq/keel:latest73714afb4443
stdlib@go1.23.4
1.25.13

Open the chart page →

15,062
akto-ai-guardrailsakto0.1.21 of 2See more

akto-ai-guardrails akto 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-agent-guard-service:latest5c6ff17c5849
stdlib@go1.25.5
1.25.13

Open the chart page →

256
akto-ai-guardrails-v2akto0.3.01 of 6See more

akto-ai-guardrails-v2 akto 0.3.0

1 of the 6 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
aktosecurity/data-ingestion-service:1.4.946ed5bcb04b2
stdlib@go1.26.3
1.25.13

Open the chart page →

49,651
akto-aws-api-gateway-connectorakto0.1.11 of 1See more

akto-aws-api-gateway-connector akto 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
aktosecurity/mirror-api-logging:api-gateway-logging-multi-logging1a1bc76d50fe
stdlib@go1.23.3
1.25.13

Open the chart page →

416
akto-central-setupakto1.2.31 of 5See more

akto-central-setup akto 1.2.3

1 of the 5 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.28e01c0305844
stdlib@go1.26.4
1.25.13

Open the chart page →

3,953
akto-hybrid-redactakto1.44.73 of 5See more

akto-hybrid-redact akto 1.44.7

3 of the 5 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
keelhq/keel:latest73714afb4443
stdlib@go1.23.4
1.25.13
public.ecr.aws/aktosecurity/akto-api-security-mini-testing:1.74.4_local5bda14f66e8e
stdlib@go1.26.5
1.25.13
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.1-1-ubi9d20bd62f0182
stdlib@go1.25.4
1.25.13

Open the chart page →

5,701
akto-k8s-agentakto0.1.21 of 1See more

akto-k8s-agent akto 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
aktosecurity/mirror-api-logging:k8s_agentc1313b1ff2ed
stdlib@go1.25.12
1.25.13

Open the chart page →

288
akto-k8s-ebpfakto0.1.31 of 1See more

akto-k8s-ebpf akto 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
aktosecurity/mirror-api-logging:k8s_ebpf3e506f5e5f47
stdlib@go1.26.5
1.25.13

Open the chart page →

647
akto-k8s-ebpf-openshiftakto0.1.11 of 1See more

akto-k8s-ebpf-openshift akto 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/mirror-api-logging:k8s_ebpf_core_impd94ce715f051
stdlib@go1.25.9
1.25.13

Open the chart page →

1,438
akto-mini-runtimeakto0.7.221 of 3See more

akto-mini-runtime akto 0.7.22

1 of the 3 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
stdlib@go1.26.4
1.25.13

Open the chart page →

3,305
akto-mini-runtime-shaakto0.7.231 of 3See more

akto-mini-runtime-sha akto 0.7.23

1 of the 3 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafkadigest-pinnedd20bd62f0182
stdlib@go1.25.4
1.25.13

Open the chart page →

3,779
akto-mini-testingakto1.45.73 of 5See more

akto-mini-testing akto 1.45.7

3 of the 5 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-mini-testing:1.72.6_local43316f900242
stdlib@go1.26.5
1.25.13
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
stdlib@go1.26.4
1.25.13
public.ecr.aws/aktosecurity/keelhq-keel:akto_v1.0.01eb61443d68e
stdlib@go1.23.4
1.25.13

Open the chart page →

7,598
akto-mini-testing-kafkaakto1.42.11 of 5See more

akto-mini-testing-kafka akto 1.42.1

1 of the 5 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
keelhq/keel:latest73714afb4443
stdlib@go1.23.4
1.25.13

Open the chart page →

7,178

Container images carrying it

5,367 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

No deployed image carries CVE-2026-56859.

syft 1.42.1 · advisories as of 2 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.