StackRadar

CVE-2026-56859

High

Advisory

Published 13 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,688
of 17,985 indexed, latest versions
Container images
5,349
deployed by those charts
Fix available
1 of 2
affected packages

Add recursion depth guard during decode in encoding/xml

Carried by container images the latest versions of 4,688 of 17,985 indexed charts deploy, on 5,349 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+195 more1.25.135,349
golang-1.19deb1.19.8-2no fix listed1
OSV records
DEBIAN-CVE-2026-56859GO-2026-6088
Also known as
BIT-golang-2026-56859

Charts affected

4,688 by stars
ChartLatestAffected imagesRadar Score
csi-driver-smbcsi-driver-smbVerified publisher1.20.35 of 6See more

csi-driver-smb csi-driver-smb 1.20.3

5 of the 6 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.17.0f9de845b1701
stdlib@go1.26.3
1.25.13
registry.k8s.io/sig-storage/csi-provisioner:v6.3.0a4b0b1a37605
stdlib@go1.26.3
1.25.13
registry.k8s.io/sig-storage/csi-resizer:v2.2.0a2d40c1c3ccb
stdlib@go1.26.3
1.25.13
registry.k8s.io/sig-storage/livenessprobe:v2.19.006da0d5b8908
stdlib@go1.26.3
1.25.13
registry.k8s.io/sig-storage/smbplugin:v1.20.3dc7746bb081e
stdlib@go1.26.4
1.25.13

Open the chart page →

3,788
emissary-ingressdatawire7.1.8-ea1 of 1See more

emissary-ingress datawire 7.1.8-ea

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
datawire/emissary:2.0.2-ea9716efbdd24b
stdlib@go1.15
1.25.13

Open the chart page →

6,105
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
stdlib@go1.17.1
1.25.13

Open the chart page →

8,895
synapsehalkeye0.40.01 of 2See more

synapse halkeye 0.40.0

1 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
stdlib@go1.19.8
1.25.13

Open the chart page →

7,412
hpe-csi-driverhpe-storageVerified publisher3.3.05 of 14See more

hpe-csi-driver hpe-storage 3.3.0

5 of the 14 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-attacher:v4.12.0b9dc9a714a48
stdlib@go1.26.3
1.25.13
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.17.0f9de845b1701
stdlib@go1.26.3
1.25.13
registry.k8s.io/sig-storage/csi-provisioner:v6.3.0a4b0b1a37605
stdlib@go1.26.3
1.25.13
registry.k8s.io/sig-storage/csi-resizer:v2.2.1ea1d25e23479
stdlib@go1.26.3
1.25.13
registry.k8s.io/sig-storage/csi-snapshotter:v8.6.042af0929bcd6
stdlib@go1.26.3
1.25.13

Open the chart page →

2,560
imgproxyimgproxy1.1.01 of 1See more

imgproxy imgproxy 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/imgproxy/imgproxy:v3.30.074c1bee92e04
stdlib@go1.25.1
1.25.13

Open the chart page →

2,934
cloudflaredkubitodevVerified publisher1.7.91 of 1See more

cloudflared kubitodev 1.7.9

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
cloudflare/cloudflared:2026.3.06b599ca3e974
stdlib@go1.24.13
1.25.13

Open the chart page →

1,862
ngrok-operatorngrokOfficialVerified publisher0.24.01 of 2See more

ngrok-operator ngrok 0.24.0

1 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ngrok/ngrok-operator:0.22.0db8e6fecc52c
stdlib@go1.26.5
1.25.13

Open the chart page →

195
prometheus-snmp-exporterprometheus-communityOfficialVerified publisher9.18.11 of 1See more

prometheus-snmp-exporter prometheus-community 9.18.1

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
quay.io/prometheus/snmp-exporter:v0.30.1e5fd5e8b43ac
stdlib@go1.25.5
1.25.13

Open the chart page →

732
hostpath-provisionerrimusz0.2.131 of 1See more

hostpath-provisioner rimusz 0.2.13

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
quay.io/rimusz/hostpath-provisioner:v0.2.587f0398ec7ff
stdlib@go1.16.7
1.25.13

Open the chart page →

2,972
daskdask2024.1.11 of 2See more

dask dask 2024.1.1

1 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
stdlib@go1.21.5
1.25.13

Open the chart page →

14,154
dgraphdgraph24.1.41 of 1See more

dgraph dgraph 24.1.4

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
dgraph/dgraph:v24.1.4b57fa31f9b7f
stdlib@go1.22.12
1.25.13

Open the chart page →

3,634
openldaphelm-openldapVerified publisher2.0.41 of 3See more

openldap helm-openldap 2.0.4

1 of the 3 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
osixia/openldap:1.4.0ccd95cc6e61e
stdlib@go1.13.4
1.25.13

Open the chart page →

9,024
netbirdjaconiVerified publisher0.15.13 of 4See more

netbird jaconi 0.15.1

3 of the 4 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
netbirdio/management:0.45.10c9994b393ea
stdlib@go1.23.9
1.25.13
netbirdio/relay:0.45.1872e3add0e1e
stdlib@go1.23.9
1.25.13
netbirdio/signal:0.45.146ce5a45538f
stdlib@go1.23.9
1.25.13

Open the chart page →

9,731
k8upk8upVerified publisher4.10.01 of 1See more

k8up k8up 4.10.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/k8up-io/k8up:v2.16.029458113b8b6
stdlib@go1.26.3
1.25.13

Open the chart page →

880
kube-starrockskube-starrocksOfficialVerified publisher1.11.71 of 1See more

kube-starrocks kube-starrocks 1.11.7

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
starrocks/operator:v1.11.78c20435a7579
stdlib@go1.22.12
1.25.13

Open the chart page →

889
linkerd-jaegerlinkerd2Verified publisher30.12.112 of 4See more

linkerd-jaeger linkerd2 30.12.11

2 of the 4 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
jaegertracing/all-in-one:1.3104d224a9999b
stdlib@go1.17.6
1.25.13
otel/opentelemetry-collector:0.59.0ee9da0b08d83
stdlib@go1.18.5
1.25.13

Open the chart page →

5,956
gotenbergmaikumoriVerified publisher1.25.01 of 1See more

gotenberg maikumori 1.25.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8.36.087c16b9f3642
stdlib@go1.26.5
1.25.13

Open the chart page →

12,674
argocdnicklasfrahm-argocdVerified publisher0.3.02 of 2See more

argocd nicklasfrahm-argocd 0.3.0

2 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
public.ecr.aws/docker/library/redis:7.2.8-alpinec88ea2979a49
stdlib@go1.18.2
1.25.13
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
stdlib@go1.22.7
1.25.13

Open the chart page →

6,931
oneuptimeoneuptimeOfficialVerified publisher14.0.122 of 7See more

oneuptime oneuptime 14.0.12

2 of the 7 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
library/postgres:latest5a5a84b19854
stdlib@go1.24.6
1.25.13
oneuptime/runner:releasefcb8eeaa8e5e
stdlib@go1.26.5
1.25.13

Open the chart page →

8,981
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
stdlib@go1.17.1
1.25.13

Open the chart page →

7,220
karmawiremindVerified publisher2.13.11 of 1See more

karma wiremind 2.13.1

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/prymitive/karma:v0.13190a10c5c6793
stdlib@go1.26.3
1.25.13

Open the chart page →

221
amd-gpuamd-gpu-helmOfficialVerified publisher0.22.01 of 1See more

amd-gpu amd-gpu-helm 0.22.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
rocm/k8s-device-plugin:1.31.0.926212c665aab
stdlib@go1.23.6
1.25.13

Open the chart page →

1,590
scribebackube-helm-chartsVerified publisher0.2.01 of 2See more

scribe backube-helm-charts 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
quay.io/backube/scribe:0.2.0cdefc81c6b2e
stdlib@go1.15.12
1.25.13

Open the chart page →

7,949
camel-kcamel-kVerified publisher2.11.01 of 1See more

camel-k camel-k 2.11.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
apache/camel-k:2.11.0d173e7efe258
stdlib@go1.26.5
1.25.13

Open the chart page →

1,636
edge-stackdatawire7.1.8-ea1 of 2See more

edge-stack datawire 7.1.8-ea

1 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
datawire/aes:2.0.3-ea07f8fe4f4f8e
stdlib@go1.15
1.25.13

Open the chart page →

6,535
falcosidekickfalcosecurity0.14.01 of 1See more

falcosidekick falcosecurity 0.14.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
falcosecurity/falcosidekick:2.32.01976da721518
stdlib@go1.25.1
1.25.13

Open the chart page →

2,143
glasskube-operatorglasskubeOfficialVerified publisher0.12.23 of 3See more

glasskube-operator glasskube 0.12.2

3 of the 3 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
glasskube/operator:0.12.2be5133100d63
stdlib@go1.20.8
1.25.13
quay.io/minio/mc:RELEASE.2023-09-29T16-41-22Za784ce6e3b1b
stdlib@go1.21.1
1.25.13
quay.io/minio/minio:RELEASE.2023-09-30T07-02-29Z6262bc9a2730
stdlib@go1.21.1
1.25.13

Open the chart page →

14,206
beylagrafana1.16.111 of 1See more

beyla grafana 1.16.11

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
grafana/beyla:3.32.03ff0f7cf2bbf
stdlib@go1.25.11
1.25.13

Open the chart page →

225
helm-dashboardkomodorVerified publisher2.0.71 of 1See more

helm-dashboard komodor 2.0.7

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
komodorio/helm-dashboard:2.1.3258a9044e658
stdlib@go1.26.5
1.25.13

Open the chart page →

455
kube-prometheus-stackkube-prometheus-stack-oci91.9.01 of 6See more

kube-prometheus-stack kube-prometheus-stack-oci 91.9.0

1 of the 6 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
quay.io/prometheus/node-exporter:v1.12.1-distroless8c9bac11973b
stdlib@go1.26.5
1.25.13

Open the chart page →

503
kube-vipkube-vip0.11.11 of 1See more

kube-vip kube-vip 0.11.1

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/kube-vip/kube-vip:v1.2.32fcdbb014a2e
stdlib@go1.26.5
1.25.13

Open the chart page →

208
outlinekubitodevVerified publisher1.2.21 of 4See more

outline kubitodev 1.2.2

1 of the 4 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
outlinewiki/outline:0.82.0494dfb9249a6
stdlib@go1.20.12
1.25.13

Open the chart page →

6,295
linkerd-vizlinkerd2-edgeVerified publisher30.14.11-edge1 of 5See more

linkerd-viz linkerd2-edge 30.14.11-edge

1 of the 5 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
prom/prometheus:v2.48.1a67e5e402ff5
stdlib@go1.21.5
1.25.13

Open the chart page →

1,825
plane-cemakeplaneOfficialVerified publisher1.8.42 of 11See more

plane-ce makeplane 1.8.4

2 of the 11 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
library/postgres:15.7-alpine468d34fefd63
stdlib@go1.18.2
1.25.13
pgsty/minio:RELEASE.2026-08-04T00-00-00Zb6bfe7239bfc
stdlib@go1.26.5
1.25.13

Open the chart page →

4,212
milvusmilvus-helm5.0.302 of 4See more

milvus milvus-helm 5.0.30

2 of the 4 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
milvusdb/etcd:3.5.25-r1fededb2f2d63
stdlib@go1.24.10
1.25.13
quay.io/minio/minio:RELEASE.2024-12-18T13-15-44Z1dce27c494a1
stdlib@go1.23.4
1.25.13

Open the chart page →

12,749
mssqlmssqlVerified publisher1.10.31 of 1See more

mssql mssql 1.10.3

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/helm-mssql/mssql:1.10.3f923d842bc47
stdlib@go1.23.1
1.25.13

Open the chart page →

926
opa-kube-mgmtopa-kube-mgmtVerified publisher11.0.142 of 2See more

opa-kube-mgmt opa-kube-mgmt 11.0.14

2 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
openpolicyagent/kube-mgmt:11.0.14758ff3fb4727
stdlib@go1.25.0
1.25.13
openpolicyagent/opa:1.19.0852359995443
stdlib@go1.26.5
1.25.13

Open the chart page →

778
redis-operatorot-container-kit0.26.11 of 1See more

redis-operator ot-container-kit 0.26.1

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
quay.io/opstree/redis-operator:v0.26.01c6818e5e505
stdlib@go1.25.12
1.25.13

Open the chart page →

193
outlineoutline0.0.91 of 4See more

outline outline 0.0.9

1 of the 4 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
stdlib@go1.19.4
1.25.13

Open the chart page →

5,289
spirespiffeVerified publisher0.30.24 of 10See more

spire spiffe 0.30.2

4 of the 10 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/spiffe/spiffe-csi-driver:0.2.79dfe4f0caff0
stdlib@go1.24.0
1.25.13
ghcr.io/spiffe/spiffe-helper:0.11.01c92e5998ad3
stdlib@go1.25.3
1.25.13
ghcr.io/spiffe/spire-controller-manager:0.7.0d7b9e710f542
stdlib@go1.26.5
1.25.13
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.15.011f199f6bec4
stdlib@go1.24.6
1.25.13

Open the chart page →

2,635
altinity-clickhouse-operatoraltinity-clickhouse-operator0.27.41 of 3See more

altinity-clickhouse-operator altinity-clickhouse-operator 0.27.4

1 of the 3 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
registry.k8s.io/kubectl:v1.36.36e4fce3c8365
stdlib@go1.26.5
1.25.13

Open the chart page →

240
bytebasebytebase1.1.51 of 1See more

bytebase bytebase 1.1.5

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
bytebase/bytebase:latesta6d845773b60
stdlib@go1.26.5
1.25.13

Open the chart page →

418
cert-manager-csi-drivercert-managerOfficialVerified publisher0.16.03 of 3See more

cert-manager-csi-driver cert-manager 0.16.0

3 of the 3 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-csi-driver:v0.16.09d13db6dc80e
stdlib@go1.26.5
1.25.13
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.17.0f9de845b1701
stdlib@go1.26.3
1.25.13
registry.k8s.io/sig-storage/livenessprobe:v2.19.006da0d5b8908
stdlib@go1.26.3
1.25.13

Open the chart page →

806
ansible-semaphorecloudhippieVerified publisher15.2.121 of 1See more

ansible-semaphore cloudhippie 15.2.12

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
semaphoreui/semaphore:v2.19.1498ad9bc7a2a0
stdlib@go1.25.5
1.25.13

Open the chart page →

1,971
etcdcloudpirates-etcdVerified publisher0.8.81 of 1See more

etcd cloudpirates-etcd 0.8.8

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
gcr.io/etcd-development/etcd:v3.7.1a9983dd6d928
stdlib@go1.26.5
1.25.13

Open the chart page →

232
zookeepercloudpirates-zookeeperVerified publisher0.15.01 of 1See more

zookeeper cloudpirates-zookeeper 0.15.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
library/zookeeper:3.9.57d0f24ebb67b
stdlib@go1.18.1
1.25.13

Open the chart page →

3,994
vertical-pod-autoscalercluster-autoscaler0.13.01 of 4See more

vertical-pod-autoscaler cluster-autoscaler 0.13.0

1 of the 4 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0a7943503b45d
stdlib@go1.21.3
1.25.13

Open the chart page →

1,293
codefreshcodefresh-onpremOfficialVerified publisher2.12.195 of 42See more

codefresh codefresh-onprem 2.12.19

5 of the 42 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
bitnamilegacy/consul:1.21.4-debian-12-r133ae872fc99d
stdlib@go1.25.0
1.25.13
bitnamilegacy/mongodb:7.0.14-debian-12-r321e8f8baa432
stdlib@go1.21.12
1.25.13
bitnamilegacy/nats:2.11.8-debian-12-r0fa0cfba6034a
stdlib@go1.24.6
1.25.13
quay.io/codefresh/dind:3.0.250885ab519dac
stdlib@go1.26.5
1.25.13
quay.io/codefresh/redis:7.4.3-debian-12-r0935f97598255
stdlib@go1.23.8
1.25.13

Open the chart page →

18,437
couchbase-operatorcouchbaseVerified publisher2.93.02 of 2See more

couchbase-operator couchbase 2.93.0

2 of the 2 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
couchbase/admission-controller:2.9.3bf2d2e87e45f
stdlib@go1.26.5
1.25.13
couchbase/operator:2.9.369a385b49e1f
stdlib@go1.26.5
1.25.13

Open the chart page →

980

Container images carrying it

5,349 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

No deployed image carries CVE-2026-56859.

syft 1.42.1 · advisories as of 3 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.