StackRadar

CVE-2026-56859

High

Advisory

Published 13 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,704
of 17,911 indexed, latest versions
Container images
5,369
deployed by those charts
Fix available
1 of 2
affected packages

Add recursion depth guard during decode in encoding/xml

Carried by container images the latest versions of 4,704 of 17,911 indexed charts deploy, on 5,369 images.

Affected packageAffected versionsFixed inImages
golang-1.19deb1.19.8-2no fix listed1
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+193 more1.25.135,369
OSV records
DEBIAN-CVE-2026-56859GO-2026-6088
Also known as
BIT-golang-2026-56859

Charts affected

4,704 by stars
ChartLatestAffected imagesRadar Score
posthogzeet0.23.22 of 9See more

posthog zeet 0.23.2

2 of the 9 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.19.07a85f522c5bc
stdlib@go1.17.13
1.25.13
altinity/metrics-exporter:latest8940ecadae65
stdlib@go1.26.5
1.25.13

Open the chart page →

3,751
endlessh-gozekker6Verified publisher0.4.01 of 1See more

endlessh-go zekker6 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/shizunge/endlessh-go:2026.0730.08826dad32623
stdlib@go1.26.5
1.25.13

Open the chart page →

525
zookeeper-exporterzookeeper-exporter0.1.01 of 1See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
dabealu/zookeeper-exporter:latest86106fec315f
stdlib@go1.14.15
1.25.13

Open the chart page →

1,249
zoo-project-druzoo-projectOfficialVerified publisher0.10.42 of 6See more

zoo-project-dru zoo-project 0.10.4

2 of the 6 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
library/postgres:18.4-alpine3.249a8afca54e78
stdlib@go1.24.6
1.25.13
zooproject/zoo-project:dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a9a507cb7e2dd
stdlib@go1.26.5
1.25.13

Open the chart page →

8,374

Container images carrying it

5,369 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/snapshot-controller:v8.2.09dade8f2f3ab
stdlib@go1.23.1
1.25.13
4
alfhou/hammond:v0.0.24c85dc0293aa1
stdlib@go1.20.6
1.25.13
3
apache/apisix-ingress-controller:2.2.05c5efa4c7f2a
stdlib@go1.26.5
1.25.13
3
argoproj/argocd:v1.8.1830e86cacefd
stdlib@go1.14.12
1.25.13
3
bitnamilegacy/etcd:latest99b408c15272
stdlib@go1.23.10
1.25.13
3
bitnamilegacy/kubectl:latestcd354d5b2556
stdlib@go1.24.5
1.25.13
3
bitnamilegacy/mongodb:6.0.4-debian-11-r10016dce036593
stdlib@go1.17.10
1.25.13
3
bitnamilegacy/os-shell:12-debian-12-r5177e65e9d633e
stdlib@go1.25.0
1.25.13
3
bitnamilegacy/pgpool:4.6.3-debian-12-r0d3bf3910f148
stdlib@go1.25.0
1.25.13
3
bitnamilegacy/valkey-cluster:8.1.3-debian-12-r332869e769b7e
stdlib@go1.24.6
1.25.13
3
caddy/ingress:v0.2.118d1366fc0e9
stdlib@go1.21.4
1.25.13
3
ciscolabs/rtsp-server:latestb59fc10bb821
stdlib@go1.19.2
1.25.13
3
cloudpirates/image-minio:RELEASE.2025-10-15T17-29-55Z-hardened8dc02a7e5093
stdlib@go1.25.7
1.25.13
3
csiplugin/csi-qingcloud:v1.4.00766163dc046
stdlib@go1.19.13
1.25.13
3
datawire/aes:1.14.48588eafe6862
stdlib@go1.15
1.25.13
3
derailed/popeye:v0.22.18e68e22c7663
stdlib@go1.23.5
1.25.13
3
dgraph/dgraph:v21.12.03b55ea83fffe
stdlib@go1.17.3
1.25.13
3
dnationcloud/kubernetes-jsonnet-translator:2.0.178fed4f3c130
stdlib@go1.26.5
1.25.13
3
envoyproxy/gateway:v1.7.5156b7d32c73b
stdlib@go1.26.5
1.25.13
3
ethpandaops/tracoor:latestd8514b9f4c59
stdlib@go1.24.13
1.25.13
3
grafana/grafana:8.2.500568d89c4f8
stdlib@go1.17
1.25.13
3
grafana/grafana:13.1.0121a7a9ece6d
stdlib@go1.25.7
1.25.13
3
grafana/grafana:11.3.0a0f881232a6f
stdlib@go1.23.1
1.25.13
3
grafana/loki:3.6.1144148ad243c0
stdlib@go1.26.2
1.25.13
3
grafana/loki:3.4.258a6c186ce78
stdlib@go1.23.6
1.25.13
3
grafana/loki-canary:3.6.70dac7d5cb383
stdlib@go1.24.13
1.25.13
3
grafana/promtail:2.4.2626900031c4e
stdlib@go1.17.2
1.25.13
3
groundnuty/k8s-wait-for:v2.0c14d7271e401
stdlib@go1.19.3
1.25.13
3
hashicorp/http-echo:1.0.0:latestfcb75f691c8b
stdlib@go1.21.1
1.25.13
3
hashicorp/vault:2.0.45be49781ecf7
stdlib@go1.26.5
1.25.13
3
hashicorp/vault-k8s:1.7.655e27b080c9b
stdlib@go1.26.5
1.25.13
3
jacobalberty/unifi:v10.0.162896c0ab82d33
stdlib@go1.24.6
1.25.13
3
kubegems/kubegems:v1.24.10a730bcf9322a
stdlib@go1.24.10
1.25.13
3
kubernetesui/dashboard-api:1.14.096a702cfd339
stdlib@go1.23.12
1.25.13
3
kubernetesui/dashboard-auth:1.4.053e9917898bf
stdlib@go1.23.12
1.25.13
3
kubernetesui/dashboard-metrics-scraper:1.2.25154b68252bd
stdlib@go1.23.4
1.25.13
3
kubernetesui/dashboard-web:1.7.0cc7c31bd2d84
stdlib@go1.23.9
1.25.13
3
kubespheredev/kube-webhook-certgen:v1.1.123a03c9c381f
stdlib@go1.16.9
1.25.13
3
library/docker:20.10-dind:20-dindaf96c680a7e1
stdlib@go1.19.7
1.25.13
3
library/nats:2.10-alpineb83efabe3e7d
stdlib@go1.24.2
1.25.13
3
library/postgres:14.13162a6ead070
stdlib@go1.16.7
1.25.13
3
library/postgres:15.7-alpine:15.7-alpine3.20468d34fefd63
stdlib@go1.18.2
1.25.13
3
library/postgres:115d2aa4a7b5f9
stdlib@go1.16.7
1.25.13
3
library/postgres:18-alpine:alpine6c538e7206ea
stdlib@go1.24.6
1.25.13
3
library/postgres:16f1c3376c26f2
stdlib@go1.24.6
1.25.13
3
library/registry:3.1.1:latest1be55279f18a
stdlib@go1.25.9
1.25.13
3
library/zookeeper:3.9.57d0f24ebb67b
stdlib@go1.18.1
1.25.13
3
mcp/grafana:latest9362bcf6aa0e
stdlib@go1.26.5
1.25.13
3
meshery/meshery:stable-latest44b64ee128fb
stdlib@go1.26.4
1.25.13
3
mikefarah/yq:2.4.16fc625c402de
stdlib@go1.13.3
1.25.13
3

syft 1.42.1 · advisories as of 27 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.