StackRadar

CVE-2026-56859

High

Advisory

Published 13 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,704
of 17,911 indexed, latest versions
Container images
5,369
deployed by those charts
Fix available
1 of 2
affected packages

Add recursion depth guard during decode in encoding/xml

Carried by container images the latest versions of 4,704 of 17,911 indexed charts deploy, on 5,369 images.

Affected packageAffected versionsFixed inImages
golang-1.19deb1.19.8-2no fix listed1
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+193 more1.25.135,369
OSV records
DEBIAN-CVE-2026-56859GO-2026-6088
Also known as
BIT-golang-2026-56859

Charts affected

4,704 by stars
ChartLatestAffected imagesRadar Score
posthogzeet0.23.22 of 9See more

posthog zeet 0.23.2

2 of the 9 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.19.07a85f522c5bc
stdlib@go1.17.13
1.25.13
altinity/metrics-exporter:latest8940ecadae65
stdlib@go1.26.5
1.25.13

Open the chart page →

3,751
endlessh-gozekker6Verified publisher0.4.01 of 1See more

endlessh-go zekker6 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
ghcr.io/shizunge/endlessh-go:2026.0730.08826dad32623
stdlib@go1.26.5
1.25.13

Open the chart page →

525
zookeeper-exporterzookeeper-exporter0.1.01 of 1See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
dabealu/zookeeper-exporter:latest86106fec315f
stdlib@go1.14.15
1.25.13

Open the chart page →

1,249
zoo-project-druzoo-projectOfficialVerified publisher0.10.42 of 6See more

zoo-project-dru zoo-project 0.10.4

2 of the 6 container images this version deploys carry CVE-2026-56859.

Container imageDigestPackageFixed in
library/postgres:18.4-alpine3.249a8afca54e78
stdlib@go1.24.6
1.25.13
zooproject/zoo-project:dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a9a507cb7e2dd
stdlib@go1.26.5
1.25.13

Open the chart page →

8,374

Container images carrying it

5,369 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/prometheus-operator/prometheus-config-reloader:v0.91.07d9e4eea5f11
stdlib@go1.25.9
1.25.13
3
quay.io/prometheus-operator/prometheus-config-reloader:v0.74.0d55631c7a740
stdlib@go1.22.3
1.25.13
3
quay.io/prometheus-operator/prometheus-operator:v0.90.152a6a92d915e
stdlib@go1.25.8
1.25.13
3
quay.io/prometheus-operator/prometheus-operator:v0.74.06b3f6d8b4c0a
stdlib@go1.22.3
1.25.13
3
quay.io/prometheus-operator/prometheus-operator:v0.92.17d9247d23514
stdlib@go1.26.4
1.25.13
3
quay.io/prometheus/prometheus:v2.41.01a3e9a878e50
stdlib@go1.19.4
1.25.13
3
quay.io/prometheus/prometheus:v2.55.0378f4e037035
stdlib@go1.23.2
1.25.13
3
quay.io/prometheus/prometheus:v2.26.038d40a760569
stdlib@go1.16.2
1.25.13
3
quay.io/prometheus/prometheus:v3.10.07571a304e67f
stdlib@go1.26.0
1.25.13
3
quay.io/prometheus/prometheus:v2.31.1a8779cfe553e
stdlib@go1.17.3
1.25.13
3
quay.io/prometheus/prometheus:v2.43.0f5c29683a301
stdlib@go1.19.7
1.25.13
3
quay.io/prometheus/prometheus:v2.54.1f6639335d34a
stdlib@go1.22.6
1.25.13
3
quay.io/prometheus/pushgateway:v1.10.07a4d0696a24e
stdlib@go1.23.1
1.25.13
3
quay.io/prometheus/pushgateway:v1.8.0c159e946abf4
stdlib@go1.22.1
1.25.13
3
quay.io/prometheus/snmp-exporter:v0.30.1e5fd5e8b43ac
stdlib@go1.25.5
1.25.13
3
quay.io/redhat-cop/kube-rbac-proxy:v0.11.0c68135620167
stdlib@go1.15.15
1.25.13
3
quay.io/sighup/permission-manager:v1.7.1-rc1f5e6a5dcee33
stdlib@go1.16.8
1.25.13
3
registry.k8s.io/autoscaling/vpa-admission-controller:1.7.1be29624f7f12
stdlib@go1.26.5
1.25.13
3
registry.k8s.io/autoscaling/vpa-recommender:1.7.189cea705535f
stdlib@go1.26.5
1.25.13
3
registry.k8s.io/autoscaling/vpa-updater:1.7.1feb42a526970
stdlib@go1.26.5
1.25.13
3
registry.k8s.io/ingress-nginx/controller:v1.5.14ba73c697770
stdlib@go1.19.2
1.25.13
3
registry.k8s.io/ingress-nginx/controller:v1.8.1e5c4824e7375
stdlib@go1.20.5
1.25.13
3
registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.136d05b4077fb
stdlib@go1.22.2
1.25.13
3
registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.2e8825994b7a2
stdlib@go1.24.1
1.25.13
3
registry.k8s.io/kubectl:v1.31.099b37df34bc4
stdlib@go1.22.5
1.25.13
3
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.02bbc91556733
stdlib@go1.24.6
1.25.13
3
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.06b2f0b6f2f86
stdlib@go1.26.2
1.25.13
3
registry.k8s.io/sig-storage/csi-attacher:v4.3.04eb73137b663
stdlib@go1.20.3
1.25.13
3
registry.k8s.io/sig-storage/csi-attacher:v4.8.0a399393ff5bd
stdlib@go1.23.1
1.25.13
3
registry.k8s.io/sig-storage/csi-attacher:v4.11.0b74b05b39501
stdlib@go1.25.7
1.25.13
3
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.12.00d23a6fd60c4
stdlib@go1.22.5
1.25.13
3
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.14.05244abbe87e0
stdlib@go1.24.2
1.25.13
3
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.10.1f25af73ee708
stdlib@go1.21.5
1.25.13
3
registry.k8s.io/sig-storage/csi-provisioner:v6.2.06be9f63ca4ca
stdlib@go1.25.7
1.25.13
3
registry.k8s.io/sig-storage/csi-provisioner:v5.2.0d5e46da8aff7
stdlib@go1.23.1
1.25.13
3
registry.k8s.io/sig-storage/csi-resizer:v1.13.12a0b297cc7c4
stdlib@go1.23.1
1.25.13
3
registry.k8s.io/sig-storage/csi-resizer:v1.8.02e2b44393539
stdlib@go1.20.3
1.25.13
3
registry.k8s.io/sig-storage/csi-resizer:v1.13.28ddd178ba5d0
stdlib@go1.23.1
1.25.13
3
registry.k8s.io/sig-storage/csi-resizer:v1.9.0f1f352df9787
stdlib@go1.20.5
1.25.13
3
registry.k8s.io/sig-storage/csi-snapshotter:v8.4.0c7e0a3718832
stdlib@go1.24.6
1.25.13
3
registry.k8s.io/sig-storage/csi-snapshotter:v8.5.0da081c27e8a6
stdlib@go1.25.7
1.25.13
3
registry.k8s.io/sig-storage/livenessprobe:v2.10.04dc0b87ccd69
stdlib@go1.20.3
1.25.13
3
registry.k8s.io/sig-storage/livenessprobe:v2.17.09b75b9ade162
stdlib@go1.24.6
1.25.13
3
registry.k8s.io/sig-storage/nfs-provisioner:v4.0.8c825f3d5e28b
stdlib@go1.16.2
1.25.13
3
1password/scim:v2.3.129d0c6cb67eb
stdlib@go1.16.8
1.25.13
2
abutaha/aws-es-proxy:v1.1190ed2d1dfc8
stdlib@go1.14.1
1.25.13
2
alazidis/kube-netlag:1.1.00e8c84152201
stdlib@go1.24.13
1.25.13
2
alpine/k8s:1.32.12048f8d9c8cc7
stdlib@go1.25.7
1.25.13
2
alpine/k8s:1.37.0b421c2e9419e
stdlib@go1.26.5
1.25.13
2
alpine/kubectl:1.35.49ccd82364762
stdlib@go1.25.9
1.25.13
2

syft 1.42.1 · advisories as of 27 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.