CVE-2026-56865
HighAdvisory
Published 13 Aug 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.4
- base score, highest
- EPSS
- 0.001
- 1st percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 453
- of 17,781 indexed, latest versions
- Container images
- 422
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog
Carried by container images the latest versions of 453 of 17,781 indexed charts deploy, on 422 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| golang-1.19deb | 1.19.8-2 | no fix listed | 1 |
| golang.org/ | v0.1.0, v0.2.0, v0.3.0, v0.4.2+38 more | 0.40.0 | 421 |
- OSV records
- DEBIAN-CVE-2026-56865GO-2026-6179
- Also known as
- BIT-golang-2026-56865
Charts affected
453 by stars
Container images carrying it
422 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| quay.io/ | 690c7b525f43 | golang.org/ | 0.40.0 | 8 |
| quay.io/ | e13b6ed5cb92 | golang.org/ | 0.40.0 | 8 |
| ghcr.io/ | 76d28575b71c | golang.org/ | 0.40.0 | 7 |
| quay.io/ | 9ab73a421b65 | golang.org/ | 0.40.0 | 5 |
| rancher/ | 5f6c4dc52a05 | golang.org/ | 0.40.0 | 4 |
| rancher/ | f293af9c635f | golang.org/ | 0.40.0 | 4 |
| rss3/ | 26148aa1bc52 | golang.org/ | 0.40.0 | 4 |
| ghcr.io/ | ab2e1fa19dd4 | golang.org/ | 0.40.0 | 4 |
| quay.io/ | fd4d9a3dd1fd | golang.org/ | 0.40.0 | 4 |
| goharbor/ | 215c07b71c37 | golang.org/ | 0.40.0 | 3 |
| grafana/ | 0dc5a246ab16 | golang.org/ | 0.40.0 | 3 |
| grafana/ | a0f881232a6f | golang.org/ | 0.40.0 | 3 |
| neosmemo/ | 71a5b4738d1b | golang.org/ | 0.40.0 | 3 |
| oryd/ | 2c93beb5e5f2 | golang.org/ | 0.40.0 | 3 |
| prom/ | d5155cfac40a | golang.org/ | 0.40.0 | 3 |
| rss3/ | d1d2ae6efd05 | golang.org/ | 0.40.0 | 3 |
| tykio/ | 0e03b94c153d | golang.org/ | 0.40.0 | 3 |
| tykio/ | 3e907e675bf9 | golang.org/ | 0.40.0 | 3 |
| ghcr.io/ | 0c6994bb4c5a | golang.org/ | 0.40.0 | 3 |
| ghcr.io/ | 8499afd690c4 | golang.org/ | 0.40.0 | 3 |
| ghcr.io/ | 41b0dcd8b258 | golang.org/ | 0.40.0 | 3 |
| quay.io/ | 9795f3f9f031 | golang.org/ | 0.40.0 | 3 |
| quay.io/ | 01d5d8c4cecb | golang.org/ | 0.40.0 | 3 |
| quay.io/ | 98580969b333 | golang.org/ | 0.40.0 | 3 |
| quay.io/ | 361db356b330 | golang.org/ | 0.40.0 | 3 |
| registry.gitlab.com/ | af0325804248 | golang.org/ | 0.40.0 | 3 |
| coredns/ | 9b9128672209 | golang.org/ | 0.40.0 | 2 |
| devopsfaith/ | f8bdaa8a1a43 | golang.org/ | 0.40.0 | 2 |
| grafana/ | 7790f6f7fbd8 | golang.org/ | 0.40.0 | 2 |
| grafana/ | f94b1c82957a | golang.org/ | 0.40.0 | 2 |
| grafana/ | 079600c9517b | golang.org/ | 0.40.0 | 2 |
| grafana/ | 886b56d5534e | golang.org/ | 0.40.0 | 2 |
| grafana/ | d8ea37798ccc | golang.org/ | 0.40.0 | 2 |
| k0sproject/ | f04635825d51 | golang.org/ | 0.40.0 | 2 |
| library/ | 5efed980cba3 | golang.org/ | 0.40.0 | 2 |
| library/ | 6b9cbca6fac4 | golang.org/ | 0.40.0 | 2 |
| library/ | 7d5a6ae66572 | golang.org/ | 0.40.0 | 2 |
| listmonk/ | d2eac77ddfad | golang.org/ | 0.40.0 | 2 |
| listmonk/ | f535d59e1499 | golang.org/ | 0.40.0 | 2 |
| longhornio/ | 83b79f57043f | golang.org/ | 0.40.0 | 2 |
| mattermost/ | b8bd1246cb3a | golang.org/ | 0.40.0 | 2 |
| moby/ | 504731e577c2 | golang.org/ | 0.40.0 | 2 |
| oryd/ | fe2428f103a6 | golang.org/ | 0.40.0 | 2 |
| otel/ | 125bdbeb7590 | golang.org/ | 0.40.0 | 2 |
| rss3/ | dae8a5bdd7a6 | golang.org/ | 0.40.0 | 2 |
| rss3/ | a4059dd32c48 | golang.org/ | 0.40.0 | 2 |
| tkpd/ | 74441dadcfbd | golang.org/ | 0.40.0 | 2 |
| uffizzi/ | 0344805f267b | golang.org/ | 0.40.0 | 2 |
| uselagoon/ | 2c89ed939b8b | golang.org/ | 0.40.0 | 2 |
| ghcr.io/ | 2b8d06650a1b | golang.org/ | 0.40.0 | 2 |