StackRadar

CVE-2026-57585

High

Advisory

Published 19 Jun 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
41st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
273
of 17,781 indexed, latest versions
Container images
274
deployed by those charts
Fix available
1 of 3
affected packages

MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error

Carried by container images the latest versions of 273 of 17,781 indexed charts deploy, on 274 images.

Affected packageAffected versionsFixed inImages
msgpackpypi0.5.6, 0.6.0, 0.6.1, 0.6.2+10 more1.2.1181
python-pipdeb1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+22 moreno fix listed107
python-msgpackdeb1.0.3-1build1, 1.0.3-2+b1, 1.0.3-3build2no fix listed8
OSV records
DEBIAN-CVE-2026-57585GHSA-6v7p-g79w-8964UBUNTU-CVE-2026-57585
Also known as
PYSEC-2026-3625

Charts affected

273 by stars
ChartLatestAffected imagesRadar Score
sickchillbryanalves0.3.01 of 1See more

sickchill bryanalves 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
msgpack@1.0.0
1.2.1

Open the chart page →

2,504
camerahubcamerahub0.10.211 of 2See more

camerahub camerahub 0.10.21

1 of the 2 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
camerahub/camerahub:0.36.23a5af37dd6e1b
msgpack@1.0.5
1.2.1

Open the chart page →

2,507
bucket-clonercamptocamp31.0.41 of 1See more

bucket-cloner camptocamp3 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
camptocamp/bucket-cloner:latestacfafc308d88
msgpack@1.0.2
1.2.1

Open the chart page →

4,518
pghoardcamptocamp35.8.11 of 1See more

pghoard camptocamp3 5.8.1

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
camptocamp/pghoard:10bff736b15623
msgpack@0.5.6
1.2.1

Open the chart page →

2,813
kube-ops-viewchristianhuthVerified publisher8.3.31 of 1See more

kube-ops-view christianhuth 8.3.3

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
hjacobs/kube-ops-view:23.5.0a4fae38f93d7
msgpack@1.0.5
1.2.1

Open the chart page →

1,227
kube-acp-stackcloudentity2.28.01 of 7See more

kube-acp-stack cloudentity 2.28.0

1 of the 7 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
python-pip@22.0.2+dfsg-1ubuntu0.5
no fix listed

Open the chart page →

20,900
daskcloudnativeapp2.2.12 of 2See more

dask cloudnativeapp 2.2.1

2 of the 2 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
daskdev/dask:1.1.04ecd7bc35500
msgpack@0.6.0
1.2.1
daskdev/dask-notebook:1.1.0052630f5ca04
msgpack@0.6.0
1.2.1

Open the chart page →

29,901
locustcloudnativeapp1.0.01 of 1See more

locust cloudnativeapp 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
greenbirdit/locust:0.9.0e99d53bdc944
msgpack@0.6.0
1.2.1

Open the chart page →

1,352
webpagetest-agentcloudnativeapp0.2.01 of 1See more

webpagetest-agent cloudnativeapp 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
python-pip@8.1.1-2ubuntu0.4
no fix listed

Open the chart page →

77,758
ibm-toolkit-installcloud-native-toolkit0.3.01 of 1See more

ibm-toolkit-install cloud-native-toolkit 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
msgpack@1.0.2
1.2.1

Open the chart page →

6,695
cloudlaunchcloudve0.6.01 of 5See more

cloudlaunch cloudve 0.6.0

1 of the 5 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
msgpack@1.0.2
python-pip@20.0.2-5ubuntu1.6
1.2.1
no fix listed

Open the chart page →

12,457
cloudlaunch-servercloudve0.2.01 of 5See more

cloudlaunch-server cloudve 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
msgpack@1.0.2
python-pip@20.0.2-5ubuntu1.6
1.2.1
no fix listed

Open the chart page →

12,131
cloudlaunchservercloudve0.6.01 of 4See more

cloudlaunchserver cloudve 0.6.0

1 of the 4 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
msgpack@1.0.2
python-pip@20.0.2-5ubuntu1.6
1.2.1
no fix listed

Open the chart page →

11,592
galaxycloudve6.8.61 of 3See more

galaxy cloudve 6.8.6

1 of the 3 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
msgpack@1.1.2
1.2.1

Open the chart page →

4,601
galaxykubemancloudve2.10.11 of 7See more

galaxykubeman cloudve 2.10.1

1 of the 7 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
galaxy/cloudman-server:lateste5c265fe9fcd
msgpack@1.0.4
python-pip@20.0.2-5ubuntu1.6
1.2.1
no fix listed

Open the chart page →

16,069
galaxy-stablecloudve2.0.02 of 5See more

galaxy-stable cloudve 2.0.0

2 of the 5 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
galaxy/galaxy-init:v18.010267bad550e6
python-pip@1.5.4-1ubuntu4
no fix listed
galaxy/galaxy-stable:v18.018e577a626dfd
python-pip@1.5.4-1ubuntu4
no fix listed

Open the chart page →

70,895
janisterminalcloudve0.1.01 of 2See more

janisterminal cloudve 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
cloudve/janis-terminal:latestaf56e77ca587
python-pip@9.0.1-2.3~ubuntu1.18.04.1
no fix listed

Open the chart page →

14,270
authentikcluster-deploy0.2.01 of 1See more

authentik cluster-deploy 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
msgpack@1.1.2
1.2.1

Open the chart page →

2,481
codehubcodehubVerified publisher6.2.181 of 5See more

codehub codehub 6.2.18

1 of the 5 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
jupyterhub/jupyterhub:5.4.63974ba945e65
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed

Open the chart page →

13,220
csghubcsghubVerified publisher2.4.31 of 34See more

csghub csghub 2.4.3

1 of the 34 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
msgpack@1.1.1
1.2.1

Open the chart page →

58,897
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
msgpack@1.0.7
1.2.1

Open the chart page →

6,179
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
msgpack@1.1.2
1.2.1

Open the chart page →

5,062
datacubedatacube-charts0.18.21 of 1See more

datacube datacube-charts 0.18.2

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
opendatacube/wms:latest1b90cdf68831
python-pip@9.0.1-2.3~ubuntu1
no fix listed

Open the chart page →

27,728
datacube-datadatacube-charts0.2.61 of 1See more

datacube-data datacube-charts 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
geoscienceaustralia/dea-k8s-data:latestf4039b45572a
msgpack@1.0.0
python-pip@9.0.1-2.3~ubuntu1.18.04.2
1.2.1
no fix listed

Open the chart page →

18,863
datacube-indexdatacube-charts0.4.41 of 2See more

datacube-index datacube-charts 0.4.4

1 of the 2 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
opendatacube/ows:latest668cbb41473c
msgpack@1.1.0
1.2.1

Open the chart page →

6,123
datacube-owsdatacube-charts0.20.11 of 1See more

datacube-ows datacube-charts 0.20.1

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
opendatacube/ows:latest668cbb41473c
msgpack@1.1.0
1.2.1

Open the chart page →

5,974
datacube-processingdatacube-charts0.1.11 of 2See more

datacube-processing datacube-charts 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
opendatacube/pipelines:wofs-1.225d810e8504b8
python-pip@9.0.1-2.3~ubuntu1
no fix listed

Open the chart page →

22,405
datacube-wpsdatacube-charts0.9.01 of 1See more

datacube-wps datacube-charts 0.9.0

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
opendatacube/wps:latest80df355a660b
msgpack@1.1.0
1.2.1

Open the chart page →

6,172
restcubedatacube-charts0.2.91 of 1See more

restcube datacube-charts 0.2.9

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
opendatacube/restcube:latest91870111837c
python-pip@9.0.1-2.3~ubuntu1
no fix listed

Open the chart page →

24,335
kube-web-viewdecayofmind0.0.41 of 1See more

kube-web-view decayofmind 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
hjacobs/kube-web-view:20.10.0b44a9cf81a2f
msgpack@1.0.0
1.2.1

Open the chart page →

2,264
intel-gpu-exporterdefault-ghVerified publisher0.1.01 of 1See more

intel-gpu-exporter default-gh 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
andrewgolikov55/intel-gpu-exporter:latestfcc001b61c0e
python-pip@22.0.2+dfsg-1ubuntu0.3
no fix listed

Open the chart page →

4,798
supersetdeliveryheroVerified publisher1.1.31 of 1See more

superset deliveryhero 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
apache/superset:latest16b50bbef664
msgpack@1.0.8
1.2.1

Open the chart page →

2,305
deployhubdeployhubVerified publisher10.0.4157 of 11See more

deployhub deployhub 10.0.415

7 of the 11 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
msgpack@1.1.2
1.2.1
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
msgpack@1.1.2
1.2.1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
msgpack@1.1.2
1.2.1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
msgpack@1.1.2
1.2.1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
msgpack@1.1.2
1.2.1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
msgpack@1.1.2
1.2.1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
msgpack@1.1.2
1.2.1

Open the chart page →

11,160
seafilederp3.2.01 of 1See more

seafile derp 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:10.0.170628f29c663
python-pip@20.0.2-5ubuntu1.9
no fix listed

Open the chart page →

14,856
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
msgpack@1.1.0
1.2.1

Open the chart page →

9,607
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
msgpack@1.1.0
1.2.1

Open the chart page →

9,607
difydify1.0.02 of 4See more

dify dify 1.0.0

2 of the 4 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
msgpack@1.1.0
1.2.1
langgenius/dify-plugin-daemon:main-localda995c129e2f
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed

Open the chart page →

19,224
autonodelabeldjjudas21Verified publisher0.0.101 of 1See more

autonodelabel djjudas21 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
djjudas21/autonodelabel:0.0.6f17233350c4f
msgpack@1.0.5
1.2.1

Open the chart page →

1,304
seafileeleksbai0.1.11 of 3See more

seafile eleksbai 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:9.0.106693911bcc40
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

25,122
flywayeosc-lot-1Verified publisher0.7.01 of 3See more

flyway eosc-lot-1 0.7.0

1 of the 3 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
flyway/flyway:9.1545b5d7cdc75a
python-pip@20.0.2-5ubuntu1.8
no fix listed

Open the chart page →

9,334
huntingfactlyVerified publisher0.4.141 of 1See more

hunting factly 0.4.14

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
msgpack@1.0.4
1.2.1

Open the chart page →

4,085
kodiakfikaworks1.1.41 of 2See more

kodiak fikaworks 1.1.4

1 of the 2 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
cdignam/kodiak:v0.54.05a6a55b39cee
msgpack@1.0.4
1.2.1

Open the chart page →

3,892
business-api-ecosystemfiware1.1.01 of 4See more

business-api-ecosystem fiware 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
python-pip@20.0.2-5ubuntu1.11
no fix listed

Open the chart page →

64,489
kube-ops-viewfluent-operatorVerified publisher0.1.21 of 1See more

kube-ops-view fluent-operator 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
hjacobs/kube-ops-view:20.4.058221b57d4d2
msgpack@1.0.0
1.2.1

Open the chart page →

1,848
flyteconnectorflyte2.0.01 of 1See more

flyteconnector flyte 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
msgpack@1.1.2
1.2.1

Open the chart page →

3,463
powerdnsfsdrw080.1.31 of 4See more

powerdns fsdrw08 0.1.3

1 of the 4 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
ngoduykhanh/powerdns-admin:latest9898a7cf37d2
msgpack@1.0.2
1.2.1

Open the chart page →

1,958
borgmaticgabe565Verified publisher0.10.11 of 1See more

borgmatic gabe565 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
ghcr.io/borgmatic-collective/borgmatic:1.9.9835b72878606
msgpack@1.1.0
1.2.1

Open the chart page →

2,438
babybuddygeek-cookbookVerified publisher1.2.21 of 1See more

babybuddy geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
linuxserver/babybuddy:1.10.2f7d7c7704249
msgpack@1.0.2
1.2.1

Open the chart page →

1,489
mylargeek-cookbookVerified publisher4.4.21 of 1See more

mylar geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/mylar3:version-v0.5.3b96f0e97ab3f
msgpack@1.0.2
1.2.1

Open the chart page →

1,423
openemrgeek-cookbookVerified publisher5.2.01 of 1See more

openemr geek-cookbook 5.2.0

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
openemr/openemr:6.1.089eaa6d9a4e3
msgpack@1.0.2
1.2.1

Open the chart page →

8,392

Container images carrying it

274 by charts deploying them

A fixed version is listed for 1 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
msgpack@1.1.1
1.2.1
1
ghcr.io/paperless-ngx/paperless-ngx:1.8.09bbc9a90641e
msgpack@1.0.4
1.2.1
1
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
msgpack@1.0.7
1.2.1
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
msgpack@1.1.1
1.2.1
1
ghcr.io/skyoo2003/digdag:0.0.1821fd6a6f2cd
msgpack@1.0.2
1.2.1
1
ghcr.io/smarter-project/audio-client:v3.1.23c8375dc5487
python-pip@20.0.2-5ubuntu1.6
no fix listed
1
ghcr.io/smarter-project/image-detector:v2.5.31dcca70c6446
python-pip@20.0.2-5ubuntu1.6
no fix listed
1
ghcr.io/squent/kuma-ingress-watcher:1.7.014d45b2a1f00
msgpack@1.1.0
1.2.1
1
ghcr.io/zazukoians/qlever-server:v0.10.0f10fd24b2290
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
msgpack@1.1.2
1.2.1
1
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
msgpack@1.1.2
1.2.1
1
quay.io/hpestorage/filex-csi-driver:2.6.4b7f960bbf472
msgpack@1.1.2
1.2.1
1
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
msgpack@1.0.2
1.2.1
1
quay.io/opsmxpublic/awsgit:v2-openssh0d21ba756f44
msgpack@1.0.2
1.2.1
1
quay.io/opsmxpublic/awsgit:v3-js15a6faada3d4
msgpack@1.0.2
1.2.1
1
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
msgpack@1.1.2
1.2.1
1
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
msgpack@1.1.2
1.2.1
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
msgpack@1.1.2
1.2.1
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
msgpack@1.1.2
1.2.1
1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
msgpack@1.1.2
1.2.1
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
msgpack@1.1.2
1.2.1
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
msgpack@1.1.2
1.2.1
1
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed
1
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
python-pip@20.0.2-5ubuntu1.1
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.