StackRadar

CVE-2026-57585

High

Advisory

Published 19 Jun 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
41st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
273
of 17,781 indexed, latest versions
Container images
274
deployed by those charts
Fix available
1 of 3
affected packages

MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error

Carried by container images the latest versions of 273 of 17,781 indexed charts deploy, on 274 images.

Affected packageAffected versionsFixed inImages
msgpackpypi0.5.6, 0.6.0, 0.6.1, 0.6.2+10 more1.2.1181
python-pipdeb1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+22 moreno fix listed107
python-msgpackdeb1.0.3-1build1, 1.0.3-2+b1, 1.0.3-3build2no fix listed8
OSV records
DEBIAN-CVE-2026-57585GHSA-6v7p-g79w-8964UBUNTU-CVE-2026-57585
Also known as
PYSEC-2026-3625

Charts affected

273 by stars
ChartLatestAffected imagesRadar Score
sdnc-promsmo-helm-chart6.0.01 of 2See more

sdnc-prom smo-helm-chart 6.0.0

1 of the 2 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.2875814cc853d
python-pip@8.1.1-2ubuntu0.4
no fix listed

Open the chart page →

24,776
sdnc-websmo-helm-chart6.0.01 of 3See more

sdnc-web smo-helm-chart 6.0.0

1 of the 3 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.2875814cc853d
python-pip@8.1.1-2ubuntu0.4
no fix listed

Open the chart page →

24,776
ueb-listenersmo-helm-chart6.0.01 of 3See more

ueb-listener smo-helm-chart 6.0.0

1 of the 3 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
oomk8s/readiness-check:2.0.2875814cc853d
python-pip@8.1.1-2ubuntu0.4
no fix listed

Open the chart page →

25,769
cost-analyzersoftonic2.5.51 of 6See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
gcr.io/kubecost1/kubecost-modeling:v0.1.24a2259b098b13
msgpack@1.1.0
1.2.1

Open the chart page →

7,901
testing-multitoolsomeblackmagic0.1.21 of 1See more

testing-multitool someblackmagic 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
someblackmagic/k8s-testing-multitool:v0.1.06eca64b6b440
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

30,687
downscalersqream-chartsVerified publisher1.0.01 of 1See more

downscaler sqream-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.05d328c003efe
msgpack@1.0.4
1.2.1

Open the chart page →

1,009
sn-platform-slimstreamnative1.11.441 of 6See more

sn-platform-slim streamnative 1.11.44

1 of the 6 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
streamnative/apache-pulsar-grafana-dashboard-k8s:0.1.20e6d7aa3ef32
python-pip@20.0.2-5ubuntu1.10
no fix listed

Open the chart page →

10,134
icinga2svtech-public-helm-charts1.0.01 of 4See more

icinga2 svtech-public-helm-charts 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
svtechnmaa/svtech_icinga2:v1.1.667be2aba9436
msgpack@1.0.5
1.2.1

Open the chart page →

5,511
rundecksvtech-public-helm-charts1.0.01 of 2See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
msgpack@1.0.4
1.2.1

Open the chart page →

18,756
rundeck-option-providersvtech-public-helm-charts1.0.01 of 2See more

rundeck-option-provider svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
svtechnmaa/svtech_rundeck_option_provider:v1.1.1674fad30a51f
msgpack@1.0.5
1.2.1

Open the chart page →

1,428
tensor_apptensor-app0.2.21 of 3See more

tensor_app tensor-app 0.2.2

1 of the 3 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
xeladock/mysql_dns:latest4baf531453f1
python-pip@22.0.2+dfsg-1
no fix listed

Open the chart page →

17,461
synapsetranhailongVerified publisher0.1.01 of 2See more

synapse tranhailong 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.78.0def97fd537d8
msgpack@1.0.4
1.2.1

Open the chart page →

3,164
unmanicvhdirkVerified publisher0.1.41 of 1See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
josh5/unmanic:0.2.64d49c4816260
python-pip@22.0.2+dfsg-1ubuntu0.4
no fix listed

Open the chart page →

9,347
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed

Open the chart page →

4,305
twenty-crmvictorlane0.0.11 of 3See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
twentycrm/twenty-postgres-spilo:latest2f78405a78be
msgpack@1.0.3
python-msgpack@1.0.3-1build1
1.2.1
no fix listed

Open the chart page →

13,459
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
python-pip@24.0+dfsg-1ubuntu1.2
no fix listed

Open the chart page →

7,628
kongwallarmVerified publisher4.6.32 of 7See more

kong wallarm 4.6.3

2 of the 7 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
wallarm/ingress-collectd:4.6.0-1fcfa8ba405bd
msgpack@1.0.0
1.2.1
wallarm/ingress-python:4.6.0-15cb2ae08b40f
msgpack@0.5.6
1.2.1

Open the chart page →

11,405
kong-previewwallarmVerified publisher4.2.31 of 5See more

kong-preview wallarm 4.2.3

1 of the 5 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
wallarm/ingress-collectd:4.2.1-124dc4ca1ee1b
msgpack@1.0.0
1.2.1

Open the chart page →

2,905
wallarm-node-nextwallarmVerified publisher0.5.31 of 2See more

wallarm-node-next wallarm 0.5.3

1 of the 2 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
wallarm/node-helpers:5.0.2-1097cadc42336
msgpack@1.0.3
1.2.1

Open the chart page →

2,408
wallarm-oobwallarmVerified publisher0.23.01 of 3See more

wallarm-oob wallarm 0.23.0

1 of the 3 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
wallarm/node-helpers:6.10.1aecd88b24c51
msgpack@1.0.8
1.2.1

Open the chart page →

2,824
supersetwbstack0.1.01 of 1See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
apache/superset:4.0.1ab9467fd712c
msgpack@1.0.2
1.2.1

Open the chart page →

7,085
ambassadorwenerme6.9.51 of 2See more

ambassador wenerme 6.9.5

1 of the 2 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
msgpack@1.0.0
1.2.1

Open the chart page →

4,086
powerdnsadminwitcom-gmbh0.3.41 of 1See more

powerdnsadmin witcom-gmbh 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-57585.

Container imageDigestPackageFixed in
ngoduykhanh/powerdns-admin:v0.2.4ba36ab196d3d
msgpack@1.0.2
1.2.1

Open the chart page →

2,643

Container images carrying it

274 by charts deploying them

A fixed version is listed for 1 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
oomk8s/readiness-check:2.0.2875814cc853d
python-pip@8.1.1-2ubuntu0.4
no fix listed
11
oomk8s/readiness-check:2.0.07daa08b81954
python-pip@8.1.1-2ubuntu0.4
no fix listed
6
apache/superset:6.1.0:latest16b50bbef664
msgpack@1.0.8
1.2.1
3
cloudve/cloudlaunch-server:latest4a3d7fae90bb
msgpack@1.0.2
python-pip@20.0.2-5ubuntu1.6
1.2.1
no fix listed
3
dpage/pgadmin4:6.12781369df9994
msgpack@1.0.2
1.2.1
3
quay.io/devtron/ai-agent:0.0.16545dac92173
msgpack@1.1.0
1.2.1
3
amancevice/superset:0.35.212a0a9e66550
msgpack@0.6.1
1.2.1
2
datawire/aes:1.14.48588eafe6862
msgpack@1.0.0
1.2.1
2
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
msgpack@1.0.5
1.2.1
2
hjacobs/kube-ops-view:20.4.058221b57d4d2
msgpack@1.0.0
1.2.1
2
homebridge/homebridge:latest77c685a40911
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed
2
locustio/locust:2.32.2a0d4b88e42c1
msgpack@1.1.0
1.2.1
2
memgraph/memgraph:3.13.0a1dc375774ed
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed
2
ngoduykhanh/powerdns-admin:v0.2.4ba36ab196d3d
msgpack@1.0.2
1.2.1
2
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
msgpack@0.5.6
python-pip@8.1.1-2ubuntu0.4
1.2.1
no fix listed
2
opendatacube/ows:latest668cbb41473c
msgpack@1.1.0
1.2.1
2
smartedge/generic-multi-access-network-virtualization:1.04cd63c22ce36
python-pip@20.0.2-5ubuntu1.6
no fix listed
2
streamnative/apache-pulsar-grafana-dashboard-k8s:0.1.20e6d7aa3ef32
python-pip@20.0.2-5ubuntu1.10
no fix listed
2
tzahi12345/youtubedl-material:4.3.2:latest2f943d584711
python-pip@22.0.2+dfsg-1ubuntu0.2
no fix listed
2
ghcr.io/browserless/chromium:v2.56.7b1ba7b054af2
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed
2
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
msgpack@1.1.2
1.2.1
2
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
msgpack@1.1.0
1.2.1
2
a10networks/acos-prometheus-exporter:latest8dc58d434d71
python-pip@9.0.1-2.3~ubuntu1.18.04.1
no fix listed
1
alerta/alerta-web:8.5.04786b9eaa606
msgpack@1.0.2
1.2.1
1
allegroai/clearml-agent-k8s-base:1.24-21772827a01bb5
python-pip@9.0.1-2.3~ubuntu1.18.04.5
no fix listed
1
anchore/anchore-engine:v0.10.0bde9eedf639d
msgpack@1.0.2
1.2.1
1
anchore/anchore-engine:v0.7.1ed9b3badd17c
msgpack@1.0.0
1.2.1
1
andrewgolikov55/intel-gpu-exporter:latestfcc001b61c0e
python-pip@22.0.2+dfsg-1ubuntu0.3
no fix listed
1
apachepulsar/pulsar:3.1.016f9fdab3fa6
python-pip@22.0.2+dfsg-1ubuntu0.3
no fix listed
1
apachepulsar/pulsar:2.10.03b262ab7a7d9
python-pip@20.0.2-5ubuntu1.6
no fix listed
1
apachepulsar/pulsar:3.0.79c9947de139d
python-pip@22.0.2+dfsg-1ubuntu0.4
no fix listed
1
apache/ranger:2.7.076c176e8a0e4
python-pip@22.0.2+dfsg-1ubuntu0.6
no fix listed
1
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
msgpack@1.0.2
1.2.1
1
apache/superset:4.0.1ab9467fd712c
msgpack@1.0.2
1.2.1
1
archivebox/archivebox:0.7.41a5a37331091
msgpack@1.0.3
python-msgpack@1.0.3-2+b1
1.2.1
no fix listed
1
arunvelsriram/utils:latest655ad18fd8d6
python-pip@24.0+dfsg-1ubuntu1.2
no fix listed
1
assistiot/open_api_backend:1.1.230812ba93555
python-pip@22.0.2+dfsg-1ubuntu0.4
no fix listed
1
assistiot/video_augmentation:runner-cpu-lateste5ae539ce2cb
python-pip@20.0.2-5ubuntu1.8
no fix listed
1
baserow/backend:1.31.1e0b3c8130b91
msgpack@1.0.8
1.2.1
1
baserow/baserow:1.30.1df0c42eb67e8
msgpack@1.0.8
1.2.1
1
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
msgpack@1.1.2
1.2.1
1
bicarus/elrond-rosetta:v1.3.50.0b1dab0721e1c
python-pip@20.0.2-5ubuntu1.6
no fix listed
1
blakeblackshear/frigate:0.10.0-amd64ae269270ad9e
python-pip@20.0.2-5ubuntu1.6
no fix listed
1
bmeares/meerschaum:2.8.48e9c5bacaa82
msgpack@1.1.0
1.2.1
1
camerahub/camerahub:0.36.23a5af37dd6e1b
msgpack@1.0.5
1.2.1
1
camptocamp/bucket-cloner:latestacfafc308d88
msgpack@1.0.2
1.2.1
1
camptocamp/pghoard:10bff736b15623
msgpack@0.5.6
1.2.1
1
cdignam/kodiak:v0.54.05a6a55b39cee
msgpack@1.0.4
1.2.1
1
citizenstig/httpbin:latestb81c818ccb86
python-pip@8.1.1-2ubuntu0.4
no fix listed
1
ckan/ckan-base-datapusher:0.0.2184d11924549f
msgpack@1.0.2
1.2.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.