CVE-2026-5773

High

Advisory

Published 29 Apr 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.006; 48th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,253; of 17,790 indexed, latest versions
Container images: 1,175; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,253 of 17,790 indexed charts deploy, on 1,175 images.

Affected package	Affected versions	Fixed in	Images
curldeb	1:8.14.1-2+deb13u3+e1, 7.47.0-1ubuntu2.2, 7.47.0-1ubuntu2.5, 7.47.0-1ubuntu2.6+85 more	1:8.14.1-2+deb13u3+e2, 7.47.0-1ubuntu2.19+esm17, 7.58.0-2ubuntu3.24+esm10, 7.68.0-1ubuntu2.25+esm5+5 more	1,020
curlapk	8.12.1-r0, 8.17.0-r1, 8.18.0-r0, 8.19.0-r0	8.20.0-r0	155

OSV records: ALPINE-CVE-2026-5773 DEBIAN-CVE-2026-5773 UBUNTU-CVE-2026-5773 ECHO-73da-59b1-befa
Also known as: USN-8227-1, USN-8525-1

Charts affected

1,253 by stars

Chart

Latest

Affected images

Radar Score

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-5773.

Container image	Digest	Package	Fixed in
library/nginx :1.25	a484819eb602	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15

Open the chart page →

7,697

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-5773.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	curl@7.88.1-10+deb12u7	7.88.1-10+deb12u15

Open the chart page →

13,783

language-toolzekker6

1.12.1

1 of 2 See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-5773.

Container image	Digest	Package	Fixed in
erikvl87/languagetool :6.7-dockerupdate-3	e1ea6a975388	curl@8.17.0-r1	8.20.0-r0

Open the chart page →

1,571

Container images carrying it

1,175 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/streamingfast/firehose-ethereum :v2.12.4	89969b78fb07	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.9	1
ghcr.io/streamingfast/firehose-ethereum :v2.14.3	bf816072380e	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.9	1
ghcr.io/streamingfast/firehose-ethereum :v2.12.4-geth	d7bdfa7b41da	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.9	1
ghcr.io/streamingfast/go-ethereum :geth-v1.16.9-fh3.0	8e3cb38953a3	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.9	1
ghcr.io/streamingfast/substreams-sink-kv :v2.3.0	26953ec68d5d	curl@7.68.0-1ubuntu2.24	7.68.0-1ubuntu2.25+esm5	1
ghcr.io/streamingfast/substreams-sink-noop :v1.4.0	d7c43c3135c6	curl@7.68.0-1ubuntu2.24	7.68.0-1ubuntu2.25+esm5	1
ghcr.io/streamvisor/streamvisor :4.1.4	0bc598b2ac9a	curl@8.5.0-2ubuntu10.8	8.5.0-2ubuntu10.9	1
ghcr.io/sudo-kraken/3d-printing-cost-calculators :v1.1.1	220c5e4e1a3d	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	1
ghcr.io/sudo-kraken/authentik-webfinger-proxy :v1.1.1	e1351a977607	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	1
ghcr.io/sudo-kraken/fantasy-dice-chamber :v1.3.2	99fd4cb0f4fe	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	1
ghcr.io/sudo-kraken/finances-tracker :v1.1.1	c73527cde81c	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	1
ghcr.io/sudo-kraken/jf-pushover-webhook :v1.1.0	ee9cf22a39ab	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	1
ghcr.io/theconnman/docker-hub-rss :0.6.2	38eba84b2be8	curl@8.17.0-r1	8.20.0-r0	1
ghcr.io/thoroslives/zilean :v3.10.1	bce6aca0f6ca	curl@8.12.1-r0	8.20.0-r0	1
ghcr.io/turbot/guardrails-agent-kubernetes :0.3.0	9d01bf9c9224	curl@8.5.0-2ubuntu10.5	8.5.0-2ubuntu10.9	1
ghcr.io/umami-software/umami :3.0.3	28f263fe06f7	curl@8.17.0-r1	8.20.0-r0	1
ghcr.io/umami-software/umami :postgresql-v2.20.1	73ca19b41745	curl@8.17.0-r1	8.20.0-r0	1
ghcr.io/umami-software/umami :3.1.0	e3f80c0625aa	curl@8.17.0-r1	8.20.0-r0	1
ghcr.io/voxpupuli/container-puppetdb :7.18.0-v1.5.0	a56dfe91f5b1	curl@7.81.0-1ubuntu1.16	7.81.0-1ubuntu1.24	1
ghcr.io/voxpupuli/container-puppetserver :7.17.0-v1.5.0	916746209ac5	curl@7.81.0-1ubuntu1.16	7.81.0-1ubuntu1.24	1
ghcr.io/voxpupuli/puppetserver :8.7.0-main	63873f3f698e	curl@7.81.0-1ubuntu1.20	7.81.0-1ubuntu1.24	1
ghcr.io/vshn/haproxy-with-mysql :1.0.0	a3c27ee3fb2f	curl@7.88.1-10+deb12u1	7.88.1-10+deb12u15	1
ghcr.io/wgbh-mla/pbcore-util :pr-6	6e04659a3baa	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	1
ghcr.io/wiremind/bitnami/keycloak :26.5.0-debian-12-r3	8622ea9e43c0	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	1
ghcr.io/wiremind/bitnami/rabbitmq :4.2.2-debian-12-r1	1572e12bc93c	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	1
ghcr.io/wiremind/grafana-pdf-exporter :v1.7	dbaa8527bf4c	curl@7.88.1-10+deb12u4	7.88.1-10+deb12u15	1
ghcr.io/wizarrrr/wizarr :4.2.0-beta.3	d19d886d5090	curl@7.88.1-10+deb12u6	7.88.1-10+deb12u15	1
ghcr.io/wmde/wbaas-backup :v0.1.7	8e6a9516eac0	curl@7.58.0-2ubuntu3.18	7.58.0-2ubuntu3.24+esm10	1
ghcr.io/wolveix/satisfactory-server :v1.9.10	e0f2f8c97598	curl@7.81.0-1ubuntu1.20	7.81.0-1ubuntu1.24	1
ghcr.io/wundergraph/cosmo/otelcollector :0.18.1	5a6fe78d4d15	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	1
ghcr.io/yurymkomarov/docker/kubernetes-kiosk-chromium :0.1.2	7bff29dcec72	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	1
ghcr.io/zoriya/kyoo_autosync :4.7.1	fbba58ddb1a6	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	1
ghcr.io/zoriya/kyoo_back :4.7.1	416e980f76a6	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	1
ghcr.io/zoriya/kyoo_scanner :4.7.1	7dc0ee57b628	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	1
public.ecr.aws/aktosecurity/akto-api-security-testing-db-layer :1.74.4_local	1ed844ecab29	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.9	1
public.ecr.aws/groundcovercom/grafana-groundcover :v0.0.54-grafana11.3.7	ee9d973e3952	curl@7.81.0-1ubuntu1.20	7.81.0-1ubuntu1.24	1
public.ecr.aws/groundcovercom/temporalio/admin-tools :1.29.7-20260730-1	af8cea3b8538	curl@1:8.14.1-2+deb13u3+e1	1:8.14.1-2+deb13u3+e2	1
public.ecr.aws/jtekt-corporation/image-storage-service :v1.16.17	b1493760c716	curl@7.88.1-10+deb12u7	7.88.1-10+deb12u15	1
public.ecr.aws/jtekt-corporation/image-storage-service-gui :v1.9.4	34823c8abe00	curl@7.88.1-10+deb12u7	7.88.1-10+deb12u15	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15	1
public.ecr.aws/jtekt-corporation/shinsei-manager-front :v1.5.5	f8fb4eea4071	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15	1
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	curl@7.88.1-10+deb12u4	7.88.1-10+deb12u15	1
public.ecr.aws/k2x0t8t6/kubeadapt/app/kubeadapt-k8s-pulse :v3.0.1	dc5a516c2333	curl@7.88.1-10+deb12u14	7.88.1-10+deb12u15	1
public.ecr.aws/outerbounds/metaflow_metadata_service :v2.4.13	f7567ce3419d	curl@7.88.1-10+deb12u8	7.88.1-10+deb12u15	1
public.ecr.aws/spotinst/spot-network-client :1.0.14	86380a01587d	curl@8.5.0-2ubuntu10.6	8.5.0-2ubuntu10.9	1
public.ecr.aws/spotinst/spot-network-client :1.0.0-8-lb_endpoint-d0ec127	efcecf98b912	curl@7.58.0-2ubuntu3.19	7.58.0-2ubuntu3.24+esm10	1
public.ecr.aws/supportpal/helpdesk-monolithic :4.0.4	573779e57fae	curl@7.68.0-1ubuntu2.5	7.68.0-1ubuntu2.25+esm5	1
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	curl@7.88.1-10+deb12u5	7.88.1-10+deb12u15	1
quay.io/aerokube/keygen :1.0.1	578934444f04	curl@7.81.0-1ubuntu1.16	7.81.0-1ubuntu1.24	1
quay.io/argoproj/argocd :v2.4.11	5b6701d8fb31	curl@7.81.0-1ubuntu1.3	7.81.0-1ubuntu1.24	1