CVE-2026-63209
UnscoredAdvisory
Published 27 Jul 2026In the index since 30 Sept 2026
- Severity
- Unscored
- worst across findings
- CVSS
- —
- base score, highest
- EPSS
- 0.004
- 28th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 1,318
- of 17,966 indexed, latest versions
- Container images
- 1,377
- deployed by those charts
- Fix available
- 1 of 1
- affected package
OOB read in github.com/klauspost/compress/s2
Carried by container images the latest versions of 1,318 of 17,966 indexed charts deploy, on 1,377 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| github.com/ | v1.16.0, v1.16.3, v1.16.5, v1.16.6+20 more | 1.18.7 | 1,377 |
- OSV records
- GO-2026-5841
- Also known as
- GHSA-259r-337f-4rfw
Charts affected
1,318 by stars
Container images carrying it
1,377 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 761d96bf2d9c | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 7444eb2107f6 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 46a16edcb62e | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 5523ff02e511 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 8849703f0ff8 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | c9438109f23d | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 3c995dc8a59f | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | df6b11907d33 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 7bfe1c07bd9b | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 735dd5d2709d | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | ec36422b09af | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 42574f512837 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 4e2a3cce7ce8 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 9518de37eed5 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | e93dfe7454d4 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | e24894e32cbc | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | f70e33e17161 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 3feb9da85270 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 71ba8d272db1 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | c6fe64c7bfcd | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 8617f0a7f703 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 0087cb49616f | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | b5ade0d9cc6b | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 6bf945565865 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 0cca6760763a | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 560a16a56d4e | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 00b48beff3ae | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 6226040e1346 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 06ed5db6cd33 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | b914032ef9ad | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | a61c7022abcf | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 832a32779e6d | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 63f7eaf5aa8a | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | c62e3347611c | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 89028adefcff | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | e1fdac6133ad | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 528f2174fa2f | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 42e1b6862913 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | b3256cbc7b68 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 73cbeb990cf4 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 5dfa86b6451f | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 90097a08b87c | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | b69bcdaa8492 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 84f70425f4dd | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 45e744fc623f | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 9bc88940affc | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | b065ec5a5239 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | df917c5a7e54 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | cb76395b84eb | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 8e3869d31c70 | github.com/ | 1.18.7 | 1 |