StackRadar

CVE-2026-63209

Unscored

Advisory

Published 27 Jul 2026In the index since 30 Sept 2026
Severity
Unscored
worst across findings
CVSS
—
base score, highest
EPSS
0.004
28th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,304
of 17,966 indexed, latest versions
Container images
1,361
deployed by those charts
Fix available
1 of 1
affected package

OOB read in github.com/klauspost/compress/s2

Carried by container images the latest versions of 1,304 of 17,966 indexed charts deploy, on 1,361 images.

Affected packageAffected versionsFixed inImages
github.com/klauspost/compressgolangv1.16.0, v1.16.3, v1.16.5, v1.16.6+20 more1.18.71,361
OSV records
GO-2026-5841
Also known as
GHSA-259r-337f-4rfw

Charts affected

1,304 by stars
ChartLatestAffected imagesRadar Score
tailscalekubernetes-homelab-helm-chartsVerified publisher0.1.21 of 2See more

tailscale kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
tailscale/tailscale:v1.96.5dbeff02d2337
github.com/klauspost/compress@v1.18.2
1.18.7

Open the chart page →

1,067
kubernetes-stateless-chartkubernetes-stateless-chart1.0.31 of 1See more

kubernetes-stateless-chart kubernetes-stateless-chart 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
portainer/portainer-ce:2.18.4-alpine3e61aaee1341
github.com/klauspost/compress@v1.16.3
1.18.7

Open the chart page →

3,304
kubescoutkubescouteVerified publisher0.1.11 of 1See more

kubescout kubescoute 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/haedalwang/kubescout:0.1.107d51f838f0d
github.com/klauspost/compress@v1.18.0
1.18.7

Open the chart page →

757
kubeseckubesecVerified publisher1.1.01 of 1See more

kubesec kubesec 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
kubesec/kubesec:latest025a365d9f18
github.com/klauspost/compress@v1.17.11
1.18.7

Open the chart page →

1,090
kube-site-followerkube-site-follower0.1.141 of 2See more

kube-site-follower kube-site-follower 0.1.14

1 of the 2 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/cloudnative-pg/cloudnative-pg:1.25.0a27779ed1085
github.com/klauspost/compress@v1.17.9
1.18.7

Open the chart page →

916
mesherykubesphere-stable0.5.04 of 13See more

meshery kubesphere-stable 0.5.0

4 of the 13 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
layer5/meshery:stable-latest78a8be21bef3
github.com/klauspost/compress@v1.18.0
1.18.7
layer5/meshery-consul:stable-latest25a4cc38abcd
github.com/klauspost/compress@v1.17.0
1.18.7
layer5/meshery-istio:stable-latestfde47c141ec6
github.com/klauspost/compress@v1.17.0
1.18.7
layer5/meshery-linkerd:stable-latestb99c73bac1f5
github.com/klauspost/compress@v1.17.0
1.18.7

Open the chart page →

25,067
kubetailkubetailVerified publisher0.26.01 of 3See more

kubetail kubetail 0.26.0

1 of the 3 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/kubetail-org/kubetail-dashboard:0.17.08617f0a7f703
github.com/klauspost/compress@v1.18.0
1.18.7

Open the chart page →

1,904
kubiks-agentkubiksVerified publisher0.4.02 of 3See more

kubiks-agent kubiks 0.4.0

2 of the 3 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
grafana/beyla:2.2.2a9cf4560472e
github.com/klauspost/compress@v1.18.0
1.18.7
otel/opentelemetry-collector-contrib:0.128.01ab0baba0ee3
github.com/klauspost/compress@v1.18.0
1.18.7

Open the chart page →

3,243
kubeservice-cosign-webhookkubservice-chartsVerified publisher1.1.12 of 5See more

kubeservice-cosign-webhook kubservice-charts 1.1.1

2 of the 5 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
dongjiang1989/cosign-webhook:v1.1.02a3ead6a55dc
github.com/klauspost/compress@v1.16.5
1.18.7
quay.io/jetstack/cert-manager-ctl:v1.13.1c10bde7ff9ad
github.com/klauspost/compress@v1.16.0
1.18.7

Open the chart page →

7,149
kubeservice-custom-limitrangekubservice-chartsVerified publisher1.3.01 of 5See more

kubeservice-custom-limitrange kubservice-charts 1.3.0

1 of the 5 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.13.1c10bde7ff9ad
github.com/klauspost/compress@v1.16.0
1.18.7

Open the chart page →

6,182
kubeservice-namespace-node-affinitykubservice-chartsVerified publisher1.1.21 of 5See more

kubeservice-namespace-node-affinity kubservice-charts 1.1.2

1 of the 5 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-ctl:v1.13.1c10bde7ff9ad
github.com/klauspost/compress@v1.16.0
1.18.7

Open the chart page →

6,944
kitcaddykvalitetsitVerified publisher1.5.111 of 2See more

kitcaddy kvalitetsit 1.5.11

1 of the 2 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
kvalitetsit/kitcaddy:1.5.110e66907ea266
github.com/klauspost/compress@v1.18.6
1.18.7

Open the chart page →

169
chibisafel4gVerified publisher0.1.11 of 3See more

chibisafe l4g 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
library/caddy:2-alpinede23def33b17
github.com/klauspost/compress@v1.18.6
1.18.7

Open the chart page →

5,379
authz-pdplabs64io-helm-chartsVerified publisher0.8.31 of 1See more

authz-pdp labs64io-helm-charts 0.8.3

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/cerbos/cerbos:0.51.08d35a64e4a99
github.com/klauspost/compress@v1.18.3
1.18.7

Open the chart page →

824
lagoon-remotelagoon-chartsVerified publisher0.107.01 of 1See more

lagoon-remote lagoon-charts 0.107.0

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
uselagoon/docker-host:v3.6.12c89ed939b8b
github.com/klauspost/compress@v1.18.0
1.18.7

Open the chart page →

2,323
lgtmlgtmVerified publisher0.28.01 of 9See more

lgtm lgtm 0.28.0

1 of the 9 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
grafana/grafana:13.2.2-distroless69a5d2d957ca
github.com/klauspost/compress@v1.18.2
1.18.7

Open the chart page →

959
lgtm-stacklgtm-stackVerified publisher0.1.32 of 8See more

lgtm-stack lgtm-stack 0.1.3

2 of the 8 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
grafana/alloy:v1.18.10f4434c92b3e
github.com/klauspost/compress@v1.18.6
1.18.7
grafana/grafana:13.1.0121a7a9ece6d
github.com/klauspost/compress@v1.18.6
1.18.7

Open the chart page →

2,732
keptn-lifecycle-operatorlifecycle-toolkitVerified publisher0.6.01 of 1See more

keptn-lifecycle-operator lifecycle-toolkit 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/keptn/lifecycle-operator:v2.0.0866ced256a8c
github.com/klauspost/compress@v1.17.9
1.18.7

Open the chart page →

625
linkerd-jaegerlinkerd2-edgeVerified publisher30.14.11-edge1 of 4See more

linkerd-jaeger linkerd2-edge 30.14.11-edge

1 of the 4 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.83.071fcef33ae71
github.com/klauspost/compress@v1.16.7
1.18.7

Open the chart page →

4,418
litlyxlitlyx0.2.01 of 5See more

litlyx litlyx 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
library/mongo:8.0.11dca8d11fe467
github.com/klauspost/compress@v1.17.8
1.18.7

Open the chart page →

8,453
lokxylokxyVerified publisher0.2.01 of 1See more

lokxy lokxy 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
lokxy/lokxy:v0.9.0e4ac800dc55d
github.com/klauspost/compress@v1.18.6
1.18.7

Open the chart page →

202
mcpmcp-chartsVerified publisher0.0.231 of 7See more

mcp mcp-charts 0.0.23

1 of the 7 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/gla-rad/mc-mms-router:latest032e977d9adf
github.com/klauspost/compress@v1.18.0
1.18.7

Open the chart page →

7,324
mw-kube-agent-v2middleware-labsVerified publisher2.8.61 of 1See more

mw-kube-agent-v2 middleware-labs 2.8.6

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/mw-kube-agent:1.12.09c7bc0f9bb35
github.com/klauspost/compress@v1.17.11
1.18.7

Open the chart page →

4,496
maddymyaVerified publisher22.4.121 of 2See more

maddy mya 22.4.12

1 of the 2 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
foxcpp/maddy:0.7.16ab538e2f28b
github.com/klauspost/compress@v1.17.4
1.18.7

Open the chart page →

1,421
surveyornatsVerified publisher0.20.91 of 1See more

surveyor nats 0.20.9

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
natsio/nats-surveyor:0.9.9104a3e938b23
github.com/klauspost/compress@v1.18.4
1.18.7

Open the chart page →

929
natz-operatornatz-operatorVerified publisher0.9.51 of 1See more

natz-operator natz-operator 0.9.5

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/zeiss/natz-operator/operator:0.9.5187007974540
github.com/klauspost/compress@v1.17.9
1.18.7

Open the chart page →

742
clowder2ncsaVerified publisher1.9.71 of 12See more

clowder2 ncsa 1.9.7

1 of the 12 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2023.12.230b60b6565ab2
github.com/klauspost/compress@v1.17.4
1.18.7

Open the chart page →

39,408
octopuso7studios-octopus-helm-chartsOfficialVerified publisher1.2.33 of 5See more

octopus o7studios-octopus-helm-charts 1.2.3

3 of the 5 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
library/nats:2.11.9-alpine777787bbb4c7
github.com/klauspost/compress@v1.18.0
1.18.7
natsio/nats-box:0.18.0abdc9f9f0120
github.com/klauspost/compress@v1.18.0
1.18.7
percona/percona-server-mongodb-operator:1.20.1d09453ce7886
github.com/klauspost/compress@v1.17.11
1.18.7

Open the chart page →

6,329
librechatopenshift1.9.01 of 3See more

librechat openshift 1.9.0

1 of the 3 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
library/mongo:8.0.20098862b1339f
github.com/klauspost/compress@v1.17.8
1.18.7

Open the chart page →

6,198
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.12 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.1

2 of the 34 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
grafana/grafana:13.2.2-distroless69a5d2d957ca
github.com/klauspost/compress@v1.18.2
1.18.7
jaegertracing/jaeger:2.20.046a886260e04
github.com/klauspost/compress@v1.18.6
1.18.7

Open the chart page →

22,392
opikopikOfficialVerified publisher2.2.861See more

opik opik 2.2.86

1 container image this version deploys carries CVE-2026-63209.

Container imageDigestPackageFixed in
cloudpirates/image-minio:RELEASE.2025-10-15T17-29-55Z-hardened8dc02a7e5093
github.com/klauspost/compress@v1.18.0
1.18.7

Open the chart page →

—
opsopsVerified publisher1.2.02 of 2See more

ops ops 1.2.0

2 of the 2 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
shaowenchen/ops-controller-manager:latest35575d4f2bfe
github.com/klauspost/compress@v1.17.2
1.18.7
shaowenchen/ops-server:latest6bac5cebd125
github.com/klauspost/compress@v1.17.2
1.18.7

Open the chart page →

103,521
orbitalregorbitalregVerified publisher0.3.01 of 4See more

orbitalreg orbitalreg 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
orbitalreg/orbitalreg-api:0.1.045f2620337af
github.com/klauspost/compress@v1.17.9
1.18.7

Open the chart page →

2,320
uptime-kumapascaliskeVerified publisher3.0.01 of 1See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
github.com/klauspost/compress@v1.18.0
1.18.7

Open the chart page →

7,533
periscopeperiscopeVerified publisher1.1.61 of 1See more

periscope periscope 1.1.6

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/gnana997/periscope:1.1.621b284fb00f2
github.com/klauspost/compress@v1.18.0
1.18.7

Open the chart page →

951
pgbouncerpgbouncer-helm0.6.01 of 2See more

pgbouncer pgbouncer-helm 0.6.0

1 of the 2 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
apache/airflow:airflow-pgbouncer-exporter-2025.03.05-0.18.0adf7260c2c5f
github.com/klauspost/compress@v1.17.9
1.18.7

Open the chart page →

472
chartmuseumphntom4.0.201 of 1See more

chartmuseum phntom 4.0.20

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
phntom/chartmuseum:v0.16.053883b65d9b7
github.com/klauspost/compress@v1.16.0
1.18.7

Open the chart page →

2,948
podtracepodtraceOfficialVerified publisher0.14.81 of 2See more

podtrace podtrace 0.14.8

1 of the 2 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
alpine/k8s:1.37.0b421c2e9419e
github.com/klauspost/compress@v1.18.1
1.18.7

Open the chart page →

647
prometheus-pingmesh-exporterprometheus-communityVerified publisher0.5.01 of 1See more

prometheus-pingmesh-exporter prometheus-community 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
dongjiang1989/pingmesh-agent:v1.2.2c82de0272da0
github.com/klauspost/compress@v1.17.9
1.18.7

Open the chart page →

856
prometheus-sql-exporterprometheus-communityVerified publisher0.5.01 of 1See more

prometheus-sql-exporter prometheus-community 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/justwatchcom/sql_exporter:v0.8c4b1d3d0f052
github.com/klauspost/compress@v1.17.11
1.18.7

Open the chart page →

1,386
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
github.com/klauspost/compress@v1.18.6
1.18.7

Open the chart page →

9,277
velero-s3-deploymentradar-baseVerified publisher0.4.31 of 4See more

velero-s3-deployment radar-base 0.4.3

1 of the 4 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
quay.io/minio/mc:RELEASE.2024-11-21T17-21-54Z993e8c454a7e
github.com/klauspost/compress@v1.17.10
1.18.7

Open the chart page →

4,840
rbac-serverrbac-server1.19.11 of 1See more

rbac-server rbac-server 1.19.1

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
public.ecr.aws/cloudnatix/llmariner/rbac-server:1.19.1df1adeb86679
github.com/klauspost/compress@v1.17.11
1.18.7

Open the chart page →

705
rclonercloneVerified publisher2.2.01 of 1See more

rclone rclone 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
rclone/rclone:1.6874c51b8817e5
github.com/klauspost/compress@v1.17.9
1.18.7

Open the chart page →

1,683
redis-chartredis-ha-chartVerified publisher0.1.51 of 2See more

redis-chart redis-ha-chart 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
truebyteinnovationllp/redis-exporter:v1.86.01c6a945af653
github.com/klauspost/compress@v1.18.0
1.18.7

Open the chart page →

241
reportportalreportportal-ioOfficialVerified publisher26.8.121 of 15See more

reportportal reportportal-io 26.8.12

1 of the 15 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2025.7.23-debian-12-r08935e75fa5d1
github.com/klauspost/compress@v1.18.0
1.18.7

Open the chart page →

13,192
resurfaceresurfaceioVerified publisher3.9.01 of 3See more

resurface resurfaceio 3.9.0

1 of the 3 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
haproxytech/kubernetes-ingress:1.11.4c5f8a41ef0d4
github.com/klauspost/compress@v1.17.0
1.18.7

Open the chart page →

7,732
prometheusromanow-helm-chartsVerified publisher1.7.21 of 1See more

prometheus romanow-helm-charts 1.7.2

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
prom/prometheus:v2.52.05c435642ca4d
github.com/klauspost/compress@v1.17.8
1.18.7

Open the chart page →

1,155
uptime-kumasb-helm-charts0.4.01 of 1See more

uptime-kuma sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.24c364ef96aad
github.com/klauspost/compress@v1.18.0
1.18.7

Open the chart page →

41,195
sceptresceptreai0.1.121 of 5See more

sceptre sceptreai 0.1.12

1 of the 5 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
maponyacharles/sceptreai:seaweedfs-0.1.127c8a525f08e9
github.com/klauspost/compress@v1.18.6
1.18.7

Open the chart page →

4,965

Container images carrying it

1,361 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
registry.gitlab.com/shortlink-org/shortlink/link:latest86d87291ffd4
github.com/klauspost/compress@v1.18.2
1.18.7
1
registry.gitlab.com/xrow-public/ci-tools/tools:mainaa62b23f2b5e
github.com/klauspost/compress@v1.18.0
1.18.7
1
registry.gitlab.com/xrow-public/developer-operator/developer-operator-controller:2.1.2301847adfe16
github.com/klauspost/compress@v1.18.0
1.18.7
1
registry.gitlab.com/xrow-public/velero-client/velero-client:1.4.203015f863a3e
github.com/klauspost/compress@v1.18.2
1.18.7
1
registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere:v1.32.0f9f4dfd733ab
github.com/klauspost/compress@v1.17.9
1.18.7
1
registry.k8s.io/coredns/coredns:v1.13.294caebb89dcf
github.com/klauspost/compress@v1.18.0
1.18.7
1
registry.k8s.io/etcd:3.6.4-0e36c08168342
github.com/klauspost/compress@v1.17.9
1.18.7
1
registry.k8s.io/ingress-nginx/controller:v1.11.3d56f135b6462
github.com/klauspost/compress@v1.17.9
1.18.7
1
registry.k8s.io/ingress-nginx/controller:v1.12.0e6b8de175acd
github.com/klauspost/compress@v1.17.9
1.18.7
1
registry.k8s.io/sig-storage/csi-snapshotter:v8.2.15f4bb469fec5
github.com/klauspost/compress@v1.17.11
1.18.7
1
registry.k8s.io/sig-storage/snapshot-controller:v8.2.1472fa35a89da
github.com/klauspost/compress@v1.17.11
1.18.7
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.