StackRadar

CVE-2026-63209

Unscored

Advisory

Published 27 Jul 2026In the index since 30 Sept 2026
Severity
Unscored
worst across findings
CVSS
—
base score, highest
EPSS
0.004
28th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,304
of 17,966 indexed, latest versions
Container images
1,361
deployed by those charts
Fix available
1 of 1
affected package

OOB read in github.com/klauspost/compress/s2

Carried by container images the latest versions of 1,304 of 17,966 indexed charts deploy, on 1,361 images.

Affected packageAffected versionsFixed inImages
github.com/klauspost/compressgolangv1.16.0, v1.16.3, v1.16.5, v1.16.6+20 more1.18.71,361
OSV records
GO-2026-5841
Also known as
GHSA-259r-337f-4rfw

Charts affected

1,304 by stars
ChartLatestAffected imagesRadar Score
flux-suspensions-exporteralpineworks0.1.01 of 1See more

flux-suspensions-exporter alpineworks 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/alpineworks/flux-suspension-exporter:v1.0.0341f0a6cd2b6
github.com/klauspost/compress@v1.17.11
1.18.7

Open the chart page →

581
ipalpineworks0.1.21 of 1See more

ip alpineworks 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/alpineworks/ip:v1.0.04e0d4d51f0bc
github.com/klauspost/compress@v1.17.11
1.18.7

Open the chart page →

557
versitygwalpineworks0.1.21 of 1See more

versitygw alpineworks 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
versity/versitygw:v1.0.145192635d0353
github.com/klauspost/compress@v1.18.0
1.18.7

Open the chart page →

1,288
versitygw-webhook-pulsar-proxyalpineworks0.1.11 of 1See more

versitygw-webhook-pulsar-proxy alpineworks 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/alpineworks/versitygw-webhook-pulsar-proxy:v1.0.06e9ced773732
github.com/klauspost/compress@v1.18.0
1.18.7

Open the chart page →

915
alustan-helmalustan-helm1.0.01 of 1See more

alustan-helm alustan-helm 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
alustan/install-argocd:1.0.0c16c34f46ad3
github.com/klauspost/compress@v1.16.5
1.18.7

Open the chart page →

1,928
amorphieamorphie0.1.25 of 18See more

amorphie amorphie 0.1.2

5 of the 18 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
daprio/injector:1.11.2763b9b70b0c8
github.com/klauspost/compress@v1.16.3
1.18.7
daprio/operator:1.11.2c584428aa12d
github.com/klauspost/compress@v1.16.3
1.18.7
daprio/placement:1.11.2d8e1446da996
github.com/klauspost/compress@v1.16.3
1.18.7
daprio/sentry:1.11.21f507c1a181b
github.com/klauspost/compress@v1.16.3
1.18.7
hashicorp/vault:1.15.26b4e5dadf082
github.com/klauspost/compress@v1.16.5
1.18.7

Open the chart page →

29,312
buildkit-serviceandrcunsVerified publisher1.8.01 of 1See more

buildkit-service andrcuns 1.8.0

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
moby/buildkit:v0.31.0a095b3d11ce1
github.com/klauspost/compress@v1.18.6
1.18.7

Open the chart page →

1,353
dnsmadeeasy-webhookangelnu6.0.71 of 1See more

dnsmadeeasy-webhook angelnu 6.0.7

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/angelnu/dnsmadeeasy-webhook:v1.9.0a5ca158b1f02
github.com/klauspost/compress@v1.17.11
1.18.7

Open the chart page →

819
maddyangelnu5.0.01 of 1See more

maddy angelnu 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/foxcpp/maddy:0.9.5de42151adff6
github.com/klauspost/compress@v1.17.11
1.18.7

Open the chart page →

929
ddosifyanteonVerified publisher1.7.51 of 13See more

ddosify anteon 1.7.5

1 of the 13 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
chrislusf/seaweedfs:3.56ed80f00fde46
github.com/klauspost/compress@v1.16.7
1.18.7

Open the chart page →

26,966
antmediaantmediaVerified publisher3.1.01 of 4See more

antmedia antmedia 3.1.0

1 of the 4 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
library/mongo:8.04968f22d0c6c
github.com/klauspost/compress@v1.18.6
1.18.7

Open the chart page →

4,313
monitoringantmediaVerified publisher1.0.01 of 6See more

monitoring antmedia 1.0.0

1 of the 6 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
grafana/grafana:latestac461fb352ab
github.com/klauspost/compress@v1.18.5
1.18.7

Open the chart page →

2,542
imagepullerapache-pulsar-helm-chart-repo1.0.11 of 2See more

imagepuller apache-pulsar-helm-chart-repo 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
library/docker:latest3f3c01aaaebf
github.com/klauspost/compress@v1.18.5
1.18.7

Open the chart page →

264
accounts-uiappscodeVerified publisher2026.9.111 of 1See more

accounts-ui appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1139076a89c36b
github.com/klauspost/compress@v1.18.5
1.18.7

Open the chart page →

2,595
aceappscodeVerified publisher2026.9.111 of 2See more

ace appscode 2026.9.11

1 of the 2 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1139076a89c36b
github.com/klauspost/compress@v1.18.5
1.18.7

Open the chart page →

2,901
ace-installerappscodeVerified publisher2026.9.112 of 2See more

ace-installer appscode 2026.9.11

2 of the 2 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
library/registry:3.1.11be55279f18a
github.com/klauspost/compress@v1.18.4
1.18.7
ghcr.io/appscode/b3:v2026.9.1139076a89c36b
github.com/klauspost/compress@v1.18.5
1.18.7

Open the chart page →

3,277
ace-installer-certifiedappscodeVerified publisher2026.9.112 of 2See more

ace-installer-certified appscode 2026.9.11

2 of the 2 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
library/registry:3.1.11be55279f18a
github.com/klauspost/compress@v1.18.4
1.18.7
ghcr.io/appscode/b3:v2026.9.1178a9fb785ec5
github.com/klauspost/compress@v1.18.0
1.18.7

Open the chart page →

3,277
acerproxyappscodeVerified publisher2026.9.111 of 1See more

acerproxy appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/appscode/acerproxy:v0.2.021de3771fdd5
github.com/klauspost/compress@v1.18.1
1.18.7

Open the chart page →

1,363
aceshifterappscodeVerified publisher2026.9.111 of 1See more

aceshifter appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/appscode/aceshifter:v0.0.3e5f5c254a55a
github.com/klauspost/compress@v1.18.1
1.18.7

Open the chart page →

1,071
billingappscodeVerified publisher2026.9.111 of 1See more

billing appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1139076a89c36b
github.com/klauspost/compress@v1.18.5
1.18.7

Open the chart page →

2,595
catalog-managerappscodeVerified publisher2026.9.111 of 1See more

catalog-manager appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/appscode/catalog-manager:v0.14.091cf84624081
github.com/klauspost/compress@v1.18.6
1.18.7

Open the chart page →

110
cattlesetappscodeVerified publisher2026.7.81 of 1See more

cattleset appscode 2026.7.8

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/appscode/cattleset:v0.0.145554a03e448
github.com/klauspost/compress@v1.18.1
1.18.7

Open the chart page →

645
cluster-connectorappscodeVerified publisher2025.12.151 of 1See more

cluster-connector appscode 2025.12.15

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/appscode/cluster-connector:v0.0.140efd9d9ef6ca
github.com/klauspost/compress@v1.18.1
1.18.7

Open the chart page →

625
cluster-importerappscodeVerified publisher2026.9.111 of 1See more

cluster-importer appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/appscode/ace:v0.2.0b8e03da90e70
github.com/klauspost/compress@v1.18.2
1.18.7

Open the chart page →

1,056
cluster-profile-managerappscodeVerified publisher2026.9.181 of 1See more

cluster-profile-manager appscode 2026.9.18

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/kluster-manager/cluster-profile:v0.13.0048e041157d0
github.com/klauspost/compress@v1.18.1
1.18.7

Open the chart page →

131
crd-managerappscodeVerified publisher2026.7.211 of 1See more

crd-manager appscode 2026.7.21

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/voyagermesh/crd-manager:v0.3.0e67f14e5c853
github.com/klauspost/compress@v1.18.1
1.18.7

Open the chart page →

873
dns-proxyappscodeVerified publisher2026.9.111 of 1See more

dns-proxy appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/appscode/cloudflare-dns-proxy:v0.0.5dfbef0285e14
github.com/klauspost/compress@v1.18.1
1.18.7

Open the chart page →

647
falco-ui-serverappscodeVerified publisher2026.1.151 of 2See more

falco-ui-server appscode 2026.1.15

1 of the 2 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
rancher/kine:v0.11.412889bbcd1e8
github.com/klauspost/compress@v1.17.2
1.18.7

Open the chart page →

2,952
fargocdappscodeVerified publisher2026.9.181 of 1See more

fargocd appscode 2026.9.18

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/appscode/fargocd:v0.1.0c59d775d9a7c
github.com/klauspost/compress@v1.18.1
1.18.7

Open the chart page →

459
fargocd-managerappscodeVerified publisher2026.9.181 of 1See more

fargocd-manager appscode 2026.9.18

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/appscode/fargocd:v0.1.0c59d775d9a7c
github.com/klauspost/compress@v1.18.1
1.18.7

Open the chart page →

459
gh-ci-webhookappscodeVerified publisher2026.9.111 of 1See more

gh-ci-webhook appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/appscode/gh-ci-webhook:v0.0.2036ce246d884e
github.com/klauspost/compress@v1.17.9
1.18.7

Open the chart page →

1,411
inbox-agentappscodeVerified publisher2026.6.21 of 2See more

inbox-agent appscode 2026.6.2

1 of the 2 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/appscode/inbox-agent:v0.0.6f630e47772c9
github.com/klauspost/compress@v1.18.1
1.18.7

Open the chart page →

1,831
kubedb-autoscalerappscodeVerified publisher0.51.01 of 1See more

kubedb-autoscaler appscode 0.51.0

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/kubedb/kubedb-autoscaler:v0.51.05d1182ac21f0
github.com/klauspost/compress@v1.18.5
1.18.7

Open the chart page →

610
kubedb-certifiedappscodeVerified publisher2026.7.105 of 8See more

kubedb-certified appscode 2026.7.10

5 of the 8 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/appscode/petset:v0.1.093fa0daf603c
github.com/klauspost/compress@v1.18.1
1.18.7
ghcr.io/kubedb/kubedb-autoscaler:v0.51.05d1182ac21f0
github.com/klauspost/compress@v1.18.5
1.18.7
ghcr.io/kubedb/kubedb-crd-manager:v0.21.09506a6cb98d1
github.com/klauspost/compress@v1.18.5
1.18.7
ghcr.io/kubedb/kubedb-ops-manager:v0.53.06d4c9fe66e4f
github.com/klauspost/compress@v1.18.5
1.18.7
ghcr.io/kubedb/kubedb-provisioner:v0.66.0e7041c3b41e7
github.com/klauspost/compress@v1.18.5
1.18.7

Open the chart page →

4,903
kubedb-crd-managerappscodeVerified publisher0.21.01 of 1See more

kubedb-crd-manager appscode 0.21.0

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/kubedb/kubedb-crd-manager:v0.21.09506a6cb98d1
github.com/klauspost/compress@v1.18.5
1.18.7

Open the chart page →

594
kubedb-dashboardappscodeVerified publisher0.42.01 of 1See more

kubedb-dashboard appscode 0.42.0

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/kubedb/kubedb-kibana:v0.42.0735dd5d2709d
github.com/klauspost/compress@v1.18.5
1.18.7

Open the chart page →

188
kubedb-oneappscodeVerified publisher2023.12.286 of 10See more

kubedb-one appscode 2023.12.28

6 of the 10 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/kubedb/kubedb-autoscaler:v0.25.0df6b11907d33
github.com/klauspost/compress@v1.17.0
1.18.7
ghcr.io/kubedb/kubedb-dashboard:v0.16.07bfe1c07bd9b
github.com/klauspost/compress@v1.17.0
1.18.7
ghcr.io/kubedb/kubedb-ops-manager:v0.27.1ec36422b09af
github.com/klauspost/compress@v1.17.0
1.18.7
ghcr.io/kubedb/kubedb-provisioner:v0.40.242574f512837
github.com/klauspost/compress@v1.17.0
1.18.7
ghcr.io/kubedb/kubedb-schema-manager:v0.16.09518de37eed5
github.com/klauspost/compress@v1.17.0
1.18.7
ghcr.io/kubedb/kubedb-webhook-server:v0.16.2e24894e32cbc
github.com/klauspost/compress@v1.17.0
1.18.7

Open the chart page →

15,322
kubedb-ops-managerappscodeVerified publisher0.53.01 of 1See more

kubedb-ops-manager appscode 0.53.0

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/kubedb/kubedb-ops-manager:v0.53.06d4c9fe66e4f
github.com/klauspost/compress@v1.18.5
1.18.7

Open the chart page →

789
kubedb-schema-managerappscodeVerified publisher0.42.01 of 1See more

kubedb-schema-manager appscode 0.42.0

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/kubedb/kubedb-schema-manager:v0.42.04e2a3cce7ce8
github.com/klauspost/compress@v1.18.5
1.18.7

Open the chart page →

185
kubestashappscodeVerified publisher2026.7.101 of 2See more

kubestash appscode 2026.7.10

1 of the 2 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/kubestash/kubestash:v0.29.00686b2a40280
github.com/klauspost/compress@v1.18.0
1.18.7

Open the chart page →

958
kubestash-certifiedappscodeVerified publisher2026.7.101 of 2See more

kubestash-certified appscode 2026.7.10

1 of the 2 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/kubestash/kubestash:v0.29.00686b2a40280
github.com/klauspost/compress@v1.18.0
1.18.7

Open the chart page →

958
kubestash-operatorappscodeVerified publisher0.29.01 of 2See more

kubestash-operator appscode 0.29.0

1 of the 2 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/kubestash/kubestash:v0.29.00686b2a40280
github.com/klauspost/compress@v1.18.0
1.18.7

Open the chart page →

958
kube-ui-serverappscodeVerified publisher2026.9.111 of 1See more

kube-ui-server appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/appscode/kube-ui-server:v0.7.0c76693a329c1
github.com/klauspost/compress@v1.18.5
1.18.7

Open the chart page →

248
kubevaultappscodeVerified publisher2026.8.71 of 2See more

kubevault appscode 2026.8.7

1 of the 2 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/kubevault/vault-operator:v0.25.0c8e042b5cee8
github.com/klauspost/compress@v1.18.5
1.18.7

Open the chart page →

902
kubevault-certifiedappscodeVerified publisher2026.2.271 of 1See more

kubevault-certified appscode 2026.2.27

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/kubevault/vault-operator:v0.24.00087cb49616f
github.com/klauspost/compress@v1.18.2
1.18.7

Open the chart page →

1,223
kubevault-operatorappscodeVerified publisher0.25.01 of 1See more

kubevault-operator appscode 0.25.0

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/kubevault/vault-operator:v0.25.0c8e042b5cee8
github.com/klauspost/compress@v1.18.5
1.18.7

Open the chart page →

596
kubevault-webhook-serverappscodeVerified publisher0.25.01 of 2See more

kubevault-webhook-server appscode 0.25.0

1 of the 2 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/kubevault/vault-operator:v0.25.0c8e042b5cee8
github.com/klauspost/compress@v1.18.5
1.18.7

Open the chart page →

902
kubevirt-infra-csi-driverappscodeVerified publisher0.1.01 of 6See more

kubevirt-infra-csi-driver appscode 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-resizer:v1.13.12a0b297cc7c4
github.com/klauspost/compress@v1.17.11
1.18.7

Open the chart page →

1,860
marketplace-apiappscodeVerified publisher2026.9.111 of 1See more

marketplace-api appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1139076a89c36b
github.com/klauspost/compress@v1.18.5
1.18.7

Open the chart page →

2,595
opentelemetry-kube-stackappscodeVerified publisher0.14.121 of 3See more

opentelemetry-kube-stack appscode 0.14.12

1 of the 3 container images this version deploys carry CVE-2026-63209.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator:0.144.079b81912f1fb
github.com/klauspost/compress@v1.18.2
1.18.7

Open the chart page →

1,919

Container images carrying it

1,361 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
registry.gitlab.com/shortlink-org/shortlink/link:latest86d87291ffd4
github.com/klauspost/compress@v1.18.2
1.18.7
1
registry.gitlab.com/xrow-public/ci-tools/tools:mainaa62b23f2b5e
github.com/klauspost/compress@v1.18.0
1.18.7
1
registry.gitlab.com/xrow-public/developer-operator/developer-operator-controller:2.1.2301847adfe16
github.com/klauspost/compress@v1.18.0
1.18.7
1
registry.gitlab.com/xrow-public/velero-client/velero-client:1.4.203015f863a3e
github.com/klauspost/compress@v1.18.2
1.18.7
1
registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere:v1.32.0f9f4dfd733ab
github.com/klauspost/compress@v1.17.9
1.18.7
1
registry.k8s.io/coredns/coredns:v1.13.294caebb89dcf
github.com/klauspost/compress@v1.18.0
1.18.7
1
registry.k8s.io/etcd:3.6.4-0e36c08168342
github.com/klauspost/compress@v1.17.9
1.18.7
1
registry.k8s.io/ingress-nginx/controller:v1.11.3d56f135b6462
github.com/klauspost/compress@v1.17.9
1.18.7
1
registry.k8s.io/ingress-nginx/controller:v1.12.0e6b8de175acd
github.com/klauspost/compress@v1.17.9
1.18.7
1
registry.k8s.io/sig-storage/csi-snapshotter:v8.2.15f4bb469fec5
github.com/klauspost/compress@v1.17.11
1.18.7
1
registry.k8s.io/sig-storage/snapshot-controller:v8.2.1472fa35a89da
github.com/klauspost/compress@v1.17.11
1.18.7
1

syft 1.42.1 · advisories as of 30 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.