StackRadar

CVE-2026-63435

Medium

Advisory

Published 2 Sept 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.003
26th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
34
of 17,781 indexed, latest versions
Container images
36
deployed by those charts
Fix available
1 of 5
affected packages

Mail: Email address spoofing via malformed RFC 2047 encoded-words

Carried by container images the latest versions of 34 of 17,781 indexed charts deploy, on 36 images.

Affected packageAffected versionsFixed inImages
mailgem2.6.6, 2.7.1, 2.8.0.1, 2.8.1+1 more2.9.126
ruby2.7deb2.7.0-5ubuntu1.4, 2.7.0-5ubuntu1.5, 2.7.0-5ubuntu1.8no fix listed6
ruby2.3deb2.3.1-2~16.04.5no fix listed2
ruby3.0deb3.0.2-7ubuntu2.4, 3.0.2-7ubuntu2.8no fix listed2
ruby2.5deb2.5.8-1bbox1~bionic1no fix listed1
OSV records
GHSA-mvxr-6m87-mv2qUBUNTU-CVE-2026-63435

Charts affected

34 by stars
ChartLatestAffected imagesRadar Score
chatwootchatwootVerified publisher2.0.241 of 3See more

chatwoot chatwoot 2.0.24

1 of the 3 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v4.15.167ebc751c171
mail@2.8.1
2.9.1

Open the chart page →

9,203
puppetserverpuppetserver9.5.21 of 5See more

puppetserver puppetserver 9.5.2

1 of the 5 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
ghcr.io/voxpupuli/container-puppetserver:7.17.0-v1.5.0916746209ac5
ruby3.0@3.0.2-7ubuntu2.4
no fix listed

Open the chart page →

14,184
kubernetes-loggingkubernetes-logging4.8.01 of 6See more

kubernetes-logging kubernetes-logging 4.8.0

1 of the 6 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
opensearchproject/logstash-oss-with-opensearch-output-plugin:8.9.043b0cdaf26ed
mail@2.6.6
2.9.1

Open the chart page →

10,530
uffizzi-appuffizzi-app1.3.01 of 14See more

uffizzi-app uffizzi-app 1.3.0

1 of the 14 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
uffizzi/app:latest66e9e3937c60
mail@2.7.1
2.9.1

Open the chart page →

19,337
huginnutkuozdemirVerified publisher2.2.11 of 4See more

huginn utkuozdemir 2.2.1

1 of the 4 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
huginn/huginn-single-process:4d17829cf6b15b004ad3f4be196303dca4944810c794eddc7b47
mail@2.7.1
ruby2.5@2.5.8-1bbox1~bionic1
2.9.1
no fix listed

Open the chart page →

18,137
mastodondefault-ghVerified publisher0.3.11 of 3See more

mastodon default-gh 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
mail@2.8.0.1
2.9.1

Open the chart page →

5,056
docker-registry-browsergmelilloVerified publisher0.1.21 of 1See more

docker-registry-browser gmelillo 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
klausmeyer/docker-registry-browser:1.3.5430a440d95af
mail@2.7.1
2.9.1

Open the chart page →

4,108
openprojecthomeenterpriseinc0.5.01 of 1See more

openproject homeenterpriseinc 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
openproject/community:12.0.2734743d11094
mail@2.7.1
2.9.1

Open the chart page →

6,810
opennebulakvaps2.1.15 of 9See more

opennebula kvaps 2.1.1

5 of the 9 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
ghcr.io/kvaps/opennebula:v5.12.0.4-1e28e0e7de11b
ruby2.7@2.7.0-5ubuntu1.5
no fix listed
ghcr.io/kvaps/opennebula-exporter:v5.12.0.401563adc95fd
ruby2.7@2.7.0-5ubuntu1.4
no fix listed
ghcr.io/kvaps/opennebula-exporter:v5.12.0.4-12b92df1143b9
ruby2.7@2.7.0-5ubuntu1.5
no fix listed
ghcr.io/kvaps/opennebula-flow:v5.12.0.4-1600221f0f43f
ruby2.7@2.7.0-5ubuntu1.5
no fix listed
ghcr.io/kvaps/opennebula-gate:v5.12.0.4-1a85e03d8bc1d
ruby2.7@2.7.0-5ubuntu1.5
no fix listed

Open the chart page →

113,791
chatwootmaxcrm-chartsVerified publisher1.1.2011 of 4See more

chatwoot maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
mail@2.8.1
2.9.1

Open the chart page →

5,940
redminemt1905027.3.41 of 3See more

redmine mt190502 7.3.4

1 of the 3 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
library/redmine:6.1.204ac44a2595b
mail@2.8.1
2.9.1

Open the chart page →

7,527
redmineredmine-helm-chartVerified publisher0.2.61 of 1See more

redmine redmine-helm-chart 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
library/redmine:6.1.3-trixief474a901faec
mail@2.8.1
2.9.1

Open the chart page →

4,240
logstashromanow-helm-chartsVerified publisher1.5.01 of 1See more

logstash romanow-helm-charts 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
library/logstash:7.17.817a4f64e9cf5
mail@2.6.6
2.9.1

Open the chart page →

7,529
antigenic-docuseal-helm-chartantigenic-docuseal-helm-chartVerified publisher0.2.01 of 1See more

antigenic-docuseal-helm-chart antigenic-docuseal-helm-chart 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
docuseal/docuseal:2.4.17493fd7f6728
mail@2.9.0
2.9.1

Open the chart page →

2,766
puppetservercamptocamp31.0.11 of 2See more

puppetserver camptocamp3 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
ghcr.io/voxpupuli/puppetserver:8.7.0-main63873f3f698e
ruby3.0@3.0.2-7ubuntu2.8
no fix listed

Open the chart page →

5,886
elk-stackelk-stack-test1.0.21 of 9See more

elk-stack elk-stack-test 1.0.2

1 of the 9 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
library/logstash:9.1.233eae14f0867
mail@2.8.1
2.9.1

Open the chart page →

2,942
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-emailservicea1f5cebb5240
mail@2.8.1
2.9.1

Open the chart page →

49,025
docker-registry-browsergtaylor0.4.41 of 1See more

docker-registry-browser gtaylor 0.4.4

1 of the 1 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
klausmeyer/docker-registry-browser:1.4.0bdc4c6b8595b
mail@2.7.1
2.9.1

Open the chart page →

3,564
octoboxhalkeye0.1.11 of 1See more

octobox halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
octoboxio/octobox:latestd909041c46eb
mail@2.9.0
2.9.1

Open the chart page →

3,255
manyfoldjeffrescVerified publisher1.0.31 of 1See more

manyfold jeffresc 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
ghcr.io/manyfold3d/manyfold:0.136.0d14ca4d82475
mail@2.9.0
2.9.1

Open the chart page →

1,960
gitlabkubesphereVerified publisher4.2.33 of 17See more

gitlab kubesphere 4.2.3

3 of the 17 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
mirrorgitlabcontainers/gitlab-sidekiq-ce:v13.2.294d1431683fa
mail@2.7.1
2.9.1
mirrorgitlabcontainers/gitlab-task-runner-ce:v13.2.29efd73993c34
mail@2.7.1
2.9.1
mirrorgitlabcontainers/gitlab-webservice-ce:v13.2.230393f990f5c
mail@2.7.1
2.9.1

Open the chart page →

38,133
maxcrm-chartsmaxcrm-chartsVerified publisher1.1.2011 of 4See more

maxcrm-charts maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
mail@2.8.1
2.9.1

Open the chart page →

5,940
danboorumy0nVerified publisher0.0.21 of 1See more

danbooru my0n 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
mail@2.7.1
2.9.1

Open the chart page →

12,791
danbooru-stackmy0nVerified publisher0.0.31 of 4See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
mail@2.7.1
2.9.1

Open the chart page →

12,791
betydbncsaVerified publisher0.6.11 of 4See more

betydb ncsa 0.6.1

1 of the 4 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
pecan/bety:5.4.1f825d480cd62
mail@2.7.1
2.9.1

Open the chart page →

9,542
pecanncsaVerified publisher0.6.21 of 15See more

pecan ncsa 0.6.2

1 of the 15 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
pecan/bety:5.4.1f825d480cd62
mail@2.7.1
2.9.1

Open the chart page →

14,154
comacopencord1.0.01 of 9See more

comac opencord 1.0.0

1 of the 9 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
omecproject/onos-progran:1.0.05715e5648aa0
ruby2.3@2.3.1-2~16.04.5
no fix listed

Open the chart page →

88,546
onos-progranopencord1.2.71 of 2See more

onos-progran opencord 1.2.7

1 of the 2 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
muluder/prograncontrollermcord:0.1.843b597a93da7
ruby2.3@2.3.1-2~16.04.5
no fix listed

Open the chart page →

38,865
redminerestic-pvc-backupVerified publisher0.2.61 of 1See more

redmine restic-pvc-backup 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
library/redmine:6.1.3-trixief474a901faec
mail@2.8.1
2.9.1

Open the chart page →

4,240
mastodonrivals-spaceVerified publisher3.1.21 of 3See more

mastodon rivals-space 3.1.2

1 of the 3 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
mail@2.8.0.1
2.9.1

Open the chart page →

6,026
fluentd-operatorstatcan0.5.11 of 1See more

fluentd-operator statcan 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
vmware/kube-fluentd-operator:latestf028c138a5f4
mail@2.8.1
2.9.1

Open the chart page →

1,955
velero-notificationsvelero-notifications1.1.01 of 1See more

velero-notifications velero-notifications 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
ghcr.io/simoncaron/velero-notifications:1.0.0d058963d4de7
mail@2.7.1
2.9.1

Open the chart page →

1,285
maybe-financevicsuferVerified publisher0.2.71 of 3See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
mail@2.8.1
2.9.1

Open the chart page →

10,795
kongwallarmVerified publisher4.6.31 of 7See more

kong wallarm 4.6.3

1 of the 7 container images this version deploys carry CVE-2026-63435.

Container imageDigestPackageFixed in
wallarm/kong:3.1.0-ubuntu-4.6.0ea9608c82e40
ruby2.7@2.7.0-5ubuntu1.8
no fix listed

Open the chart page →

11,405

Container images carrying it

36 by charts deploying them

A fixed version is listed for 1 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
chatwoot/chatwoot:v3.1.0d530ab8c1753
mail@2.8.1
2.9.1
2
library/redmine:6.1.3-trixief474a901faec
mail@2.8.1
2.9.1
2
pecan/bety:5.4.1f825d480cd62
mail@2.7.1
2.9.1
2
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
mail@2.7.1
2.9.1
2
chatwoot/chatwoot:v4.15.167ebc751c171
mail@2.8.1
2.9.1
1
docuseal/docuseal:2.4.17493fd7f6728
mail@2.9.0
2.9.1
1
huginn/huginn-single-process:4d17829cf6b15b004ad3f4be196303dca4944810c794eddc7b47
mail@2.7.1
ruby2.5@2.5.8-1bbox1~bionic1
2.9.1
no fix listed
1
klausmeyer/docker-registry-browser:1.3.5430a440d95af
mail@2.7.1
2.9.1
1
klausmeyer/docker-registry-browser:1.4.0bdc4c6b8595b
mail@2.7.1
2.9.1
1
library/logstash:7.17.817a4f64e9cf5
mail@2.6.6
2.9.1
1
library/logstash:9.1.233eae14f0867
mail@2.8.1
2.9.1
1
library/redmine:6.1.204ac44a2595b
mail@2.8.1
2.9.1
1
mirrorgitlabcontainers/gitlab-sidekiq-ce:v13.2.294d1431683fa
mail@2.7.1
2.9.1
1
mirrorgitlabcontainers/gitlab-task-runner-ce:v13.2.29efd73993c34
mail@2.7.1
2.9.1
1
mirrorgitlabcontainers/gitlab-webservice-ce:v13.2.230393f990f5c
mail@2.7.1
2.9.1
1
muluder/prograncontrollermcord:0.1.843b597a93da7
ruby2.3@2.3.1-2~16.04.5
no fix listed
1
octoboxio/octobox:latestd909041c46eb
mail@2.9.0
2.9.1
1
omecproject/onos-progran:1.0.05715e5648aa0
ruby2.3@2.3.1-2~16.04.5
no fix listed
1
openproject/community:12.0.2734743d11094
mail@2.7.1
2.9.1
1
opensearchproject/logstash-oss-with-opensearch-output-plugin:8.9.043b0cdaf26ed
mail@2.6.6
2.9.1
1
uffizzi/app:latest66e9e3937c60
mail@2.7.1
2.9.1
1
vmware/kube-fluentd-operator:latestf028c138a5f4
mail@2.8.1
2.9.1
1
wallarm/kong:3.1.0-ubuntu-4.6.0ea9608c82e40
ruby2.7@2.7.0-5ubuntu1.8
no fix listed
1
ghcr.io/kvaps/opennebula:v5.12.0.4-1e28e0e7de11b
ruby2.7@2.7.0-5ubuntu1.5
no fix listed
1
ghcr.io/kvaps/opennebula-exporter:v5.12.0.401563adc95fd
ruby2.7@2.7.0-5ubuntu1.4
no fix listed
1
ghcr.io/kvaps/opennebula-exporter:v5.12.0.4-12b92df1143b9
ruby2.7@2.7.0-5ubuntu1.5
no fix listed
1
ghcr.io/kvaps/opennebula-flow:v5.12.0.4-1600221f0f43f
ruby2.7@2.7.0-5ubuntu1.5
no fix listed
1
ghcr.io/kvaps/opennebula-gate:v5.12.0.4-1a85e03d8bc1d
ruby2.7@2.7.0-5ubuntu1.5
no fix listed
1
ghcr.io/manyfold3d/manyfold:0.136.0d14ca4d82475
mail@2.9.0
2.9.1
1
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
mail@2.8.0.1
2.9.1
1
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
mail@2.8.1
2.9.1
1
ghcr.io/open-telemetry/demo:1.12.0-emailservicea1f5cebb5240
mail@2.8.1
2.9.1
1
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
mail@2.8.0.1
2.9.1
1
ghcr.io/simoncaron/velero-notifications:1.0.0d058963d4de7
mail@2.7.1
2.9.1
1
ghcr.io/voxpupuli/container-puppetserver:7.17.0-v1.5.0916746209ac5
ruby3.0@3.0.2-7ubuntu2.4
no fix listed
1
ghcr.io/voxpupuli/puppetserver:8.7.0-main63873f3f698e
ruby3.0@3.0.2-7ubuntu2.8
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.