CVE-2026-71557
MediumAdvisory
Published 7 Aug 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.3
- base score, highest
- EPSS
- 0.004
- 35th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 205
- of 17,781 indexed, latest versions
- Container images
- 207
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
go-git: Malicious reference names may modify files outside the reference storage
Carried by container images the latest versions of 205 of 17,781 indexed charts deploy, on 207 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| github.com/ | v5.0.0, v5.1.0, v5.2.0, v5.3.0+23 more | 5.19.2 | 205 |
| github.com/ | v6.0.0-alpha.3, v6.0.0-alpha.4.0.20260520124234-0860a7d8a164 | 6.0.0-alpha.5 | 2 |
- OSV records
- GHSA-qgq7-7hm3-q39j
- Also known as
- GO-2026-6214
Charts affected
205 by stars
Container images carrying it
207 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| quay.io/ | ebba936046ab | github.com/ | 5.19.2 | 1 |
| quay.io/ | c241c971aef8 | github.com/ | 5.19.2 | 1 |
| quay.io/ | 6ff40fa6257f | github.com/ | 5.19.2 | 1 |
| quay.io/ | bca5dfcc67ca | github.com/ | 5.19.2 | 1 |
| quay.io/ | 7b4202c25b67 | github.com/ | 5.19.2 | 1 |
| registry.gitlab.com/ | 5b7636dfba3f | github.com/ | 5.19.2 | 1 |
| registry.gitlab.com/ | 9b9d1ed86b6a | github.com/ | 5.19.2 | 1 |