CVE-2026-80230

High

Advisory

Published 2 Sept 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.006; 45th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,912; of 17,790 indexed, latest versions
Container images: 1,721; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 1,912 of 17,790 indexed charts deploy, on 1,721 images.

Affected package	Affected versions	Fixed in	Images
curldeb	1:8.14.1-2+deb13u3+e1, 7.47.0-1ubuntu2.2, 7.47.0-1ubuntu2.5, 7.47.0-1ubuntu2.6+107 more	1:8.14.1-2+deb13u3+e2	1,365
curlapk	8.10.1-r0, 8.10.1-r1, 8.12.0-r1, 8.12.1-r0+12 more	8.22.0-r0	356

OSV records: ALPINE-CVE-2026-80230 CGA-fch3-mxx2-fc37 DEBIAN-CVE-2026-80230 UBUNTU-CVE-2026-80230 ECHO-1d32-d52b-d070
Also known as: CGA-ff7h-5wg5-4v24
Trending: Rank 44 in indexed charts, since 5 Sept 2026. See the ranking →

Charts affected

1,912 by stars

Chart

Latest

Affected images

Radar Score

wordpress-alpinewordpress-alpine

1.5.18

2 of 6 See more

wordpress-alpine wordpress-alpine 1.5.18

2 of the 6 container images this version deploys carry CVE-2026-80230.

Container image	Digest	Package	Fixed in
ghcr.io/shesselink81/nginx-alpine :7.1.0.0	9783481cad2a	curl@8.21.0-r0	8.22.0-r0
ghcr.io/shesselink81/wordpress-alpine :7.1.0.0	32ace450bcd9	curl@8.21.0-r0	8.22.0-r0

Open the chart page →

4,032

Wordpresswordpress-mariadb

1.0.2

1 of 2 See more

Wordpress wordpress-mariadb 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-80230.

Container image	Digest	Package	Fixed in
library/wordpress :latest	5a93c470ae82	curl@8.14.1-2+deb13u4	no fix listed

Open the chart page →

5,635

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-80230.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	curl@7.81.0-1ubuntu1.16	no fix listed

Open the chart page →

14,172

xboardxboard

0.2.0

1 of 1 See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-80230.

Container image	Digest	Package	Fixed in
ghcr.io/cedar2025/xboard :latest	896e4926e0d7	curl@8.20.0-r0	8.22.0-r0

Open the chart page →

1,042

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-80230.

Container image	Digest	Package	Fixed in
library/nginx :1.25	a484819eb602	curl@7.88.1-10+deb12u5	no fix listed

Open the chart page →

7,685

xkopsxkops

0.1.0

2 of 5 See more

xkops xkops 0.1.0

2 of the 5 container images this version deploys carry CVE-2026-80230.

Container image	Digest	Package	Fixed in
library/mongo :latest	5211c51171f5	curl@8.5.0-2ubuntu10.11	no fix listed
murtazashah46/helmfile :latest	4d11726cf803	curl@7.88.1-10+deb12u7	no fix listed

Open the chart page →

13,197

nginx-chartxxoznge-nginx

0.1.0

1 of 1 See more

nginx-chart xxoznge-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-80230.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	curl@8.14.1-2+deb13u4	no fix listed

Open the chart page →

1,839

my-nginx-appyasser-nginx-app

0.1.0

1 of 1 See more

my-nginx-app yasser-nginx-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-80230.

Container image	Digest	Package	Fixed in
library/nginx :stable	d5792f71a949	curl@8.14.1-2+deb13u4	no fix listed

Open the chart page →

1,839

prometheus-monitoring-stackyotron-helm-charts

1.2.0

1 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

1 of the 3 container images this version deploys carry CVE-2026-80230.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	curl@8.21.0-r0	8.22.0-r0

Open the chart page →

879

language-toolzekker6

1.12.1

1 of 2 See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-80230.

Container image	Digest	Package	Fixed in
erikvl87/languagetool :6.7-dockerupdate-3	e1ea6a975388	curl@8.17.0-r1	8.22.0-r0

Open the chart page →

1,571

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-80230.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	curl@8.14.1-2+deb13u4	no fix listed

Open the chart page →

1,839

zoo-project-druzoo-project

0.10.4

2 of 6 See more

zoo-project-dru zoo-project 0.10.4

2 of the 6 container images this version deploys carry CVE-2026-80230.

Container image	Digest	Package	Fixed in
library/postgres :18.4-alpine3.24	9a8afca54e78	curl@8.21.0-r0	8.22.0-r0
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	curl@7.81.0-1ubuntu1.25	no fix listed

Open the chart page →

7,916

Container images carrying it

1,721 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
freeradius/freeradius-server :3.0.21	21c8bfa904d8	curl@7.58.0-2ubuntu3.8	no fix listed	2
freikin/dawarich :1.14.5	11826c67e4b1	curl@8.14.1-2+deb13u5	no fix listed	2
geoservercloud/geoserver-cloud-gateway :1.0-RC3	756559ee788a	curl@7.68.0-1ubuntu2.7	no fix listed	2
geoservercloud/geoserver-cloud-rest :1.0-RC3	99540eef78ad	curl@7.68.0-1ubuntu2.7	no fix listed	2
geoservercloud/geoserver-cloud-wcs :1.0-RC3	5c254c53a357	curl@7.68.0-1ubuntu2.7	no fix listed	2
geoservercloud/geoserver-cloud-webui :1.0-RC3	c687b1cbc891	curl@7.68.0-1ubuntu2.7	no fix listed	2
geoservercloud/geoserver-cloud-wfs :1.0-RC3	5288f320cf36	curl@7.68.0-1ubuntu2.7	no fix listed	2
geoservercloud/geoserver-cloud-wms :1.0-RC3	a30a60ac6cd0	curl@7.68.0-1ubuntu2.7	no fix listed	2
gisaia/agate :0.18.1	98213fa403ae	curl@8.21.0-r0	8.22.0-r0	2
gisaia/airs :0.18.1	5abfe00317bf	curl@8.21.0-r0	8.22.0-r0	2
gisaia/aproc-service :0.18.1	ac6564921994	curl@8.21.0-r0	8.22.0-r0	2
gisaia/arlas-fam-wui :0.18.1	3700dcaf7a75	curl@8.20.0-r0	8.22.0-r0	2
gisaia/arlas-wui :28.0.3	b83b3e067173	curl@8.19.0-r0	8.22.0-r0	2
gisaia/arlas-wui-builder :28.0.1	a35977a5bb7d	curl@8.19.0-r0	8.22.0-r0	2
gisaia/arlas-wui-hub :28.0.2	1a3cc43d822f	curl@8.19.0-r0	8.22.0-r0	2
gisaia/fam :0.18.1	ae525930b4b6	curl@8.21.0-r0	8.22.0-r0	2
gjeanmart/safe-ganache-node :latest	926264c8f2d1	curl@7.88.1-10	no fix listed	2
gotenberg/gotenberg :8.36.0	87c16b9f3642	curl@8.21.0-2~bpo13+1	no fix listed	2
gotenberg/gotenberg :8 :8.37.0	f29984bd1e22	curl@8.21.0-2~bpo13+1	no fix listed	2
gotson/komga :1.26.3	6c2a967bbe9a	curl@8.18.0-1ubuntu2.3	no fix listed	2
gradiant/ueransim :3.2.6	015b30d5fa0f	curl@7.81.0-1ubuntu1.20	no fix listed	2
grafana/grafana :12.3.1	2175aaa91c96	curl@8.17.0-r1	8.22.0-r0	2
grafana/grafana :12.3.3	9e1e77ade304	curl@8.17.0-r1	8.22.0-r0	2
grafana/grafana :12.4.1	e932bd6ed0e0	curl@8.17.0-r1	8.22.0-r0	2
graviteeio/apim-gateway :4.12.19-debian	05fd67a93056	curl@8.14.1-2+deb13u4	no fix listed	2
graviteeio/apim-management-api :4.12.19-debian	27374522cd04	curl@8.14.1-2+deb13u4	no fix listed	2
homebridge/homebridge :latest	77c685a40911	curl@8.5.0-2ubuntu10.13	no fix listed	2
infisical/infisical :latest :v0.165.6	02082bf13163	curl@8.14.1-2+deb13u4	no fix listed	2
interlayhq/interbtc :latest	a66d0e35e70f	curl@7.68.0-1ubuntu2.25	no fix listed	2
istio/kubectl :1.5.10	dbb7726d1bf0	curl@7.58.0-2ubuntu3.9	no fix listed	2
istio/proxyv2 :1.18.0	757d28c24100	curl@7.81.0-1ubuntu1.10	no fix listed	2
istio/proxyv2 :1.10.3	a78b7a165744	curl@7.58.0-2ubuntu3.13	no fix listed	2
jenkins/jenkins :2.426.1-jdk11	b470bcdc4ecd	curl@7.88.1-10+deb12u4	no fix listed	2
jenkins/jenkins :2.541.3-jdk21	c4098086090c	curl@8.14.1-2+deb13u2	no fix listed	2
jupyterhub/configurable-http-proxy :5.3.0 :latest	69a7170eeeda	curl@8.19.0-r0	8.22.0-r0	2
kubeshop/testkube-api-server :2.13.2	44166c28422f	curl@8.21.0-r0	8.22.0-r0	2
kurento/kurento-media-server :latest	03c0d34d0828	curl@8.5.0-2ubuntu10.6	no fix listed	2
library/buildpack-deps :curl	04907bdd423b	curl@8.14.1-2+deb13u4	no fix listed	2
library/caddy :2.11.4-alpine :2-alpine	5f5c8640aae0	curl@8.19.0-r0	8.22.0-r0	2
library/caddy :latest	df7f1c2fb114	curl@8.19.0-r0	8.22.0-r0	2
library/cassandra :3.11.6	5aa8400b4b3b	curl@7.58.0-2ubuntu3.9	no fix listed	2
library/cassandra :4.1.3	7cbcec0086ac	curl@7.81.0-1ubuntu1.15	no fix listed	2
library/elasticsearch :7.17.3	5e6ac15bf6a5	curl@7.68.0-1ubuntu2.7	no fix listed	2
library/elasticsearch :8.19.12	89729a95066a	curl@8.5.0-2ubuntu10.8	no fix listed	2
library/influxdb :2.7	b8d940ca9376	curl@7.88.1-10+deb12u14	no fix listed	2
library/mongo :8.0.20	098862b1339f	curl@8.5.0-2ubuntu10.8	no fix listed	2
library/mongo :5.0	41108d183e97	curl@7.68.0-1ubuntu2.25	no fix listed	2
library/mongo :4.2.3	58b25d51baa1	curl@7.58.0-2ubuntu3.8	no fix listed	2
library/mongo :7	b096b4cb9269	curl@7.81.0-1ubuntu1.27	no fix listed	2
library/mongo :7.0	b6421fd6d1c5	curl@7.81.0-1ubuntu1.25	no fix listed	2