CVE-2026-9496
HighAdvisory
Published 26 May 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.7
- base score, highest
- EPSS
- 0.003
- 28th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 663
- of 17,781 indexed, latest versions
- Container images
- 677
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
pacote is vulnerable to Denial of Service (DoS) via the addGitSha function
Carried by container images the latest versions of 663 of 17,781 indexed charts deploy, on 677 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| npmdeb | 3.5.2-0ubuntu4, 6.14.4+ds-1ubuntu2, 9.2.0~ds1-2, 11.17.0-0 | no fix listed | 7 |
| pacotenpm | 11.2.7, 11.3.1, 11.3.3, 11.3.4+30 more | 21.5.1 | 671 |
Charts affected
663 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| convertigoconvertigoOfficialVerified publisher | 8.4.3 | 1 of 5See more | 17,404 |
| cosmocosmo-platformOfficialVerified publisher | 0.20.0 | 3 of 10See more | 28,839 |
| hoppscotchdeliveryheroVerified publisher | 0.3.2 | 1 of 1See more | 3,451 |
| duplistatusduplistatusVerified publisher | 1.2.0 | 1 of 2See more | 1,870 |
| nightscoutgabe565Verified publisher | 0.13.0 | 1 of 2See more | 2,521 |
| audiobookshelfgeek-cookbookVerified publisher | 1.2.2 | 1 of 1See more | 1,959 |
| mealiegeek-cookbookVerified publisher | 5.1.2 | 1 of 2See more | 7,579 |
| zwavejs2mqttgeek-cookbookVerified publisher | 5.4.2 | 1 of 1See more | 3,476 |
| graphql-hivegraphql-hive | 1.0.0 | 9 of 17See more | 10,311 |
| coreinstill-aiOfficialVerified publisher | 0.1.75 | 1 of 15See more | 30,816 |
| dynamodbkeyporttech | 0.1.27 | 1 of 2See more | 1,304 |
| kubeviouskubevious | 1.2.2 | 3 of 7See more | 14,204 |
| bitwarden-crd-operatorlerentisVerified publisher | 0.18.0 | 1 of 1See more | 2,003 |
| activepiecesmeyerchartsVerified publisher | 0.1.6 | 1 of 1See more | 2,635 |
| kobotoolboxone-acre-fundVerified publisher | 0.7.4 | 1 of 9See more | 18,517 |
| n8none-acre-fundVerified publisher | 0.1.52 | 1 of 3See more | 7,776 |
| openclaw-with-brainopenclaw-with-brainVerified publisher | 0.1.67 | 1 of 3See more | 5,218 |
| kratos-selfservice-ui-nodeory | 0.64.0 | 1 of 1See more | 1,966 |
| pacmanpacmanVerified publisher | 2.0.2 | 1 of 2See more | 638 |
| overseerrpree-helm-chartsVerified publisher | 1.2.0 | 1 of 1See more | 2,702 |
| laravelrenoki-co | 1.0.0 | 1 of 2See more | 6,931 |
| hedgedocrobertobochetVerified publisher | 1.4.0 | 1 of 1See more | 977 |
| browserless-chromesagikazarmarkVerified publisher | 0.0.5 | 1 of 1See more | 24,488 |
| soketisoketi | 2.0.0 | 1 of 1See more | 1,636 |
| pretixtechwolf12Verified publisher | 2026.7.0 | 1 of 3See more | 9,770 |
| thingsboard-clusterthingsboard-cluster-bettaVerified publisher | 0.2.26 | 1 of 6See more | 14,566 |
| feedbacksystemthm-mni-iiVerified publisher | 0.47.1 | 3 of 10See more | 28,534 |
| wgerwgerOfficialVerified publisher | 1.0.0 | 1 of 8See more | 8,491 |
| nocodbzekker6Verified publisher | 1.10.0 | 1 of 1See more | 4,016 |
| agentareaagentareaVerified publisher | 0.0.18 | 2 of 16See more | 14,914 |
| bredbandskollen-prometheus-exporteraolde | 0.2.3 | 1 of 1See more | 1,972 |
| dbgateappscodeVerified publisher | 2026.3.30 | 1 of 1See more | 458 |
| dltbrokerassist-iot-distributed-broker | 0.2.0 | 1 of 9See more | 77,706 |
| dltloggingassist-iot-logging-auditing | 0.2.0 | 1 of 9See more | 77,687 |
| kinesisaws-kinesis-local | 0.8.0 | 1 of 1See more | 360 |
| seerrbdclark-helm-chartsVerified publisher | 0.1.5 | 1 of 1See more | 1,991 |
| maildevchristianhuthVerified publisher | 1.6.0 | 1 of 1See more | 1,143 |
| skoonerchristianhuthVerified publisher | 0.4.0 | 1 of 1See more | 1,341 |
| data-fairdata354-helmVerified publisher | 1.1.2 | 6 of 12See more | 38,346 |
| mastodondefault-ghVerified publisher | 0.3.1 | 1 of 3See more | 5,056 |
| directusdirectus-io | 2.1.0 | 1 of 3See more | 7,473 |
| jellystatdjjudas21Verified publisher | 0.1.12 | 1 of 1See more | 1,722 |
| joplin-serverdjjudas21Verified publisher | 5.5.8 | 1 of 1See more | 3,925 |
| domain-lockerdomain-locker | 0.2.8 | 1 of 3See more | 1,882 |
| rstudiodsri-helm-charts | 0.1.28 | 1 of 1See more | 5,670 |
| enbuildenbuildVerified publisher | 0.0.50 | 3 of 6See more | 31,510 |
| ethereumjsethereum-helm-chartsVerified publisher | 0.1.2 | 1 of 2See more | 1,442 |
| iobrokereugen | 0.2.6 | 1 of 1See more | 11,458 |
| atlas-cmmsf3k-techVerified publisher | 0.151.5 | 1 of 4See more | 5,291 |
| taigafermosit | 0.0.11 | 1 of 7See more | 8,496 |
Container images carrying it
677 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| opea/ | 7f854e9bffaf | pacote | 21.5.1 | 1 |
| openbas/ | a277796d9724 | pacote | 21.5.1 | 1 |
| opencti/ | 186fc757c3eb | pacote | 21.5.1 | 1 |
| opendatacube/ | 80df355a660b | pacote | 21.5.1 | 1 |
| openemr/ | 89eaa6d9a4e3 | pacote | 21.5.1 | 1 |
| openproject/ | 88dc1359dfb5 | pacote | 21.5.1 | 1 |
| openthread/ | f307f59f6432 | npm | no fix listed | 1 |
| openwhisk/ | c80dba0de3aa | npm | no fix listed | 1 |
| oryd/ | 6465e95993b5 | pacote | 21.5.1 | 1 |
| oryd/ | 46a7bac1ad0c | pacote | 21.5.1 | 1 |
| oryd/ | d454c21c11bc | pacote | 21.5.1 | 1 |
| otwld/ | d1954b759e47 | pacote | 21.5.1 | 1 |
| outlinewiki/ | 494dfb9249a6 | pacote | 21.5.1 | 1 |
| outlinewiki/ | 832051f039b4 | pacote | 21.5.1 | 1 |
| pawelmalak/ | 93e7b0abb603 | pacote | 21.5.1 | 1 |
| pawelmalak/ | 9f88b17692a0 | pacote | 21.5.1 | 1 |
| penpotapp/ | 5c835ffd87ab | pacote | 21.5.1 | 1 |
| penpotapp/ | 72a8061e8806 | pacote | 21.5.1 | 1 |
| penpotapp/ | 84f3f07ead11 | pacote | 21.5.1 | 1 |
| phpdockerio/ | ea8354b42600 | pacote | 21.5.1 | 1 |
| plumdog/ | 0c2fa2db0357 | pacote | 21.5.1 | 1 |
| polonel/ | 0cf6513f6fe3 | pacote | 21.5.1 | 1 |
| pretix/ | 5df3b7aa852e | pacote | 21.5.1 | 1 |
| promasu/ | 51d1142b9f95 | pacote | 21.5.1 | 1 |
| prowlercloud/ | 79ee83c8e702 | pacote | 21.5.1 | 1 |
| pschiffe/ | 37ebba8c2b8f | pacote | 21.5.1 | 1 |
| psorab/ | 53b68896c4ce | pacote | 21.5.1 | 1 |
| pumejlab/ | f563eabcb819 | pacote | 21.5.1 | 1 |
| punkerside/ | be20c81d6ca1 | pacote | 21.5.1 | 1 |
| qxip/ | 77acc9c7a9fd | pacote | 21.5.1 | 1 |
| rahulbhiwagade122/ | 08490b70998c | pacote | 21.5.1 | 1 |
| redis/ | 019fcf774631 | pacote | 21.5.1 | 1 |
| redis/ | 55542a762210 | pacote | 21.5.1 | 1 |
| redis/ | 699d341bd329 | pacote | 21.5.1 | 1 |
| redis/ | 85562d67a912 | pacote | 21.5.1 | 1 |
| rocketadmin/ | 10955ef540b9 | pacote | 21.5.1 | 1 |
| rocketchat/ | 44af8ac4e711 | pacote | 21.5.1 | 1 |
| rocketchat/ | 6bc18fb5d0e5 | pacote | 21.5.1 | 1 |
| rocketchat/ | 819771c4abe4 | pacote | 21.5.1 | 1 |
| rocketchat/ | c1170bdfe797 | pacote | 21.5.1 | 1 |
| safeglobal/ | 12ccfd93fcaf | pacote | 21.5.1 | 1 |
| saidsef/ | 67025e3a163e | pacote | 21.5.1 | 1 |
| samajh/ | ea742b4372ad | pacote | 21.5.1 | 1 |
| samajh/ | 05ef4fddbb75 | pacote | 21.5.1 | 1 |
| sharanalwar/ | 5e82950b16b7 | pacote | 21.5.1 | 1 |
| shinobisystems/ | 3ca746937856 | pacote | 21.5.1 | 1 |
| shinobisystems/ | c2f5ce2e1067 | pacote | 21.5.1 | 1 |
| shyamkrishna21/ | af2785f5bb71 | pacote | 21.5.1 | 1 |
| shyamkrishna21/ | 3998b83def53 | pacote | 21.5.1 | 1 |
| sigp/ | 2c219b04758e | pacote | 21.5.1 | 1 |