CVE-2026-9538

High

Advisory

Published 26 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.004; 38th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,460; of 17,813 indexed, latest versions
Container images: 2,459; deployed by those charts
Fix available: 42 of 42; affected packages

Red Hat Security Advisory: perl:5.32 security update

Carried by container images the latest versions of 2,460 of 17,813 indexed charts deploy, on 2,459 images.

Affected package	Affected versions	Fixed in	Images
perldeb	5.18.2-2ubuntu1, 5.18.2-2ubuntu1.1, 5.18.2-2ubuntu1.4, 5.18.2-2ubuntu1.7+47 more	5.38.2-3.2ubuntu0.4, 5.40.1-6+e6	2,438
perlrpm	0:1.28-416.el8, 0:1.28-417.el8_3, 0:1.28-419.el8_4.1, 0:1.28-420.el8+4 more	0:1.30-474.module+el8.10.0+24099+8aa2f756, 0:5.74-474.module+el8.10.0+24099+8aa2f756	19
perl-Carprpm	1.42-396.el8	0:1.50-439.module+el8.10.0+21354+3ad137bb	16
perl-constantrpm	1.33-396.el8	0:1.33-1001.module+el8.10.0+21354+3ad137bb	16
perl-Exporterrpm	5.72-396.el8	0:5.74-458.module+el8.10.0+21354+3ad137bb	16
perl-File-Pathrpm	2.15-2.el8	0:2.16-439.module+el8.10.0+21354+3ad137bb	16
perl-parentrpm	1:0.237-1.el8	1:0.238-457.module+el8.10.0+21354+3ad137bb	16
perl-PathToolsrpm	3.74-1.el8	0:3.78-439.module+el8.10.0+21354+3ad137bb	16
perl-Scalar-List-Utilsrpm	3:1.49-2.el8	4:1.55-457.module+el8.10.0+21354+3ad137bb	16
perl-Socketrpm	4:2.027-3.el8	4:2.031-1.module+el8.10.0+21354+3ad137bb	16
perl-Text-Tabs+Wraprpm	2013.0523-395.el8	0:2013.0523-396.module+el8.10.0+21354+3ad137bb	16
perl-threadsrpm	1:2.21-2.el8	1:2.25-457.module+el8.10.0+21354+3ad137bb	16
perl-threads-sharedrpm	1.58-2.el8	0:1.61-457.module+el8.10.0+21354+3ad137bb	16
perl-Unicode-Normalizerpm	1.25-396.el8	0:1.27-458.module+el8.10.0+21354+3ad137bb	16
perl-Encoderpm	4:2.97-3.el8	4:3.08-461.module+el8.10.0+21354+3ad137bb	15
perl-File-Temprpm	0.230.600-1.el8	1:0.231.100-1.module+el8.10.0+21354+3ad137bb	15
perl-Getopt-Longrpm	1:2.50-4.el8	1:2.52-1.module+el8.10.0+21354+3ad137bb	15
perl-HTTP-Tinyrpm	0.074-1.el8, 0.074-1.el8_6.1, 0.074-2.el8, 0.074-2.el8_9.1+1 more	0:0.078-1.module+el8.10.0+21354+3ad137bb	15
perl-MIME-Base64rpm	3.15-396.el8	0:3.15-1001.module+el8.10.0+21354+3ad137bb	15
perl-Pod-Escapesrpm	1:1.07-395.el8	1:1.07-396.module+el8.10.0+21354+3ad137bb	15
perl-podlatorsrpm	4.11-1.el8	1:4.14-457.module+el8.10.0+21354+3ad137bb	15
perl-Pod-Perldocrpm	3.28-396.el8	0:3.28.01-443.module+el8.10.0+21354+3ad137bb	15
perl-Pod-Simplerpm	1:3.35-395.el8	1:3.42-1.module+el8.10.0+21354+3ad137bb	15
perl-Pod-Usagerpm	4:1.69-395.el8	4:2.01-1.module+el8.10.0+21354+3ad137bb	15
perl-Storablerpm	1:3.11-3.el8	1:3.21-457.module+el8.10.0+21354+3ad137bb	15
perl-Term-ANSIColorrpm	4.06-396.el8	0:5.01-458.module+el8.10.0+21354+3ad137bb	15
perl-Term-Caprpm	1.17-395.el8	0:1.17-396.module+el8.10.0+21354+3ad137bb	15
perl-Text-ParseWordsrpm	3.30-395.el8	0:3.30-396.module+el8.10.0+21354+3ad137bb	15
perl-Time-Localrpm	1:1.280-1.el8	2:1.300-4.module+el8.10.0+21354+3ad137bb	15
perl-Data-Dumperrpm	2.167-399.el8	0:2.174-440.module+el8.10.0+21354+3ad137bb	14
perl-Digestrpm	1.17-395.el8	0:1.20-1.module+el8.10.0+21354+3ad137bb	13
perl-Digest-MD5rpm	2.55-396.el8	0:2.58-1.module+el8.10.0+21354+3ad137bb	13
perl-IO-Socket-IPrpm	0.39-5.el8	0:0.41-2.module+el8.10.0+21354+3ad137bb	13
perl-libnetrpm	3.11-3.el8	0:3.13-1.module+el8.10.0+21354+3ad137bb	13
perl-URIrpm	1.73-3.el8	0:1.76-5.module+el8.10.0+21354+3ad137bb	13
perl-Archive-Tarrpm	2.38-6.el9, 2.38-6.el9.0.1	0:2.38-6.el9_8.2	2
perl-Thread-Queuerpm	3.13-1.el8	0:3.14-457.module+el8.10.0+21354+3ad137bb	2
perl-Compress-Raw-Bzip2rpm	2.081-1.el8	0:2.096-1.module+el8.10.0+21354+3ad137bb	1
perl-Compress-Raw-Zlibrpm	2.081-1.el8	0:2.096-2.module+el8.10.0+21354+3ad137bb	1
perl-Digest-SHArpm	1:6.02-1.el8	1:6.02-2.module+el8.10.0+21354+3ad137bb	1
perl-Encode-Localerpm	1.05-10.module+el8.3.0+6498+9eecfe51	0:1.05-10.module+el8.10.0+21354+3ad137bb	1
perl-IO-Compressrpm	2.081-1.el8	0:2.096-2.module+el8.10.0+24402+ce90c7a0	1

OSV records: DEBIAN-CVE-2026-9538 RHSA-2026:48225 RLSA-2026:49525 UBUNTU-CVE-2026-9538 ECHO-e379-3651-bf29
Also known as: USN-8684-1

Charts affected

2,460 by stars

Chart

Latest

Affected images

Radar Score

nightingalexxl-job-admin

0.2.11

3 of 6 See more

nightingale xxl-job-admin 0.2.11

3 of the 6 container images this version deploys carry CVE-2026-9538.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	perl@5.38.2-3.2ubuntu0.2	5.38.2-3.2ubuntu0.4
flashcatcloud/nightingale :8.0.0-beta.11	ea1b0aaabe09	perl@5.36.0-7+deb12u2	no fix listed
library/redis :6.2	d2ad7b21cafa	perl@5.36.0-7+deb12u3	no fix listed

Open the chart page →

9,738

pgcatxxl-job-admin

0.3.3

1 of 1 See more

pgcat xxl-job-admin 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-9538.

Container image	Digest	Package	Fixed in
ghcr.io/postgresml/pgcat :v1.2.0	627761f6dcbc	perl@5.36.0-7+deb12u1	no fix listed

Open the chart page →

3,196

nginx-chartxxoznge-nginx

0.1.0

1 of 1 See more

nginx-chart xxoznge-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-9538.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	perl@5.40.1-6	no fix listed

Open the chart page →

1,956

helm-demoyahoon-helm-demo

1.0.0

1 of 1 See more

helm-demo yahoon-helm-demo 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-9538.

Container image	Digest	Package	Fixed in
ghcr.io/yahoon/helm-demo :1.0.0	2930290a758c	perl@5.40.1-6	no fix listed

Open the chart page →

1,338

my-nginx-appyasser-nginx-app

0.1.0

1 of 1 See more

my-nginx-app yasser-nginx-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-9538.

Container image	Digest	Package	Fixed in
library/nginx :stable	d5792f71a949	perl@5.40.1-6	no fix listed

Open the chart page →

1,956

api-snapyoukadev

0.1.1

1 of 1 See more

api-snap youkadev 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-9538.

Container image	Digest	Package	Fixed in
youkadev/api-snap :0.1.1	4db0f9428e67	perl@5.36.0-7+deb12u1	no fix listed

Open the chart page →

2,718

changedetection-iozekker6

1.102.0

1 of 1 See more

changedetection-io zekker6 1.102.0

1 of the 1 container images this version deploys carry CVE-2026-9538.

Container image	Digest	Package	Fixed in
ghcr.io/dgtlmoon/changedetection.io :0.60.7	096dae27b5d6	perl@5.36.0-7+deb12u3	no fix listed

Open the chart page →

2,697

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-9538.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	perl@5.40.1-6	no fix listed

Open the chart page →

1,956

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-9538.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	perl@5.26.1-6ubuntu0.5	no fix listed
yandex/clickhouse-server :21.3.20	4eccfffb01d7	perl@5.30.0-9ubuntu0.2	no fix listed

Open the chart page →

9,296

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-9538.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	perl@5.34.0-3ubuntu1.7	no fix listed

Open the chart page →

7,966

Container images carrying it

2,459 by charts deploying them

A fixed version is listed for 42 of the 42 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/serenita-org/vero :v0.8.3	e5a7ec714acc	perl@5.36.0-7+deb12u1	no fix listed	1
ghcr.io/sergelogvinov/fluentd :1.19.3	3273d13f1e75	perl@5.40.1-6	no fix listed	1
ghcr.io/sergelogvinov/mongodb :8.0.10	1eee8e20a87f	perl@5.36.0-7+deb12u2	no fix listed	1
ghcr.io/sergelogvinov/mongosqld :2.14.23	0b826375ed42	perl@5.34.0-3ubuntu1.4	no fix listed	1
ghcr.io/sergelogvinov/mongosync :1.15.0	fa99ed475f03	perl@5.38.2-3.2ubuntu0.2	5.38.2-3.2ubuntu0.4	1
ghcr.io/sergelogvinov/pgbouncer :16.15	18f1121ba0a4	perl@5.36.0-7+deb12u3	no fix listed	1
ghcr.io/sergelogvinov/postgresql :16.15	fafb72e98f22	perl@5.36.0-7+deb12u3	no fix listed	1
ghcr.io/shadrus/srebot :0.14.0	9b4415e937b2	perl@5.40.1-6	no fix listed	1
ghcr.io/siafoundation/renterd :2.9.0	e0334f124863	perl@5.36.0-7+deb12u3	no fix listed	1
ghcr.io/siafoundation/s3d :bf33bf3	b3fcc85f7282	perl@5.36.0-7+deb12u3	no fix listed	1
ghcr.io/sikalabs/hello-world-server :latest	cf8538bf6489	perl@5.40.1-6	no fix listed	1
ghcr.io/sissbruecker/linkding :1.45.0	61b2eb9eed8e	perl@5.40.1-6	no fix listed	1
ghcr.io/slskd/slskd :0.25.1	ab9ed50e028b	perl@5.38.2-3.2ubuntu0.2	5.38.2-3.2ubuntu0.4	1
ghcr.io/smarter-project/audio-client :v3.1.2	3c8375dc5487	perl@5.30.0-9ubuntu0.3	no fix listed	1
ghcr.io/smarter-project/gstreamer :v1.0.2	5ecb16015aa8	perl@5.30.0-9ubuntu0.3	no fix listed	1
ghcr.io/smarter-project/image-detector :v2.5.3	1dcca70c6446	perl@5.30.0-9ubuntu0.3	no fix listed	1
ghcr.io/spidernet-io/egressgateway-agent :v0.6.9	a8ec2f74c9d0	perl@5.38.2-3.2ubuntu0.1	5.38.2-3.2ubuntu0.4	1
ghcr.io/spidernet-io/egressgateway-controller :v0.6.9	9deda7b68c34	perl@5.38.2-3.2ubuntu0.1	5.38.2-3.2ubuntu0.4	1
ghcr.io/spidernet-io/spiderpool/spiderpool-agent :v1.2.0	8bb9411e47e0	perl@5.30.0-9ubuntu0.5	no fix listed	1
ghcr.io/spidernet-io/spiderpool/spiderpool-controller :v1.2.0	42304e3ed36e	perl@5.30.0-9ubuntu0.5	no fix listed	1
ghcr.io/squent/kuma-ingress-watcher :1.7.0	14d45b2a1f00	perl@5.36.0-7+deb12u1	no fix listed	1
ghcr.io/stac-utils/stac-fastapi-pgstac :7.0.0	8b026c47cc1b	perl@5.40.1-6+deb13u1	no fix listed	1
ghcr.io/star-whale/server :0.6.15	8368359c8dd0	perl@5.30.0-9ubuntu0.2	no fix listed	1
ghcr.io/steadybit/agent :2.4.6	d246bfa55f63	perl@5.40.1-6+deb13u1	no fix listed	1
ghcr.io/steadybit/extension-container :v1.8.1	ae79f958b479	perl@5.40.1-6+deb13u1	no fix listed	1
ghcr.io/steadybit/extension-host :v1.8.1	03a5ef26aac5	perl@5.40.1-6+deb13u1	no fix listed	1
ghcr.io/stirling-tools/stirling-pdf :2.14.3	3b3670fce70b	perl@5.38.2-3.2ubuntu0.2	5.38.2-3.2ubuntu0.4	1
ghcr.io/streamingfast/firehose-core :v1.12.3	91fca773a63f	perl@5.38.2-3.2ubuntu0.2	5.38.2-3.2ubuntu0.4	1
ghcr.io/streamingfast/firehose-ethereum :v2.12.4	89969b78fb07	perl@5.38.2-3.2ubuntu0.1	5.38.2-3.2ubuntu0.4	1
ghcr.io/streamingfast/firehose-ethereum :v2.14.3	bf816072380e	perl@5.38.2-3.2ubuntu0.2	5.38.2-3.2ubuntu0.4	1
ghcr.io/streamingfast/firehose-ethereum :v2.12.4-geth	d7bdfa7b41da	perl@5.38.2-3.2ubuntu0.1	5.38.2-3.2ubuntu0.4	1
ghcr.io/streamingfast/go-ethereum :geth-v1.16.9-fh3.0	8e3cb38953a3	perl@5.38.2-3.2ubuntu0.2	5.38.2-3.2ubuntu0.4	1
ghcr.io/streamingfast/substreams-sink-kv :v2.3.0	26953ec68d5d	perl@5.30.0-9ubuntu0.5	no fix listed	1
ghcr.io/streamingfast/substreams-sink-noop :v1.4.0	d7c43c3135c6	perl@5.30.0-9ubuntu0.5	no fix listed	1
ghcr.io/streamvisor/streamvisor :4.1.4	0bc598b2ac9a	perl@5.38.2-3.2ubuntu0.2	5.38.2-3.2ubuntu0.4	1
ghcr.io/strrl/wonder-mesh-net :v2026.629.0	625b140372fd	perl@5.36.0-7+deb12u3	no fix listed	1
ghcr.io/substra/substra-backend :1.0.1	21967f54ec86	perl@5.38.2-3.2build2	5.38.2-3.2ubuntu0.4	1
ghcr.io/sudo-kraken/3d-printing-cost-calculators :v1.1.1	220c5e4e1a3d	perl@5.36.0-7+deb12u3	no fix listed	1
ghcr.io/sudo-kraken/authentik-webfinger-proxy :v1.1.1	e1351a977607	perl@5.36.0-7+deb12u3	no fix listed	1
ghcr.io/sudo-kraken/fantasy-dice-chamber :v1.3.2	99fd4cb0f4fe	perl@5.36.0-7+deb12u3	no fix listed	1
ghcr.io/sudo-kraken/finances-tracker :v1.1.1	c73527cde81c	perl@5.36.0-7+deb12u3	no fix listed	1
ghcr.io/sudo-kraken/jf-pushover-webhook :v1.1.0	ee9cf22a39ab	perl@5.36.0-7+deb12u3	no fix listed	1
ghcr.io/suwayomi/suwayomi-server :v2.3.2320	d2c3218c7f9f	perl@5.38.2-3.2ubuntu0.3	5.38.2-3.2ubuntu0.4	1
ghcr.io/tarampampam/video-dl-bot :1.4.3	6daa2dc7556b	perl@5.40.1-6	no fix listed	1
ghcr.io/tauffer-consulting/domino-rest :latest	8bf880fe8c73	perl@5.36.0-7+deb12u1	no fix listed	1
ghcr.io/theduffman85/crowdsec-web-ui :2026.8.3	bfadbab9a72c	perl@5.40.1-6	no fix listed	1
ghcr.io/toeverything/affine :0.27.4	b649f5ce2384	perl@5.36.0-7+deb12u3	no fix listed	1
ghcr.io/topolvm/pie :0.18.0	aa467443e407	perl@5.34.0-3ubuntu1.7	no fix listed	1
ghcr.io/topolvm/topolvm-with-sidecar :0.41.1	70548dbe0c6a	perl@5.34.0-3ubuntu1.7	no fix listed	1
ghcr.io/topolvm/topolvm-with-sidecar :0.35.0	b354978c440d	perl@5.34.0-3ubuntu1.3	no fix listed	1