GHSA-w5hq-g745-h8pq

High

Advisory

Published 22 Apr 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.004; 28th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 602; of 17,787 indexed, latest versions
Container images: 600; deployed by those charts
Fix available: 1 of 1; affected package

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

Carried by container images the latest versions of 602 of 17,787 indexed charts deploy, on 600 images.

Affected package	Affected versions	Fixed in	Images
uuidnpm	2.0.2, 2.0.3, 3.0.1, 3.1.0+15 more	11.1.1, 13.0.1	600

OSV records: GHSA-w5hq-g745-h8pq
Also known as: CVE-2026-41907, CVE-2026-41988

Charts affected

602 by stars

Chart

Latest

Affected images

Radar Score

helloworldyotron-helm-charts

0.1.0

1 of 1 See more

helloworld yotron-helm-charts 0.1.0

1 of the 1 container images this version deploys carry GHSA-w5hq-g745-h8pq.

Container image	Digest	Package	Fixed in
a5hut0sh/helloworld :1.0	2ae77620e616	uuid@3.3.2	11.1.1

Open the chart page →

1,309

alertmanager-matrix-forwarderzloi-space

1.0.1

1 of 2 See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry GHSA-w5hq-g745-h8pq.

Container image	Digest	Package	Fixed in
zl0i/alertmanager-matrix-forwarder :v1.0.0	e94047931739	uuid@3.4.0	11.1.1

Open the chart page →

3,118

Container images carrying it

600 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
aureliengasser/http-folder :1.1.1	11c4318c2571	uuid@3.3.3	11.1.1	1
automatischio/automatisch :0.15.0	3bace7a12d5f	uuid@9.0.1	11.1.1	1
baserow/baserow :1.30.1	df0c42eb67e8	uuid@9.0.0	11.1.1	1
bastilimbach/docker-magicmirror :v2.15.0	41b0835ab31e	uuid@8.3.2	11.1.1	1
bicarus/mx-api-service :1.0.2-hf1	dab88659ae3b	uuid@9.0.0	11.1.1	1
billimek/node-influx-uptimerobot :latest	5814f0bcf5ba	uuid@3.2.1	11.1.1	1
bluerange/bluerange-mosquitto :25	f1bfbba84832	uuid@3.4.0	11.1.1	1
bnjbvr/kresus :0.22.1	37e216b182c8	uuid@9.0.1	11.1.1	1
browserless/chrome :1.48.0-chrome-stable	c81ae5585b47	uuid@3.4.0	11.1.1	1
budibase/apps :3.41.3	44fe6feab985	uuid@9.0.1	11.1.1	1
budibase/worker :3.41.3	de5e2e560ce8	uuid@3.4.0	11.1.1	1
carbonetes/carbonetes-analyzer :1.0.3	1b9b93c9a37f	uuid@3.4.0	11.1.1	1
catalysm/csmm :latest	f003b35f54d9	uuid@3.4.0	11.1.1	1
ccjacobs14/amazon :5	9a9b14a6f09e	uuid@8.3.2	11.1.1	1
chainsafe/lodestar :latest	5593f6e97912	uuid@9.0.1	11.1.1	1
chainsafe/lodestar :v1.27.0	7b9fe4aa8073	uuid@9.0.1	11.1.1	1
chatwoot/chatwoot :v4.15.1	67ebc751c171	uuid@3.4.0	11.1.1	1
chibisafe/chibisafe-server :latest	3da4fcbc1a18	uuid@9.0.1	11.1.1	1
chocobozzz/peertube :v8.1.5	052712130691	uuid@8.3.2	11.1.1	1
cnieg/maildev :v1.1.9	98ee05668915	uuid@3.3.3	11.1.1	1
coderaiser/cloudcmd :16.6.1	b34a9775c7ce	uuid@8.3.2	11.1.1	1
codercom/code-server :4.11.0-debian	1e2cc688008e	uuid@8.3.2	11.1.1	1
codetogether/codetogether :latest	4348c8a38752	uuid@3.4.0	11.1.1	1
coldatom/containers-security-api :latest	eae9e82da080	uuid@3.4.0	11.1.1	1
coldatom/containers-security-front :latest	7c2fbbb41bcf	uuid@8.3.2	11.1.1	1
conduction/conduction-ui-app :dev	d591f5e6f2a9	uuid@3.4.0	11.1.1	1
continuoussecuritytooling/keycloak-reporting-cli :1.3.3	f04ecefab64e	uuid@10.0.0	11.1.1	1
countly/api :25.05.4	f4cc7447c4f5	uuid@8.3.2	11.1.1	1
countly/countly-server :25.05.4	e3c238248f99	uuid@8.3.2	11.1.1	1
countly/frontend :25.05.4	2acbc11499b6	uuid@9.0.1	11.1.1	1
cryptexlabs/authf :0.12.11	189c07411d7c	uuid@9.0.1	11.1.1	1
cryptexlabs/swagger-combine-ui :0.2.1	ed0bc94fd412	uuid@3.4.0	11.1.1	1
daskdev/dask-notebook :1.1.0	052630f5ca04	uuid@3.1.0	11.1.1	1
datarhei/restreamer :0.6.4	655e12f9eeed	uuid@3.3.3	11.1.1	1
davidvmar/urjc-davidvmar-external-service :1.0.0	2a68e9ac7f09	uuid@3.3.3	11.1.1	1
davidvmar/urjc-davidvmar-server :1.0.0	5663f5b24615	uuid@3.3.3	11.1.1	1
decayofmind/hubot :3.3.2	1e18e92fe694	uuid@3.3.2	11.1.1	1
denisshav/backend :latest	4cc8dc5a4499	uuid@3.3.3	11.1.1	1
dessalines/lemmy-ui :0.19.20	ee4c620d8e93	uuid@3.2.1	11.1.1	1
devkrishan001/backend :latest	f1c3acadeabe	uuid@8.3.2	11.1.1	1
devspacecloud/ui :0.3.3	deef55ff29a7	uuid@3.3.2	11.1.1	1
directus/directus :12.0.2	9c8470ea465c	uuid@9.0.1	11.1.1	1
directus/directus :11.1.0	e3c8bb975350	uuid@10.0.0	11.1.1	1
diygod/rsshub :latest	1d4b508b6357	uuid@3.4.0	11.1.1	1
diygod/rsshub :2025-11-09	7a6312cac0d5	uuid@13.0.0	13.0.1	1
documenso/documenso :v1.8.1	7f16a9449f18	uuid@8.3.2	11.1.1	1
drumsergio/lynxprompt :2.0.75	c6afb6679301	uuid@8.3.2	11.1.1	1
eameti/node-app :latest	f36642affa86	uuid@3.3.3	11.1.1	1
eclipseaerios/benchmarking-tool :1.0.0	a4b4c2e7fe62	uuid@10.0.0	11.1.1	1
electerious/ackee :3.2.0	5e7173fa321c	uuid@8.3.2	11.1.1	1