GHSA-w5hq-g745-h8pq

High

Advisory

Published 22 Apr 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.004; 28th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 602; of 17,787 indexed, latest versions
Container images: 600; deployed by those charts
Fix available: 1 of 1; affected package

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

Carried by container images the latest versions of 602 of 17,787 indexed charts deploy, on 600 images.

Affected package	Affected versions	Fixed in	Images
uuidnpm	2.0.2, 2.0.3, 3.0.1, 3.1.0+15 more	11.1.1, 13.0.1	600

OSV records: GHSA-w5hq-g745-h8pq
Also known as: CVE-2026-41907, CVE-2026-41988

Charts affected

602 by stars

Chart

Latest

Affected images

Radar Score

helloworldyotron-helm-charts

0.1.0

1 of 1 See more

helloworld yotron-helm-charts 0.1.0

1 of the 1 container images this version deploys carry GHSA-w5hq-g745-h8pq.

Container image	Digest	Package	Fixed in
a5hut0sh/helloworld :1.0	2ae77620e616	uuid@3.3.2	11.1.1

Open the chart page →

1,309

alertmanager-matrix-forwarderzloi-space

1.0.1

1 of 2 See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry GHSA-w5hq-g745-h8pq.

Container image	Digest	Package	Fixed in
zl0i/alertmanager-matrix-forwarder :v1.0.0	e94047931739	uuid@3.4.0	11.1.1

Open the chart page →

3,118

Container images carrying it

600 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
enketo/enketo-express :3.0.4	dcad9c2273f6	uuid@3.3.3	11.1.1	1
ethereumex/eth-stats-dashboard :v0.0.1	a7603aa8df4c	uuid@3.1.0	11.1.1	1
ethereumoptimism/data-transport-layer :0.5.56	e07968a0e686	uuid@8.3.2	11.1.1	1
etherpad/etherpad :2.7.2	b723fe5f2594	uuid@8.3.2	11.1.1	1
ethersphere/bzz-token-service :latest	7624f11a72ad	uuid@3.3.3	11.1.1	1
ethpandaops/blobscan :latest	7a9ab6370657	uuid@8.3.2	11.1.1	1
ethpandaops/blobscan-indexer :latest	c58eb9ffe446	uuid@3.3.3	11.1.1	1
ethpandaops/ethereumjs :master	fb84b718500f	uuid@11.1.0	11.1.1	1
evoapicloud/evolution-api :latest	966625532d90	uuid@13.0.0	13.0.1	1
factly/mande-web :0.34.1	742355964b0e	uuid@9.0.1	11.1.1	1
fallenbagel/jellyseerr :latest	4538137bc5af	uuid@9.0.1	11.1.1	1
fallenbagel/jellyseerr :1.7.0	6dcdb5ba5091	uuid@3.4.0	11.1.1	1
fanzynoodle/smeejas :0.0.1	5f9916c1a287	uuid@3.4.0	11.1.1	1
felddy/foundryvtt :0.8.3	6c5d90b90349	uuid@3.4.0	11.1.1	1
felipecs8/app-movies-series :v1	4e51693fcdf5	uuid@3.4.0	11.1.1	1
fiware/biz-ecosystem-logic-proxy :11.20.3	d551a13e8278	uuid@3.4.0	11.1.1	1
fiware/idm :8.3.3	a1b6ed4ae84f	uuid@3.4.0	11.1.1	1
fiware/iotagent-json :3.1.0	879b21a0d36d	uuid@8.3.2	11.1.1	1
fiware/iotagent-ul :1.14.0	fe11f55a926d	uuid@3.3.3	11.1.1	1
flagsmith/flagsmith-frontend :v2.6.0	df02a29e8b0c	uuid@3.3.2	11.1.1	1
flanksource/canary-checker-ui :v1.4.281	764c84e550db	uuid@8.3.2	11.1.1	1
folioci/mod-graphql :latest	f0655a6a08fd	uuid@9.0.1	11.1.1	1
fonoster/routr-connect :2.13.6	e8c84b5eaa67	uuid@8.3.2	11.1.1	1
fonoster/routr-dispatcher :2.13.6	5f8f380dc174	uuid@8.3.2	11.1.1	1
fonoster/routr-location :2.13.6	051ba9c34ef5	uuid@8.3.2	11.1.1	1
fonoster/routr-pgdata :2.13.6	e4d5f5ff1945	uuid@8.3.2	11.1.1	1
fonoster/routr-registry :2.13.6	e27001f2813c	uuid@8.3.2	11.1.1	1
fosrl/pangolin :1.13.0	c32ad797ab96	uuid@10.0.0	11.1.1	1
frappe/frappe-socketio :v13.4.1	2095767a9e82	uuid@3.4.0	11.1.1	1
freikin/dawarich :1.14.5	11826c67e4b1	uuid@8.3.2	11.1.1	1
galaxy/galaxy-init :v18.01	0267bad550e6	uuid@3.1.0	11.1.1	1
gethue/hue :4.11.0	11b649636e68	uuid@3.3.3	11.1.1	1
gethue/hue :4.10.0	5702b2c37ff9	uuid@3.3.3	11.1.1	1
ghostfolio/ghostfolio :3.7.0	e3c6ab53e49b	uuid@8.3.2	11.1.1	1
glenndehaan/api-mapper :latest	6ff6310683bf	uuid@3.4.0	11.1.1	1
glenndehaan/contentbridge :latest	99b9e4f73848	uuid@8.3.2	11.1.1	1
glenndehaan/kube-hook :latest	0a7116f48bfe	uuid@3.4.0	11.1.1	1
governify/collector-dynamic :v1.3.0	6d3d1a5b46a9	uuid@3.4.0	11.1.1	1
graphiteapp/graphite-statsd :1.1.7-6	04a0037cc2ae	uuid@3.3.3	11.1.1	1
gristlabs/grist :0.7.9	6e71b1914a7e	uuid@8.3.2	11.1.1	1
halkeye/gitter-slack-bridge :v2.0.1	53eb2b3cd4cb	uuid@3.3.3	11.1.1	1
halkeye/hubot :latest	9764d2202130	uuid@3.3.2	11.1.1	1
halkeye/irslackd :latest	7638bfba70b0	uuid@3.3.2	11.1.1	1
hansehe/graphql-gateway :1.0.4	58e09540afbc	uuid@8.3.1	11.1.1	1
haveagitgat/tdarr_node :2.00.10	1e3f9328327d	uuid@3.3.3	11.1.1	1
haveagitgat/tdarr_node :2.17.01	3ff0913202dd	uuid@3.4.0	11.1.1	1
hecrom/myweatherprocessingreactclient :1.3.11	5454b54d5b28	uuid@8.3.2	11.1.1	1
helga09/shoes_ukr :v1.1.1	7999bc8b77c0	uuid@8.3.2	11.1.1	1
henrywhitaker3/speedtest-tracker :latest	47159a940229	uuid@3.4.0	11.1.1	1
heywood8/redisinsight :2.28.0	0bc9ab313d37	uuid@3.4.0	11.1.1	1