GHSA-w5hq-g745-h8pq

High

Advisory

Published 22 Apr 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.004; 28th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 602; of 17,787 indexed, latest versions
Container images: 600; deployed by those charts
Fix available: 1 of 1; affected package

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

Carried by container images the latest versions of 602 of 17,787 indexed charts deploy, on 600 images.

Affected package	Affected versions	Fixed in	Images
uuidnpm	2.0.2, 2.0.3, 3.0.1, 3.1.0+15 more	11.1.1, 13.0.1	600

OSV records: GHSA-w5hq-g745-h8pq
Also known as: CVE-2026-41907, CVE-2026-41988

Charts affected

602 by stars

Chart

Latest

Affected images

Radar Score

helloworldyotron-helm-charts

0.1.0

1 of 1 See more

helloworld yotron-helm-charts 0.1.0

1 of the 1 container images this version deploys carry GHSA-w5hq-g745-h8pq.

Container image	Digest	Package	Fixed in
a5hut0sh/helloworld :1.0	2ae77620e616	uuid@3.3.2	11.1.1

Open the chart page →

1,309

alertmanager-matrix-forwarderzloi-space

1.0.1

1 of 2 See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry GHSA-w5hq-g745-h8pq.

Container image	Digest	Package	Fixed in
zl0i/alertmanager-matrix-forwarder :v1.0.0	e94047931739	uuid@3.4.0	11.1.1

Open the chart page →

3,118

Container images carrying it

600 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
oryd/hive-selfservice-ui-node :v0.0.4	26347ef0a2de	uuid@3.3.2	11.1.1	1
oryd/kratos-selfservice-ui-node :v0.13.0-20	d454c21c11bc	uuid@3.4.0	11.1.1	1
otwld/velero-ui :0.10.2	d1954b759e47	uuid@13.0.0	13.0.1	1
outlinewiki/outline :0.82.0	494dfb9249a6	uuid@9.0.1	11.1.1	1
pachyderm/grpc-proxy :0.4.9	2b27f41d4d02	uuid@3.3.2	11.1.1	1
parithoshj/testnet-faucet :9859e0d	cdca426fea6d	uuid@3.3.3	11.1.1	1
patdada/bella-docker :v1.0.0	75127147a624	uuid@3.4.0	11.1.1	1
patrickhulce/lhci-server :0.8.1	74b4b6a3954d	uuid@3.3.2	11.1.1	1
pawelmalak/flame :2.1.1	93e7b0abb603	uuid@8.3.2	11.1.1	1
pawelmalak/flame :multiarch2.3.1	9f88b17692a0	uuid@8.3.2	11.1.1	1
phntom/camo :2.3.1	a9b1304d6c71	uuid@3.3.3	11.1.1	1
phntom/codimd :2.4.3	1b9aafbb62e6	uuid@3.4.0	11.1.1	1
plumdog/db-operator :latest	0c2fa2db0357	uuid@3.4.0	11.1.1	1
polonel/trudesk :1.2.6	0cf6513f6fe3	uuid@3.3.2	11.1.1	1
project2team4/react :latest	3ff031a08887	uuid@3.3.3	11.1.1	1
rahulbhiwagade122/desishowbiz :latest	08490b70998c	uuid@9.0.1	11.1.1	1
rakii8585/angular-node-webapp :latest	026082a515ac	uuid@3.3.3	11.1.1	1
redis/redisinsight :2.68	019fcf774631	uuid@8.3.2	11.1.1	1
redis/redisinsight :3.2.0	55542a762210	uuid@11.1.0	11.1.1	1
redis/redisinsight :2.46	699d341bd329	uuid@9.0.0	11.1.1	1
redis/redisinsight :3.4	85562d67a912	uuid@11.1.0	11.1.1	1
refar/apm-portal :v5.7.1	dcca8e4477a6	uuid@3.3.3	11.1.1	1
requarks/wiki :canary-2.5.243	8b5865a7386c	uuid@7.0.3	11.1.1	1
rlex/jsonvisio :1.9.5	cd50ff65118e	uuid@3.3.3	11.1.1	1
roadiehq/community-backstage-image :latest	ef355bf5b639	uuid@3.3.3	11.1.1	1
robotshop/rs-cart :latest	388349d5cb3c	uuid@3.3.3	11.1.1	1
robotshop/rs-catalogue :latest	d545747c1b97	uuid@3.4.0	11.1.1	1
robotshop/rs-user :latest	ea509182c180	uuid@3.3.3	11.1.1	1
rocketchat/ddp-streamer-service :8.6.1	819771c4abe4	uuid@8.3.2	11.1.1	1
saidsef/aws-kinesis-local :v2026.06	67025e3a163e	uuid@7.0.3	11.1.1	1
samajh/alprfrontend :latest	05ef4fddbb75	uuid@3.4.0	11.1.1	1
shahanafarooqui/rtl :0.11.0	d0cd3d868aca	uuid@3.4.0	11.1.1	1
shinobisystems/shinobi :dev	3ca746937856	uuid@3.4.0	11.1.1	1
shinobisystems/shinobi :latest	c2f5ce2e1067	uuid@8.3.2	11.1.1	1
shyamkrishna21/cloudvault :latest	af2785f5bb71	uuid@8.3.2	11.1.1	1
shyamkrishna21/shopsync :latest	3998b83def53	uuid@8.3.2	11.1.1	1
sigp/siren :v3.0.4	2c219b04758e	uuid@9.0.1	11.1.1	1
siscc/dotstatsuite-data-lifecycle-manager :v14.0.0	b6f9a7c888fc	uuid@8.3.2	11.1.1	1
slagattollas/server-practica :latest	6dd8ead8e2b1	uuid@3.3.3	11.1.1	1
slagattollas/weatherservice-practica :latest	68e7f56393fc	uuid@3.3.3	11.1.1	1
snyk/kubernetes-monitor :2.23.26	fb5ad76ce84e	uuid@3.4.0	11.1.1	1
socialmediamacroscope/smile_graphql :0.3.1	c5095e94bc65	uuid@9.0.1	11.1.1	1
socialmediamacroscope/smile_server :0.3.3	1a528c794270	uuid@3.4.0	11.1.1	1
solidproject/community-server :6.0.2	ccc4acb7e9a1	uuid@8.3.2	11.1.1	1
someblackmagic/alertmanager-to-alerta-bot :latest	78bf43744ea5	uuid@8.3.2	11.1.1	1
someblackmagic/alert-mapper :v0.1.0	88351d85c04c	uuid@8.3.2	11.1.1	1
soulteary/cronicle :0.9.80	ac2512fa6e39	uuid@3.3.2	11.1.1	1
speckle/speckle-preview-service :2.26.3	092384dba45d	uuid@8.3.2	11.1.1	1
speckle/speckle-preview-service :2.23.14-branch.testing6.334655-b4e04ee	6dee853ba74a	uuid@8.3.2	11.1.1	1
speckle/speckle-preview-service :2.25.10-branch.testing6.645-b125c1e	787adcb20a3a	uuid@8.3.2	11.1.1	1