GHSA-w5hq-g745-h8pq

High

Advisory

Published 22 Apr 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.004; 28th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 602; of 17,787 indexed, latest versions
Container images: 600; deployed by those charts
Fix available: 1 of 1; affected package

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

Carried by container images the latest versions of 602 of 17,787 indexed charts deploy, on 600 images.

Affected package	Affected versions	Fixed in	Images
uuidnpm	2.0.2, 2.0.3, 3.0.1, 3.1.0+15 more	11.1.1, 13.0.1	600

OSV records: GHSA-w5hq-g745-h8pq
Also known as: CVE-2026-41907, CVE-2026-41988

Charts affected

602 by stars

Chart

Latest

Affected images

Radar Score

helloworldyotron-helm-charts

0.1.0

1 of 1 See more

helloworld yotron-helm-charts 0.1.0

1 of the 1 container images this version deploys carry GHSA-w5hq-g745-h8pq.

Container image	Digest	Package	Fixed in
a5hut0sh/helloworld :1.0	2ae77620e616	uuid@3.3.2	11.1.1

Open the chart page →

1,309

alertmanager-matrix-forwarderzloi-space

1.0.1

1 of 2 See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry GHSA-w5hq-g745-h8pq.

Container image	Digest	Package	Fixed in
zl0i/alertmanager-matrix-forwarder :v1.0.0	e94047931739	uuid@3.4.0	11.1.1

Open the chart page →

3,118

Container images carrying it

600 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
mojaloop/event-sidecar :v11.0.1	89b8ab71b74b	uuid@3.3.3	11.1.1	5
decisionrules/server :latest	f38d8571fa06	uuid@8.3.2	11.1.1	4
hyperledger/fabric-ca-tools :latest	4ce6f43ded2e	uuid@3.1.0	11.1.1	4
hyperledger/fabric-couchdb :0.4.15	f6c724592abf	uuid@3.1.0	11.1.1	4
oscarsotosanchez/server :v1.0	6e2e1279126b	uuid@8.3.2	11.1.1	4
oscarsotosanchez/weatherservice :v1.0	911ec961d10b	uuid@3.3.3	11.1.1	4
redis/redisinsight :3.8 :latest	b5e19ee240ab	uuid@8.3.2	11.1.1	4
ghcr.io/advplyr/audiobookshelf :2.36.0	180acad33d69	uuid@8.3.2	11.1.1	4
ghcr.io/skooner-k8s/skooner :stable	60c1562e4d51	uuid@3.4.0	11.1.1	4
assistiot/dlt_api :2.0.0	e36a8922fa0c	uuid@8.3.2	11.1.1	3
dgraph/dgraph :v21.12.0	3b55ea83fffe	uuid@3.3.3	11.1.1	3
frankescobar/allure-docker-service-ui :7.0.3 :latest	4ebd8b4ef340	uuid@3.3.3	11.1.1	3
mojaloop/account-lookup-service :v11.8.0	b06d3287ea82	uuid@3.3.3	11.1.1	3
pantsel/konga :latest	c8172b75607d	uuid@3.1.0	11.1.1	3
rcdelacruz/my-strapi-app :js-amd64	38007f358355	uuid@8.3.2	11.1.1	3
ghcr.io/kamilkisiela/graphql-hive/app :59b64c36c866b3555c135c70de76a884e63f8619	a4a3639899f7	uuid@8.3.2	11.1.1	3
ghcr.io/seerr-team/seerr :latest :v3.4.1	f4768de5f616	uuid@9.0.1	11.1.1	3
quay.io/devtron/notifier :9804331c-372-39294	709c7da19c5a	uuid@8.3.2	11.1.1	3
quay.io/hedgedoc/hedgedoc :1.12.0	89bd85d7817f	uuid@3.4.0	11.1.1	3
actualbudget/actual-server :26.9.0	552beab3dec8	uuid@8.3.2	11.1.1	2
agoldis/sorry-cypress-api :2.5.11	afaa5a84051d	uuid@3.4.0	11.1.1	2
agoldis/sorry-cypress-director :2.5.11	10228ecd353b	uuid@3.3.2	11.1.1	2
amazon/opendistro-for-elasticsearch-kibana :1.13.2	c740d7a89475	uuid@3.3.2	11.1.1	2
chatwoot/chatwoot :v3.1.0	d530ab8c1753	uuid@3.4.0	11.1.1	2
ethersphere/bee-localchain :latest	0558799ca992	uuid@8.3.2	11.1.1	2
fjvela/urjc-fjvela-external-service :1.0.1	a8ebe5ca13fc	uuid@3.3.3	11.1.1	2
fjvela/urjc-fjvela-server :1.0.5	3c840aebce22	uuid@3.3.3	11.1.1	2
gjeanmart/safe-ganache-node :latest	926264c8f2d1	uuid@8.3.2	11.1.1	2
governify/assets-manager :v1.4.1	2987672448c7	uuid@8.3.2	11.1.1	2
governify/director :v1.4.0	608c6940bb98	uuid@3.4.0	11.1.1	2
governify/registry :v3.4.0	d3f37f4f8168	uuid@8.3.2	11.1.1	2
governify/render :v2.2.0	daeca1ce28e6	uuid@3.4.0	11.1.1	2
governify/reporter :v2.2.0	38595913458f	uuid@3.4.0	11.1.1	2
gradiant/open5gs-webui :2.7.5	fbd10c017541	uuid@3.1.0	11.1.1	2
hookiesolutions/webhookie :latest	0629694246ba	uuid@8.3.2	11.1.1	2
hoppscotch/hoppscotch :2024.8.2	f1da831950b7	uuid@9.0.0	11.1.1	2
htmlprogrammer2001/simple-db-app :1.0	a7e0a233a9bc	uuid@3.3.3	11.1.1	2
infisical/infisical :latest :v0.165.6	02082bf13163	uuid@8.3.2	11.1.1	2
istio/examples-bookinfo-ratings-v1 :1.15.0	09b9d6958a13	uuid@3.3.2	11.1.1	2
istio/examples-bookinfo-ratings-v1 :1.14.0	eb0f1a725ca8	uuid@3.3.2	11.1.1	2
koenkk/zigbee2mqtt :1.19.1	5f9129b1ffbc	uuid@3.3.3	11.1.1	2
kutt/kutt :latest :v3.2.6	fa3d24a89b04	uuid@8.3.2	11.1.1	2
l7mp/kurento-one2one-call-server :latest	fd2b2d06fff6	uuid@3.1.0	11.1.1	2
library/ghost :6.63.0	e05bc1169fb2	uuid@9.0.1	11.1.1	2
library/mongo-express :1.0.2 :latest	1b23d7976f02	uuid@8.3.2	11.1.1	2
martinaif/backstage-k8s-demo-backend :test1	43bc40a3da0e	uuid@3.3.3	11.1.1	2
mesosphere/kommander :6.100.1	3917e82333a9	uuid@3.4.0	11.1.1	2
migmartri/prerender :latest	486aacfd5aa9	uuid@3.0.1	11.1.1	2
mojaloop/central-ledger :v13.14.0	1abc8a7aa71c	uuid@3.3.3	11.1.1	2
mojaloop/ml-api-adapter :v11.1.6	fb71d233c742	uuid@3.3.3	11.1.1	2