StackRadar

GO-2026-5048

Unscored

Advisory

Published 27 Jul 2026In the index since 5 Sept 2026
Severity
Unscored
worst across findings
CVSS
—
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
27
of 17,781 indexed, latest versions
Container images
23
deployed by those charts
Fix available
None
affected package

Denial of service via unbounded map allocations in github.com/iskorotkov/avro/v2 and github.com/hamba/avro/v2

Carried by container images the latest versions of 27 of 17,781 indexed charts deploy, on 23 images.

Affected packageAffected versionsFixed inImages
github.com/hamba/avro/v2golangv2.25.1, v2.26.0, v2.28.0, v2.29.0+2 moreno fix listed23
OSV records
GO-2026-5048
Also known as
GHSA-mx64-mj3q-7prj

Charts affected

27 by stars
ChartLatestAffected imagesRadar Score
argo-eventsargoOfficialVerified publisher2.4.271 of 1See more

argo-events argo 2.4.27

1 of the 1 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
github.com/hamba/avro/v2@v2.31.0
no fix listed

Open the chart page →

969
signozsignoz0.141.11 of 5See more

signoz signoz 0.141.1

1 of the 5 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
signoz/signoz-otel-collector:v0.144.972aa1e4c1ec5
github.com/hamba/avro/v2@v2.30.0
no fix listed

Open the chart page →

7,568
k8s-infrasignoz0.17.11 of 1See more

k8s-infra signoz 0.17.1

1 of the 1 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.139.0faf125d656fa
github.com/hamba/avro/v2@v2.29.0
no fix listed

Open the chart page →

1,039
bentoself-hosters-by-nightVerified publisher0.9.11 of 1See more

bento self-hosters-by-night 0.9.1

1 of the 1 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
ghcr.io/warpstreamlabs/bento:1.8.121715979aefa
github.com/hamba/avro/v2@v2.26.0
no fix listed

Open the chart page →

1,046
opentelemetry-demoopentelemetry-helmVerified publisher0.41.11 of 34See more

opentelemetry-demo opentelemetry-helm 0.41.1

1 of the 34 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.156.0125bdbeb7590
github.com/hamba/avro/v2@v2.31.0
no fix listed

Open the chart page →

22,420
versitygw-webhook-pulsar-proxyalpineworks0.1.11 of 1See more

versitygw-webhook-pulsar-proxy alpineworks 0.1.1

1 of the 1 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
ghcr.io/alpineworks/versitygw-webhook-pulsar-proxy:v1.0.06e9ced773732
github.com/hamba/avro/v2@v2.26.0
no fix listed

Open the chart page →

893
otel-collectorarieotechVerified publisher0.1.01 of 1See more

otel-collector arieotech 0.1.0

1 of the 1 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.154.0b3079f45e19b
github.com/hamba/avro/v2@v2.31.0
no fix listed

Open the chart page →

245
catalyst-agentscatalyst-agents0.1.301 of 18See more

catalyst-agents catalyst-agents 0.1.30

1 of the 18 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.156.0125bdbeb7590
github.com/hamba/avro/v2@v2.31.0
no fix listed

Open the chart page →

15,027
argo-eventscluster-deploy0.1.01 of 1See more

argo-events cluster-deploy 0.1.0

1 of the 1 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.10a83d2699ae53
github.com/hamba/avro/v2@v2.31.0
no fix listed

Open the chart page →

1,035
dapr-agentsdapr-agents-devVerified publisher0.1.51 of 31See more

dapr-agents dapr-agents-dev 0.1.5

1 of the 31 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.145.0a7343f018690
github.com/hamba/avro/v2@v2.30.0
no fix listed

Open the chart page →

22,193
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.114.037fa87091cfa
github.com/hamba/avro/v2@v2.25.1
no fix listed

Open the chart page →

49,025
pyroscope-monitoringgrafana0.1.11 of 6See more

pyroscope-monitoring grafana 0.1.1

1 of the 6 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
grafana/otel-lgtm:0.11.1009d8c3ce4f3a
github.com/hamba/avro/v2@v2.28.0
no fix listed

Open the chart page →

8,188
armada-executorgresearch0.22.81 of 1See more

armada-executor gresearch 0.22.8

1 of the 1 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
gresearch/armada-executor:latest393aff4aa8f2
github.com/hamba/avro/v2@v2.31.0
no fix listed

Open the chart page →

707
armada-lookout-ingestergresearch0.22.81 of 1See more

armada-lookout-ingester gresearch 0.22.8

1 of the 1 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
gresearch/armada-lookout-ingester:latest3df14cda1855
github.com/hamba/avro/v2@v2.31.0
no fix listed

Open the chart page →

707
armada-lookout-migrationgresearch0.22.81 of 1See more

armada-lookout-migration gresearch 0.22.8

1 of the 1 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
gresearch/armada-lookout:latestf5e3226f1d33
github.com/hamba/avro/v2@v2.31.0
no fix listed

Open the chart page →

707
armada-scheduler-migrationgresearch0.22.81 of 1See more

armada-scheduler-migration gresearch 0.22.8

1 of the 1 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
gresearch/armada-scheduler:latest6141a6213fcb
github.com/hamba/avro/v2@v2.31.0
no fix listed

Open the chart page →

707
ilum-otel-collectorilumVerified publisher0.1.01 of 1See more

ilum-otel-collector ilum 0.1.0

1 of the 1 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.113.05ac3e0ba2b0b
github.com/hamba/avro/v2@v2.25.1
no fix listed

Open the chart page →

1,384
openlitopenlit1.24.01 of 3See more

openlit openlit 1.24.0

1 of the 3 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
ghcr.io/openlit/openlit:1.24.02434560e8f0e
github.com/hamba/avro/v2@v2.29.0
no fix listed

Open the chart page →

5,017
soha-observabilityopensohaVerified publisher0.2.11 of 2See more

soha-observability opensoha 0.2.1

1 of the 2 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.157.0f2f01157055a
github.com/hamba/avro/v2@v2.31.0
no fix listed

Open the chart page →

336
parcaparca-rr0.1.01 of 2See more

parca parca-rr 0.1.0

1 of the 2 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
ghcr.io/parca-dev/parca:v0.24.23776500fde82
github.com/hamba/avro/v2@v2.29.0
no fix listed

Open the chart page →

2,366
tykquench-tyk0.0.131 of 2See more

tyk quench-tyk 0.0.13

1 of the 2 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/tykdigest-pinnedfca606eb53eb
github.com/hamba/avro/v2@v2.31.0
no fix listed

Open the chart page →

46
monitoringrocketchat-server0.0.171 of 9See more

monitoring rocketchat-server 0.0.17

1 of the 9 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.143.03bc07732530c
github.com/hamba/avro/v2@v2.29.0
no fix listed

Open the chart page →

6,859
tyk-control-planetyk-helm5.3.02 of 7See more

tyk-control-plane tyk-helm 5.3.0

2 of the 7 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
tykio/tyk-dashboard:v5.13.10e03b94c153d
github.com/hamba/avro/v2@v2.31.0
no fix listed
tykio/tyk-gateway-ee:v5.13.13e907e675bf9
github.com/hamba/avro/v2@v2.31.0
no fix listed

Open the chart page →

2,925
tyk-dashboardtyk-helm5.3.01 of 1See more

tyk-dashboard tyk-helm 5.3.0

1 of the 1 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
tykio/tyk-dashboard:v5.13.10e03b94c153d
github.com/hamba/avro/v2@v2.31.0
no fix listed

Open the chart page →

653
tyk-data-planetyk-helm5.3.01 of 3See more

tyk-data-plane tyk-helm 5.3.0

1 of the 3 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
tykio/tyk-gateway-ee:v5.13.13e907e675bf9
github.com/hamba/avro/v2@v2.31.0
no fix listed

Open the chart page →

848
tyk-stacktyk-helm5.3.02 of 7See more

tyk-stack tyk-helm 5.3.0

2 of the 7 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
tykio/tyk-dashboard:v5.13.10e03b94c153d
github.com/hamba/avro/v2@v2.31.0
no fix listed
tykio/tyk-gateway-ee:v5.13.13e907e675bf9
github.com/hamba/avro/v2@v2.31.0
no fix listed

Open the chart page →

2,875
argo-eventswenerme2.4.271 of 1See more

argo-events wenerme 2.4.27

1 of the 1 container images this version deploys carry GO-2026-5048.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
github.com/hamba/avro/v2@v2.31.0
no fix listed

Open the chart page →

969

Container images carrying it

23 by charts deploying them

A fixed version is listed for 0 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
tykio/tyk-dashboard:v5.13.10e03b94c153d
github.com/hamba/avro/v2@v2.31.0
no fix listed
3
tykio/tyk-gateway-ee:v5.13.13e907e675bf9
github.com/hamba/avro/v2@v2.31.0
no fix listed
3
otel/opentelemetry-collector-contrib:0.156.0125bdbeb7590
github.com/hamba/avro/v2@v2.31.0
no fix listed
2
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
github.com/hamba/avro/v2@v2.31.0
no fix listed
2
grafana/otel-lgtm:0.11.1009d8c3ce4f3a
github.com/hamba/avro/v2@v2.28.0
no fix listed
1
gresearch/armada-executor:latest393aff4aa8f2
github.com/hamba/avro/v2@v2.31.0
no fix listed
1
gresearch/armada-lookout:latestf5e3226f1d33
github.com/hamba/avro/v2@v2.31.0
no fix listed
1
gresearch/armada-lookout-ingester:latest3df14cda1855
github.com/hamba/avro/v2@v2.31.0
no fix listed
1
gresearch/armada-scheduler:latest6141a6213fcb
github.com/hamba/avro/v2@v2.31.0
no fix listed
1
otel/opentelemetry-collector-contrib:0.114.037fa87091cfa
github.com/hamba/avro/v2@v2.25.1
no fix listed
1
otel/opentelemetry-collector-contrib:0.143.03bc07732530c
github.com/hamba/avro/v2@v2.29.0
no fix listed
1
otel/opentelemetry-collector-contrib:0.113.05ac3e0ba2b0b
github.com/hamba/avro/v2@v2.25.1
no fix listed
1
otel/opentelemetry-collector-contrib:0.145.0a7343f018690
github.com/hamba/avro/v2@v2.30.0
no fix listed
1
otel/opentelemetry-collector-contrib:0.154.0b3079f45e19b
github.com/hamba/avro/v2@v2.31.0
no fix listed
1
otel/opentelemetry-collector-contrib:0.157.0f2f01157055a
github.com/hamba/avro/v2@v2.31.0
no fix listed
1
otel/opentelemetry-collector-contrib:0.139.0faf125d656fa
github.com/hamba/avro/v2@v2.29.0
no fix listed
1
signoz/signoz-otel-collector:v0.144.972aa1e4c1ec5
github.com/hamba/avro/v2@v2.30.0
no fix listed
1
ghcr.io/alpineworks/versitygw-webhook-pulsar-proxy:v1.0.06e9ced773732
github.com/hamba/avro/v2@v2.26.0
no fix listed
1
ghcr.io/openlit/openlit:1.24.02434560e8f0e
github.com/hamba/avro/v2@v2.29.0
no fix listed
1
ghcr.io/parca-dev/parca:v0.24.23776500fde82
github.com/hamba/avro/v2@v2.29.0
no fix listed
1
ghcr.io/quenchworks/images/tykfca606eb53eb
github.com/hamba/avro/v2@v2.31.0
no fix listed
1
ghcr.io/warpstreamlabs/bento:1.8.121715979aefa
github.com/hamba/avro/v2@v2.26.0
no fix listed
1
quay.io/argoproj/argo-events:v1.9.10a83d2699ae53
github.com/hamba/avro/v2@v2.31.0
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.