GO-2026-5841
UnscoredAdvisory
Published 27 Jul 2026In the index since 5 Sept 2026
- Severity
- Unscored
- worst across findings
- CVSS
- —
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 1,278
- of 17,792 indexed, latest versions
- Container images
- 1,348
- deployed by those charts
- Fix available
- 1 of 1
- affected package
OOB read in github.com/klauspost/compress/s2
Carried by container images the latest versions of 1,278 of 17,792 indexed charts deploy, on 1,348 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| github.com/ | v1.16.0, v1.16.3, v1.16.5, v1.16.6+20 more | 1.18.7 | 1,348 |
- OSV records
- GO-2026-5841
- Also known as
- GHSA-259r-337f-4rfw
Charts affected
1,278 by stars
Container images carrying it
1,348 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | 66d353e7693f | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 49800ff775f3 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | efb69ec3330c | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 5a6fe78d4d15 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 5afcab98d9d7 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | b380b5f17c3f | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 187007974540 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 4fdf4edfda45 | github.com/ | 1.18.7 | 1 |
| ghcr.io/ | 78f9b82050bc | github.com/ | 1.18.7 | 1 |
| mcr.microsoft.com/ | 6e43ba0bd009 | github.com/ | 1.18.7 | 1 |
| mcr.microsoft.com/ | f9e20264150a | github.com/ | 1.18.7 | 1 |
| mcr.microsoft.com/ | afdfa3da79df | github.com/ | 1.18.7 | 1 |
| mcr.microsoft.com/ | fa8eba9843ff | github.com/ | 1.18.7 | 1 |
| mcr.microsoft.com/ | 59b9d0348428 | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | 1eb61443d68e | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | d94ce715f051 | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | b654b266fa32 | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | 9ad31fb4e5be | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | 8aa9ea5f67b8 | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | 01d8413d5075 | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | 6769c2275a43 | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | 90b890f800ab | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | 86957bbeeff5 | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | f4925b15ce94 | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | f1348a65664a | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | f68901a54664 | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | ee9d973e3952 | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | af8cea3b8538 | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | 70f191d0a80e | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | d75b6da94913 | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | fe383abf1dbc | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | a94d2d4aae85 | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | f30f0dc32205 | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | 1afcfbc000e0 | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | e97e0e7a2088 | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | cfc92cc2de65 | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | 9083e60c38bc | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | 651739583336 | github.com/ | 1.18.7 | 1 |
| public.ecr.aws/ | 08c90bd040bf | github.com/ | 1.18.7 | 1 |
| quay.io/ | 0deb1a1c9176 | github.com/ | 1.18.7 | 1 |
| quay.io/ | 95b5cf7ba6fe | github.com/ | 1.18.7 | 1 |
| quay.io/ | a36ab0c0860c | github.com/ | 1.18.7 | 1 |
| quay.io/ | acaf37352569 | github.com/ | 1.18.7 | 1 |
| quay.io/ | 577fc18f86ad | github.com/ | 1.18.7 | 1 |
| quay.io/ | 6efd1cb89dc1 | github.com/ | 1.18.7 | 1 |
| quay.io/ | 91b9825f09a8 | github.com/ | 1.18.7 | 1 |
| quay.io/ | a83d2699ae53 | github.com/ | 1.18.7 | 1 |
| quay.io/ | 3c56f354fac5 | github.com/ | 1.18.7 | 1 |
| quay.io/ | a09814522a72 | github.com/ | 1.18.7 | 1 |
| quay.io/ | 51dded00137a | github.com/ | 1.18.7 | 1 |