mirror.gcr.io/rancher/k3s:v1.36.1-k3s1
clean
Patched Image
ghcr.io/verity-org/rancher/k3s:v1.36.1-k3s1
Supply Chain
Full compliance detailsSignedSLSA L3SBOMRekor
Verify this artifact
Cosign signature
cosign verify \ --certificate-identity-regexp "https://github.com/verity-org/verity/.github/workflows/" \ --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \ ghcr.io/verity-org/rancher/k3s:v1.36.1-k3s1
Build provenance
gh attestation verify \ oci://ghcr.io/verity-org/rancher/k3s:v1.36.1-k3s1 \ --owner verity-org
Before patching
Found 98 vulnerabilities — none have upstream fixes available.
1 CRITICAL59 HIGH35 MEDIUM3 UNKNOWN
Fix available — pending patch
These vulnerabilities have upstream fixes but could not be automatically patched. Manual remediation may be required.
- CVE-2026-33186CRITICAL
- Package
- google.golang.org/grpc
- Installed
- v1.78.0
- Fixed
- 1.79.3
- CVE-2026-27145HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.11, 1.26.4
- CVE-2026-33811HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-33814HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-39820HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-39836HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-42499HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-42504HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.11, 1.26.4
- CVE-2026-46680HIGH
- Package
- github.com/containerd/containerd/v2
- Installed
- v2.2.3-k3s1
- Fixed
- 2.0.9, 2.2.4, 2.3.1
- CVE-2026-53488HIGH
- Package
- github.com/containerd/containerd/v2
- Installed
- v2.2.3-k3s1
- Fixed
- 2.0.10, 2.1.9, 2.2.5, 2.3.2
- CVE-2026-53489HIGH
- Package
- github.com/containerd/containerd/v2
- Installed
- v2.2.3-k3s1
- Fixed
- 2.1.9, 2.2.5, 2.3.2
- CVE-2026-53492HIGH
- Package
- github.com/containerd/containerd/v2
- Installed
- v2.2.3-k3s1
- Fixed
- 2.1.9, 2.2.5, 2.3.2
- CVE-2026-25681HIGH
- Package
- golang.org/x/net
- Installed
- v0.47.0
- Fixed
- 0.55.0
- CVE-2026-27136HIGH
- Package
- golang.org/x/net
- Installed
- v0.47.0
- Fixed
- 0.55.0
- CVE-2026-33814HIGH
- Package
- golang.org/x/net
- Installed
- v0.47.0
- Fixed
- 0.53.0
- CVE-2026-39821HIGH
- Package
- golang.org/x/net
- Installed
- v0.47.0
- Fixed
- 0.55.0
- CVE-2026-42502HIGH
- Package
- golang.org/x/net
- Installed
- v0.47.0
- Fixed
- 0.55.0
- CVE-2026-27145HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.11, 1.26.4
- CVE-2026-33811HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-33814HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-39820HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-39836HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-42499HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-42504HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.11, 1.26.4
- CVE-2026-34040HIGH
- Package
- github.com/docker/docker
- Installed
- v25.0.15-0.20260325154711-d2dbc0547253+incompatible
- Fixed
- 29.3.1
- CVE-2026-39827HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.47.0
- Fixed
- 0.52.0
- CVE-2026-39828HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.47.0
- Fixed
- 0.52.0
- CVE-2026-39829HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.47.0
- Fixed
- 0.52.0
- CVE-2026-39830HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.47.0
- Fixed
- 0.52.0
- CVE-2026-39832HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.47.0
- Fixed
- 0.52.0
- CVE-2026-39835HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.47.0
- Fixed
- 0.52.0
- CVE-2026-42508HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.47.0
- Fixed
- 0.52.0
- CVE-2026-46595HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.47.0
- Fixed
- 0.52.0
- CVE-2026-46597HIGH
- Package
- golang.org/x/crypto
- Installed
- v0.47.0
- Fixed
- 0.52.0
- CVE-2026-25681HIGH
- Package
- golang.org/x/net
- Installed
- v0.49.0
- Fixed
- 0.55.0
- CVE-2026-27136HIGH
- Package
- golang.org/x/net
- Installed
- v0.49.0
- Fixed
- 0.55.0
- CVE-2026-33814HIGH
- Package
- golang.org/x/net
- Installed
- v0.49.0
- Fixed
- 0.53.0
- CVE-2026-39821HIGH
- Package
- golang.org/x/net
- Installed
- v0.49.0
- Fixed
- 0.55.0
- CVE-2026-42502HIGH
- Package
- golang.org/x/net
- Installed
- v0.49.0
- Fixed
- 0.55.0
- CVE-2026-27145HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.11, 1.26.4
- CVE-2026-33811HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-33814HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-39820HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-39836HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-42499HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-42504HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.11, 1.26.4
- CVE-2026-25681HIGH
- Package
- golang.org/x/net
- Installed
- v0.43.0
- Fixed
- 0.55.0
- CVE-2026-27136HIGH
- Package
- golang.org/x/net
- Installed
- v0.43.0
- Fixed
- 0.55.0
- CVE-2026-33814HIGH
- Package
- golang.org/x/net
- Installed
- v0.43.0
- Fixed
- 0.53.0
- CVE-2026-39821HIGH
- Package
- golang.org/x/net
- Installed
- v0.43.0
- Fixed
- 0.55.0
- CVE-2026-42502HIGH
- Package
- golang.org/x/net
- Installed
- v0.43.0
- Fixed
- 0.55.0
- CVE-2026-27145HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.11, 1.26.4
- CVE-2026-33811HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-33814HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-39820HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-39836HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-42499HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-42504HIGH
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.11, 1.26.4
- CVE-2026-39823MEDIUM
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-39825MEDIUM
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-39826MEDIUM
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-42507MEDIUM
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.11, 1.26.4
- CVE-2026-47262MEDIUM
- Package
- github.com/containerd/containerd/v2
- Installed
- v2.2.3-k3s1
- Fixed
- 2.0.10, 2.1.9, 2.2.5, 2.3.2
- CVE-2026-50195MEDIUM
- Package
- github.com/containerd/containerd/v2
- Installed
- v2.2.3-k3s1
- Fixed
- 2.1.9, 2.2.5, 2.3.2
- CVE-2026-25680MEDIUM
- Package
- golang.org/x/net
- Installed
- v0.47.0
- Fixed
- 0.55.0
- CVE-2026-42506MEDIUM
- Package
- golang.org/x/net
- Installed
- v0.47.0
- Fixed
- 0.55.0
- CVE-2026-39823MEDIUM
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-39825MEDIUM
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-39826MEDIUM
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-42507MEDIUM
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.11, 1.26.4
- CVE-2026-33997MEDIUM
- Package
- github.com/docker/docker
- Installed
- v25.0.15-0.20260325154711-d2dbc0547253+incompatible
- Fixed
- 29.3.1
- CVE-2026-42328MEDIUM
- Package
- github.com/ipld/go-ipld-prime
- Installed
- v0.22.0
- Fixed
- 0.23.0
- CVE-2026-40898MEDIUM
- Package
- github.com/quic-go/quic-go
- Installed
- v0.59.0
- Fixed
- 0.59.1
- CVE-2026-39831MEDIUM
- Package
- golang.org/x/crypto
- Installed
- v0.47.0
- Fixed
- 0.52.0
- CVE-2026-39833MEDIUM
- Package
- golang.org/x/crypto
- Installed
- v0.47.0
- Fixed
- 0.52.0
- CVE-2026-39834MEDIUM
- Package
- golang.org/x/crypto
- Installed
- v0.47.0
- Fixed
- 0.52.0
- CVE-2026-46598MEDIUM
- Package
- golang.org/x/crypto
- Installed
- v0.47.0
- Fixed
- 0.52.0
- CVE-2026-25680MEDIUM
- Package
- golang.org/x/net
- Installed
- v0.49.0
- Fixed
- 0.55.0
- CVE-2026-42506MEDIUM
- Package
- golang.org/x/net
- Installed
- v0.49.0
- Fixed
- 0.55.0
- CVE-2026-39823MEDIUM
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-39825MEDIUM
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-39826MEDIUM
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-42507MEDIUM
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.11, 1.26.4
- CVE-2026-41579MEDIUM
- Package
- github.com/opencontainers/runc
- Installed
- v1.4.2
- Fixed
- 1.3.6, 1.4.3, 1.5.0-rc.3
- CVE-2025-47911MEDIUM
- Package
- golang.org/x/net
- Installed
- v0.43.0
- Fixed
- 0.45.0
- CVE-2025-58190MEDIUM
- Package
- golang.org/x/net
- Installed
- v0.43.0
- Fixed
- 0.45.0
- CVE-2026-25680MEDIUM
- Package
- golang.org/x/net
- Installed
- v0.43.0
- Fixed
- 0.55.0
- CVE-2026-42506MEDIUM
- Package
- golang.org/x/net
- Installed
- v0.43.0
- Fixed
- 0.55.0
- CVE-2026-39823MEDIUM
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-39825MEDIUM
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-39826MEDIUM
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.10, 1.26.3
- CVE-2026-42507MEDIUM
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.11, 1.26.4
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39824UNKNOWN
- Package
- golang.org/x/sys
- Installed
- v0.40.0
- Fixed
- 0.44.0
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39824UNKNOWN
- Package
- golang.org/x/sys
- Installed
- v0.40.0
- Fixed
- 0.44.0
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-39824UNKNOWN
- Package
- golang.org/x/sys
- Installed
- v0.38.0
- Fixed
- 0.44.0
- CVE-2026-39822UNKNOWN
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
- CVE-2026-42505UNKNOWN
- Package
- stdlib
- Installed
- v1.26.2
- Fixed
- 1.25.12, 1.26.5, 1.27.0-rc.2
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2026-33186 | google.golang.org/grpc | v1.78.0 | 1.79.3 | CRITICAL |
| CVE-2026-27145 | stdlib | v1.26.2 | 1.25.11, 1.26.4 | HIGH |
| CVE-2026-33811 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-33814 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-39820 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-39836 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-42499 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-42504 | stdlib | v1.26.2 | 1.25.11, 1.26.4 | HIGH |
| CVE-2026-46680 | github.com/containerd/containerd/v2 | v2.2.3-k3s1 | 2.0.9, 2.2.4, 2.3.1 | HIGH |
| CVE-2026-53488 | github.com/containerd/containerd/v2 | v2.2.3-k3s1 | 2.0.10, 2.1.9, 2.2.5, 2.3.2 | HIGH |
| CVE-2026-53489 | github.com/containerd/containerd/v2 | v2.2.3-k3s1 | 2.1.9, 2.2.5, 2.3.2 | HIGH |
| CVE-2026-53492 | github.com/containerd/containerd/v2 | v2.2.3-k3s1 | 2.1.9, 2.2.5, 2.3.2 | HIGH |
| CVE-2026-25681 | golang.org/x/net | v0.47.0 | 0.55.0 | HIGH |
| CVE-2026-27136 | golang.org/x/net | v0.47.0 | 0.55.0 | HIGH |
| CVE-2026-33814 | golang.org/x/net | v0.47.0 | 0.53.0 | HIGH |
| CVE-2026-39821 | golang.org/x/net | v0.47.0 | 0.55.0 | HIGH |
| CVE-2026-42502 | golang.org/x/net | v0.47.0 | 0.55.0 | HIGH |
| CVE-2026-27145 | stdlib | v1.26.2 | 1.25.11, 1.26.4 | HIGH |
| CVE-2026-33811 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-33814 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-39820 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-39836 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-42499 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-42504 | stdlib | v1.26.2 | 1.25.11, 1.26.4 | HIGH |
| CVE-2026-34040 | github.com/docker/docker | v25.0.15-0.20260325154711-d2dbc0547253+incompatible | 29.3.1 | HIGH |
| CVE-2026-39827 | golang.org/x/crypto | v0.47.0 | 0.52.0 | HIGH |
| CVE-2026-39828 | golang.org/x/crypto | v0.47.0 | 0.52.0 | HIGH |
| CVE-2026-39829 | golang.org/x/crypto | v0.47.0 | 0.52.0 | HIGH |
| CVE-2026-39830 | golang.org/x/crypto | v0.47.0 | 0.52.0 | HIGH |
| CVE-2026-39832 | golang.org/x/crypto | v0.47.0 | 0.52.0 | HIGH |
| CVE-2026-39835 | golang.org/x/crypto | v0.47.0 | 0.52.0 | HIGH |
| CVE-2026-42508 | golang.org/x/crypto | v0.47.0 | 0.52.0 | HIGH |
| CVE-2026-46595 | golang.org/x/crypto | v0.47.0 | 0.52.0 | HIGH |
| CVE-2026-46597 | golang.org/x/crypto | v0.47.0 | 0.52.0 | HIGH |
| CVE-2026-25681 | golang.org/x/net | v0.49.0 | 0.55.0 | HIGH |
| CVE-2026-27136 | golang.org/x/net | v0.49.0 | 0.55.0 | HIGH |
| CVE-2026-33814 | golang.org/x/net | v0.49.0 | 0.53.0 | HIGH |
| CVE-2026-39821 | golang.org/x/net | v0.49.0 | 0.55.0 | HIGH |
| CVE-2026-42502 | golang.org/x/net | v0.49.0 | 0.55.0 | HIGH |
| CVE-2026-27145 | stdlib | v1.26.2 | 1.25.11, 1.26.4 | HIGH |
| CVE-2026-33811 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-33814 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-39820 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-39836 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-42499 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-42504 | stdlib | v1.26.2 | 1.25.11, 1.26.4 | HIGH |
| CVE-2026-25681 | golang.org/x/net | v0.43.0 | 0.55.0 | HIGH |
| CVE-2026-27136 | golang.org/x/net | v0.43.0 | 0.55.0 | HIGH |
| CVE-2026-33814 | golang.org/x/net | v0.43.0 | 0.53.0 | HIGH |
| CVE-2026-39821 | golang.org/x/net | v0.43.0 | 0.55.0 | HIGH |
| CVE-2026-42502 | golang.org/x/net | v0.43.0 | 0.55.0 | HIGH |
| CVE-2026-27145 | stdlib | v1.26.2 | 1.25.11, 1.26.4 | HIGH |
| CVE-2026-33811 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-33814 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-39820 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-39836 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-42499 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | HIGH |
| CVE-2026-42504 | stdlib | v1.26.2 | 1.25.11, 1.26.4 | HIGH |
| CVE-2026-39823 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | MEDIUM |
| CVE-2026-39825 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | MEDIUM |
| CVE-2026-39826 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | MEDIUM |
| CVE-2026-42507 | stdlib | v1.26.2 | 1.25.11, 1.26.4 | MEDIUM |
| CVE-2026-47262 | github.com/containerd/containerd/v2 | v2.2.3-k3s1 | 2.0.10, 2.1.9, 2.2.5, 2.3.2 | MEDIUM |
| CVE-2026-50195 | github.com/containerd/containerd/v2 | v2.2.3-k3s1 | 2.1.9, 2.2.5, 2.3.2 | MEDIUM |
| CVE-2026-25680 | golang.org/x/net | v0.47.0 | 0.55.0 | MEDIUM |
| CVE-2026-42506 | golang.org/x/net | v0.47.0 | 0.55.0 | MEDIUM |
| CVE-2026-39823 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | MEDIUM |
| CVE-2026-39825 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | MEDIUM |
| CVE-2026-39826 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | MEDIUM |
| CVE-2026-42507 | stdlib | v1.26.2 | 1.25.11, 1.26.4 | MEDIUM |
| CVE-2026-33997 | github.com/docker/docker | v25.0.15-0.20260325154711-d2dbc0547253+incompatible | 29.3.1 | MEDIUM |
| CVE-2026-42328 | github.com/ipld/go-ipld-prime | v0.22.0 | 0.23.0 | MEDIUM |
| CVE-2026-40898 | github.com/quic-go/quic-go | v0.59.0 | 0.59.1 | MEDIUM |
| CVE-2026-39831 | golang.org/x/crypto | v0.47.0 | 0.52.0 | MEDIUM |
| CVE-2026-39833 | golang.org/x/crypto | v0.47.0 | 0.52.0 | MEDIUM |
| CVE-2026-39834 | golang.org/x/crypto | v0.47.0 | 0.52.0 | MEDIUM |
| CVE-2026-46598 | golang.org/x/crypto | v0.47.0 | 0.52.0 | MEDIUM |
| CVE-2026-25680 | golang.org/x/net | v0.49.0 | 0.55.0 | MEDIUM |
| CVE-2026-42506 | golang.org/x/net | v0.49.0 | 0.55.0 | MEDIUM |
| CVE-2026-39823 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | MEDIUM |
| CVE-2026-39825 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | MEDIUM |
| CVE-2026-39826 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | MEDIUM |
| CVE-2026-42507 | stdlib | v1.26.2 | 1.25.11, 1.26.4 | MEDIUM |
| CVE-2026-41579 | github.com/opencontainers/runc | v1.4.2 | 1.3.6, 1.4.3, 1.5.0-rc.3 | MEDIUM |
| CVE-2025-47911 | golang.org/x/net | v0.43.0 | 0.45.0 | MEDIUM |
| CVE-2025-58190 | golang.org/x/net | v0.43.0 | 0.45.0 | MEDIUM |
| CVE-2026-25680 | golang.org/x/net | v0.43.0 | 0.55.0 | MEDIUM |
| CVE-2026-42506 | golang.org/x/net | v0.43.0 | 0.55.0 | MEDIUM |
| CVE-2026-39823 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | MEDIUM |
| CVE-2026-39825 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | MEDIUM |
| CVE-2026-39826 | stdlib | v1.26.2 | 1.25.10, 1.26.3 | MEDIUM |
| CVE-2026-42507 | stdlib | v1.26.2 | 1.25.11, 1.26.4 | MEDIUM |
| CVE-2026-39822 | stdlib | v1.26.2 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.2 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39824 | golang.org/x/sys | v0.40.0 | 0.44.0 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.2 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.2 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39824 | golang.org/x/sys | v0.40.0 | 0.44.0 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.2 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.2 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-39824 | golang.org/x/sys | v0.38.0 | 0.44.0 | UNKNOWN |
| CVE-2026-39822 | stdlib | v1.26.2 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
| CVE-2026-42505 | stdlib | v1.26.2 | 1.25.12, 1.26.5, 1.27.0-rc.2 | UNKNOWN |
Awaiting upstream fix
No fix is available yet for these vulnerabilities. They can be suppressed in your compliance tooling until an upstream fix is released.
- CVE-2026-41567HIGH
- Package
- github.com/docker/docker
- Installed
- v25.0.15-0.20260325154711-d2dbc0547253+incompatible
- Fixed
- CVE-2026-42306HIGH
- Package
- github.com/docker/docker
- Installed
- v25.0.15-0.20260325154711-d2dbc0547253+incompatible
- Fixed
- CVE-2026-41568MEDIUM
- Package
- github.com/docker/docker
- Installed
- v25.0.15-0.20260325154711-d2dbc0547253+incompatible
- Fixed
- GO-2026-5932UNKNOWN
- Package
- golang.org/x/crypto
- Installed
- v0.47.0
- Fixed
| ID | Package | Installed | Fixed | Severity |
|---|---|---|---|---|
| CVE-2026-41567 | github.com/docker/docker | v25.0.15-0.20260325154711-d2dbc0547253+incompatible | HIGH | |
| CVE-2026-42306 | github.com/docker/docker | v25.0.15-0.20260325154711-d2dbc0547253+incompatible | HIGH | |
| CVE-2026-41568 | github.com/docker/docker | v25.0.15-0.20260325154711-d2dbc0547253+incompatible | MEDIUM | |
| GO-2026-5932 | golang.org/x/crypto | v0.47.0 | UNKNOWN |
Original image reference
mirror.gcr.io/rancher/k3s:v1.36.1-k3s1