StackRadar

CVE-2026-35469

High

Advisory

Published 16 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.007
49th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
484
of 17,787 indexed, latest versions
Container images
447
deployed by those charts
Fix available
1 of 1
affected package

SpdyStream: DOS on CRI

Carried by container images the latest versions of 484 of 17,787 indexed charts deploy, on 447 images.

Affected packageAffected versionsFixed inImages
github.com/moby/spdystreamgolangv0.2.0, v0.4.0, v0.5.00.5.1447
OSV records
GHSA-pc3f-x583-g7j2
Also known as
GO-2026-4958

Charts affected

484 by stars
ChartLatestAffected imagesRadar Score
gitlab-runnerslamdev0.0.11 of 1See more

gitlab-runner slamdev 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
gitlab/gitlab-runner:v15.3.0860d4a3fec7a
github.com/moby/spdystream@v0.2.0
0.5.1

Open the chart page →

9,196
smarter-k3s-edgesmarterVerified publisher0.0.121 of 2See more

smarter-k3s-edge smarter 0.0.12

1 of the 2 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
rancher/k3s:v1.25.3-k3s1eaa270df79cc
github.com/moby/spdystream@v0.2.0
0.5.1

Open the chart page →

3,462
cost-analyzersoftonic2.5.51 of 6See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
grafana/grafana:11.5.28b37a2f028f1
github.com/moby/spdystream@v0.5.0
0.5.1

Open the chart page →

7,901
harborsoftonic1.13.01 of 8See more

harbor softonic 1.13.0

1 of the 8 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
github.com/moby/spdystream@v0.2.0
0.5.1

Open the chart page →

7,672
kyvernosoftonic3.5.21 of 7See more

kyverno softonic 3.5.2

1 of the 7 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
registry.k8s.io/kubectl:v1.32.73c5268158974
github.com/moby/spdystream@v0.5.0
0.5.1

Open the chart page →

1,019
redis-operatorsoftonic0.18.01 of 1See more

redis-operator softonic 0.18.0

1 of the 1 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
ghcr.io/ot-container-kit/redis-operator/redis-operator:v0.18.090bfeb2e0d71
github.com/moby/spdystream@v0.2.0
0.5.1

Open the chart page →

551
trivy-operatorsoftonic0.18.01 of 1See more

trivy-operator softonic 0.18.0

1 of the 1 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
ghcr.io/aquasecurity/trivy-operator:0.16.0a608b798fda5
github.com/moby/spdystream@v0.2.0
0.5.1

Open the chart page →

2,505
testing-multitoolsomeblackmagic0.1.21 of 1See more

testing-multitool someblackmagic 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
someblackmagic/k8s-testing-multitool:v0.1.06eca64b6b440
github.com/moby/spdystream@v0.2.0
0.5.1

Open the chart page →

30,687
datadogspartan0.1.01 of 1See more

datadog spartan 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
gcr.io/datadoghq/cluster-agent:7.61.06efe04ba4e06
github.com/moby/spdystream@v0.4.0
0.5.1

Open the chart page →

3,232
spire-identity-exchangespiffeVerified publisher0.2.21 of 3See more

spire-identity-exchange spiffe 0.2.2

1 of the 3 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
registry.k8s.io/kubectl:v1.31.099b37df34bc4
github.com/moby/spdystream@v0.4.0
0.5.1

Open the chart page →

1,427
ambassador-manifestssqream-chartsVerified publisher0.6.31 of 1See more

ambassador-manifests sqream-charts 0.6.3

1 of the 1 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
datawire/aes:3.11.195ec30b3c732
github.com/moby/spdystream@v0.2.0
0.5.1

Open the chart page →

2,416
allurestakaterVerified publisher1.0.11 of 1See more

allure stakater 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
quay.io/eformat/jenkins-agent-graalvm:latesta3b9a07648b6
github.com/moby/spdystream@v0.2.0
0.5.1

Open the chart page →

28,165
switchbladeswitchblade0.0.191 of 1See more

switchblade switchblade 0.0.19

1 of the 1 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
public.ecr.aws/boundless-software/switchblade:release-v0.0.19-lcm01d8413d5075
github.com/moby/spdystream@v0.2.0
0.5.1

Open the chart page →

1,360
paperless-ngx-backuptaskmediaVerified publisher1.1.01 of 1See more

paperless-ngx-backup taskmedia 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
ghcr.io/taskmedia/kubectl-gpg-ncftp:main0fb2b5584f7c
github.com/moby/spdystream@v0.2.0
0.5.1

Open the chart page →

518
act-runnertektonops0.1.21 of 2See more

act-runner tektonops 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
library/docker:23.0.6-dindafa5d5134900
github.com/moby/spdystream@v0.2.0
0.5.1

Open the chart page →

4,212
traefik-secrets-exportertraefik-secrets-exporter0.0.21 of 1See more

traefik-secrets-exporter traefik-secrets-exporter 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
ghcr.io/reiche-world/traefik-secrets-exporter:0.0.21485ff93cbf9
github.com/moby/spdystream@v0.5.0
0.5.1

Open the chart page →

1,675
trident-protecttrident-protect100.2606.01 of 2See more

trident-protect trident-protect 100.2606.0

1 of the 2 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
netapp/trident-protect-utils:v2.0.0cd0c18d8f9ec
github.com/moby/spdystream@v0.5.0
0.5.1

Open the chart page →

1,331
trident-protect-bxp-previewtrident-protect100.2511.0-bxp-preview2 of 3See more

trident-protect-bxp-preview trident-protect 100.2511.0-bxp-preview

2 of the 3 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
netapp/controller:25.11.0-bxp-preview06f6c9a0653f
github.com/moby/spdystream@v0.5.0
0.5.1
netapp/trident-protect-utils:v1.0.058b9fac358bd
github.com/moby/spdystream@v0.5.0
0.5.1

Open the chart page →

2,183
trident-protect-consoletrident-protect100.2608.0-console1 of 3See more

trident-protect-console trident-protect 100.2608.0-console

1 of the 3 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
netapp/trident-protect-utils:v2.0.0cd0c18d8f9ec
github.com/moby/spdystream@v0.5.0
0.5.1

Open the chart page →

1,322
harbor-scanner-trivytrivy-operator0.31.21 of 1See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.31.26e790e233872
github.com/moby/spdystream@v0.2.0
0.5.1

Open the chart page →

2,477
aws-eks-asg-rolling-update-handlertwin1.5.01 of 1See more

aws-eks-asg-rolling-update-handler twin 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
twinproduction/aws-eks-asg-rolling-update-handler:v1.7.08f38c206972e
github.com/moby/spdystream@v0.2.0
0.5.1

Open the chart page →

1,118
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
bitnamilegacy/kubectl:1.301249fc292e84
github.com/moby/spdystream@v0.2.0
0.5.1

Open the chart page →

8,607
ciliumvks-helm-chartsVerified publisher1.17.142 of 3See more

cilium vks-helm-charts 1.17.14

2 of the 3 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
quay.io/cilium/cilium:v1.17.14cdcfab5b4466
github.com/moby/spdystream@v0.5.0
0.5.1
quay.io/cilium/operator-generic:v1.17.14773886ec9337
github.com/moby/spdystream@v0.5.0
0.5.1

Open the chart page →

4,046
volcanovolcano-sh1.15.21 of 3See more

volcano volcano-sh 1.15.2

1 of the 3 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
volcanosh/vc-webhook-manager:v1.15.22fff65aad011
github.com/moby/spdystream@v0.5.0
0.5.1

Open the chart page →

1,533
aih-scannerwallarmVerified publisher2.7.111 of 2See more

aih-scanner wallarm 2.7.11

1 of the 2 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
wallarm/aih-scanner:2.7.11f1cb26db1f5b
github.com/moby/spdystream@v0.5.0
0.5.1

Open the chart page →

3,911
istio-service-meshwbstack0.0.11 of 1See more

istio-service-mesh wbstack 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
istio/pilot:1.17.1ce9d87606701
github.com/moby/spdystream@v0.2.0
0.5.1

Open the chart page →

6,232
azure-scheduledevents-managerwebdevopsVerified publisher1.0.171 of 1See more

azure-scheduledevents-manager webdevops 1.0.17

1 of the 1 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
webdevops/azure-scheduledevents-manager:24.9.0-kubernetes7acd46a8a972
github.com/moby/spdystream@v0.4.0
0.5.1

Open the chart page →

1,122
argo-eventswenerme2.4.271 of 1See more

argo-events wenerme 2.4.27

1 of the 1 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
github.com/moby/spdystream@v0.5.0
0.5.1

Open the chart page →

969
emissary-ingresswenerme8.12.21 of 2See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
datawire/emissary:3.12.21f67a1292d2a
github.com/moby/spdystream@v0.2.0
0.5.1

Open the chart page →

10,843
kubernetes-dashboardwenerme7.14.01 of 5See more

kubernetes-dashboard wenerme 7.14.0

1 of the 5 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
kubernetesui/dashboard-api:1.14.096a702cfd339
github.com/moby/spdystream@v0.5.0
0.5.1

Open the chart page →

3,478
openebswenerme3.10.01 of 3See more

openebs wenerme 3.10.0

1 of the 3 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
openebs/provisioner-localpv:3.5.0aea39e49bb97
github.com/moby/spdystream@v0.2.0
0.5.1

Open the chart page →

10,489
postgres-operatorwiremindVerified publisher1.14.0-wiremind01 of 1See more

postgres-operator wiremind 1.14.0-wiremind0

1 of the 1 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
ghcr.io/zalando/postgres-operator:v1.14.04f40cfc2283b
github.com/moby/spdystream@v0.2.0
0.5.1

Open the chart page →

1,286
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
murtazashah46/helmfile:latest4d11726cf803
github.com/moby/spdystream@v0.2.0
0.5.1

Open the chart page →

13,677
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-35469.

Container imageDigestPackageFixed in
grafana/grafana:11.5.15781759b3d27
github.com/moby/spdystream@v0.5.0
0.5.1

Open the chart page →

9,381

Container images carrying it

447 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/ncsa/jupyterhub-metrics/collector:1.3.0dcb8c731bb1b
github.com/moby/spdystream@v0.5.0
0.5.1
1
ghcr.io/nefelim4ag/k8s-ssh-bastion:0.5.04d337e14c80b
github.com/moby/spdystream@v0.2.0
0.5.1
1
ghcr.io/oguzhan-yilmaz/argocd-backup-s3:latestb61c750ade19
github.com/moby/spdystream@v0.2.0
0.5.1
1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.2035bc5ca66d55a
github.com/moby/spdystream@v0.5.0
0.5.1
1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.55d7f93d2182fe
github.com/moby/spdystream@v0.5.0
0.5.1
1
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--steampipe:latestc0c8d53df9f3
github.com/moby/spdystream@v0.4.0
0.5.1
1
ghcr.io/ot-container-kit/redis-operator/redis-operator:v0.18.090bfeb2e0d71
github.com/moby/spdystream@v0.2.0
0.5.1
1
ghcr.io/peak-scale/capsule-argo-addon:0.7.5087a80163971
github.com/moby/spdystream@v0.5.0
0.5.1
1
ghcr.io/rabbitmq/cluster-operator:2.17.25d690e6cd856
github.com/moby/spdystream@v0.5.0
0.5.1
1
ghcr.io/reiche-world/traefik-secrets-exporter:0.0.21485ff93cbf9
github.com/moby/spdystream@v0.5.0
0.5.1
1
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
github.com/moby/spdystream@v0.5.0
0.5.1
1
ghcr.io/samr037/node-debug-dashboard:0.3.0c79b2e64a211
github.com/moby/spdystream@v0.5.0
0.5.1
1
ghcr.io/stashed/stash:v0.42.03a98245a7667
github.com/moby/spdystream@v0.2.0
0.5.1
1
ghcr.io/stashed/stash-enterprise:v0.42.1759f3850eda9
github.com/moby/spdystream@v0.5.0
0.5.1
1
ghcr.io/stashed/stash-enterprise:v0.32.0e9bde36e34b7
github.com/moby/spdystream@v0.2.0
0.5.1
1
ghcr.io/taskmedia/kubectl-gpg-ncftp:main0fb2b5584f7c
github.com/moby/spdystream@v0.2.0
0.5.1
1
ghcr.io/tjm/vault-gcp-secrets:v1.19.59f157fe035f1
github.com/moby/spdystream@v0.4.0
0.5.1
1
ghcr.io/turbot/guardrails-agent-kubernetes:0.3.09d01bf9c9224
github.com/moby/spdystream@v0.4.0
0.5.1
1
ghcr.io/voyagermesh/gateway:v1.6.223f4da194134
github.com/moby/spdystream@v0.5.0
0.5.1
1
ghcr.io/voyagermesh/voyager:v17.5.04964ceaf9d35
github.com/moby/spdystream@v0.5.0
0.5.1
1
ghcr.io/wjentner/k8s-db-backup-retention:v1.1.08027bb46d1f4
github.com/moby/spdystream@v0.4.0
0.5.1
1
ghcr.io/zalando/postgres-operator:v1.14.04f40cfc2283b
github.com/moby/spdystream@v0.2.0
0.5.1
1
ghcr.io/zalando/postgres-operator:v1.12.2d81cda253f5c
github.com/moby/spdystream@v0.2.0
0.5.1
1
ghcr.io/zufardhiyaulhaq/frp-operator:v0.11.0cd25ee354df2
github.com/moby/spdystream@v0.2.0
0.5.1
1
public.ecr.aws/aktosecurity/keelhq-keel:akto_v1.0.01eb61443d68e
github.com/moby/spdystream@v0.5.0
0.5.1
1
public.ecr.aws/aws-ec2/aws-node-termination-handler:v1.19.0844478ebd5b8
github.com/moby/spdystream@v0.2.0
0.5.1
1
public.ecr.aws/aws-ec2/aws-node-termination-handler:v1.25.69ad31fb4e5be
github.com/moby/spdystream@v0.4.0
0.5.1
1
public.ecr.aws/aws-ec2/aws-node-termination-handler-2/controller:v2.0.0-beta9637c80dd23f
github.com/moby/spdystream@v0.2.0
0.5.1
1
public.ecr.aws/boundless-software/switchblade:release-v0.0.19-lcm01d8413d5075
github.com/moby/spdystream@v0.2.0
0.5.1
1
public.ecr.aws/datadog/agent:7.73.0f4925b15ce94
github.com/moby/spdystream@v0.5.0
0.5.1
1
public.ecr.aws/groundcovercom/grafana-groundcover:v0.0.54-grafana11.3.7ee9d973e3952
github.com/moby/spdystream@v0.5.0
0.5.1
1
public.ecr.aws/r3m4q3r9/pleco:0.24.0651739583336
github.com/moby/spdystream@v0.2.0
0.5.1
1
public.ecr.aws/t0u0d5o5/ecr_authenticator:latest077e4e57e41c
github.com/moby/spdystream@v0.2.0
0.5.1
1
quay.io/aerokube/keygen:1.0.1578934444f04
github.com/moby/spdystream@v0.2.0
0.5.1
1
quay.io/argoproj/argocd:v2.4.115b6701d8fb31
github.com/moby/spdystream@v0.2.0
0.5.1
1
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
github.com/moby/spdystream@v0.5.0
0.5.1
1
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
github.com/moby/spdystream@v0.5.0
0.5.1
1
quay.io/argoproj/argocd:v2.8.6acaf37352569
github.com/moby/spdystream@v0.2.0
0.5.1
1
quay.io/argoproj/argocli:v3.7.11577fc18f86ad
github.com/moby/spdystream@v0.5.0
0.5.1
1
quay.io/argoproj/argocli:v3.7.16efd1cb89dc1
github.com/moby/spdystream@v0.5.0
0.5.1
1
quay.io/argoproj/argocli:v3.5.591b9825f09a8
github.com/moby/spdystream@v0.2.0
0.5.1
1
quay.io/argoproj/argo-events:v1.9.10a83d2699ae53
github.com/moby/spdystream@v0.5.0
0.5.1
1
quay.io/argoprojlabs/argocd-rbac-operator:v0.2.451dded00137a
github.com/moby/spdystream@v0.5.0
0.5.1
1
quay.io/argoproj/workflow-controller:v3.7.166388d1b2f08
github.com/moby/spdystream@v0.5.0
0.5.1
1
quay.io/argoproj/workflow-controller:v3.5.56ab0da144235
github.com/moby/spdystream@v0.2.0
0.5.1
1
quay.io/argoproj/workflow-controller:v3.7.11c46aa0ded8ed
github.com/moby/spdystream@v0.5.0
0.5.1
1
quay.io/bentoml/yatai:0.4.614b482c1f1b8
github.com/moby/spdystream@v0.2.0
0.5.1
1
quay.io/bentoml/yatai:1.1.13a5dc9d91de0d
github.com/moby/spdystream@v0.2.0
0.5.1
1
quay.io/cilium/cilium:v1.18.2858f807ea4e2
github.com/moby/spdystream@v0.5.0
0.5.1
1
quay.io/cilium/cilium:v1.17.14cdcfab5b4466
github.com/moby/spdystream@v0.5.0
0.5.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.