CVE-2026-39820

High

Advisory

Published 7 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.008; 55th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,218; of 17,988 indexed, latest versions
Container images: 4,748; deployed by those charts
Fix available: 1 of 2; affected packages

Quadratic string concatentation in consumeComment in net/mail

Carried by container images the latest versions of 4,218 of 17,988 indexed charts deploy, on 4,748 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+183 more	1.25.10	4,748
golang-1.19deb	1.19.8-2	no fix listed	1

OSV records: DEBIAN-CVE-2026-39820 GO-2026-4986
Also known as: BIT-golang-2026-39820

Charts affected

4,218 by stars

Chart

Latest

Affected images

Radar Score

argo-cdargo

10.9.6

2 of 3 See more

argo-cd argo 10.9.6

2 of the 3 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
ghcr.io/dexidp/dex :v2.45.1	8499afd690c4	stdlib@go1.25.6	1.25.10
quay.io/argoproj/argocd :v3.5.3	dd3f47d5a5e4	stdlib@go1.26.2	1.25.10

Open the chart page →

3,862

ingress-nginxingress-nginx

4.15.1

2 of 2 See more

ingress-nginx ingress-nginx 4.15.1

2 of the 2 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
registry.k8s.io/ingress-nginx/controller :v1.15.1	594ceea76b01	stdlib@go1.26.1	1.25.10
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.6.9	01038e7de14b	stdlib@go1.26.1	1.25.10

Open the chart page →

1,953

kubernetes-dashboardk8s-dashboard

7.14.0

4 of 5 See more

kubernetes-dashboard k8s-dashboard 7.14.0

4 of the 5 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
kubernetesui/dashboard-api :1.14.0	96a702cfd339	stdlib@go1.23.12	1.25.10
kubernetesui/dashboard-auth :1.4.0	53e9917898bf	stdlib@go1.23.12	1.25.10
kubernetesui/dashboard-metrics-scraper :1.2.2	5154b68252bd	stdlib@go1.23.4	1.25.10
kubernetesui/dashboard-web :1.7.0	cc7c31bd2d84	stdlib@go1.23.9	1.25.10

Open the chart page →

4,170

lokigrafana

7.3.0

2 of 6 See more

loki grafana 7.3.0

2 of the 6 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
grafana/loki :3.6.11	44148ad243c0	stdlib@go1.26.2	1.25.10
prom/memcached-exporter :v0.15.4	b6763ecb3c47	stdlib@go1.25.3	1.25.10

Open the chart page →

4,714

gitlabgitlab

10.4.1

1 of 21 See more

gitlab gitlab 10.4.1

1 of the 21 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign :v19.4.1	5dd7827fa474	stdlib@go1.22.0	1.25.10

Open the chart page →

17,854

jenkinsjenkinsci

5.9.65

1 of 2 See more

jenkins jenkinsci 5.9.65

1 of the 2 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
jenkins/jenkins :2.568.3-jdk21	c1e4c349365f	stdlib@go1.25.3	1.25.10

Open the chart page →

3,238

metallbmetallb

0.16.1

3 of 4 See more

metallb metallb 0.16.1

3 of the 4 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
quay.io/metallb/controller :v0.16.1	f51ab515de9c	stdlib@go1.25.9	1.25.10
quay.io/metallb/frr-k8s :v0.0.25	1cb06fb2d553	stdlib@go1.25.8	1.25.10
quay.io/metallb/speaker :v0.16.1	16561e96531e	stdlib@go1.25.9	1.25.10

Open the chart page →

2,795

rancherrancher-stable

2.15.2

1 of 2 See more

rancher rancher-stable 2.15.2

1 of the 2 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
rancher/rancher :v2.15.2	0c3d8e570255	stdlib@go1.26.1	1.25.10

Open the chart page →

2,171

giteagitea

12.7.0

2 of 4 See more

gitea gitea 12.7.0

2 of the 4 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
bitnamilegacy/pgpool :4.6.3-debian-12-r0	d3bf3910f148	stdlib@go1.25.0	1.25.10
bitnamilegacy/valkey-cluster :8.1.3-debian-12-r3	32869e769b7e	stdlib@go1.24.6	1.25.10

Open the chart page →

10,029

nfs-subdir-external-provisionernfs-subdir-external-provisioner

4.0.18

1 of 1 See more

nfs-subdir-external-provisioner nfs-subdir-external-provisioner 4.0.18

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner :v4.0.2	63d5e04551ec	stdlib@go1.15	1.25.10

Open the chart page →

3,791

artifact-hubartifact-hub

1.23.0

4 of 7 See more

artifact-hub artifact-hub 1.23.0

4 of the 7 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
aquasec/trivy :0.69.3	bcc376de8d77	stdlib@go1.25.7	1.25.10
artifacthub/postgres :latest	4fd34fa635cc	stdlib@go1.24.6	1.25.10
artifacthub/scanner :v1.23.0	2d8365601f0e	stdlib@go1.25.7	1.25.10
artifacthub/tracker :v1.23.0	5368d21a6e5c	stdlib@go1.24.4	1.25.10

Open the chart page →

13,698

prometheus-blackbox-exporterprometheus-community

11.19.1

1 of 1 See more

prometheus-blackbox-exporter prometheus-community 11.19.1

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
quay.io/prometheus/blackbox-exporter :v0.28.0	e753ff9f3fc4	stdlib@go1.25.5	1.25.10

Open the chart page →

821

deschedulerdescheduler

0.36.0

1 of 1 See more

descheduler descheduler 0.36.0

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
registry.k8s.io/descheduler/descheduler :v0.36.0	7ca92c0a7b4f	stdlib@go1.26.0	1.25.10

Open the chart page →

808

argo-cdargo-cd-oci

10.9.6

2 of 3 See more

argo-cd argo-cd-oci 10.9.6

2 of the 3 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
ghcr.io/dexidp/dex :v2.45.1	8499afd690c4	stdlib@go1.25.6	1.25.10
quay.io/argoproj/argocd :v3.5.3	dd3f47d5a5e4	stdlib@go1.26.2	1.25.10

Open the chart page →

3,862

jupyterhubjupyterhub

4.4.2

2 of 7 See more

jupyterhub jupyterhub 4.4.2

2 of the 7 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
quay.io/jupyterhub/k8s-image-awaiter :4.4.2	c4df1176d152	stdlib@go1.23.12	1.25.10
registry.k8s.io/kube-scheduler :v1.30.14	74a5cf9cfa9f	stdlib@go1.23.10	1.25.10

Open the chart page →

9,596

mimir-distributedgrafana

6.2.0

2 of 6 See more

mimir-distributed grafana 6.2.0

2 of the 6 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
quay.io/minio/mc :RELEASE.2024-11-21T17-21-54Z	993e8c454a7e	stdlib@go1.23.4	1.25.10
quay.io/minio/minio :RELEASE.2024-12-18T13-15-44Z	1dce27c494a1	stdlib@go1.23.4	1.25.10

Open the chart page →

5,704

natsnats

2.15.0

1 of 3 See more

nats nats 2.15.0

1 of the 3 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
natsio/nats-server-config-reloader :0.23.0	64cb6c858e79	stdlib@go1.25.6	1.25.10

Open the chart page →

2,479

dexdex

0.25.2

1 of 1 See more

dex dex 0.25.2

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
ghcr.io/dexidp/dex :v2.45.1	8499afd690c4	stdlib@go1.25.6	1.25.10

Open the chart page →

1,671

uptime-kumauptime-kuma

4.2.0

1 of 1 See more

uptime-kuma uptime-kuma 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :2.5.0	a8610b3b4c38	stdlib@go1.20.5	1.25.10

Open the chart page →

34,116

airflowairflow-helm

8.9.0

1 of 4 See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
apache/airflow :2.8.4-python3.9	64e58748b6b9	stdlib@go1.21.8	1.25.10

Open the chart page →

12,447

nfs-server-provisionerkvaps

1.8.0

1 of 1 See more

nfs-server-provisioner kvaps 1.8.0

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/nfs-provisioner :v4.0.8	c825f3d5e28b	stdlib@go1.16.2	1.25.10

Open the chart page →

3,309

chartmuseumchartmuseum

3.10.4

1 of 1 See more

chartmuseum chartmuseum 3.10.4

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
ghcr.io/helm/chartmuseum :v0.16.3	c81f105c3682	stdlib@go1.24.1	1.25.10

Open the chart page →

1,976

rook-cephrook

1.20.8

1 of 2 See more

rook-ceph rook 1.20.8

1 of the 2 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
rook/ceph :v1.20.8	d47a748c058a	stdlib@go1.22.10	1.25.10

Open the chart page →

1,894

argo-eventsargo

2.4.27

1 of 1 See more

argo-events argo 2.4.27

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
quay.io/argoproj/argo-events :v1.9.11	fa07b2c9ece6	stdlib@go1.25.6	1.25.10

Open the chart page →

1,393

victoria-metrics-k8s-stackvictoriametrics

0.95.0

1 of 7 See more

victoria-metrics-k8s-stack victoriametrics 0.95.0

1 of the 7 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
grafana/grafana :13.2.2-distroless	69a5d2d957ca	stdlib@go1.25.7	1.25.10

Open the chart page →

1,188

aws-node-termination-handleraws

0.21.0

1 of 1 See more

aws-node-termination-handler aws 0.21.0

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-ec2/aws-node-termination-handler :v1.19.0	844478ebd5b8	stdlib@go1.19.5	1.25.10

Open the chart page →

2,077

prometheus-adapterprometheus-community

5.3.0

1 of 1 See more

prometheus-adapter prometheus-community 5.3.0

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
registry.k8s.io/prometheus-adapter/prometheus-adapter :v0.12.0	932eae60e2bc	stdlib@go1.22.2	1.25.10

Open the chart page →

1,349

home-assistanthelm-hass

0.3.83

1 of 1 See more

home-assistant helm-hass 0.3.83

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2026.9.4	3e6710a7ab2a	stdlib@go1.23.3	1.25.10

Open the chart page →

2,898

openebsopenebs

4.6.1

18 of 35 See more

openebs openebs 4.6.1

18 of the 35 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
grafana/alloy :v1.8.1	7790f6f7fbd8	stdlib@go1.24.1	1.25.10
grafana/loki :3.4.2	58a6c186ce78	stdlib@go1.23.6	1.25.10
library/nats :2.9.17-alpine	1a7b320b2942	stdlib@go1.19.9	1.25.10
natsio/nats-server-config-reloader :0.10.1	e414cc7e6f59	stdlib@go1.19.4	1.25.10
natsio/prometheus-nats-exporter :0.11.0	31c02aac089a	stdlib@go1.20.3	1.25.10
openebs/etcd :3.6.4-debian-12-r0	c86c06f1ce6a	stdlib@go1.24.5	1.25.10
openebs/lvm-driver :1.10.1	41f73aba7f31	stdlib@go1.24.7	1.25.10
openebs/provisioner-localpv :4.6.0	99f5116f5cb8	stdlib@go1.25.0	1.25.10
openebs/zfs-driver :2.11.1	16f1a74bb249	stdlib@go1.26.2	1.25.10
quay.io/prometheus-operator/prometheus-config-reloader :v0.81.0	959d47672fbf	stdlib@go1.23.7	1.25.10
registry.k8s.io/sig-storage/csi-attacher :v4.8.1	69888dba5815	stdlib@go1.23.1	1.25.10
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.13.0	d7138bcc3aa5	stdlib@go1.23.1	1.25.10
registry.k8s.io/sig-storage/csi-provisioner :v5.2.0	d5e46da8aff7	stdlib@go1.23.1	1.25.10
registry.k8s.io/sig-storage/csi-provisioner :v6.1.0	e5900dc98b0d	stdlib@go1.24.6	1.25.10
registry.k8s.io/sig-storage/csi-resizer :v2.0.0	4a95d94e57ad	stdlib@go1.24.6	1.25.10
registry.k8s.io/sig-storage/csi-resizer :v1.13.2	8ddd178ba5d0	stdlib@go1.23.1	1.25.10
registry.k8s.io/sig-storage/csi-snapshotter :v8.2.0	dd788d79cf4c	stdlib@go1.23.1	1.25.10
registry.k8s.io/sig-storage/snapshot-controller :v8.2.0	9dade8f2f3ab	stdlib@go1.23.1	1.25.10

Open the chart page →

28,611

open-webuiopen-webui

16.6.0

1 of 4 See more

open-webui open-webui 16.6.0

1 of the 4 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
library/redis :7.4.2-alpine3.21	02419de7eddf	stdlib@go1.18.2	1.25.10

Open the chart page →

2,241

actions-runner-controlleractions-runner-controller

0.23.7

2 of 2 See more

actions-runner-controller actions-runner-controller 0.23.7

2 of the 2 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
summerwind/actions-runner-controller :v0.27.6	2128f81dbede	stdlib@go1.20.7	1.25.10
quay.io/brancz/kube-rbac-proxy :v0.13.1	738c854322f5	stdlib@go1.19.1	1.25.10

Open the chart page →

4,061

aws-for-fluent-bitaws

0.2.0

1 of 1 See more

aws-for-fluent-bit aws 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-observability/aws-for-fluent-bit :3.2.1	a480a1241720	stdlib@go1.25.6	1.25.10

Open the chart page →

408

apisixapisix

2.18.0

1 of 3 See more

apisix apisix 2.18.0

1 of the 3 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
bitnamilegacy/etcd :latest	99b408c15272	stdlib@go1.23.10	1.25.10

Open the chart page →

3,381

vpafairwinds-stable

5.1.0

1 of 4 See more

vpa fairwinds-stable 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v20230312-helm-chart-4.5.2-28-g66a760794	01d181618f27	stdlib@go1.20.1	1.25.10

Open the chart page →

2,002

terraformhashicorp

1.1.2

1 of 1 See more

terraform hashicorp 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
hashicorp/terraform-k8s :1.1.2	b19857bab620	stdlib@go1.18.8	1.25.10

Open the chart page →

2,733

trinotrino

1.42.2

1 of 1 See more

1,656

dagsterdagster

1.13.25

1 of 5 See more

dagster dagster 1.13.25

1 of the 5 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
library/postgres :14.6	f565573d74ae	stdlib@go1.18.2	1.25.10

Open the chart page →

4,229

zabbixzabbix-community

7.1.0

3 of 5 See more

zabbix zabbix-community 7.1.0

3 of the 5 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
library/postgres :16	a3b7f434b2dc	stdlib@go1.24.6	1.25.10
zabbix/zabbix-agent2 :ubuntu-7.0.23	7322a94c5d7a	stdlib@go1.24.10	1.25.10
zabbix/zabbix-web-service :ubuntu-7.0.23	915b3183e054	stdlib@go1.24.10	1.25.10

Open the chart page →

15,663

keycloakcloudpirates-keycloak

0.21.41

2 of 3 See more

keycloak cloudpirates-keycloak 0.21.41

2 of the 3 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
library/postgres :18.0	073e7c8b84e2	stdlib@go1.24.6	1.25.10
library/postgres :18.6	86c951e05bf5	stdlib@go1.24.6	1.25.10

Open the chart page →

5,125

graylogkong-z

3.0.35

1 of 5 See more

graylog kong-z 3.0.35

1 of the 5 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
quay.io/mongodb/mongodb-kubernetes-operator :0.13.0	2dcc6393e6f7	stdlib@go1.24.2	1.25.10

Open the chart page →

3,053

connectonepassword-connect

2.4.1

2 of 2 See more

connect onepassword-connect 2.4.1

2 of the 2 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
1password/connect-api :1.8.2	e915c0c84397	stdlib@go1.25.7	1.25.10
1password/connect-sync :1.8.2	6297ca6136c0	stdlib@go1.25.7	1.25.10

Open the chart page →

3,334

node-problem-detectordeliveryhero

2.4.1

1 of 1 See more

node-problem-detector deliveryhero 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
registry.k8s.io/node-problem-detector/node-problem-detector :v1.35.1	c380751accc5	stdlib@go1.25.5	1.25.10

Open the chart page →

2,334

miniominio-official

5.4.0

2 of 2 See more

minio minio-official 5.4.0

2 of the 2 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
quay.io/minio/mc :RELEASE.2024-11-21T17-21-54Z	993e8c454a7e	stdlib@go1.23.4	1.25.10
quay.io/minio/minio :RELEASE.2024-12-18T13-15-44Z	1dce27c494a1	stdlib@go1.23.4	1.25.10

Open the chart page →

3,367

openfaasopenfaas

15.0.13

3 of 6 See more

openfaas openfaas 15.0.13

3 of the 6 container images this version deploys carry CVE-2026-39820.

Container image	Digest	Package	Fixed in
library/nats-streaming :0.25.6	0ad6861379c9	stdlib@go1.20.11	1.25.10
ghcr.io/openfaas/gateway :0.27.14	ee0eaecc490c	stdlib@go1.24.13	1.25.10
ghcr.io/openfaas/queue-worker :0.14.2	c18da04d70f6	stdlib@go1.23.4	1.25.10