StackRadar

CVE-2026-39820

High

Advisory

Published 7 May 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.008
54th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,218
of 17,985 indexed, latest versions
Container images
4,748
deployed by those charts
Fix available
1 of 2
affected packages

Quadratic string concatentation in consumeComment in net/mail

Carried by container images the latest versions of 4,218 of 17,985 indexed charts deploy, on 4,748 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+183 more1.25.104,748
golang-1.19deb1.19.8-2no fix listed1
OSV records
DEBIAN-CVE-2026-39820GO-2026-4986
Also known as
BIT-golang-2026-39820

Charts affected

4,218 by stars
ChartLatestAffected imagesRadar Score
food-managermoreillonVerified publisher0.5.01 of 2See more

food-manager moreillon 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:6.0.10-debian-11-r842319decb591
stdlib@go1.19.12
1.25.10

Open the chart page →

15,407
redminemt1905027.3.42 of 3See more

redmine mt190502 7.3.4

2 of the 3 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
library/postgres:1886c951e05bf5
stdlib@go1.24.6
1.25.10
library/redmine:6.1.204ac44a2595b
stdlib@go1.24.6
1.25.10

Open the chart page →

8,553
podsyncmy0nVerified publisher1.5.41 of 2See more

podsync my0n 1.5.4

1 of the 2 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
tdeutsch/podsync:v2.4.2b67186f4c9a5
stdlib@go1.19.3
1.25.10

Open the chart page →

2,694
maddymyaVerified publisher22.4.121 of 2See more

maddy mya 22.4.12

1 of the 2 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
foxcpp/maddy:0.7.16ab538e2f28b
stdlib@go1.19.13
1.25.10

Open the chart page →

1,930
registrymyaVerified publisher22.4.111 of 1See more

registry mya 22.4.11

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
distribution/distribution:2.8.3f84b2078238f
stdlib@go1.20.8
1.25.10

Open the chart page →

1,289
simple-gowikimy-helm-chartsVerified publisher0.2.01 of 1See more

simple-gowiki my-helm-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
forchaladtest/mygowiki:1.0.170827eaecad1
stdlib@go1.22.6
1.25.10

Open the chart page →

678
satisfactorynaj981.1.11 of 1See more

satisfactory naj98 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
wolveix/satisfactory-server:v1.9.1199be1064b18
stdlib@go1.18.1
1.25.10

Open the chart page →

4,654
nats-account-servernatsVerified publisher0.8.11 of 1See more

nats-account-server nats 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
natsio/nats-account-server:1.0.0a3381560aab6
stdlib@go1.16.6
1.25.10

Open the chart page →

3,509
surveyornatsVerified publisher0.20.91 of 1See more

surveyor nats 0.20.9

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
natsio/nats-surveyor:0.9.9104a3e938b23
stdlib@go1.26.1
1.25.10

Open the chart page →

1,101
natz-operatornatz-operatorVerified publisher0.9.51 of 1See more

natz-operator natz-operator 0.9.5

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
ghcr.io/zeiss/natz-operator/operator:0.9.5187007974540
stdlib@go1.23.3
1.25.10

Open the chart page →

1,077
spring-helmnaveenalla-springboot1.0.01 of 2See more

spring-helm naveenalla-springboot 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
library/postgres:latest86c951e05bf5
stdlib@go1.24.6
1.25.10

Open the chart page →

1,693
clowder2ncsaVerified publisher1.9.76 of 12See more

clowder2 ncsa 1.9.7

6 of the 12 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:8.12.215d4647fd491
stdlib@go1.21.8
1.25.10
bitnamilegacy/keycloak:20.0.5cb04e49e6eb1
stdlib@go1.18.2
1.25.10
bitnamilegacy/minio:2023.12.230b60b6565ab2
stdlib@go1.20.13
1.25.10
bitnamilegacy/mongodb:5.0.103bb1deeaf9d0
stdlib@go1.18.4
1.25.10
bitnamilegacy/os-shell:12-debian-12-r16d24925821dd2
stdlib@go1.21.7
1.25.10
bitnamilegacy/rabbitmq:3.10.88f7161d8ce19
stdlib@go1.16.7
1.25.10

Open the chart page →

44,718
cluster-issuersnginx-cert-charts0.3.04 of 4See more

cluster-issuers nginx-cert-charts 0.3.0

4 of the 4 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-cainjector:v1.19.3eb1df56668b6
stdlib@go1.25.6
1.25.10
quay.io/jetstack/cert-manager-controller:v1.19.3a07125af5e83
stdlib@go1.25.6
1.25.10
quay.io/jetstack/cert-manager-startupapicheck:v1.19.3e51a06251338
stdlib@go1.25.6
1.25.10
quay.io/jetstack/cert-manager-webhook:v1.19.32625754083d5
stdlib@go1.25.6
1.25.10

Open the chart page →

3,112
ngrok-operatorngrok-operator1.1.01 of 2See more

ngrok-operator ngrok-operator 1.1.0

1 of the 2 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
zufardhiyaulhaq/ngrok-operator:v1.3.07cf2ae3fb1fb
stdlib@go1.16.15
1.25.10

Open the chart page →

2,737
cloud9nicholaswildeVerified publisher1.0.01 of 1See more

cloud9 nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
linuxserver/cloud9:version-1.29.245c5fe102ff3
stdlib@go1.17.11
1.25.10

Open the chart page →

12,794
gotifynicholaswildeVerified publisher1.0.01 of 1See more

gotify nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
gotify/server-arm7:2.0.23d91e302ad1d0
stdlib@go1.16
1.25.10

Open the chart page →

3,763
installernicholaswildeVerified publisher1.0.01 of 1See more

installer nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
ghcr.io/nicholaswilde/installer:version-0.2.947d8ecd310a9
stdlib@go1.15.3
1.25.10

Open the chart page →

2,125
shiorinicholaswildeVerified publisher1.0.11 of 1See more

shiori nicholaswilde 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
ghcr.io/nicholaswilde/shiori:version-v1.5.0e0645abe6777
stdlib@go1.16.5
1.25.10

Open the chart page →

3,288
writefreelynicholaswildeVerified publisher1.0.01 of 1See more

writefreely nicholaswilde 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
ghcr.io/nicholaswilde/writefreely:version-0.13.1c3c8481b7e56
stdlib@go1.15.12
1.25.10

Open the chart page →

9,290
node-exporternode-exporterVerified publisher0.1.101 of 1See more

node-exporter node-exporter 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
prom/node-exporter:v1.6.0d2e48098c364
stdlib@go1.20.4
1.25.10

Open the chart page →

1,738
helm-composenousefreakVerified publisher0.1.31 of 2See more

helm-compose nousefreak 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
library/mariadb:10.8.2-focal490f01279be1
stdlib@go1.16.7
1.25.10

Open the chart page →

15,281
nri-resource-policy-balloonsnri-pluginsOfficialVerified publisher0.14.01 of 1See more

nri-resource-policy-balloons nri-plugins 0.14.0

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
ghcr.io/containers/nri-plugins/nri-resource-policy-balloons:v0.14.0a8c8297c7274
stdlib@go1.26.0
1.25.10

Open the chart page →

493
nri-resource-policy-topology-awarenri-pluginsOfficialVerified publisher0.14.01 of 1See more

nri-resource-policy-topology-aware nri-plugins 0.14.0

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
ghcr.io/containers/nri-plugins/nri-resource-policy-topology-aware:v0.14.0e2443833726a
stdlib@go1.26.0
1.25.10

Open the chart page →

493
nutanix-csi-snapshotnutanix-helm-releasesOfficialVerified publisher8.3.01 of 1See more

nutanix-csi-snapshot nutanix-helm-releases 8.3.0

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/snapshot-controller:v8.3.012c2da094b02
stdlib@go1.24.2
1.25.10

Open the chart page →

718
octopuso7studios-octopus-helm-chartsOfficialVerified publisher1.2.34 of 5See more

octopus o7studios-octopus-helm-charts 1.2.3

4 of the 5 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
library/nats:2.11.9-alpine777787bbb4c7
stdlib@go1.24.7
1.25.10
natsio/nats-box:0.18.0abdc9f9f0120
stdlib@go1.24.3
1.25.10
natsio/nats-server-config-reloader:0.19.181edf32a3680
stdlib@go1.24.5
1.25.10
percona/percona-server-mongodb-operator:1.20.1d09453ce7886
stdlib@go1.24.3
1.25.10

Open the chart page →

7,450
oadaoadaVerified publisher5.0.61 of 11See more

oada oada 5.0.6

1 of the 11 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
groundnuty/k8s-wait-for:no-root-v2.0a26d3d3f6e1c
stdlib@go1.19.3
1.25.10

Open the chart page →

15,131
transfer.shobeoneVerified publisher1.0.51 of 1See more

transfer.sh obeone 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
dutchcoders/transfer.sh:v1.6.1-noroot8db9ade72a0d
stdlib@go1.20.11
1.25.10

Open the chart page →

1,651
oci-native-ingress-controlleroci-native-ingress-controller1.0.01 of 1See more

oci-native-ingress-controller oci-native-ingress-controller 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
amaanx86/oci-native-ingress-controller:masterd7206ac7a319
stdlib@go1.23.7
1.25.10

Open the chart page →

736
growthbookone-acre-fundVerified publisher0.3.01 of 3See more

growthbook one-acre-fund 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
jwilder/dockerize:latestf94fb59fb4f6
stdlib@go1.25.5
1.25.10

Open the chart page →

1,839
open5gs-webuiopen5gs-webuiVerified publisher2.3.11 of 2See more

open5gs-webui open5gs-webui 2.3.1

1 of the 2 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:4.4.14fe2bd7b4036
stdlib@go1.15.1
1.25.10

Open the chart page →

7,000
kruiseopenkruise1.9.12 of 2See more

kruise openkruise 1.9.1

2 of the 2 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
openkruise/kruise-helm-hook:v0.1.0edc7cf9428fd
stdlib@go1.20.14
1.25.10
openkruise/kruise-manager:v1.9.1f81ae78a36a4
stdlib@go1.23.9
1.25.10

Open the chart page →

2,481
openobserveopenobserve1.0.21 of 6See more

openobserve openobserve 1.0.2

1 of the 6 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
natsio/nats-server-config-reloader:0.23.064cb6c858e79
stdlib@go1.25.6
1.25.10

Open the chart page →

3,618
openrouter-botopenrouter-botVerified publisher0.2.01 of 1See more

openrouter-bot openrouter-bot 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
lifailon/openrouter-bot:latestea37e4b6b952
stdlib@go1.25.0
1.25.10

Open the chart page →

1,321
librechatopenshift1.9.01 of 3See more

librechat openshift 1.9.0

1 of the 3 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
library/mongo:8.0.20098862b1339f
stdlib@go1.25.7
1.25.10

Open the chart page →

6,589
openstack-kamaji-clusteropenstack-kamaji-clusterVerified publisher0.2.41 of 1See more

openstack-kamaji-cluster openstack-kamaji-cluster 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
registry.k8s.io/autoscaling/cluster-autoscaler:v1.34.07b172f42533c
stdlib@go1.24.7
1.25.10

Open the chart page →

1,057
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.22 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.2

2 of the 34 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
grafana/grafana:13.2.2-distroless69a5d2d957ca
stdlib@go1.25.7
1.25.10
library/postgres:18.4a02db8cac496
stdlib@go1.24.6
1.25.10

Open the chart page →

24,359
openvaultopenvaultVerified publisher0.9.01 of 2See more

openvault openvault 0.9.0

1 of the 2 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
stdlib@go1.23.7
1.25.10

Open the chart page →

7,893
opikopikOfficialVerified publisher2.2.884 of 13See more

opik opik 2.2.88

4 of the 13 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
alpine/kubectl:1.35.0862d86046bbc
stdlib@go1.25.5
1.25.10
cloudpirates/image-minio:RELEASE.2025-10-15T17-29-55Z-hardened8dc02a7e5093
stdlib@go1.25.7
1.25.10
library/mysql:8.4.2ac80b6e09e5b
stdlib@go1.18.2
1.25.10
library/zookeeper:3.9.4dfa9ba46d14b
stdlib@go1.18.1
1.25.10

Open the chart page →

15,214
opsopsVerified publisher1.2.02 of 2See more

ops ops 1.2.0

2 of the 2 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
shaowenchen/ops-controller-manager:latest35575d4f2bfe
stdlib@go1.24.13
1.25.10
shaowenchen/ops-server:latest6bac5cebd125
stdlib@go1.24.9
1.25.10

Open the chart page →

100,574
orbitalregorbitalregVerified publisher0.3.02 of 4See more

orbitalreg orbitalreg 0.3.0

2 of the 4 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
stdlib@go1.24.6
1.25.10
orbitalreg/orbitalreg-api:0.1.045f2620337af
stdlib@go1.22.12
1.25.10

Open the chart page →

3,047
kubernetes-dashboard-proxyosc0.7.23 of 4See more

kubernetes-dashboard-proxy osc 0.7.2

3 of the 4 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
kubernetesui/dashboard:v2.7.02e500d29e9d5
stdlib@go1.19
1.25.10
kubernetesui/metrics-scraper:v1.0.876049887f07a
stdlib@go1.18.2
1.25.10
quay.io/oauth2-proxy/oauth2-proxy:v7.1.3ecd26b74a01f
stdlib@go1.16
1.25.10

Open the chart page →

8,481
osc-bsu-csi-driverosc-bsu-csi-driverVerified publisher2.2.03 of 6See more

osc-bsu-csi-driver osc-bsu-csi-driver 2.2.0

3 of the 6 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.15.011f199f6bec4
stdlib@go1.24.6
1.25.10
registry.k8s.io/sig-storage/csi-provisioner:v6.1.1d992c36d4ddd
stdlib@go1.24.6
1.25.10
registry.k8s.io/sig-storage/livenessprobe:v2.16.088092d100909
stdlib@go1.24.2
1.25.10

Open the chart page →

3,495
hlf-caowkin2.1.02 of 2See more

hlf-ca owkin 2.1.0

2 of the 2 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
hyperledger/fabric-ca:1.5.1c7f3422ec1d5
stdlib@go1.15.7
1.25.10
jwilder/dockerize:latestf94fb59fb4f6
stdlib@go1.25.5
1.25.10

Open the chart page →

4,646
hlf-ordowkin3.1.01 of 1See more

hlf-ord owkin 3.1.0

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
hyperledger/fabric-orderer:2.2.137294e05209b
stdlib@go1.14.4
1.25.10

Open the chart page →

4,400
hlf-peerowkin5.1.01 of 1See more

hlf-peer owkin 5.1.0

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
hyperledger/fabric-peer:2.2.1bf4995c86af6
stdlib@go1.14.4
1.25.10

Open the chart page →

4,769
prometheus-cachethqoxyno-zetaVerified publisher1.1.11 of 1See more

prometheus-cachethq oxyno-zeta 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
oxynozeta/prometheus-cachethq:1.1.131f11669d597
stdlib@go1.15.1
1.25.10

Open the chart page →

2,619
ngrok-operatorpaganuzzi0.0.21 of 1See more

ngrok-operator paganuzzi 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
ghcr.io/paganuzzi/ngrokoperator:latest5a10cd095699
stdlib@go1.15.12
1.25.10

Open the chart page →

3,798
paperless-ngxpaperlessVerified publisher0.4.01 of 3See more

paperless-ngx paperless 0.4.0

1 of the 3 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngxdigest-pinnedaa810a36942c
stdlib@go1.24.4
1.25.10

Open the chart page →

10,208
pardus-nginx-nodeportpardus-charts0.5.01 of 1See more

pardus-nginx-nodeport pardus-charts 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
uderelier19/pardus-nginx:25-nodeport8ab640b44e3f
stdlib@go1.24.4
1.25.10

Open the chart page →

554
uptime-kumapascaliskeVerified publisher3.0.01 of 1See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-39820.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
stdlib@go1.20.5
1.25.10

Open the chart page →

8,214

Container images carrying it

4,748 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

No deployed image carries CVE-2026-39820.

syft 1.42.1 · advisories as of 3 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.