CVE-2026-39827

Medium

Advisory

Published 22 May 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.5; base score, highest
EPSS: 0.003; 21st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,482; of 17,805 indexed, latest versions
Container images: 2,806; deployed by those charts
Fix available: 1 of 1; affected package

golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS

Carried by container images the latest versions of 2,482 of 17,805 indexed charts deploy, on 2,806 images.

Affected package	Affected versions	Fixed in	Images
golang.org/x/cryptogolang	v0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+154 more	0.52.0	2,806

OSV records: GHSA-qpw4-5x99-6vjp
Also known as: GO-2026-5016

Charts affected

2,482 by stars

Chart

Latest

Affected images

Radar Score

ceph-csi-cephfswikimedia

0.1.8

1 of 5 See more

ceph-csi-cephfs wikimedia 0.1.8

1 of the 5 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	golang.org/x/crypto@v0.0.0-20220214200702-86341886e292	0.52.0

Open the chart page →

10,334

ceph-csi-rbdwikimedia

0.1.13

1 of 6 See more

ceph-csi-rbd wikimedia 0.1.13

1 of the 6 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	golang.org/x/crypto@v0.0.0-20220214200702-86341886e292	0.52.0

Open the chart page →

11,840

jaegerwikimedia

3.1.2

2 of 4 See more

jaeger wikimedia 3.1.2

2 of the 4 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-collector :1.53.0	7f1269222903	golang.org/x/crypto@v0.17.0	0.52.0
jaegertracing/jaeger-query :1.53.0	049bb0d64ea3	golang.org/x/crypto@v0.17.0	0.52.0

Open the chart page →

9,365

opentelemetry-collectorwikimedia

0.62.7

1 of 1 See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
otel/opentelemetry-collector-contrib :0.81.0	c6671841470b	golang.org/x/crypto@v0.10.0	0.52.0

Open the chart page →

2,035

wireguardwireguard-bananas

1.5.0

1 of 1 See more

wireguard wireguard-bananas 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
place1/wg-access-server :v0.4.6	2b2f3ea80ed6	golang.org/x/crypto@v0.0.0-20200709230013-948cd5f35899	0.52.0

Open the chart page →

2,753

dex-k8s-authenticatorwiremind

1.7.0

1 of 1 See more

dex-k8s-authenticator wiremind 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
mintel/dex-k8s-authenticator :1.4.0	caf71cee7b9a	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.52.0

Open the chart page →

2,792

postgres-operatorwiremind

1.14.0-wiremind0

1 of 1 See more

postgres-operator wiremind 1.14.0-wiremind0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
ghcr.io/zalando/postgres-operator :v1.14.0	4f40cfc2283b	golang.org/x/crypto@v0.31.0	0.52.0

Open the chart page →

1,433

prometheus-openstack-exporterwiremind

0.5.0

1 of 1 See more

prometheus-openstack-exporter wiremind 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
ghcr.io/openstack-exporter/openstack-exporter :1.7.0	e5146a7dd515	golang.org/x/crypto@v0.8.0	0.52.0

Open the chart page →

1,480

prometheus-safety-exporterwiremind

0.6.0

1 of 2 See more

prometheus-safety-exporter wiremind 0.6.0

1 of the 2 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
quay.io/prometheuscommunity/json-exporter :v0.7.0	3a777171d39a	golang.org/x/crypto@v0.31.0	0.52.0

Open the chart page →

726

registrywiremind

0.1.1

1 of 1 See more

registry wiremind 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
ghcr.io/distribution/distribution :3.0.0	4ba3adf47f5c	golang.org/x/crypto@v0.36.0	0.52.0

Open the chart page →

1,358

kafka-connect-uiwitcom-gmbh

0.5.0

1 of 2 See more

kafka-connect-ui witcom-gmbh 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
quay.io/oauth2-proxy/oauth2-proxy :v7.3.0	8c21390be87d	golang.org/x/crypto@v0.0.0-20220214200702-86341886e292	0.52.0

Open the chart page →

2,513

mrtg-backendwitcom-gmbh

0.7.0

1 of 2 See more

mrtg-backend witcom-gmbh 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
quay.io/oauth2-proxy/oauth2-proxy :v7.2.1	febeebebe762	golang.org/x/crypto@v0.0.0-20210711020723-a769d52b0f97	0.52.0

Open the chart page →

2,624

commentopluspluswyrihaximusnet

0.4.0

1 of 1 See more

commentoplusplus wyrihaximusnet 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
caroga/commentoplusplus :v1.8.7	f3233882b3bd	golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83	0.52.0

Open the chart page →

1,960

oauth2xd

1.0.0

1 of 1 See more

oauth2 xd 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
lishimeng/hufu :v1.2.1	3d5752dac834	golang.org/x/crypto@v0.11.0	0.52.0

Open the chart page →

2,008

owlxd

0.5.1

2 of 2 See more

owl xd 0.5.1

2 of the 2 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
lishimeng/owl-console :v0.11.2	c79a67657baf	golang.org/x/crypto@v0.14.0	0.52.0
lishimeng/owl-messager :v0.11.2	3d00485e64dc	golang.org/x/crypto@v0.14.0	0.52.0

Open the chart page →

4,110

passportxd

0.2.16

2 of 2 See more

passport xd 0.2.16

2 of the 2 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
lishimeng/passport :v0.2.16	3e7d05ded625	golang.org/x/crypto@v0.7.0	0.52.0
lishimeng/passport-profile :v0.2.16	0970dfe5dc8f	golang.org/x/crypto@v0.7.0	0.52.0

Open the chart page →

3,976

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
lishimeng/tabby :v1.0.4	8145c3dc83c8	golang.org/x/crypto@v0.7.0	0.52.0

Open the chart page →

7,679

treexd

0.1.10

1 of 1 See more

tree xd 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
lishimeng/tree :v0.2.8	9b2f8be6c7d3	golang.org/x/crypto@v0.7.0	0.52.0

Open the chart page →

1,998

zooxd

0.4.0

1 of 1 See more

zoo xd 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
lishimeng/zoo :v0.4.0	e0b8d2d8ca28	golang.org/x/crypto@v0.13.0	0.52.0

Open the chart page →

2,070

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	golang.org/x/crypto@v0.5.0	0.52.0

Open the chart page →

13,895

atlas-operatorxxl-job-admin

0.7.11

1 of 1 See more

atlas-operator xxl-job-admin 0.7.11

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
arigaio/atlas-operator :0.7.11	1c4caa13c92b	golang.org/x/crypto@v0.39.0	0.52.0

Open the chart page →

1,197

cloudeye-exporterxxl-job-admin

0.1.2

1 of 1 See more

cloudeye-exporter xxl-job-admin 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
dellnoantechnp/cloudeye-exporter :v2.0.31	6873356c882d	golang.org/x/crypto@v0.0.0-20220525230936-793ad666bf5e	0.52.0

Open the chart page →

2,693

kminionxxl-job-admin

0.13.0

1 of 1 See more

kminion xxl-job-admin 0.13.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
redpandadata/kminion :v2.3.2	56da99e8d0d3	golang.org/x/crypto@v0.51.0	0.52.0

Open the chart page →

668

nfs-subdir-external-provisionerxxl-job-admin

4.0.18

1 of 1 See more

nfs-subdir-external-provisioner xxl-job-admin 4.0.18

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner :v4.0.2	63d5e04551ec	golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975	0.52.0

Open the chart page →

2,746

nightingalexxl-job-admin

0.2.11

2 of 6 See more

nightingale xxl-job-admin 0.2.11

2 of the 6 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
flashcatcloud/nightingale :8.0.0-beta.11	ea1b0aaabe09	golang.org/x/crypto@v0.32.0	0.52.0
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	golang.org/x/crypto@v0.25.0	0.52.0

Open the chart page →

9,730

ygdrassil-monitoringygdrassil

0.4.0

7 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

7 of the 10 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	golang.org/x/crypto@v0.32.0	0.52.0
prom/alertmanager :v0.28.0	d5155cfac40a	golang.org/x/crypto@v0.31.0	0.52.0
quay.io/prometheus-operator/prometheus-config-reloader :v0.79.2	193280a33bc1	golang.org/x/crypto@v0.31.0	0.52.0
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	golang.org/x/crypto@v0.21.0	0.52.0
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	golang.org/x/crypto@v0.31.0	0.52.0
quay.io/prometheus/pushgateway :v1.11.0	99392035ae99	golang.org/x/crypto@v0.32.0	0.52.0
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.14.0	37d841299325	golang.org/x/crypto@v0.28.0	0.52.0

Open the chart page →

9,518

prometheusalertygqygq2

1.0.0

1 of 1 See more

prometheusalert ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
feiyu563/prometheus-alert :v4.9.1	224cfa68cbd9	golang.org/x/crypto@v0.22.0	0.52.0

Open the chart page →

1,610

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	golang.org/x/crypto@v0.0.0-20211115234514-b4de73f9ece8	0.52.0

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

2 of 4 See more

rawfile-csi ymatrix 0.2.1

2 of the 4 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	golang.org/x/crypto@v0.0.0-20210817164053-32db794688a5	0.52.0
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	golang.org/x/crypto@v0.0.0-20210817164053-32db794688a5	0.52.0

Open the chart page →

8,002

version-checkerymrs

0.2.3

1 of 1 See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9	0.52.0

Open the chart page →

3,025

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d	0.52.0
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0	0.52.0

Open the chart page →

5,077

zahori-moonzahori

1.0.1

1 of 3 See more

zahori-moon zahori 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-39827.

Container image	Digest	Package	Fixed in
quay.io/aerokube/moon-ui :2.0.5	89990b146824	golang.org/x/crypto@v0.10.0	0.52.0

Open the chart page →

2,908

Container images carrying it

2,806 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
youssef11gaber10/deployment-auth-go :latest	6597b26959d2	golang.org/x/crypto@v0.9.0	0.52.0	1
zabbix/zabbix-agent2 :ubuntu-7.0.23	7322a94c5d7a	golang.org/x/crypto@v0.38.0	0.52.0	1
zabbix/zabbix-agent2 :ubuntu-6.0.8	e5b594057c9c	golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9	0.52.0	1
zachomedia/cert-manager-webhook-pdns :v2.5.5	4940e227a39b	golang.org/x/crypto@v0.48.0	0.52.0	1
zeetdev/tailscale-relay :v1.24.2	1967aa2840b6	golang.org/x/crypto@v0.0.0-20220427172511-eb4f295cb31f	0.52.0	1
zufardhiyaulhaq/community-operator-v2 :v1.0.0	7f1bbbe114eb	golang.org/x/crypto@v0.0.0-20220411220226-7b82a4e95df4	0.52.0	1
zufardhiyaulhaq/ngrok-operator :v1.3.0	7cf2ae3fb1fb	golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83	0.52.0	1
gcr.io/cadvisor/cadvisor :v0.47.2	e6c562b5e983	golang.org/x/crypto@v0.1.0	0.52.0	1
gcr.io/cadvisor/cadvisor :v0.52.1	f40e65878e25	golang.org/x/crypto@v0.31.0	0.52.0	1
gcr.io/cockroachlabs-helm-charts/cockroach-self-signer-cert :1.3	e225fe7eaa55	golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9	0.52.0	1
gcr.io/datadoghq/cluster-agent :7.61.0	6efe04ba4e06	golang.org/x/crypto@v0.31.0	0.52.0	1
gcr.io/gke-release/custom-metrics-stackdriver-adapter :v0.13.1-gke.0	6937c0a9b203	golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83	0.52.0	1
gcr.io/gloo-mesh/gloo-mesh :1.1.2	a4011eae6a0b	golang.org/x/crypto@v0.0.0-20210513164829-c07d793c2f9a	0.52.0	1
gcr.io/istio-release/pilot :1.11.1	c552478f8f11	golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83	0.52.0	1
gcr.io/istio-release/proxyv2 :1.11.1	9538fabe49fd	golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83	0.52.0	1
gcr.io/istio-testing/operator :latest	8d4576f7b98f	golang.org/x/crypto@v0.25.0	0.52.0	1
gcr.io/kaniko-project/executor :latest	4e7a52dd1f14	golang.org/x/crypto@v0.38.0	0.52.0	1
gcr.io/kasten-images/restorectl :8.0.14	5a0884f9a90c	golang.org/x/crypto@v0.45.0	0.52.0	1
gcr.io/knative-releases/knative.dev/eventing/cmd/broker/filter	d675f211a40f	golang.org/x/crypto@v0.28.0	0.52.0	1
gcr.io/knative-releases/knative.dev/eventing/cmd/broker/ingress	ec4b544499ba	golang.org/x/crypto@v0.28.0	0.52.0	1
gcr.io/knative-releases/knative.dev/eventing/cmd/mtchannel_broker	395f4ff1bd34	golang.org/x/crypto@v0.28.0	0.52.0	1
gcr.io/knative-releases/knative.dev/net-certmanager/cmd/webhook	873b968f02b5	golang.org/x/crypto@v0.0.0-20200323165209-0ec3e9974c59	0.52.0	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator	1e3db4f2eeed	golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0	0.52.0	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator	a5de0fb75046	golang.org/x/crypto@v0.0.0-20200302210943-78000ba7a073	0.52.0	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler	2ef460356b17	golang.org/x/crypto@v0.0.0-20200302210943-78000ba7a073	0.52.0	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler	db6ceff2aab4	golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0	0.52.0	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller	30ce73388ae5	golang.org/x/crypto@v0.0.0-20200302210943-78000ba7a073	0.52.0	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller :v1.13.1	53d9aa4d2c7a	golang.org/x/crypto@v0.18.0	0.52.0	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller :v1.2.5	75cfdcfa050a	golang.org/x/crypto@v0.0.0-20220214200702-86341886e292	0.52.0	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller :v1.10.2	98a2cc7fd62e	golang.org/x/crypto@v0.1.0	0.52.0	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller	b2cd45b8a8a4	golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0	0.52.0	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller	bac158dfb0c7	golang.org/x/crypto@v0.0.0-20220214200702-86341886e292	0.52.0	1
gcr.io/knative-releases/knative.dev/serving/cmd/webhook	d27b4495ccc3	golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0	0.52.0	1
gcr.io/knative-releases/knative.dev/serving/cmd/webhook	f16c0e022203	golang.org/x/crypto@v0.0.0-20200302210943-78000ba7a073	0.52.0	1
gcr.io/kubecost1/cost-model :prod-2.5.5	02b90651367f	golang.org/x/crypto@v0.31.0	0.52.0	1
gcr.io/kubecost1/cost-model :prod-1.81.0	67f4f162da8d	golang.org/x/crypto@v0.0.0-20201221181555-eec23a3978ad	0.52.0	1
gcr.io/kubecost1/cost-model :prod-1.108.1	852f7923fad3	golang.org/x/crypto@v0.15.0	0.52.0	1
gcr.io/kubecost1/cost-model :prod-1.82.2	989a60847416	golang.org/x/crypto@v0.0.0-20201221181555-eec23a3978ad	0.52.0	1
gcr.io/kubecost1/cost-model :prod-2.6.3	9e507ac0aebb	golang.org/x/crypto@v0.32.0	0.52.0	1
gcr.io/kubecost1/server :prod-1.82.2	2b1a3d08caac	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.52.0	1
gcr.io/kubecost1/server :prod-1.81.0	a348db3e4d74	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.52.0	1
gcr.io/ml-pipeline/api-server :2.3.0	39661bd823e8	golang.org/x/crypto@v0.22.0	0.52.0	1
gcr.io/ml-pipeline/api-server :2.0.0-alpha.5	dc6ca05bb94f	golang.org/x/crypto@v0.0.0-20220128200615-198e4374d7ed	0.52.0	1
gcr.io/ml-pipeline/cache-server :2.3.0	293941ee4f65	golang.org/x/crypto@v0.22.0	0.52.0	1
gcr.io/ml-pipeline/cache-server :2.0.0-alpha.5	83e79c709df3	golang.org/x/crypto@v0.0.0-20220128200615-198e4374d7ed	0.52.0	1
gcr.io/ml-pipeline/persistenceagent :2.0.0-alpha.5	00db9796a37b	golang.org/x/crypto@v0.0.0-20220128200615-198e4374d7ed	0.52.0	1
gcr.io/ml-pipeline/persistenceagent :2.3.0	109ac1b38c41	golang.org/x/crypto@v0.22.0	0.52.0	1
gcr.io/ml-pipeline/scheduledworkflow :2.0.0-alpha.5	795a0c8a0e13	golang.org/x/crypto@v0.0.0-20220128200615-198e4374d7ed	0.52.0	1
gcr.io/ml-pipeline/scheduledworkflow :2.3.0	f7e67e0bc071	golang.org/x/crypto@v0.22.0	0.52.0	1
gcr.io/ml-pipeline/workflow-controller :v3.3.8-license-compliance	6c8e4e2a6443	golang.org/x/crypto@v0.0.0-20220128200615-198e4374d7ed	0.52.0	1