StackRadar

CVE-2026-39827

Medium

Advisory

Published 22 May 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.003
21st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,522
of 17,828 indexed, latest versions
Container images
2,853
deployed by those charts
Fix available
1 of 1
affected package

golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS

Carried by container images the latest versions of 2,522 of 17,828 indexed charts deploy, on 2,853 images.

Affected packageAffected versionsFixed inImages
golang.org/x/cryptogolangv0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+154 more0.52.02,853
OSV records
GHSA-qpw4-5x99-6vjp
Also known as
GO-2026-5016

Charts affected

2,522 by stars
ChartLatestAffected imagesRadar Score
reporting-nifi-processor-svcmojaloop0.0.21 of 3See more

reporting-nifi-processor-svc mojaloop 0.0.2

1 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
library/mongo:6.0.271a63fc2438e
golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d
0.52.0

Open the chart page →

6,265
eks-pod-identity-webhookmondu-aiVerified publisher0.3.11 of 1See more

eks-pod-identity-webhook mondu-ai 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/mondu-ai/eks-pod-identity-webhook:latestc2ac3bad857d
golang.org/x/crypto@v0.44.0
0.52.0

Open the chart page →

474
mongodb-admin-interfacemongo-db-admin-interfaceVerified publisher0.1.01 of 2See more

mongodb-admin-interface mongo-db-admin-interface 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
library/mongo:5.041108d183e97
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

5,265
enterprise-operatormongodb-helm-charts1.33.01 of 1See more

enterprise-operator mongodb-helm-charts 1.33.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
quay.io/mongodb/mongodb-enterprise-operator-ubi:1.33.0b05101723412
golang.org/x/crypto@v0.37.0
0.52.0

Open the chart page →

1,578
mongodb-query-exportermongodb-query-exporterVerified publisher5.1.01 of 1See more

mongodb-query-exporter mongodb-query-exporter 5.1.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/raffis/mongodb-query-exporter:v5.1.0ca6ac8a5b329
golang.org/x/crypto@v0.13.0
0.52.0

Open the chart page →

989
mongodb-secure-backupmongodb-secure-backup1.0.01 of 2See more

mongodb-secure-backup mongodb-secure-backup 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
arconixforge/mongodb-secure-backup:v1.1c08d7c438966
golang.org/x/crypto@v0.32.0
0.52.0

Open the chart page →

1,034
mongopingmongoping1.3.11 of 1See more

mongoping mongoping 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
udhos/mongoping:1.3.103b08b63f524
golang.org/x/crypto@v0.38.0
0.52.0

Open the chart page →

1,283
camera-viewermoreillonVerified publisher0.2.11 of 4See more

camera-viewer moreillon 0.2.1

1 of the 4 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:6.0.4-debian-11-r10016dce036593
golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d
0.52.0

Open the chart page →

11,826
face-recognitionmoreillonVerified publisher0.2.41 of 3See more

face-recognition moreillon 0.2.4

1 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:6.0.4-debian-11-r10016dce036593
golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d
0.52.0

Open the chart page →

8,576
mqtt-loggermoreillonVerified publisher0.3.12 of 5See more

mqtt-logger moreillon 0.3.1

2 of the 5 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
bitnamilegacy/influxdb:2.6.1-debian-11-r18d17df1f9d745
golang.org/x/crypto@v0.0.0-20220331220935-ae2d96664a29
0.52.0
bitnamilegacy/mongodb:6.0.4-debian-11-r10016dce036593
golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d
0.52.0

Open the chart page →

11,072
user-manager-mongodbmoreillonVerified publisher0.6.21 of 4See more

user-manager-mongodb moreillon 0.6.2

1 of the 4 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:6.0.10-debian-11-r842319decb591
golang.org/x/crypto@v0.12.0
0.52.0

Open the chart page →

25,975
backupmorremeyer4.0.01 of 1See more

backup morremeyer 4.0.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
restic/restic:0.15.2579e4e6a4931
golang.org/x/crypto@v0.7.0
0.52.0

Open the chart page →

2,303
hcloud-ccm-networksmorremeyer2.0.01 of 1See more

hcloud-ccm-networks morremeyer 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
hetznercloud/hcloud-cloud-controller-manager:v1.16.08c07e6d7a76c
golang.org/x/crypto@v0.10.0
0.52.0

Open the chart page →

1,754
chirpstackmosquitto-helm-chart0.5.01 of 8See more

chirpstack mosquitto-helm-chart 0.5.0

1 of the 8 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
chirpstack/chirpstack-application-server:3fb7667fe037f
golang.org/x/crypto@v0.0.0-20200709230013-948cd5f35899
0.52.0

Open the chart page →

98,942
chirpstack-event-forwardmosquitto-helm-chart0.1.21 of 1See more

chirpstack-event-forward mosquitto-helm-chart 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/liangyuanpeng/chirpstack-event-forward:v0.1.223dc6274cc4b
golang.org/x/crypto@v0.0.0-20210817164053-32db794688a5
0.52.0

Open the chart page →

1,855
replacermosquitto-helm-chart0.2.01 of 3See more

replacer mosquitto-helm-chart 0.2.0

1 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/liangyuanpeng/replacer:v1.1.00b2a41c2a43e
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0

Open the chart page →

3,933
configmapsecretsmozilla0.0.11 of 1See more

configmapsecrets mozilla 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
mzinc/configmapsecret-controller:v0.5.1eebbcbf2d1f7
golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83
0.52.0

Open the chart page →

2,110
adguard-homemt1905024.0.121 of 2See more

adguard-home mt190502 4.0.12

1 of the 2 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
adguard/adguardhome:v0.107.737fbf01d73ecb
golang.org/x/crypto@v0.48.0
0.52.0

Open the chart page →

1,168
maddymt1905024.1.21 of 1See more

maddy mt190502 4.1.2

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
foxcpp/maddy:0.9.2a4b839985b9b
golang.org/x/crypto@v0.32.0
0.52.0

Open the chart page →

1,045
memosmt1905027.3.21 of 3See more

memos mt190502 7.3.2

1 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
neosmemo/memos:0.26.23eefcc231141
golang.org/x/crypto@v0.47.0
0.52.0

Open the chart page →

2,665
minifluxmt1905021.1.61 of 3See more

miniflux mt190502 1.1.6

1 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
miniflux/miniflux:2.2.18a3ca6bbc1f74
golang.org/x/crypto@v0.49.0
0.52.0

Open the chart page →

2,313
nightscoutmt1905021.1.01 of 3See more

nightscout mt190502 1.1.0

1 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
golang.org/x/crypto@v0.25.0
0.52.0

Open the chart page →

6,695
vikunjamt1905027.1.21 of 3See more

vikunja mt190502 7.1.2

1 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
vikunja/vikunja:0.24.6ed1f3ed467fe
golang.org/x/crypto@v0.27.0
0.52.0

Open the chart page →

3,039
unpollermvisonneau0.1.01 of 1See more

unpoller mvisonneau 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
golift/unifi-poller:v2.9.2585a29a06d05
golang.org/x/crypto@v0.13.0
0.52.0

Open the chart page →

1,191
authmyaVerified publisher22.4.31 of 1See more

auth mya 22.4.3

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
cesanta/docker_auth:1.6.04d16885f3d4c
golang.org/x/crypto@v0.0.0-20190820162420-60c769a6c586
0.52.0

Open the chart page →

2,382
cognativemyaVerified publisher0.2403.32 of 3See more

cognative mya 0.2403.3

2 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
grafana/grafana:10.4.0f9811e4e687f
golang.org/x/crypto@v0.18.0
0.52.0
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
golang.org/x/crypto@v0.20.0
0.52.0

Open the chart page →

7,429
giteamyaVerified publisher23.12.51 of 1See more

gitea mya 23.12.5

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
gitea/gitea:1.21.6ac73e0da341f
golang.org/x/crypto@v0.18.0
0.52.0

Open the chart page →

3,438
myhelmappmyhelmapp0.1.11 of 1See more

myhelmapp myhelmapp 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
tobirachel/node-project3:v17d9f37154994
golang.org/x/crypto@v0.0.0-20211108221036-ceb1ce70b4fa
0.52.0

Open the chart page →

3,369
Practica_4_helmmy-heml-appVerified publisher0.1.01 of 7See more

Practica_4_helm my-heml-app 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
library/mongo:5.0.6-focal8e70544b6c76
golang.org/x/crypto@v0.0.0-20200302210943-78000ba7a073
0.52.0

Open the chart page →

28,034
influxdbmy-personal-influxdb20.1.01 of 1See more

influxdb my-personal-influxdb2 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
library/influxdb:2.7b8d940ca9376
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

3,913
traefik-forward-auth-openidnas-helm-chartsVerified publisher1.0.11 of 1See more

traefik-forward-auth-openid nas-helm-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
thomseddon/traefik-forward-auth:latestb364aa6a4117
golang.org/x/crypto@v0.0.0-20190701094942-4def268fd1a4
0.52.0

Open the chart page →

2,198
nats-kafkanatsVerified publisher0.15.41 of 1See more

nats-kafka nats 0.15.4

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
natsio/nats-kafka:1.4.2bb241956b0dc
golang.org/x/crypto@v0.15.0
0.52.0

Open the chart page →

1,732
account-servernatz-operatorVerified publisher0.9.51 of 1See more

account-server natz-operator 0.9.5

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/zeiss/natz-operator/account-server:0.9.5b380b5f17c3f
golang.org/x/crypto@v0.33.0
0.52.0

Open the chart page →

746
incorencsaVerified publisher1.38.01 of 29See more

incore ncsa 1.38.0

1 of the 29 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:4.4.5e3c9d6b4bc92
golang.org/x/crypto@v0.0.0-20190530122614-20be4c3c3ed5
0.52.0

Open the chart page →

15,562
jupyterhub-metricsncsaVerified publisher1.3.01 of 5See more

jupyterhub-metrics ncsa 1.3.0

1 of the 5 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
timescale/timescaledb:latest-pg156343bdc87ca1
golang.org/x/crypto@v0.32.0
0.52.0

Open the chart page →

3,212
uptime-kumancsaVerified publisher1.7.31 of 1See more

uptime-kuma ncsa 1.7.3

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.5c74379ac4509
golang.org/x/crypto@v0.51.0
0.52.0

Open the chart page →

30,720
papergirlneoskop3.2.61 of 5See more

papergirl neoskop 3.2.6

1 of the 5 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
minio/mc:RELEASE.2022-05-09T04-08-26Z4b415310d8d0
golang.org/x/crypto@v0.0.0-20220128200615-198e4374d7ed
0.52.0

Open the chart page →

6,999
neosyncneosyncVerified publisher0.5.412 of 3See more

neosync neosync 0.5.41

2 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/nucleuscloud/neosync/api:0.5.41e2abb798f29f
golang.org/x/crypto@v0.36.0
0.52.0
ghcr.io/nucleuscloud/neosync/worker:0.5.4196f42450c5b1
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

7,329
apineosync-apiVerified publisher0.5.411 of 1See more

api neosync-api 0.5.41

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/nucleuscloud/neosync/api:0.5.41e2abb798f29f
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

2,888
workerneosync-workerVerified publisher0.5.411 of 1See more

worker neosync-worker 0.5.41

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/nucleuscloud/neosync/worker:0.5.4196f42450c5b1
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

2,866
bluesky-pdsnerkho-helm-charts0.4.21 of 1See more

bluesky-pds nerkho-helm-charts 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4.204cbc6e3ea157d
golang.org/x/crypto@v0.41.0
0.52.0

Open the chart page →

2,402
netbirdnetbird1.9.03 of 4See more

netbird netbird 1.9.0

3 of the 4 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
netbirdio/management:0.46.0b0adc4ad4ec6
golang.org/x/crypto@v0.37.0
0.52.0
netbirdio/relay:0.46.0d32f82514a24
golang.org/x/crypto@v0.37.0
0.52.0
netbirdio/signal:0.46.0e8f392611152
golang.org/x/crypto@v0.37.0
0.52.0

Open the chart page →

6,500
iamdnetsocVerified publisher0.6.11 of 2See more

iamd netsoc 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/netsoc/iamd:1.1.22fe6b69b20d7
golang.org/x/crypto@v0.0.0-20210616213533-5ff15b29337e
0.52.0

Open the chart page →

2,892
shhdnetsocVerified publisher0.1.71 of 1See more

shhd netsoc 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/netsoc/shhd:0.1.60bb44992b62c
golang.org/x/crypto@v0.0.0-20210711020723-a769d52b0f97
0.52.0

Open the chart page →

3,989
webspacednetsocVerified publisher0.2.81 of 2See more

webspaced netsoc 0.2.8

1 of the 2 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/netsoc/webspaced:0.5.1edc238a538a0
golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83
0.52.0

Open the chart page →

5,196
neurofaceneurofaceVerified publisher1.4.21 of 3See more

neuroface neuroface 1.4.2

1 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
openvino/model_server:2025.2.11e7cd1d70cc1
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

7,686
agent-controlnewrelic0.0.921 of 1See more

agent-control newrelic 0.0.92

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
newrelic/newrelic-agent-control-cli:0.48.01a448492b55a
golang.org/x/crypto@v0.40.0
0.52.0

Open the chart page →

3,922
agent-control-cdnewrelic1.0.03 of 3See more

agent-control-cd newrelic 1.0.0

3 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/fluxcd/flux-cli:v2.5.1274a179fd402
golang.org/x/crypto@v0.33.0
0.52.0
ghcr.io/fluxcd/helm-controller:v1.2.062eaa9c9a929
golang.org/x/crypto@v0.32.0
0.52.0
ghcr.io/fluxcd/source-controller:v1.5.000cd9316a379
golang.org/x/crypto@v0.32.0
0.52.0

Open the chart page →

5,520
nexus-tasksnexus-tasks2.0.01 of 5See more

nexus-tasks nexus-tasks 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/ashvinbambhaniya/nexus-tasks-backend:2.0.0f80349eb018b
golang.org/x/crypto@v0.49.0
0.52.0

Open the chart page →

3,932
nginx-examplengrok-ingress-helm0.3.01 of 2See more

nginx-example ngrok-ingress-helm 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
wernight/ngrok:latestd211f29ebcfe
golang.org/x/crypto@v0.17.0
0.52.0

Open the chart page →

2,722

Container images carrying it

2,853 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/csi-resizer:v2.0.04a95d94e57ad
golang.org/x/crypto@v0.37.0
0.52.0
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.8.03e2bf2eaef9f
golang.org/x/crypto@v0.36.0
0.52.0
1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.03ce0fdba4d8e
golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975
0.52.0
1

syft 1.42.1 · advisories as of 22 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.