StackRadar

CVE-2026-39827

Medium

Advisory

Published 22 May 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.003
21st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,522
of 17,828 indexed, latest versions
Container images
2,853
deployed by those charts
Fix available
1 of 1
affected package

golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS

Carried by container images the latest versions of 2,522 of 17,828 indexed charts deploy, on 2,853 images.

Affected packageAffected versionsFixed inImages
golang.org/x/cryptogolangv0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+154 more0.52.02,853
OSV records
GHSA-qpw4-5x99-6vjp
Also known as
GO-2026-5016

Charts affected

2,522 by stars
ChartLatestAffected imagesRadar Score
simple-mongodbtyk-helm0.1.11 of 1See more

simple-mongodb tyk-helm 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
golang.org/x/crypto@v0.25.0
0.52.0

Open the chart page →

4,167
typhoontyphoonVerified publisher0.2.31 of 2See more

typhoon typhoon 0.2.3

1 of the 2 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/zeiss/typhoon/controller:0.2.34fdf4edfda45
golang.org/x/crypto@v0.33.0
0.52.0

Open the chart page →

1,691
deep-learning-toolsuninettsigma29.1.21 of 3See more

deep-learning-tools uninettsigma2 9.1.2

1 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
sigma2as/goidc-proxy:next656ac798963a
golang.org/x/crypto@v0.48.0
0.52.0

Open the chart page →

1,572
desktop-vncuninettsigma22.0.21 of 2See more

desktop-vnc uninettsigma2 2.0.2

1 of the 2 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
sigma2as/goidc-proxy:next656ac798963a
golang.org/x/crypto@v0.48.0
0.52.0

Open the chart page →

476
jupyteruninettsigma21.1.41 of 2See more

jupyter uninettsigma2 1.1.4

1 of the 2 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
sigma2as/goidc-proxy:next656ac798963a
golang.org/x/crypto@v0.48.0
0.52.0

Open the chart page →

476
miniouninettsigma21.2.01 of 1See more

minio uninettsigma2 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
sigma2as/minio:20240306-3a2e4f5c284ead9ec3e
golang.org/x/crypto@v0.1.0
0.52.0

Open the chart page →

4,998
rstudiouninettsigma21.3.61 of 3See more

rstudio uninettsigma2 1.3.6

1 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
sigma2as/goidc-proxy:next656ac798963a
golang.org/x/crypto@v0.48.0
0.52.0

Open the chart page →

847
sparkuninettsigma21.1.41 of 3See more

spark uninettsigma2 1.1.4

1 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
sigma2as/goidc-proxy:next656ac798963a
golang.org/x/crypto@v0.48.0
0.52.0

Open the chart page →

847
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
opencloudeu/opencloud-rolling:2.1.0f9634bb04905
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

44,581
upcloud-csiupcloud-csiVerified publisher1.18.02 of 7See more

upcloud-csi upcloud-csi 1.18.0

2 of the 7 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-attacher:v4.12.0b9dc9a714a48
golang.org/x/crypto@v0.51.0
0.52.0
registry.k8s.io/sig-storage/csi-resizer:v2.2.0a2d40c1c3ccb
golang.org/x/crypto@v0.47.0
0.52.0

Open the chart page →

1,924
kiamuswitch6.1.21 of 1See more

kiam uswitch 6.1.2

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
quay.io/uswitch/kiam:v4.0be3a5846922d
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0

Open the chart page →

2,973
proxyv2flyVerified publisher0.0.61 of 1See more

proxy v2fly 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
v2fly/v2fly-core:latestd06727b221fe
golang.org/x/crypto@v0.43.0
0.52.0

Open the chart page →

1,436
vals-operatorvals-operatorVerified publisher0.8.11 of 1See more

vals-operator vals-operator 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/digitalis-io/vals-operator:v0.8.17c776499b8c9
golang.org/x/crypto@v0.47.0
0.52.0

Open the chart page →

730
vault-raft-snapshot-agentvault-raft-snapshot-agentVerified publisher0.6.91 of 1See more

vault-raft-snapshot-agent vault-raft-snapshot-agent 0.6.9

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/argelbargel/vault-raft-snapshot-agent:v0.12.5345174727a2b
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

1,267
openldap-havcnngrVerified publisher1.0.01 of 3See more

openldap-ha vcnngr 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
osixia/openldap:1.5.018742e9c449c
golang.org/x/crypto@v0.0.0-20201012173705-84dcc777aaee
0.52.0

Open the chart page →

5,517
devportalveecode-platform-nextVerified publisher0.1.231 of 1See more

devportal veecode-platform-next 0.1.23

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinneda72cf5cb47b8
golang.org/x/crypto@v0.46.0
0.52.0

Open the chart page →

1,853
verhuis-serviceverhuis-service1.0.01 of 3See more

verhuis-service verhuis-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/verhuis-service-php:latest66bbaf95a123
golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904
0.52.0

Open the chart page →

7,518
verzoekconversieserviceverzoekconversieservice1.0.01 of 3See more

verzoekconversieservice verzoekconversieservice 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/verzoekconversieservice-php:lateste918014fb8d3
golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904
0.52.0

Open the chart page →

7,536
verzoekregistratiecomponentverzoekregistratiecomponent1.1.01 of 4See more

verzoekregistratiecomponent verzoekregistratiecomponent 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/verzoekregistratiecomponent-php:latestc4f6c03af5d3
golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904
0.52.0

Open the chart page →

7,439
verzoektypecatalogusverzoektypecatalogus1.1.01 of 4See more

verzoektypecatalogus verzoektypecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/verzoektypecatalogus-php:latest64f5eb7a398b
golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904
0.52.0

Open the chart page →

7,439
scrutinyvhdirkVerified publisher0.1.31 of 1See more

scrutiny vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/analogj/scrutiny:master-omnibus18689773150d
golang.org/x/crypto@v0.1.0
0.52.0

Open the chart page →

4,433
twenty-crmvictorlane0.0.11 of 3See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
twentycrm/twenty-postgres-spilo:latest2f78405a78be
golang.org/x/crypto@v0.0.0-20220511200225-c6db032c6c88
0.52.0

Open the chart page →

67,865
vineyard-operatorvineyardVerified publisher0.24.22 of 2See more

vineyard-operator vineyard 0.24.2

2 of the 2 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
vineyardcloudnative/vineyard-operator:latest9d419aa18faa
golang.org/x/crypto@v0.21.0
0.52.0
ghcr.io/v6d-io/v6d/kube-rbac-proxy:v0.13.0a2523c532c0c
golang.org/x/crypto@v0.0.0-20220214200702-86341886e292
0.52.0

Open the chart page →

4,573
ciliumvks-helm-chartsVerified publisher1.17.142 of 3See more

cilium vks-helm-charts 1.17.14

2 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
quay.io/cilium/cilium:v1.17.14cdcfab5b4466
golang.org/x/crypto@v0.45.0
0.52.0
quay.io/cilium/operator-generic:v1.17.14773886ec9337
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

4,247
corednsvks-helm-chartsVerified publisher1.45.01 of 1See more

coredns vks-helm-charts 1.45.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
coredns/coredns:1.13.19b9128672209
golang.org/x/crypto@v0.42.0
0.52.0

Open the chart page →

923
volantmqvolantmq0.1.21 of 1See more

volantmq volantmq 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
volantmq/volantmq:v0.4.0-rc.69bfe7857ebc3
golang.org/x/crypto@v0.0.0-20190927123631-a832865fa7ad
0.52.0

Open the chart page →

2,551
cert-manager-webhook-vultrvultrVerified publisher1.0.01 of 1See more

cert-manager-webhook-vultr vultr 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
vultr/cert-manager-webhook-vultr:v0.1.0541c3e0aec58
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0

Open the chart page →

2,508
aih-scannerwallarmVerified publisher2.7.111 of 2See more

aih-scanner wallarm 2.7.11

1 of the 2 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
wallarm/aih-scanner:2.7.11f1cb26db1f5b
golang.org/x/crypto@v0.49.0
0.52.0

Open the chart page →

4,107
gateway-control-planewallarmVerified publisher0.2.02 of 2See more

gateway-control-plane wallarm 0.2.0

2 of the 2 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
timescale/timescaledb:latest-pg17c79fa5891443
golang.org/x/crypto@v0.32.0
0.52.0
wallarm/gateway-control-plane:0.2.0a321bc974a19
golang.org/x/crypto@v0.17.0
0.52.0

Open the chart page →

1,220
wallarm-node-nextwallarmVerified publisher0.5.32 of 2See more

wallarm-node-next wallarm 0.5.3

2 of the 2 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
wallarm/node-helpers:5.0.2-1097cadc42336
golang.org/x/crypto@v0.24.0
0.52.0
wallarm/node-next:0.5.24314f3d2b918
golang.org/x/crypto@v0.26.0
0.52.0

Open the chart page →

2,414
wallarm-oobwallarmVerified publisher0.23.01 of 3See more

wallarm-oob wallarm 0.23.0

1 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
wallarm/ebpf-agent:0.11.0-rc0c8920e60c726
golang.org/x/crypto@v0.21.0
0.52.0

Open the chart page →

2,842
consulwarjiang1.3.02 of 2See more

consul warjiang 1.3.0

2 of the 2 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
hashicorp/consul:1.17.0712fe02d2f84
golang.org/x/crypto@v0.14.0
0.52.0
hashicorp/consul-k8s-control-plane:1.3.00e4452f0f265
golang.org/x/crypto@v0.0.0-20220411220226-7b82a4e95df4
0.52.0

Open the chart page →

4,102
eth-validatorwateim1.4.51 of 3See more

eth-validator wateim 1.4.5

1 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
wateim/lighthouse-launch:latest2520149ee574
golang.org/x/crypto@v0.31.0
0.52.0

Open the chart page →

4,945
wavefront-hpa-adapterwavefront0.2.101 of 1See more

wavefront-hpa-adapter wavefront 0.2.10

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
wavefronthq/wavefront-hpa-adapter:0.9.12af5fef9a4768
golang.org/x/crypto@v0.14.0
0.52.0

Open the chart page →

1,692
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.14.45a065930682d
golang.org/x/crypto@v0.0.0-20200510223506-06a226fb4e37
0.52.0

Open the chart page →

5,623
wazuh-manager-filebeatwazuh-manager-filebeat0.1.0-gamma1 of 1See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
iosifache/wazuh-manager-filebeat:latest85df3f04b5da
golang.org/x/crypto@v0.0.0-20200510223506-06a226fb4e37
0.52.0

Open the chart page →

11,243
istio-service-meshwbstack0.0.11 of 1See more

istio-service-mesh wbstack 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
istio/pilot:1.17.1ce9d87606701
golang.org/x/crypto@v0.5.0
0.52.0

Open the chart page →

6,316
azure-janitorwebdevopsVerified publisher1.0.131 of 1See more

azure-janitor webdevops 1.0.13

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
webdevops/azure-janitor:24.9.02446baee7b69
golang.org/x/crypto@v0.27.0
0.52.0

Open the chart page →

802
azure-keyvault-exporterwebdevopsVerified publisher1.0.121 of 1See more

azure-keyvault-exporter webdevops 1.0.12

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
webdevops/azure-keyvault-exporter:24.9.1f333704ecd60
golang.org/x/crypto@v0.27.0
0.52.0

Open the chart page →

802
azure-loganalytics-exporterwebdevopsVerified publisher1.0.131 of 1See more

azure-loganalytics-exporter webdevops 1.0.13

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
webdevops/azure-loganalytics-exporter:25.12.0051845d06d85
golang.org/x/crypto@v0.46.0
0.52.0

Open the chart page →

509
azure-resourcegraph-exporterwebdevopsVerified publisher1.1.51 of 1See more

azure-resourcegraph-exporter webdevops 1.1.5

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
webdevops/azure-resourcegraph-exporter:24.9.0381136dda026
golang.org/x/crypto@v0.27.0
0.52.0

Open the chart page →

786
azure-resourcemanager-exporterwebdevopsVerified publisher1.3.61 of 1See more

azure-resourcemanager-exporter webdevops 1.3.6

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
webdevops/azure-resourcemanager-exporter:26.1.0d3e1842ad419
golang.org/x/crypto@v0.46.0
0.52.0

Open the chart page →

536
pagerduty-exporterwebdevopsVerified publisher1.1.81 of 1See more

pagerduty-exporter webdevops 1.1.8

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
webdevops/pagerduty-exporter:25.12.183b95faf10a0
golang.org/x/crypto@v0.46.0
0.52.0

Open the chart page →

509
jenkinswebencryptor1.9.181 of 1See more

jenkins webencryptor 1.9.18

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

2,545
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
golang.org/x/crypto@v0.25.0
0.52.0

Open the chart page →

28,886
webresourcecataloguswebresourcecatalogus1.1.01 of 4See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/webresourcecatalogus-php:latest8f1bbd5cda85
golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904
0.52.0

Open the chart page →

7,562
ambassadorwener6.9.51 of 2See more

ambassador wener 6.9.5

1 of the 2 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
golang.org/x/crypto@v0.0.0-20201221181555-eec23a3978ad
0.52.0

Open the chart page →

4,121
apisixwener2.17.01 of 3See more

apisix wener 2.17.0

1 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
bitnamilegacy/etcd:latest99b408c15272
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

3,200
argo-cdwener10.9.22 of 3See more

argo-cd wener 10.9.2

2 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.45.18499afd690c4
golang.org/x/crypto@v0.47.0
0.52.0
quay.io/argoproj/argocd:v3.5.3dd3f47d5a5e4
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

3,085
argo-eventswener2.4.271 of 1See more

argo-events wener 2.4.27

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

1,093

Container images carrying it

2,853 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/csi-resizer:v2.0.04a95d94e57ad
golang.org/x/crypto@v0.37.0
0.52.0
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.8.03e2bf2eaef9f
golang.org/x/crypto@v0.36.0
0.52.0
1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.03ce0fdba4d8e
golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975
0.52.0
1

syft 1.42.1 · advisories as of 22 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.