StackRadar

CVE-2026-39827

Medium

Advisory

Published 22 May 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.003
21st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,533
of 17,832 indexed, latest versions
Container images
2,854
deployed by those charts
Fix available
1 of 1
affected package

golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS

Carried by container images the latest versions of 2,533 of 17,832 indexed charts deploy, on 2,854 images.

Affected packageAffected versionsFixed inImages
golang.org/x/cryptogolangv0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+153 more0.52.02,854
OSV records
GHSA-qpw4-5x99-6vjp
Also known as
GO-2026-5016

Charts affected

2,533 by stars
ChartLatestAffected imagesRadar Score
kedaarieotechVerified publisher0.1.02 of 3See more

keda arieotech 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/kedacore/keda:2.16.002348a19aeae
golang.org/x/crypto@v0.28.0
0.52.0
ghcr.io/kedacore/keda-metrics-apiserver:2.16.073a2ebae4413
golang.org/x/crypto@v0.28.0
0.52.0

Open the chart page →

2,531
s3dartur9010Verified publisher1.0.11 of 1See more

s3d artur9010 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/siafoundation/s3d:bf33bf3b3fcc85f7282
golang.org/x/crypto@v0.50.0
0.52.0

Open the chart page →

1,788
arvancloud-webhookarvancloud-webhookVerified publisher1.0.01 of 1See more

arvancloud-webhook arvancloud-webhook 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/parmincloud/arvancloud-certmanager-issuer:v1.0.00b97452674a3
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

2,388
cert-exporterarzu3.0.11 of 1See more

cert-exporter arzu 3.0.1

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
joeelliott/cert-exporter:v2.7.0b4acd14642d0
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0

Open the chart page →

2,821
siemassist-iot-cybersecurity-monitroting-siem0.1.01 of 3See more

siem assist-iot-cybersecurity-monitroting-siem 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_id-wzh:latest0aacefac9677
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0

Open the chart page →

10,802
dltbrokerassist-iot-distributed-broker0.2.03 of 9See more

dltbroker assist-iot-distributed-broker 0.2.0

3 of the 9 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
hyperledger/fabric-orderer:2.46ec3fe59ea55
golang.org/x/crypto@v0.0.0-20210322153248-0c34fe9e7dc2
0.52.0
hyperledger/fabric-peer:2.46ff36af21eb1
golang.org/x/crypto@v0.0.0-20210322153248-0c34fe9e7dc2
0.52.0
hyperledger/fabric-tools:2.4b1194f509085
golang.org/x/crypto@v0.0.0-20210322153248-0c34fe9e7dc2
0.52.0

Open the chart page →

188,331
dltloggingassist-iot-logging-auditing0.2.03 of 9See more

dltlogging assist-iot-logging-auditing 0.2.0

3 of the 9 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
hyperledger/fabric-orderer:2.46ec3fe59ea55
golang.org/x/crypto@v0.0.0-20210322153248-0c34fe9e7dc2
0.52.0
hyperledger/fabric-peer:2.46ff36af21eb1
golang.org/x/crypto@v0.0.0-20210322153248-0c34fe9e7dc2
0.52.0
hyperledger/fabric-tools:2.4b1194f509085
golang.org/x/crypto@v0.0.0-20210322153248-0c34fe9e7dc2
0.52.0

Open the chart page →

188,311
cso-proxyav1o-chartsVerified publisher0.1.31 of 1See more

cso-proxy av1o-charts 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/djcass44/cso-proxy:cccf49fdb360d44125ad
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0

Open the chart page →

4,326
dex-k8sav1o-chartsVerified publisher0.2.11 of 1See more

dex-k8s av1o-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.28.15e88f2205de1
golang.org/x/crypto@v0.0.0-20201221181555-eec23a3978ad
0.52.0

Open the chart page →

3,400
kube-image-webhookav1o-chartsVerified publisher0.1.31 of 1See more

kube-image-webhook av1o-charts 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
registry.gitlab.com/autokubeops/kube-image-webhook:v0.2.0fcf464708a21
golang.org/x/crypto@v0.0.0-20210817164053-32db794688a5
0.52.0

Open the chart page →

3,750
kubebrowseravistoOfficialVerified publisher1.4.01 of 1See more

kubebrowser avisto 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/avistotelecom/kubebrowser:0.10.0a354b8dc7e6a
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

678
db-backupballe-petersen0.1.41 of 1See more

db-backup balle-petersen 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
tobiasbp/db-backup:0.0.314bee6e33a26
golang.org/x/crypto@v0.0.0-20200109152110-61a87790db17
0.52.0

Open the chart page →

4,823
music-assistantbdclark-helm-chartsVerified publisher0.4.131 of 1See more

music-assistant bdclark-helm-charts 0.4.13

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.3885872224fa5
golang.org/x/crypto@v0.46.0
0.52.0

Open the chart page →

3,802
chirpstackbeeinventor0.1.101 of 5See more

chirpstack beeinventor 0.1.10

1 of the 5 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
chirpstack/chirpstack-application-server:3.17.6e0b23dfd24d6
golang.org/x/crypto@v0.0.0-20200709230013-948cd5f35899
0.52.0

Open the chart page →

7,826
livekit-serverbeeinventor1.0.01 of 2See more

livekit-server beeinventor 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
livekit/livekit-server:v1.0.08391fd1b834f
golang.org/x/crypto@v0.0.0-20220516162934-403b01795ae8
0.52.0

Open the chart page →

2,610
cloudflare-tunnel-operatorbeezlabs0.2.01 of 1See more

cloudflare-tunnel-operator beezlabs 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/beezlabs-org/cloudflare-tunnel-operator:v0.1.09afcd070940f
golang.org/x/crypto@v0.0.0-20210817164053-32db794688a5
0.52.0

Open the chart page →

1,597
helm-dashboardbeluga-cloudVerified publisher2.4.01 of 1See more

helm-dashboard beluga-cloud 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/beluga-cloud/helm-dashboard/dashboard:1.3.39ab9a675c405
golang.org/x/crypto@v0.14.0
0.52.0

Open the chart page →

2,909
yatai-image-builderbentomlVerified publisher3.0.441 of 1See more

yatai-image-builder bentoml 3.0.44

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
quay.io/bentoml/yatai-image-builder:3.0.4401d8538c4f48
golang.org/x/crypto@v0.46.0
0.52.0

Open the chart page →

492
aramid-indexerbiatec-repoVerified publisher3.9.03 of 5See more

aramid-indexer biatec-repo 3.9.0

3 of the 5 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
scholtz2/aramid-algo-follow-node:v4.3.0-stable1ec63eca86b6
golang.org/x/crypto@v0.37.0
0.52.0
scholtz2/aramid-conduit:v1.9.0-stable3a3b3d3277d2
golang.org/x/crypto@v0.38.0
0.52.0
scholtz2/aramid-indexer:v3.9.0-stable6770214bc881
golang.org/x/crypto@v0.38.0
0.52.0

Open the chart page →

13,910
aramid-participationbiatec-repoVerified publisher4.4.11 of 1See more

aramid-participation biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
scholtz2/algorand-participation-aramidmain-extended:4.4.1-stablef12ce1cfb72e
golang.org/x/crypto@v0.37.0
0.52.0

Open the chart page →

7,482
aramid-relaybiatec-repoVerified publisher4.4.11 of 1See more

aramid-relay biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
scholtz2/aramid-algo-node:v4.4.1-stable70263d8fab5b
golang.org/x/crypto@v0.37.0
0.52.0

Open the chart page →

5,358
voimain-participationbiatec-repoVerified publisher4.4.11 of 1See more

voimain-participation biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
scholtz2/algorand-participation-voimain-extended:4.4.1-stable64966de56d9f
golang.org/x/crypto@v0.37.0
0.52.0

Open the chart page →

7,482
prometheus-airbyte-exporterbotify-helm-chartsVerified publisher0.7.11 of 1See more

prometheus-airbyte-exporter botify-helm-charts 0.7.1

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/botify-labs/airbyte_exporter:2.3.02105b1f33013
golang.org/x/crypto@v0.18.0
0.52.0

Open the chart page →

2,972
boundaryboundary-chart0.3.121 of 1See more

boundary boundary-chart 0.3.12

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
hashicorp/boundary:0.15.3339b78b61750
golang.org/x/crypto@v0.21.0
0.52.0

Open the chart page →

1,631
syncthingbrandan-schmitz-helm-chartsVerified publisher2.1.01 of 1See more

syncthing brandan-schmitz-helm-charts 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
syncthing/syncthing:2.1.1775c4aac4862
golang.org/x/crypto@v0.51.0
0.52.0

Open the chart page →

1,226
brpservicebrpservice1.1.01 of 4See more

brpservice brpservice 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/brpservice-php:latestc17f1ba17d36
golang.org/x/crypto@v0.0.0-20200414173820-0848c9571904
0.52.0

Open the chart page →

7,843
btrfs-nfs-csibtrfs-nfs-csi0.4.03 of 7See more

btrfs-nfs-csi btrfs-nfs-csi 0.4.0

3 of the 7 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-attacher:v4.11.0b74b05b39501
golang.org/x/crypto@v0.45.0
0.52.0
registry.k8s.io/sig-storage/csi-resizer:v2.1.0589e525cddef
golang.org/x/crypto@v0.46.0
0.52.0
registry.k8s.io/sig-storage/csi-snapshotter:v8.5.0da081c27e8a6
golang.org/x/crypto@v0.47.0
0.52.0

Open the chart page →

3,249
bucket-backup-restorebucket-backup-restore0.1.01 of 2See more

bucket-backup-restore bucket-backup-restore 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
abohatyrenko/bucket-backup-restore:latestfa98af15a13e
golang.org/x/crypto@v0.14.0
0.52.0

Open the chart page →

2,050
agentbuildkite0.6.41 of 1See more

agent buildkite 0.6.4

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
buildkite/agent:3.25.0aec38cfaae0e
golang.org/x/crypto@v0.0.0-20200302210943-78000ba7a073
0.52.0

Open the chart page →

2,672
buildkite-agent-metricsbuildkite-agent-metrics0.1.01 of 1See more

buildkite-agent-metrics buildkite-agent-metrics 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
public.ecr.aws/buildkite/agent-metrics:v5.11.016e7f5c7161e
golang.org/x/crypto@v0.41.0
0.52.0

Open the chart page →

1,554
buildkit-fleetbuildkit-fleetVerified publisher0.1.21 of 1See more

buildkit-fleet buildkit-fleet 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
moby/buildkit:v0.33.0-rootless80b15f0735e8
golang.org/x/crypto@v0.50.0
0.52.0

Open the chart page →

903
argocd-source-trackercableship0.0.91 of 1See more

argocd-source-tracker cableship 0.0.9

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/cableship/argocd-source-tracker:0.0.6ff7dd45aa774
golang.org/x/crypto@v0.37.0
0.52.0

Open the chart page →

1,660
chart-sentinelcableship0.0.121 of 1See more

chart-sentinel cableship 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/cableship/chart-sentinel:0.1.0a037f1042b28
golang.org/x/crypto@v0.37.0
0.52.0

Open the chart page →

1,660
blackbox-exportercamptocamp31.0.01 of 1See more

blackbox-exporter camptocamp3 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
prom/blackbox-exporter:v0.25.0b04a9fef4fa0
golang.org/x/crypto@v0.22.0
0.52.0

Open the chart page →

913
fluxcd-webuiccowleyVerified publisher0.0.21 of 2See more

fluxcd-webui ccowley 0.0.2

1 of the 2 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
adrianberger/fluxcd-webui:latest76848c0d2780
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0

Open the chart page →

3,513
celestia-nodecelestia-node0.1.71 of 1See more

celestia-node celestia-node 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-node:v0.16.041177982c584
golang.org/x/crypto@v0.25.0
0.52.0

Open the chart page →

1,819
finops-stackcert-managerVerified publisher0.0.57 of 12See more

finops-stack cert-manager 0.0.5

7 of the 12 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
grafana/grafana:11.1.3b23b588cf7cb
golang.org/x/crypto@v0.24.0
0.52.0
ghcr.io/kyverno/background-controller:v1.12.506ed5db6cd33
golang.org/x/crypto@v0.22.0
0.52.0
ghcr.io/kyverno/cleanup-controller:v1.12.5b914032ef9ad
golang.org/x/crypto@v0.22.0
0.52.0
ghcr.io/kyverno/kyverno:v1.12.5a61c7022abcf
golang.org/x/crypto@v0.22.0
0.52.0
ghcr.io/kyverno/kyverno-cli:v1.12.5832a32779e6d
golang.org/x/crypto@v0.22.0
0.52.0
ghcr.io/kyverno/kyvernopre:v1.12.563f7eaf5aa8a
golang.org/x/crypto@v0.22.0
0.52.0
ghcr.io/kyverno/reports-controller:v1.12.5c62e3347611c
golang.org/x/crypto@v0.22.0
0.52.0

Open the chart page →

12,820
cert-manager-webhook-arvancloudcert-manager-webhook-arvancloudVerified publisher0.1.11 of 1See more

cert-manager-webhook-arvancloud cert-manager-webhook-arvancloud 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/mohammadv184/cert-manager-webhook-arvancloud:latest179bee5ef8b2
golang.org/x/crypto@v0.6.0
0.52.0

Open the chart page →

1,082
cert-manager-webhook-gandicert-manager-webhook-gandi0.6.01 of 1See more

cert-manager-webhook-gandi cert-manager-webhook-gandi 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/sintef/cert-manager-webhook-gandi:0.6.06819b34ccac8
golang.org/x/crypto@v0.24.0
0.52.0

Open the chart page →

1,040
cert-vaultcert-vaultOfficialVerified publisher2.12.01 of 7See more

cert-vault cert-vault 2.12.0

1 of the 7 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
bitnamilegacy/postgres-exporter:0.17.1-debian-12-r20cca9d93a617
golang.org/x/crypto@v0.32.0
0.52.0

Open the chart page →

16,028
challengerchronicleVerified publisher0.1.21 of 1See more

challenger chronicle 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/chronicleprotocol/challenger-go:0.1.2c8d5a3c0e966
golang.org/x/crypto@v0.31.0
0.52.0

Open the chart page →

978
erpcchronicleVerified publisher0.7.11 of 1See more

erpc chronicle 0.7.1

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/erpc/erpc:0.1.18bfed3d49a08
golang.org/x/crypto@v0.51.0
0.52.0

Open the chart page →

391
spectrechronicleVerified publisher0.3.91 of 1See more

spectre chronicle 0.3.9

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/chronicleprotocol/spectre:0.68.34e872bc016e8
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

1,563
clairclair0.0.31 of 1See more

clair clair 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
quay.io/projectquay/clair:4.7.28d38ffa8fad7
golang.org/x/crypto@v0.12.0
0.52.0

Open the chart page →

3,295
cloudbees-sidecar-injectorcloudbees2.3.32 of 2See more

cloudbees-sidecar-injector cloudbees 2.3.3

2 of the 2 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
cloudbees/cert-requester:2.3.31d44fb4f799b
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0
cloudbees/sidecar-injector:2.3.38f102ef0383a
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0

Open the chart page →

3,270
cloudflow-enterprise-componentscloudflow-helm-charts0.0.0-NIGHTLY011220201 of 9See more

cloudflow-enterprise-components cloudflow-helm-charts 0.0.0-NIGHTLY01122020

1 of the 9 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
prom/prometheus:v2.21.0d43417c260e5
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.52.0

Open the chart page →

4,267
cnpg-sandboxcloudnative-pgVerified publisher0.6.12 of 6See more

cnpg-sandbox cloudnative-pg 0.6.1

2 of the 6 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
grafana/grafana:8.3.5cd7cb4345aa7
golang.org/x/crypto@v0.0.0-20210616213533-5ff15b29337e
0.52.0
ghcr.io/cloudnative-pg/cloudnative-pg:1.17.14dd365800b62
golang.org/x/crypto@v0.0.0-20220722155217-630584e8d5aa
0.52.0

Open the chart page →

7,602
openstack-manila-csicloud-provider-openstack2.36.31 of 5See more

openstack-manila-csi cloud-provider-openstack 2.36.3

1 of the 5 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-snapshotter:v8.4.0c7e0a3718832
golang.org/x/crypto@v0.37.0
0.52.0

Open the chart page →

3,787
cloudttycloudtty0.8.102 of 2See more

cloudtty cloudtty 0.8.10

2 of the 2 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/cloudtty/cloudshell:v0.8.1023e8d178e02c
golang.org/x/crypto@v0.43.0
0.52.0
ghcr.io/cloudtty/cloudshell-operator:v0.8.1014f036e33ef1
golang.org/x/crypto@v0.31.0
0.52.0

Open the chart page →

3,041
cluster-api-visualizercluster-api-visualizer1.5.01 of 1See more

cluster-api-visualizer cluster-api-visualizer 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-39827.

Container imageDigestPackageFixed in
ghcr.io/jont828/cluster-api-visualizer:v1.5.0678ba6833297
golang.org/x/crypto@v0.40.0
0.52.0

Open the chart page →

558

Container images carrying it

2,854 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/csi-attacher:v4.10.0be59d0556508
golang.org/x/crypto@v0.38.0
0.52.0
1
registry.k8s.io/sig-storage/csi-resizer:v2.0.04a95d94e57ad
golang.org/x/crypto@v0.37.0
0.52.0
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.8.03e2bf2eaef9f
golang.org/x/crypto@v0.36.0
0.52.0
1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.03ce0fdba4d8e
golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975
0.52.0
1

syft 1.42.1 · advisories as of 23 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.