CVE-2026-39835

Medium

Advisory

Published 22 May 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.005; 42nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,482; of 17,805 indexed, latest versions
Container images: 2,806; deployed by those charts
Fix available: 1 of 1; affected package

golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow

Carried by container images the latest versions of 2,482 of 17,805 indexed charts deploy, on 2,806 images.

Affected package	Affected versions	Fixed in	Images
golang.org/x/cryptogolang	v0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+154 more	0.52.0	2,806

OSV records: GHSA-78mq-xcr3-xm33
Also known as: GO-2026-5015

Charts affected

2,482 by stars

Chart

Latest

Affected images

Radar Score

ceph-csi-cephfswikimedia

0.1.8

1 of 5 See more

ceph-csi-cephfs wikimedia 0.1.8

1 of the 5 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	golang.org/x/crypto@v0.0.0-20220214200702-86341886e292	0.52.0

Open the chart page →

10,334

ceph-csi-rbdwikimedia

0.1.13

1 of 6 See more

ceph-csi-rbd wikimedia 0.1.13

1 of the 6 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	golang.org/x/crypto@v0.0.0-20220214200702-86341886e292	0.52.0

Open the chart page →

11,840

jaegerwikimedia

3.1.2

2 of 4 See more

jaeger wikimedia 3.1.2

2 of the 4 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-collector :1.53.0	7f1269222903	golang.org/x/crypto@v0.17.0	0.52.0
jaegertracing/jaeger-query :1.53.0	049bb0d64ea3	golang.org/x/crypto@v0.17.0	0.52.0

Open the chart page →

9,365

opentelemetry-collectorwikimedia

0.62.7

1 of 1 See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
otel/opentelemetry-collector-contrib :0.81.0	c6671841470b	golang.org/x/crypto@v0.10.0	0.52.0

Open the chart page →

2,035

wireguardwireguard-bananas

1.5.0

1 of 1 See more

wireguard wireguard-bananas 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
place1/wg-access-server :v0.4.6	2b2f3ea80ed6	golang.org/x/crypto@v0.0.0-20200709230013-948cd5f35899	0.52.0

Open the chart page →

2,753

dex-k8s-authenticatorwiremind

1.7.0

1 of 1 See more

dex-k8s-authenticator wiremind 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
mintel/dex-k8s-authenticator :1.4.0	caf71cee7b9a	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.52.0

Open the chart page →

2,792

postgres-operatorwiremind

1.14.0-wiremind0

1 of 1 See more

postgres-operator wiremind 1.14.0-wiremind0

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
ghcr.io/zalando/postgres-operator :v1.14.0	4f40cfc2283b	golang.org/x/crypto@v0.31.0	0.52.0

Open the chart page →

1,433

prometheus-openstack-exporterwiremind

0.5.0

1 of 1 See more

prometheus-openstack-exporter wiremind 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
ghcr.io/openstack-exporter/openstack-exporter :1.7.0	e5146a7dd515	golang.org/x/crypto@v0.8.0	0.52.0

Open the chart page →

1,480

prometheus-safety-exporterwiremind

0.6.0

1 of 2 See more

prometheus-safety-exporter wiremind 0.6.0

1 of the 2 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
quay.io/prometheuscommunity/json-exporter :v0.7.0	3a777171d39a	golang.org/x/crypto@v0.31.0	0.52.0

Open the chart page →

726

registrywiremind

0.1.1

1 of 1 See more

registry wiremind 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
ghcr.io/distribution/distribution :3.0.0	4ba3adf47f5c	golang.org/x/crypto@v0.36.0	0.52.0

Open the chart page →

1,358

kafka-connect-uiwitcom-gmbh

0.5.0

1 of 2 See more

kafka-connect-ui witcom-gmbh 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
quay.io/oauth2-proxy/oauth2-proxy :v7.3.0	8c21390be87d	golang.org/x/crypto@v0.0.0-20220214200702-86341886e292	0.52.0

Open the chart page →

2,513

mrtg-backendwitcom-gmbh

0.7.0

1 of 2 See more

mrtg-backend witcom-gmbh 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
quay.io/oauth2-proxy/oauth2-proxy :v7.2.1	febeebebe762	golang.org/x/crypto@v0.0.0-20210711020723-a769d52b0f97	0.52.0

Open the chart page →

2,624

commentopluspluswyrihaximusnet

0.4.0

1 of 1 See more

commentoplusplus wyrihaximusnet 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
caroga/commentoplusplus :v1.8.7	f3233882b3bd	golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83	0.52.0

Open the chart page →

1,960

oauth2xd

1.0.0

1 of 1 See more

oauth2 xd 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
lishimeng/hufu :v1.2.1	3d5752dac834	golang.org/x/crypto@v0.11.0	0.52.0

Open the chart page →

2,008

owlxd

0.5.1

2 of 2 See more

owl xd 0.5.1

2 of the 2 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
lishimeng/owl-console :v0.11.2	c79a67657baf	golang.org/x/crypto@v0.14.0	0.52.0
lishimeng/owl-messager :v0.11.2	3d00485e64dc	golang.org/x/crypto@v0.14.0	0.52.0

Open the chart page →

4,110

passportxd

0.2.16

2 of 2 See more

passport xd 0.2.16

2 of the 2 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
lishimeng/passport :v0.2.16	3e7d05ded625	golang.org/x/crypto@v0.7.0	0.52.0
lishimeng/passport-profile :v0.2.16	0970dfe5dc8f	golang.org/x/crypto@v0.7.0	0.52.0

Open the chart page →

3,976

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
lishimeng/tabby :v1.0.4	8145c3dc83c8	golang.org/x/crypto@v0.7.0	0.52.0

Open the chart page →

7,679

treexd

0.1.10

1 of 1 See more

tree xd 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
lishimeng/tree :v0.2.8	9b2f8be6c7d3	golang.org/x/crypto@v0.7.0	0.52.0

Open the chart page →

1,998

zooxd

0.4.0

1 of 1 See more

zoo xd 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
lishimeng/zoo :v0.4.0	e0b8d2d8ca28	golang.org/x/crypto@v0.13.0	0.52.0

Open the chart page →

2,070

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	golang.org/x/crypto@v0.5.0	0.52.0

Open the chart page →

13,895

atlas-operatorxxl-job-admin

0.7.11

1 of 1 See more

atlas-operator xxl-job-admin 0.7.11

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
arigaio/atlas-operator :0.7.11	1c4caa13c92b	golang.org/x/crypto@v0.39.0	0.52.0

Open the chart page →

1,197

cloudeye-exporterxxl-job-admin

0.1.2

1 of 1 See more

cloudeye-exporter xxl-job-admin 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
dellnoantechnp/cloudeye-exporter :v2.0.31	6873356c882d	golang.org/x/crypto@v0.0.0-20220525230936-793ad666bf5e	0.52.0

Open the chart page →

2,693

kminionxxl-job-admin

0.13.0

1 of 1 See more

kminion xxl-job-admin 0.13.0

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
redpandadata/kminion :v2.3.2	56da99e8d0d3	golang.org/x/crypto@v0.51.0	0.52.0

Open the chart page →

668

nfs-subdir-external-provisionerxxl-job-admin

4.0.18

1 of 1 See more

nfs-subdir-external-provisioner xxl-job-admin 4.0.18

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner :v4.0.2	63d5e04551ec	golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975	0.52.0

Open the chart page →

2,746

nightingalexxl-job-admin

0.2.11

2 of 6 See more

nightingale xxl-job-admin 0.2.11

2 of the 6 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
flashcatcloud/nightingale :8.0.0-beta.11	ea1b0aaabe09	golang.org/x/crypto@v0.32.0	0.52.0
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	golang.org/x/crypto@v0.25.0	0.52.0

Open the chart page →

9,730

ygdrassil-monitoringygdrassil

0.4.0

7 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

7 of the 10 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	golang.org/x/crypto@v0.32.0	0.52.0
prom/alertmanager :v0.28.0	d5155cfac40a	golang.org/x/crypto@v0.31.0	0.52.0
quay.io/prometheus-operator/prometheus-config-reloader :v0.79.2	193280a33bc1	golang.org/x/crypto@v0.31.0	0.52.0
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	golang.org/x/crypto@v0.21.0	0.52.0
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	golang.org/x/crypto@v0.31.0	0.52.0
quay.io/prometheus/pushgateway :v1.11.0	99392035ae99	golang.org/x/crypto@v0.32.0	0.52.0
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.14.0	37d841299325	golang.org/x/crypto@v0.28.0	0.52.0

Open the chart page →

9,518

prometheusalertygqygq2

1.0.0

1 of 1 See more

prometheusalert ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
feiyu563/prometheus-alert :v4.9.1	224cfa68cbd9	golang.org/x/crypto@v0.22.0	0.52.0

Open the chart page →

1,610

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	golang.org/x/crypto@v0.0.0-20211115234514-b4de73f9ece8	0.52.0

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

2 of 4 See more

rawfile-csi ymatrix 0.2.1

2 of the 4 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	golang.org/x/crypto@v0.0.0-20210817164053-32db794688a5	0.52.0
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	golang.org/x/crypto@v0.0.0-20210817164053-32db794688a5	0.52.0

Open the chart page →

8,002

version-checkerymrs

0.2.3

1 of 1 See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9	0.52.0

Open the chart page →

3,025

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d	0.52.0
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0	0.52.0

Open the chart page →

5,077

zahori-moonzahori

1.0.1

1 of 3 See more

zahori-moon zahori 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-39835.

Container image	Digest	Package	Fixed in
quay.io/aerokube/moon-ui :2.0.5	89990b146824	golang.org/x/crypto@v0.10.0	0.52.0

Open the chart page →

2,908

Container images carrying it

2,806 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/argonix-io/argonix-api :1.0.0	5b50081a8b99	golang.org/x/crypto@v0.27.0	0.52.0	1
ghcr.io/arpa-network/node-client :latest	657a2c9f6e6d	golang.org/x/crypto@v0.22.0	0.52.0	1
ghcr.io/aserto-dev/topaz :0.32.59	4c708ecf7dc4	golang.org/x/crypto@v0.37.0	0.52.0	1
ghcr.io/ashvinbambhaniya/nexus-tasks-backend :2.0.0	f80349eb018b	golang.org/x/crypto@v0.49.0	0.52.0	1
ghcr.io/astriaorg/astria-indexer :0.1.0	5cf1e5709820	golang.org/x/crypto@v0.24.0	0.52.0	1
ghcr.io/astriaorg/astria-indexer-api :0.1.0	3490d9900af1	golang.org/x/crypto@v0.24.0	0.52.0	1
ghcr.io/astriaorg/flame :0.1.0	c8af1c5aae40	golang.org/x/crypto@v0.24.0	0.52.0	1
ghcr.io/astriaorg/ria-faucet :0.0.1	a06c8ebef427	golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519	0.52.0	1
ghcr.io/astriaorg/seq-faucet :0.9.0	bf3cb9b505b6	golang.org/x/crypto@v0.26.0	0.52.0	1
ghcr.io/autobrr/autobrr :v1.10.0	d4022cd32df5	golang.org/x/crypto@v0.0.0-20220829220503-c86fa9a7ed90	0.52.0	1
ghcr.io/autobrr/qui :v1.14.1	10b7945d4f09	golang.org/x/crypto@v0.47.0	0.52.0	1
ghcr.io/automata-network/multi-prover-avs/operator :v0.6.0	752f1aa02438	golang.org/x/crypto@v0.24.0	0.52.0	1
ghcr.io/avistotelecom/kubebrowser :0.10.0	a354b8dc7e6a	golang.org/x/crypto@v0.45.0	0.52.0	1
ghcr.io/axonops/axonops-developer-operator :v0.1.0	b3d6600c8ba5	golang.org/x/crypto@v0.31.0	0.52.0	1
ghcr.io/bamaas/gofit :0.0.1	32b6a174b419	golang.org/x/crypto@v0.22.0	0.52.0	1
ghcr.io/banzaicloud/kafka-operator :v0.25.1	13dcbc7ebfc6	golang.org/x/crypto@v0.7.0	0.52.0	1
ghcr.io/banzaicloud/kafka-operator :v0.20.2	e341aefa9a90	golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519	0.52.0	1
ghcr.io/banzaicloud/logging-operator :3.17.6	23c2d4d54a64	golang.org/x/crypto@v0.0.0-20210817164053-32db794688a5	0.52.0	1
ghcr.io/base-org/node :v0.11.1	1aba0ffe55ea	golang.org/x/crypto@v0.28.0	0.52.0	1
ghcr.io/beezlabs-org/cloudflare-tunnel-operator :v0.1.0	9afcd070940f	golang.org/x/crypto@v0.0.0-20210817164053-32db794688a5	0.52.0	1
ghcr.io/beluga-cloud/helm-dashboard/dashboard :1.3.3	9ab9a675c405	golang.org/x/crypto@v0.14.0	0.52.0	1
ghcr.io/bitmagnet-io/bitmagnet :v0.10	b6373349a301	golang.org/x/crypto@v0.41.0	0.52.0	1
ghcr.io/bitmagnet-io/bitmagnet :v0.10.0	cf2c16fac5b5	golang.org/x/crypto@v0.32.0	0.52.0	1
ghcr.io/blakeblackshear/frigate :0.14.1	22e3d0b486df	golang.org/x/crypto@v0.0.0-20201221181555-eec23a3978ad	0.52.0	1
ghcr.io/blind-oracle/cortex-tenant :v2.0.0	9f8896ffc15b	golang.org/x/crypto@v0.36.0	0.52.0	1
ghcr.io/bluesky-social/pds :0.4.208	637083d9369d	golang.org/x/crypto@v0.41.0	0.52.0	1
ghcr.io/bluesky-social/pds :0.4.204	cbc6e3ea157d	golang.org/x/crypto@v0.41.0	0.52.0	1
ghcr.io/bluesky-social/pds :0.4	d95725b24dbe	golang.org/x/crypto@v0.41.0	0.52.0	1
ghcr.io/bnb-chain/bsc :1.6.2	fd0e3ec7d960	golang.org/x/crypto@v0.36.0	0.52.0	1
ghcr.io/borchero/switchboard :0.7.4	54a193b757da	golang.org/x/crypto@v0.48.0	0.52.0	1
ghcr.io/borgmatic-collective/borgmatic :1.9.9	835b72878606	golang.org/x/crypto@v0.14.0	0.52.0	1
ghcr.io/botify-labs/airbyte_exporter :2.3.0	2105b1f33013	golang.org/x/crypto@v0.18.0	0.52.0	1
ghcr.io/brittonhayes/arma-reforger :latest	6fde1edc0983	golang.org/x/crypto@v0.3.0	0.52.0	1
ghcr.io/browsersec/kubebrowse :sha-09dfa1f	b853e9e6372a	golang.org/x/crypto@v0.38.0	0.52.0	1
ghcr.io/browsersec/kubebrowse-frontend :chore-improve-back	bd6bea5e487c	golang.org/x/crypto@v0.40.0	0.52.0	1
ghcr.io/buoyantio/prometheus :v3.3.1	e2b8aa62b648	golang.org/x/crypto@v0.35.0	0.52.0	1
ghcr.io/buoyantio/web :preview-25.4.3	3ee1b62aa111	golang.org/x/crypto@v0.37.0	0.52.0	1
ghcr.io/caarlos0/domain_exporter :v1.18.0-arm64	c852606428cf	golang.org/x/crypto@v0.0.0-20211215165025-cf75a172585e	0.52.0	1
ghcr.io/cableship/argocd-source-tracker :0.0.6	ff7dd45aa774	golang.org/x/crypto@v0.37.0	0.52.0	1
ghcr.io/cableship/chart-sentinel :0.1.0	a037f1042b28	golang.org/x/crypto@v0.37.0	0.52.0	1
ghcr.io/camptocamp/terraboard :v2.3.0	df53e2c8998c	golang.org/x/crypto@v0.14.0	0.52.0	1
ghcr.io/caninehq/canine :latest	a058034ca006	golang.org/x/crypto@v0.31.0	0.52.0	1
ghcr.io/celestiaorg/celestia-app :v3.7.0-arabica	23a9ec9b1879	golang.org/x/crypto@v0.35.0	0.52.0	1
ghcr.io/celestiaorg/celestia-app :v6.1.0-rc0	a604aefa3fae	golang.org/x/crypto@v0.42.0	0.52.0	1
ghcr.io/celestiaorg/celestia-node :v0.16.0	41177982c584	golang.org/x/crypto@v0.25.0	0.52.0	1
ghcr.io/cerbos/cerbos :0.51.0	8d35a64e4a99	golang.org/x/crypto@v0.47.0	0.52.0	1
ghcr.io/chaos-mesh/chaos-daemon :v2.8.4	0d28dbd95b03	golang.org/x/crypto@v0.49.0	0.52.0	1
ghcr.io/chaos-mesh/chaos-daemon :v2.8.3	69b1d3c09cfa	golang.org/x/crypto@v0.49.0	0.52.0	1
ghcr.io/chaos-mesh/chaos-daemon :v2.7.2	9608d9b51452	golang.org/x/crypto@v0.17.0	0.52.0	1
ghcr.io/chaos-mesh/chaos-daemon :v2.5.1	cf78fdf7403a	golang.org/x/crypto@v0.0.0-20220525230936-793ad666bf5e	0.52.0	1