StackRadar

CVE-2026-39835

Medium

Advisory

Published 22 May 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.005
42nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,482
of 17,805 indexed, latest versions
Container images
2,806
deployed by those charts
Fix available
1 of 1
affected package

golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow

Carried by container images the latest versions of 2,482 of 17,805 indexed charts deploy, on 2,806 images.

Affected packageAffected versionsFixed inImages
golang.org/x/cryptogolangv0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+154 more0.52.02,806
OSV records
GHSA-78mq-xcr3-xm33
Also known as
GO-2026-5015

Charts affected

2,482 by stars
ChartLatestAffected imagesRadar Score
network-exporterenixVerified publisher0.3.01 of 1See more

network-exporter enix 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
syepes/network_exporter:1.8.000af1691570e
golang.org/x/crypto@v0.37.0
0.52.0

Open the chart page →

1,374
topomatikenixVerified publisher1.3.11 of 1See more

topomatik enix 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
quay.io/enix/topomatik:1.3.1d9f0bec83ef0
golang.org/x/crypto@v0.51.0
0.52.0

Open the chart page →

2,174
zfs-exporterenixVerified publisher2.2.01 of 1See more

zfs-exporter enix 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
quay.io/enix/zfs-exporter:2.3.1223b053f1cbd0
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

978
ai-gateway-helmenvoy-ai-gateway0.0.0-003ab39f36923b5d40609a601e2951b73f6318fb1 of 1See more

ai-gateway-helm envoy-ai-gateway 0.0.0-003ab39f36923b5d40609a601e2951b73f6318fb

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
envoyproxy/ai-gateway-controller:003ab39f36923b5d40609a601e2951b73f6318fbec1f06ee29a7
golang.org/x/crypto@v0.40.0
0.52.0

Open the chart page →

863
eoapi-supporteoapiVerified publisher0.1.76 of 7See more

eoapi-support eoapi 0.1.7

6 of the 7 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
grafana/grafana:10.3.38640e5038e83
golang.org/x/crypto@v0.17.0
0.52.0
quay.io/prometheus-operator/prometheus-config-reloader:v0.67.014feefde1b80
golang.org/x/crypto@v0.11.0
0.52.0
quay.io/prometheus/node-exporter:v1.6.181f94e50ea37
golang.org/x/crypto@v0.8.0
0.52.0
quay.io/prometheus/prometheus:v2.47.0c5dd35038287
golang.org/x/crypto@v0.11.0
0.52.0
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.10.0ec5d6f6be228
golang.org/x/crypto@v0.9.0
0.52.0
registry.k8s.io/prometheus-adapter/prometheus-adapter:v0.11.1e6a43c83ab16
golang.org/x/crypto@v0.1.0
0.52.0

Open the chart page →

8,696
eoloPlanteolo-plannerVerified publisher0.1.01 of 7See more

eoloPlant eolo-planner 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
library/mongo:5.0-focal5e15a3f014ed
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

27,870
eoloplannereoloplannerVerified publisher0.1.01 of 7See more

eoloplanner eoloplanner 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
library/mongo:5.0.6-focal8e70544b6c76
golang.org/x/crypto@v0.0.0-20200302210943-78000ba7a073
0.52.0

Open the chart page →

32,542
eoloPlannerCommunicationsKubernetes3eoloplannercommunicationskuberneteshelmVerified publisher0.1.01 of 7See more

eoloPlannerCommunicationsKubernetes3 eoloplannercommunicationskuberneteshelm 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
library/mongo:5.0-focal5e15a3f014ed
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

27,870
eoloplannereoloplanner-molynx-gat0.1.01 of 7See more

eoloplanner eoloplanner-molynx-gat 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
library/mongo:4.4.66efa05203990
golang.org/x/crypto@v0.0.0-20200302210943-78000ba7a073
0.52.0

Open the chart page →

28,659
eolo-plannereolo-planner-repo0.1.01 of 7See more

eolo-planner eolo-planner-repo 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
library/mongo:5.0.6-focal8e70544b6c76
golang.org/x/crypto@v0.0.0-20200302210943-78000ba7a073
0.52.0

Open the chart page →

27,296
eoloplanteoloplant1.0.01 of 7See more

eoloplant eoloplant 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
library/mongo:5.0-focal5e15a3f014ed
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

27,870
eoloplantseoloplants-urjcVerified publisher0.1.01 of 7See more

eoloplants eoloplants-urjc 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
library/mongo:5.0.6-focal8e70544b6c76
golang.org/x/crypto@v0.0.0-20200302210943-78000ba7a073
0.52.0

Open the chart page →

27,933
servereoloserverVerified publisher0.1.01 of 7See more

server eoloserver 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
library/mongo:5.0.6-focal8e70544b6c76
golang.org/x/crypto@v0.0.0-20200302210943-78000ba7a073
0.52.0

Open the chart page →

32,542
flywayeosc-lot-1Verified publisher0.7.01 of 3See more

flyway eosc-lot-1 0.7.0

1 of the 3 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
alpine/git:v2.49.1c0280cf95723
golang.org/x/crypto@v0.43.0
0.52.0

Open the chart page →

72,818
thanoseosc-lot-1Verified publisher0.2.01 of 1See more

thanos eosc-lot-1 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.39.21d022ef4b8ef
golang.org/x/crypto@v0.39.0
0.52.0

Open the chart page →

851
thanos-bucketeosc-lot-1Verified publisher0.1.01 of 1See more

thanos-bucket eosc-lot-1 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.39.21d022ef4b8ef
golang.org/x/crypto@v0.39.0
0.52.0

Open the chart page →

851
epinio-uiepinioVerified publisher1.7.21 of 1See more

epinio-ui epinio 1.7.2

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
ghcr.io/epinio/epinio-ui:v1.7.1-0.0.1d3de52dfb0b4
golang.org/x/crypto@v0.0.0-20220511200225-c6db032c6c88
0.52.0

Open the chart page →

1,694
upgrade-responderepinioVerified publisher0.2.01 of 5See more

upgrade-responder epinio 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
grafana/grafana:10.1.50679e877ba20
golang.org/x/crypto@v0.11.0
0.52.0

Open the chart page →

7,406
admin-console-operatorepmdedpVerified publisher2.14.02 of 2See more

admin-console-operator epmdedp 2.14.0

2 of the 2 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
epamedp/admin-console-operator:2.14.090f9921d8d58
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.52.0
epamedp/edp-admin-console:2.14.0616c678ba3e7
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.52.0

Open the chart page →

4,310
edp-argocd-operatorepmdedpVerified publisher0.2.01 of 1See more

edp-argocd-operator epmdedp 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
epamedp/edp-argocd-operator:0.2.0976a662a5e72
golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d
0.52.0

Open the chart page →

1,575
edp-headlampepmdedpVerified publisher0.25.01 of 1See more

edp-headlamp epmdedp 0.25.0

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
epamedp/edp-headlamp:0.25.093417e18bb1a
golang.org/x/crypto@v0.18.0
0.52.0

Open the chart page →

1,268
jenkins-operatorepmdedpVerified publisher2.15.31 of 3See more

jenkins-operator epmdedp 2.15.3

1 of the 3 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
epamedp/jenkins-operator:2.15.328ef56bc0ca3
golang.org/x/crypto@v0.14.0
0.52.0

Open the chart page →

2,116
reconcilerepmdedpVerified publisher2.12.01 of 1See more

reconciler epmdedp 2.12.0

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
epamedp/reconciler:2.12.0d33e938b6d59
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.52.0

Open the chart page →

2,181
codebase-operatorepmdedp-devVerified publisher2.12.0-MDTU-DDM-SNAPSHOT.101 of 1See more

codebase-operator epmdedp-dev 2.12.0-MDTU-DDM-SNAPSHOT.10

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
epamedp/codebase-operator:2.12.0-MDTU-DDM-SNAPSHOT.1096028c86f0dd
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.52.0

Open the chart page →

2,827
gerrit-operatorepmdedp-devVerified publisher2.11.0-MDTU-DDM-SNAPSHOT.21 of 1See more

gerrit-operator epmdedp-dev 2.11.0-MDTU-DDM-SNAPSHOT.2

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
epamedp/gerrit-operator:2.11.0-MDTU-DDM-SNAPSHOT.2b71fb39e0c9e
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.52.0

Open the chart page →

2,813
jenkins-operatorepmdedp-devVerified publisher2.11.0-MDTU-DDM-SNAPSHOT.11 of 1See more

jenkins-operator epmdedp-dev 2.11.0-MDTU-DDM-SNAPSHOT.1

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
epamedp/jenkins-operator:2.11.0-MDTU-DDM-SNAPSHOT.1ff25e9fe4419
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.52.0

Open the chart page →

2,268
keycloak-operatorepmdedp-devVerified publisher1.11.0-MDTU-DDM-SNAPSHOT.101 of 1See more

keycloak-operator epmdedp-dev 1.11.0-MDTU-DDM-SNAPSHOT.10

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
epamedp/keycloak-operator:1.11.0-MDTU-DDM-SNAPSHOT.105d352199e12e
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.52.0

Open the chart page →

2,235
armiarmaethereum-helm-chartsVerified publisher0.1.21 of 2See more

armiarma ethereum-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
ethpandaops/armiarma:master1a9c3264f0a9
golang.org/x/crypto@v0.21.0
0.52.0

Open the chart page →

1,159
authenticatoorethereum-helm-chartsVerified publisher0.1.01 of 1See more

authenticatoor ethereum-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
ethpandaops/service-authenticatoor:main27b8e5ea3125
golang.org/x/crypto@v0.37.0
0.52.0

Open the chart page →

303
benchmarkoor-apiethereum-helm-chartsVerified publisher0.1.01 of 1See more

benchmarkoor-api ethereum-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
ghcr.io/ethpandaops/benchmarkoor:latest5470b2ec3161
golang.org/x/crypto@v0.48.0
0.52.0

Open the chart page →

1,047
blob-me-babyethereum-helm-chartsVerified publisher0.1.21 of 1See more

blob-me-baby ethereum-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
ethpandaops/blob-me-baby:latestad26158420dd
golang.org/x/crypto@v0.14.0
0.52.0

Open the chart page →

1,463
chaos-meshethereum-helm-chartsVerified publisher0.0.34 of 4See more

chaos-mesh ethereum-helm-charts 0.0.3

4 of the 4 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
ghcr.io/chaos-mesh/chaos-coredns:v0.2.678dc63bc5b89
golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83
0.52.0
ghcr.io/chaos-mesh/chaos-daemon:v2.8.0fb609bc264d9
golang.org/x/crypto@v0.42.0
0.52.0
ghcr.io/chaos-mesh/chaos-dashboard:v2.8.0e7f9e8f1d565
golang.org/x/crypto@v0.42.0
0.52.0
ghcr.io/chaos-mesh/chaos-mesh:v2.8.0091b906a0b13
golang.org/x/crypto@v0.42.0
0.52.0

Open the chart page →

12,474
checkpointzethereum-helm-chartsVerified publisher0.1.31 of 1See more

checkpointz ethereum-helm-charts 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
samcm/checkpointz:latesta66b24a87766
golang.org/x/crypto@v0.45.0
0.52.0

Open the chart page →

711
contributoorethereum-helm-chartsVerified publisher0.0.21 of 1See more

contributoor ethereum-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
ethpandaops/contributoor:latest1edd4074fd79
golang.org/x/crypto@v0.50.0
0.52.0

Open the chart page →

893
dugtrioethereum-helm-chartsVerified publisher0.0.71 of 1See more

dugtrio ethereum-helm-charts 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
ethpandaops/dugtrio:1.0.0e261d1734e9f
golang.org/x/crypto@v0.10.0
0.52.0

Open the chart page →

1,145
erpcethereum-helm-chartsVerified publisher0.0.41 of 1See more

erpc ethereum-helm-charts 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
ghcr.io/erpc/erpc:0.0.49f5654f745d4c
golang.org/x/crypto@v0.35.0
0.52.0

Open the chart page →

916
ethereum-metrics-exporterethereum-helm-chartsVerified publisher0.2.11 of 1See more

ethereum-metrics-exporter ethereum-helm-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
samcm/ethereum-metrics-exporter:latest91a2d9a015c1
golang.org/x/crypto@v0.41.0
0.52.0

Open the chart page →

684
eth-faucetethereum-helm-chartsVerified publisher0.1.11 of 1See more

eth-faucet ethereum-helm-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
chainflag/eth-faucet:latestac642796bcb6
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.52.0

Open the chart page →

1,998
execution-processorethereum-helm-chartsVerified publisher0.0.31 of 1See more

execution-processor ethereum-helm-charts 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
ethpandaops/execution-processor:latest5c4832e9588f
golang.org/x/crypto@v0.43.0
0.52.0

Open the chart page →

709
forkmonethereum-helm-chartsVerified publisher0.1.61 of 1See more

forkmon ethereum-helm-charts 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
holiman/nodemonitor:latest5cd609761065
golang.org/x/crypto@v0.8.0
0.52.0

Open the chart page →

1,695
forkyethereum-helm-chartsVerified publisher0.2.01 of 1See more

forky ethereum-helm-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
ethpandaops/forky:debian-latestc937f4ba737c
golang.org/x/crypto@v0.49.0
0.52.0

Open the chart page →

1,772
rpc-proxyethereum-helm-chartsVerified publisher0.1.21 of 1See more

rpc-proxy ethereum-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
ghcr.io/gochain/rpc-proxy/rpc-proxy:latestca01f5ab95f7
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

1,473
rpc-snooperethereum-helm-chartsVerified publisher0.0.21 of 1See more

rpc-snooper ethereum-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
ethpandaops/rpc-snooper:latestc0b30fcf64bc
golang.org/x/crypto@v0.41.0
0.52.0

Open the chart page →

1,535
splitoorethereum-helm-chartsVerified publisher0.0.11 of 1See more

splitoor ethereum-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
ethpandaops/splitoor:latest989da6bea4bd
golang.org/x/crypto@v0.36.0
0.52.0

Open the chart page →

1,263
tracoor-agentethereum-helm-chartsVerified publisher0.0.11 of 1See more

tracoor-agent ethereum-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
ethpandaops/tracoor:latestd8514b9f4c59
golang.org/x/crypto@v0.38.0
0.52.0

Open the chart page →

914
tracoor-serverethereum-helm-chartsVerified publisher0.0.21 of 1See more

tracoor-server ethereum-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
ethpandaops/tracoor:latestd8514b9f4c59
golang.org/x/crypto@v0.38.0
0.52.0

Open the chart page →

914
tracoor-singleethereum-helm-chartsVerified publisher0.0.51 of 2See more

tracoor-single ethereum-helm-charts 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
ethpandaops/tracoor:latestd8514b9f4c59
golang.org/x/crypto@v0.38.0
0.52.0

Open the chart page →

914
beeethersphereVerified publisher0.17.41 of 1See more

bee ethersphere 0.17.4

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
ethersphere/bee:2.2.0a884fd84b72f
golang.org/x/crypto@v0.23.0
0.52.0

Open the chart page →

3,514
ethexporterethersphereVerified publisher0.3.01 of 1See more

ethexporter ethersphere 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
darkobas/ethexporter:latest62e6464491ba
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.52.0

Open the chart page →

2,395
geth-swapethersphereVerified publisher0.6.31 of 2See more

geth-swap ethersphere 0.6.3

1 of the 2 container images this version deploys carry CVE-2026-39835.

Container imageDigestPackageFixed in
ethereum/client-go:v1.10.186d6d12a40465
golang.org/x/crypto@v0.0.0-20210921155107-089bfa567519
0.52.0

Open the chart page →

4,768

Container images carrying it

2,806 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/prometheus-adapter/prometheus-adapter:v0.11.1e6a43c83ab16
golang.org/x/crypto@v0.1.0
0.52.0
1
registry.k8s.io/provider-os/openstack-cloud-controller-manager:v1.36.0e354e40db2d0
golang.org/x/crypto@v0.50.0
0.52.0
1
registry.k8s.io/sig-storage/csi-attacher:v4.10.0be59d0556508
golang.org/x/crypto@v0.38.0
0.52.0
1
registry.k8s.io/sig-storage/csi-resizer:v2.0.04a95d94e57ad
golang.org/x/crypto@v0.37.0
0.52.0
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.8.03e2bf2eaef9f
golang.org/x/crypto@v0.36.0
0.52.0
1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.03ce0fdba4d8e
golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975
0.52.0
1

syft 1.42.1 · advisories as of 19 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.