CVE-2026-39836

Unscored

Advisory

Published 7 May 2026In the index since 5 Sept 2026

Severity: Unscored; worst across findings
CVSS: —; base score, highest
EPSS: 0.006; 47th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,067; of 17,832 indexed, latest versions
Container images: 4,635; deployed by those charts
Fix available: 1 of 1; affected package

Panic in Dial and LookupPort when handling NUL byte on Windows in net

Carried by container images the latest versions of 4,067 of 17,832 indexed charts deploy, on 4,635 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+182 more	1.25.10	4,635

OSV records: GO-2026-4971
Also known as: BIT-golang-2026-39836

Charts affected

4,067 by stars

Chart

Latest

Affected images

Radar Score

nfs-subdir-external-provisionerxxl-job-admin

4.0.18

1 of 1 See more

nfs-subdir-external-provisioner xxl-job-admin 4.0.18

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner :v4.0.2	63d5e04551ec	stdlib@go1.15	1.25.10

Open the chart page →

2,746

nightingalexxl-job-admin

0.2.11

3 of 6 See more

nightingale xxl-job-admin 0.2.11

3 of the 6 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
flashcatcloud/nightingale :8.0.0-beta.11	ea1b0aaabe09	stdlib@go1.23.9	1.25.10
library/mysql :5.7	4bc6bc963e6d	stdlib@go1.18.2	1.25.10
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	stdlib@go1.22.6	1.25.10

Open the chart page →

9,769

redisxxl-job-admin

24.1.3

1 of 1 See more

redis xxl-job-admin 24.1.3

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
ghcr.io/dellnoantechnp/bitnami/redis :8.4.0	29064423c369	stdlib@go1.25.6	1.25.10

Open the chart page →

314

pgbounceryasn77-pgbouncer

0.0.8

1 of 1 See more

pgbouncer yasn77-pgbouncer 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
ghcr.io/yasn77/pgbouncer :v0.0.6	cc8c13550e44	stdlib@go1.18.6	1.25.10

Open the chart page →

1,153

ygdrassil-monitoringygdrassil

0.4.0

7 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

7 of the 10 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	stdlib@go1.23.5	1.25.10
prom/alertmanager :v0.28.0	d5155cfac40a	stdlib@go1.23.4	1.25.10
quay.io/prometheus-operator/prometheus-config-reloader :v0.79.2	193280a33bc1	stdlib@go1.23.4	1.25.10
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	stdlib@go1.22.5	1.25.10
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	stdlib@go1.23.4	1.25.10
quay.io/prometheus/pushgateway :v1.11.0	99392035ae99	stdlib@go1.23.4	1.25.10
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.14.0	37d841299325	stdlib@go1.23.3	1.25.10

Open the chart page →

9,530

prometheusalertygqygq2

1.0.0

1 of 1 See more

prometheusalert ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
feiyu563/prometheus-alert :v4.9.1	224cfa68cbd9	stdlib@go1.20.6	1.25.10

Open the chart page →

1,611

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	stdlib@go1.18.1	1.25.10

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	stdlib@go1.17.8	1.25.10
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	stdlib@go1.17.9	1.25.10
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	stdlib@go1.16	1.25.10
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	stdlib@go1.16	1.25.10

Open the chart page →

8,003

nginx-vts-exporterymrs

0.1.2

1 of 1 See more

nginx-vts-exporter ymrs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
sophos/nginx-vts-exporter :latest	f1073556b29b	stdlib@go1.13.6	1.25.10

Open the chart page →

1,337

version-checkerymrs

0.2.3

1 of 1 See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	stdlib@go1.15.2	1.25.10

Open the chart page →

3,025

prometheus-monitoring-stackyotron-helm-charts

1.2.0

1 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

1 of the 3 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	stdlib@go1.25.7	1.25.10

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	stdlib@go1.20.4	1.25.10
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	stdlib@go1.20.4	1.25.10

Open the chart page →

5,077

zahori-moonzahori

1.0.1

3 of 3 See more

zahori-moon zahori 1.0.1

3 of the 3 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
quay.io/aerokube/moon :2.5.1	a8837b00ba1c	stdlib@go1.20.4	1.25.10
quay.io/aerokube/moon-conf :2.5.1	9ca307b30080	stdlib@go1.20.4	1.25.10
quay.io/aerokube/moon-ui :2.0.5	89990b146824	stdlib@go1.20.5	1.25.10

Open the chart page →

2,908

zahori-schedulerzahori

1.0.1

1 of 1 See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-scheduler :1.0.0	47d0979b1184	stdlib@go1.20.5	1.25.10

Open the chart page →

2,482

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	stdlib@go1.17.13	1.25.10

Open the chart page →

3,702

zookeeper-exporterzookeeper-exporter

0.1.0

1 of 1 See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
dabealu/zookeeper-exporter :latest	86106fec315f	stdlib@go1.14.15	1.25.10

Open the chart page →

1,249

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
library/postgres :18.4-alpine3.24	9a8afca54e78	stdlib@go1.24.6	1.25.10

Open the chart page →

8,105

Container images carrying it

4,635 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/ethpandaops/syncoor :master	233aa9808fc7	stdlib@go1.26.0	1.25.10	1
ghcr.io/eugenmayer/whatsmyip :0.0.1	4b6700cc0e2d	stdlib@go1.22.1	1.25.10	1
ghcr.io/eugenmayer/whoami-tls :0.1.0	477be2d05aba	stdlib@go1.24.1	1.25.10	1
ghcr.io/eumel8/rancher-servicemonitor :0.2.1	f34428cac187	stdlib@go1.22.1	1.25.10	1
ghcr.io/evilgn0me/ingressmonitorcontroller :v0.0.5	0bbfa4db14b9	stdlib@go1.24.13	1.25.10	1
ghcr.io/external-secrets/external-secrets :v0.3.11	56a1ea4490ba	stdlib@go1.17.5	1.25.10	1
ghcr.io/external-secrets/external-secrets :v2.4.1	9440a40b3947	stdlib@go1.26.2	1.25.10	1
ghcr.io/external-secrets/external-secrets :v2.1.0	ec40c3d9c48f	stdlib@go1.25.7	1.25.10	1
ghcr.io/extrality/cert-manager-webhook-namecheap :latest	e3552fa0c68a	stdlib@go1.20.6	1.25.10	1
ghcr.io/ferama/rospo :v0.12.0	ab40c1745534	stdlib@go1.21.6	1.25.10	1
ghcr.io/ferama/vipien :v0.5.3	923a3f704b21	stdlib@go1.17.8	1.25.10	1
ghcr.io/fernferret/mediawiki-backup :v0.2.2	bbef381294ed	stdlib@go1.19.5	1.25.10	1
ghcr.io/ferretdb/ferretdb :2.7.0	5706414241eb	stdlib@go1.25.4	1.25.10	1
ghcr.io/fikaworks/grgate :v0.6.3	7104f60d8972	stdlib@go1.20.2	1.25.10	1
ghcr.io/firecrawl/nuq-postgres :latest	f9388bd25ae2	stdlib@go1.24.6	1.25.10	1
ghcr.io/flanksource/facet :0.1.72	37237038be15	stdlib@go1.23.12	1.25.10	1
ghcr.io/flanksource/postgres :17.6-497383c	ebcf66281fc1	stdlib@go1.25.4	1.25.10	1
ghcr.io/flatcar/flatcar-linux-update-operator :v0.10.0-rc1	f9063e20b1f6	stdlib@go1.20.6	1.25.10	1
ghcr.io/flatcar/nebraska :4.0.0	5c9e99ff7167	stdlib@go1.24.13	1.25.10	1
ghcr.io/flohansen/dasher-server :latest	7cde8c3fa2d1	stdlib@go1.22.5	1.25.10	1
ghcr.io/fluxcd/flagger-loadtester :0.39.0	6a8546993cb5	stdlib@go1.24.12	1.25.10	1
ghcr.io/fluxcd/flux-cli :v2.9.1	020edbaee890	stdlib@go1.26.2	1.25.10	1
ghcr.io/fluxcd/flux-cli :v2.5.1	274a179fd402	stdlib@go1.23.6	1.25.10	1
ghcr.io/fluxcd/helm-controller :v1.2.0	62eaa9c9a929	stdlib@go1.23.6	1.25.10	1
ghcr.io/fluxcd/source-controller :v1.5.0	00cd9316a379	stdlib@go1.23.6	1.25.10	1
ghcr.io/fluxerapp/fluxer-static :2026.812.125337	cfe98ae544df	stdlib@go1.25.0	1.25.10	1
ghcr.io/formancehq/console :console-on.v1.1.1	a4d32c2f68b3	stdlib@go1.20.12	1.25.10	1
ghcr.io/formancehq/console-v3 :v1.16.0	c99e8ef2c545	stdlib@go1.23.8	1.25.10	1
ghcr.io/formancehq/dex :v1.0.4	b803fbe1cdb8	stdlib@go1.19.1	1.25.10	1
ghcr.io/formancehq/ledger :v1.9.2	03c1ddbda33b	stdlib@go1.18.10	1.25.10	1
ghcr.io/formancehq/membership :v1.11.0	24a0113d5fb0	stdlib@go1.24.6	1.25.10	1
ghcr.io/formancehq/portal :v1.16.0	6efef5d19d56	stdlib@go1.23.8	1.25.10	1
ghcr.io/foxcpp/maddy :0.9.5	de42151adff6	stdlib@go1.23.12	1.25.10	1
ghcr.io/fpetr/readium-lcp-server-docker-helm/lcpserver :1.9.0	324f9b7b689c	stdlib@go1.22.0	1.25.10	1
ghcr.io/fpetr/readium-lcp-server-docker-helm/lsdserver :1.9.0	cdba39e3f3d0	stdlib@go1.22.0	1.25.10	1
ghcr.io/g0dscookie/aptly :latest	edd095d3c0ee	stdlib@go1.18.3	1.25.10	1
ghcr.io/g0dscookie/icinga2 :2.13.5	da81246ccfc9	stdlib@go1.18.1	1.25.10	1
ghcr.io/gabe565/ascii-movie :1.9.6	27f85bb98da3	stdlib@go1.24.0	1.25.10	1
ghcr.io/gabe565/castsponsorskip :0.8.1	5f7b4c6dd299	stdlib@go1.23.4	1.25.10	1
ghcr.io/gabe565/domain-watch :latest	34c5a1e351d6	stdlib@go1.24.1	1.25.10	1
ghcr.io/gabe565/limo :latest	6dfdbc9853bb	stdlib@go1.20.12	1.25.10	1
ghcr.io/gabe565/matrimony :latest	d39a9d7c3e1b	stdlib@go1.22.0	1.25.10	1
ghcr.io/gabe565/transsmute :latest	c8ac95a30c31	stdlib@go1.24.1	1.25.10	1
ghcr.io/geek-cookbook/webhook-receiver :2.8.1	72e7e77f8091	stdlib@go1.21.3	1.25.10	1
ghcr.io/georgmangold/console :v1.8.1	58f4f180aa6e	stdlib@go1.24.4	1.25.10	1
ghcr.io/getsentry/sentry :26.7.2	7c5052aa4e3c	stdlib@go1.19.8	1.25.10	1
ghcr.io/gijsvandulmen/k8qu :1.4	e897b18db13d	stdlib@go1.22.6	1.25.10	1
ghcr.io/gla-rad/mc-mms-edgerouter :latest	3620d5680775	stdlib@go1.25.4	1.25.10	1
ghcr.io/gla-rad/mc-mms-router :latest	032e977d9adf	stdlib@go1.25.4	1.25.10	1
ghcr.io/glassflow/glassflow-etl-be :v3.2.0	20f066d0f631	stdlib@go1.25.0	1.25.10	1