CVE-2026-39836

Unscored

Advisory

Published 7 May 2026In the index since 5 Sept 2026

Severity: Unscored; worst across findings
CVSS: —; base score, highest
EPSS: 0.006; 47th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,067; of 17,832 indexed, latest versions
Container images: 4,635; deployed by those charts
Fix available: 1 of 1; affected package

Panic in Dial and LookupPort when handling NUL byte on Windows in net

Carried by container images the latest versions of 4,067 of 17,832 indexed charts deploy, on 4,635 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+182 more	1.25.10	4,635

OSV records: GO-2026-4971
Also known as: BIT-golang-2026-39836

Charts affected

4,067 by stars

Chart

Latest

Affected images

Radar Score

nfs-subdir-external-provisionerxxl-job-admin

4.0.18

1 of 1 See more

nfs-subdir-external-provisioner xxl-job-admin 4.0.18

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner :v4.0.2	63d5e04551ec	stdlib@go1.15	1.25.10

Open the chart page →

2,746

nightingalexxl-job-admin

0.2.11

3 of 6 See more

nightingale xxl-job-admin 0.2.11

3 of the 6 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
flashcatcloud/nightingale :8.0.0-beta.11	ea1b0aaabe09	stdlib@go1.23.9	1.25.10
library/mysql :5.7	4bc6bc963e6d	stdlib@go1.18.2	1.25.10
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	stdlib@go1.22.6	1.25.10

Open the chart page →

9,769

redisxxl-job-admin

24.1.3

1 of 1 See more

redis xxl-job-admin 24.1.3

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
ghcr.io/dellnoantechnp/bitnami/redis :8.4.0	29064423c369	stdlib@go1.25.6	1.25.10

Open the chart page →

314

pgbounceryasn77-pgbouncer

0.0.8

1 of 1 See more

pgbouncer yasn77-pgbouncer 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
ghcr.io/yasn77/pgbouncer :v0.0.6	cc8c13550e44	stdlib@go1.18.6	1.25.10

Open the chart page →

1,153

ygdrassil-monitoringygdrassil

0.4.0

7 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

7 of the 10 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	stdlib@go1.23.5	1.25.10
prom/alertmanager :v0.28.0	d5155cfac40a	stdlib@go1.23.4	1.25.10
quay.io/prometheus-operator/prometheus-config-reloader :v0.79.2	193280a33bc1	stdlib@go1.23.4	1.25.10
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	stdlib@go1.22.5	1.25.10
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	stdlib@go1.23.4	1.25.10
quay.io/prometheus/pushgateway :v1.11.0	99392035ae99	stdlib@go1.23.4	1.25.10
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.14.0	37d841299325	stdlib@go1.23.3	1.25.10

Open the chart page →

9,530

prometheusalertygqygq2

1.0.0

1 of 1 See more

prometheusalert ygqygq2 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
feiyu563/prometheus-alert :v4.9.1	224cfa68cbd9	stdlib@go1.20.6	1.25.10

Open the chart page →

1,611

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	stdlib@go1.18.1	1.25.10

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	stdlib@go1.17.8	1.25.10
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	stdlib@go1.17.9	1.25.10
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	stdlib@go1.16	1.25.10
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	stdlib@go1.16	1.25.10

Open the chart page →

8,003

nginx-vts-exporterymrs

0.1.2

1 of 1 See more

nginx-vts-exporter ymrs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
sophos/nginx-vts-exporter :latest	f1073556b29b	stdlib@go1.13.6	1.25.10

Open the chart page →

1,337

version-checkerymrs

0.2.3

1 of 1 See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	stdlib@go1.15.2	1.25.10

Open the chart page →

3,025

prometheus-monitoring-stackyotron-helm-charts

1.2.0

1 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

1 of the 3 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	stdlib@go1.25.7	1.25.10

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	stdlib@go1.20.4	1.25.10
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	stdlib@go1.20.4	1.25.10

Open the chart page →

5,077

zahori-moonzahori

1.0.1

3 of 3 See more

zahori-moon zahori 1.0.1

3 of the 3 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
quay.io/aerokube/moon :2.5.1	a8837b00ba1c	stdlib@go1.20.4	1.25.10
quay.io/aerokube/moon-conf :2.5.1	9ca307b30080	stdlib@go1.20.4	1.25.10
quay.io/aerokube/moon-ui :2.0.5	89990b146824	stdlib@go1.20.5	1.25.10

Open the chart page →

2,908

zahori-schedulerzahori

1.0.1

1 of 1 See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-scheduler :1.0.0	47d0979b1184	stdlib@go1.20.5	1.25.10

Open the chart page →

2,482

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	stdlib@go1.17.13	1.25.10

Open the chart page →

3,702

zookeeper-exporterzookeeper-exporter

0.1.0

1 of 1 See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
dabealu/zookeeper-exporter :latest	86106fec315f	stdlib@go1.14.15	1.25.10

Open the chart page →

1,249

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
library/postgres :18.4-alpine3.24	9a8afca54e78	stdlib@go1.24.6	1.25.10

Open the chart page →

8,105

Container images carrying it

4,635 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/glassflow/glassflow-etl-migration :v3.2.0	7db1a1bf3dae	stdlib@go1.25.4	1.25.10	1
ghcr.io/glassflow/kafka-kerberos-gateway :latest	2ae01c524a6e	stdlib@go1.21.13	1.25.10	1
ghcr.io/glauth/glauth :v2.5.2	09c782ca5984	stdlib@go1.25.0	1.25.10	1
ghcr.io/gnana997/periscope :1.1.6	21b284fb00f2	stdlib@go1.26.2	1.25.10	1
ghcr.io/goauthentik/server :2026.2.1	46a71d75dfd3	stdlib@go1.25.5	1.25.10	1
ghcr.io/goauthentik/server :2026.5.6	ed120caf710c	stdlib@go1.26.2	1.25.10	1
ghcr.io/gochain/rpc-proxy/rpc-proxy :latest	ca01f5ab95f7	stdlib@go1.23.11	1.25.10	1
ghcr.io/gomenhashai/gomenhashai :v1.3.3	6f031172a5ec	stdlib@go1.26.0	1.25.10	1
ghcr.io/gotify/server :2.6.1	04f4c4bb7cdd	stdlib@go1.23.3	1.25.10	1
ghcr.io/gotway/gotway :v0.0.13	7ed73c1979ee	stdlib@go1.18.3	1.25.10	1
ghcr.io/grafana/alloy-operator :1.3.0	2088dcb22aaa	stdlib@go1.24.5	1.25.10	1
ghcr.io/grafana/alloy-operator :1.7.0	2ce23f948e02	stdlib@go1.24.10	1.25.10	1
ghcr.io/grafana/alloy-operator :1.8.1	ae85d68749c7	stdlib@go1.25.8	1.25.10	1
ghcr.io/grafana/grafana-operator :v5.18.0	0af2faec9d6f	stdlib@go1.24.2	1.25.10	1
ghcr.io/grafana/grafana-operator :v5.22.2	d45fc24e8f43	stdlib@go1.26.1	1.25.10	1
ghcr.io/grafana/helm-chart-toolbox-kubectl :0.1.2	c7adcc4db378	stdlib@go1.24.9	1.25.10	1
ghcr.io/grafana/tempo-operator/tempo-operator :v0.4.0	2627be646391	stdlib@go1.21.0	1.25.10	1
ghcr.io/gurucomputing/headscale-ui :2026.03.17	015f5ba04bcb	stdlib@go1.25.8	1.25.10	1
ghcr.io/haedalwang/kubescout :0.1.1	07d51f838f0d	stdlib@go1.25.5	1.25.10	1
ghcr.io/haydercyber/secrets-bridge :0.2.0	4709f1bb3039	stdlib@go1.24.13	1.25.10	1
ghcr.io/hay-kot/homebox :v0.9.2	e6e0fbd7cca9	stdlib@go1.20.4	1.25.10	1
ghcr.io/heimops/mimir-operator :latest	4e1a3ef1fe82	stdlib@go1.24.13	1.25.10	1
ghcr.io/helm/chartmuseum :v0.16.0	71d1f1c0179e	stdlib@go1.20.4	1.25.10	1
ghcr.io/helm/chartmuseum :v0.14.0	878ef6a31fa0	stdlib@go1.17.6	1.25.10	1
ghcr.io/helm/chartmuseum :v0.15.0	c298183a5208	stdlib@go1.17.8	1.25.10	1
ghcr.io/helm/chartmuseum :v0.16.3	c81f105c3682	stdlib@go1.24.1	1.25.10	1
ghcr.io/helmfile/helmfile :v1.8.0	1808ffb76f37	stdlib@go1.24.6	1.25.10	1
ghcr.io/henrywhitaker3/argo-zombies :v0.4.4	316c397906c9	stdlib@go1.26.1	1.25.10	1
ghcr.io/home-assistant/home-assistant :2025.3.0	26c51e44d932	stdlib@go1.23.3	1.25.10	1
ghcr.io/home-assistant/home-assistant :2026.9.0	372d991e5888	stdlib@go1.25.6	1.25.10	1
ghcr.io/home-assistant/home-assistant :2026.8.2	56690a89c79a	stdlib@go1.23.3	1.25.10	1
ghcr.io/home-assistant/home-assistant :2025.12.5	9a5a3eb4a213	stdlib@go1.25.4	1.25.10	1
ghcr.io/home-assistant/home-assistant :2026.9.2	a1bc133af84e	stdlib@go1.25.6	1.25.10	1
ghcr.io/home-assistant/home-assistant :2022.5.4	ec6d67fbedfa	stdlib@go1.17.1	1.25.10	1
ghcr.io/home-assistant/home-assistant :2023.11.3	feffc0b8227d	stdlib@go1.17.1	1.25.10	1
ghcr.io/home-operations/home-assistant :2026.3.1	067e54e2e107	stdlib@go1.25.6	1.25.10	1
ghcr.io/honeycombio/kspan/kspan :0.2	c966a4f8a4b7	stdlib@go1.20.1	1.25.10	1
ghcr.io/hsn723/cert-estuary :0.2.0	0c4b6132b0ad	stdlib@go1.26.2	1.25.10	1
ghcr.io/hsn723/dkim-manager :1.4.0	0312232b31a2	stdlib@go1.26.0	1.25.10	1
ghcr.io/hsn723/postfix_exporter :0.20.0	b7da7c554018	stdlib@go1.26.2	1.25.10	1
ghcr.io/huseyinbabal/kubetag :latest	e161eddc59a0	stdlib@go1.25.5	1.25.10	1
ghcr.io/hyperspike/valkey-operator :v0.0.61	7d8c669f11a4	stdlib@go1.25.2	1.25.10	1
ghcr.io/idebeijer/gameserver-operator :latest	1b099cfe9e5e	stdlib@go1.25.7	1.25.10	1
ghcr.io/ignisda/ryot :v10.5.0	a752b6aee537	stdlib@go1.23.1	1.25.10	1
ghcr.io/igrikus/garm-operator :4.2.0	9e24d8a6a3b2	stdlib@go1.26.2	1.25.10	1
ghcr.io/imcitius/checker-edge :1.1.11	74426c1fe00f	stdlib@go1.25.9	1.25.10	1
ghcr.io/imgproxy/imgproxy :v3.30.0	74c1bee92e04	stdlib@go1.25.1	1.25.10	1
ghcr.io/imunhatep/kube-node-ready :0.5.0	7439f6f9f85c	stdlib@go1.25.7	1.25.10	1
ghcr.io/indeedeng/harbor-container-webhook :main	45ca15fc294f	stdlib@go1.24.1	1.25.10	1
ghcr.io/inlets/inlets-operator :0.17.22	08265c006973	stdlib@go1.26.2	1.25.10	1