CVE-2026-39836

High

Advisory

Published 7 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.006; 48th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,151; of 18,035 indexed, latest versions
Container images: 4,708; deployed by those charts
Fix available: 1 of 1; affected package

Panic in Dial and LookupPort when handling NUL byte on Windows in net

Carried by container images the latest versions of 4,151 of 18,035 indexed charts deploy, on 4,708 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+183 more	1.25.10	4,708

OSV records: GO-2026-4971
Also known as: BIT-golang-2026-39836

Charts affected

4,151 by stars

Chart

Latest

Affected images

Radar Score

argo-cdargo

10.9.6

2 of 3 See more

argo-cd argo 10.9.6

2 of the 3 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
ghcr.io/dexidp/dex :v2.45.1	8499afd690c4	stdlib@go1.25.6	1.25.10
quay.io/argoproj/argocd :v3.5.3	dd3f47d5a5e4	stdlib@go1.26.2	1.25.10

Open the chart page →

3,862

ingress-nginxingress-nginx

4.15.1

2 of 2 See more

ingress-nginx ingress-nginx 4.15.1

2 of the 2 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
registry.k8s.io/ingress-nginx/controller :v1.15.1	594ceea76b01	stdlib@go1.26.1	1.25.10
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.6.9	01038e7de14b	stdlib@go1.26.1	1.25.10

Open the chart page →

1,953

kubernetes-dashboardk8s-dashboard

7.14.0

4 of 5 See more

kubernetes-dashboard k8s-dashboard 7.14.0

4 of the 5 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
kubernetesui/dashboard-api :1.14.0	96a702cfd339	stdlib@go1.23.12	1.25.10
kubernetesui/dashboard-auth :1.4.0	53e9917898bf	stdlib@go1.23.12	1.25.10
kubernetesui/dashboard-metrics-scraper :1.2.2	5154b68252bd	stdlib@go1.23.4	1.25.10
kubernetesui/dashboard-web :1.7.0	cc7c31bd2d84	stdlib@go1.23.9	1.25.10

Open the chart page →

4,170

lokigrafana

7.3.0

2 of 6 See more

loki grafana 7.3.0

2 of the 6 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
grafana/loki :3.6.11	44148ad243c0	stdlib@go1.26.2	1.25.10
prom/memcached-exporter :v0.15.4	b6763ecb3c47	stdlib@go1.25.3	1.25.10

Open the chart page →

4,715

gitlabgitlab

10.4.1

1 of 21 See more

gitlab gitlab 10.4.1

1 of the 21 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
registry.gitlab.com/gitlab-org/build/cng/cfssl-self-sign :v19.4.1	5dd7827fa474	stdlib@go1.22.0	1.25.10

Open the chart page →

17,818

metallbmetallb

0.16.1

3 of 4 See more

metallb metallb 0.16.1

3 of the 4 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
quay.io/metallb/controller :v0.16.1	f51ab515de9c	stdlib@go1.25.9	1.25.10
quay.io/metallb/frr-k8s :v0.0.25	1cb06fb2d553	stdlib@go1.25.8	1.25.10
quay.io/metallb/speaker :v0.16.1	16561e96531e	stdlib@go1.25.9	1.25.10

Open the chart page →

2,795

rancherrancher-stable

2.15.2

1 of 2 See more

rancher rancher-stable 2.15.2

1 of the 2 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
rancher/rancher :v2.15.2	0c3d8e570255	stdlib@go1.26.1	1.25.10

Open the chart page →

2,171

giteagitea

12.7.0

2 of 4 See more

gitea gitea 12.7.0

2 of the 4 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
bitnamilegacy/pgpool :4.6.3-debian-12-r0	d3bf3910f148	stdlib@go1.25.0	1.25.10
bitnamilegacy/valkey-cluster :8.1.3-debian-12-r3	32869e769b7e	stdlib@go1.24.6	1.25.10

Open the chart page →

10,045

nfs-subdir-external-provisionernfs-subdir-external-provisioner

4.0.18

1 of 1 See more

nfs-subdir-external-provisioner nfs-subdir-external-provisioner 4.0.18

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner :v4.0.2	63d5e04551ec	stdlib@go1.15	1.25.10

Open the chart page →

3,791

artifact-hubartifact-hub

1.23.0

4 of 7 See more

artifact-hub artifact-hub 1.23.0

4 of the 7 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
aquasec/trivy :0.69.3	bcc376de8d77	stdlib@go1.25.7	1.25.10
artifacthub/postgres :latest	4fd34fa635cc	stdlib@go1.24.6	1.25.10
artifacthub/scanner :v1.23.0	2d8365601f0e	stdlib@go1.25.7	1.25.10
artifacthub/tracker :v1.23.0	5368d21a6e5c	stdlib@go1.24.4	1.25.10

Open the chart page →

13,704

prometheus-blackbox-exporterprometheus-community

11.19.1

1 of 1 See more

prometheus-blackbox-exporter prometheus-community 11.19.1

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
quay.io/prometheus/blackbox-exporter :v0.28.0	e753ff9f3fc4	stdlib@go1.25.5	1.25.10

Open the chart page →

821

deschedulerdescheduler

0.37.0

1 of 1 See more

descheduler descheduler 0.37.0

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
registry.k8s.io/descheduler/descheduler :v0.37.0	88deef34ff5c	stdlib@go1.26.0	1.25.10

Open the chart page →

416

argo-cdargo-cd-oci

10.9.6

2 of 3 See more

argo-cd argo-cd-oci 10.9.6

2 of the 3 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
ghcr.io/dexidp/dex :v2.45.1	8499afd690c4	stdlib@go1.25.6	1.25.10
quay.io/argoproj/argocd :v3.5.3	dd3f47d5a5e4	stdlib@go1.26.2	1.25.10

Open the chart page →

3,862

jupyterhubjupyterhub

4.4.2

2 of 7 See more

jupyterhub jupyterhub 4.4.2

2 of the 7 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
quay.io/jupyterhub/k8s-image-awaiter :4.4.2	c4df1176d152	stdlib@go1.23.12	1.25.10
registry.k8s.io/kube-scheduler :v1.30.14	74a5cf9cfa9f	stdlib@go1.23.10	1.25.10

Open the chart page →

9,657

natsnats

2.15.0

1 of 3 See more

nats nats 2.15.0

1 of the 3 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
natsio/nats-server-config-reloader :0.23.0	64cb6c858e79	stdlib@go1.25.6	1.25.10

Open the chart page →

2,479

dexdex

0.25.2

1 of 1 See more

dex dex 0.25.2

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
ghcr.io/dexidp/dex :v2.45.1	8499afd690c4	stdlib@go1.25.6	1.25.10

Open the chart page →

1,671

uptime-kumauptime-kuma

4.2.0

1 of 1 See more

uptime-kuma uptime-kuma 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :2.5.0	a8610b3b4c38	stdlib@go1.20.5	1.25.10

Open the chart page →

34,165

airflowairflow-helm

8.9.0

1 of 4 See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
apache/airflow :2.8.4-python3.9	64e58748b6b9	stdlib@go1.21.8	1.25.10

Open the chart page →

12,488

nfs-server-provisionerkvaps

1.8.0

1 of 1 See more

nfs-server-provisioner kvaps 1.8.0

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/nfs-provisioner :v4.0.8	c825f3d5e28b	stdlib@go1.16.2	1.25.10

Open the chart page →

3,309

chartmuseumchartmuseum

3.10.4

1 of 1 See more

chartmuseum chartmuseum 3.10.4

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
ghcr.io/helm/chartmuseum :v0.16.3	c81f105c3682	stdlib@go1.24.1	1.25.10

Open the chart page →

1,976

argo-eventsargo

2.4.27

1 of 1 See more

argo-events argo 2.4.27

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
quay.io/argoproj/argo-events :v1.9.11	fa07b2c9ece6	stdlib@go1.25.6	1.25.10

Open the chart page →

1,393

victoria-metrics-k8s-stackvictoriametrics

0.95.0

1 of 7 See more

victoria-metrics-k8s-stack victoriametrics 0.95.0

1 of the 7 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
grafana/grafana :13.2.2-distroless	69a5d2d957ca	stdlib@go1.25.7	1.25.10

Open the chart page →

1,188

aws-node-termination-handleraws

0.21.0

1 of 1 See more

aws-node-termination-handler aws 0.21.0

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-ec2/aws-node-termination-handler :v1.19.0	844478ebd5b8	stdlib@go1.19.5	1.25.10

Open the chart page →

2,077

prometheus-adapterprometheus-community

5.3.0

1 of 1 See more

prometheus-adapter prometheus-community 5.3.0

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
registry.k8s.io/prometheus-adapter/prometheus-adapter :v0.12.0	932eae60e2bc	stdlib@go1.22.2	1.25.10

Open the chart page →

1,349

home-assistanthelm-hass

0.3.83

1 of 1 See more

home-assistant helm-hass 0.3.83

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2026.9.4	3e6710a7ab2a	stdlib@go1.23.3	1.25.10

Open the chart page →

2,940

openebsopenebs

4.6.1

18 of 35 See more

openebs openebs 4.6.1

18 of the 35 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
grafana/alloy :v1.8.1	7790f6f7fbd8	stdlib@go1.24.1	1.25.10
grafana/loki :3.4.2	58a6c186ce78	stdlib@go1.23.6	1.25.10
library/nats :2.9.17-alpine	1a7b320b2942	stdlib@go1.19.9	1.25.10
natsio/nats-server-config-reloader :0.10.1	e414cc7e6f59	stdlib@go1.19.4	1.25.10
natsio/prometheus-nats-exporter :0.11.0	31c02aac089a	stdlib@go1.20.3	1.25.10
openebs/etcd :3.6.4-debian-12-r0	c86c06f1ce6a	stdlib@go1.24.5	1.25.10
openebs/lvm-driver :1.10.1	41f73aba7f31	stdlib@go1.24.7	1.25.10
openebs/provisioner-localpv :4.6.0	99f5116f5cb8	stdlib@go1.25.0	1.25.10
openebs/zfs-driver :2.11.1	16f1a74bb249	stdlib@go1.26.2	1.25.10
quay.io/prometheus-operator/prometheus-config-reloader :v0.81.0	959d47672fbf	stdlib@go1.23.7	1.25.10
registry.k8s.io/sig-storage/csi-attacher :v4.8.1	69888dba5815	stdlib@go1.23.1	1.25.10
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.13.0	d7138bcc3aa5	stdlib@go1.23.1	1.25.10
registry.k8s.io/sig-storage/csi-provisioner :v5.2.0	d5e46da8aff7	stdlib@go1.23.1	1.25.10
registry.k8s.io/sig-storage/csi-provisioner :v6.1.0	e5900dc98b0d	stdlib@go1.24.6	1.25.10
registry.k8s.io/sig-storage/csi-resizer :v2.0.0	4a95d94e57ad	stdlib@go1.24.6	1.25.10
registry.k8s.io/sig-storage/csi-resizer :v1.13.2	8ddd178ba5d0	stdlib@go1.23.1	1.25.10
registry.k8s.io/sig-storage/csi-snapshotter :v8.2.0	dd788d79cf4c	stdlib@go1.23.1	1.25.10
registry.k8s.io/sig-storage/snapshot-controller :v8.2.0	9dade8f2f3ab	stdlib@go1.23.1	1.25.10

Open the chart page →

28,605

open-webuiopen-webui

16.6.0

1 of 4 See more

open-webui open-webui 16.6.0

1 of the 4 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
library/redis :7.4.2-alpine3.21	02419de7eddf	stdlib@go1.18.2	1.25.10

Open the chart page →

2,241

actions-runner-controlleractions-runner-controller

0.23.7

2 of 2 See more

actions-runner-controller actions-runner-controller 0.23.7

2 of the 2 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
summerwind/actions-runner-controller :v0.27.6	2128f81dbede	stdlib@go1.20.7	1.25.10
quay.io/brancz/kube-rbac-proxy :v0.13.1	738c854322f5	stdlib@go1.19.1	1.25.10

Open the chart page →

4,061

aws-for-fluent-bitaws

0.2.0

1 of 1 See more

aws-for-fluent-bit aws 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-observability/aws-for-fluent-bit :3.2.1	a480a1241720	stdlib@go1.25.6	1.25.10

Open the chart page →

408

apisixapisix

2.18.0

1 of 3 See more

apisix apisix 2.18.0

1 of the 3 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
bitnamilegacy/etcd :latest	99b408c15272	stdlib@go1.23.10	1.25.10

Open the chart page →

3,400

vpafairwinds-stable

5.1.0

1 of 4 See more

vpa fairwinds-stable 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v20230312-helm-chart-4.5.2-28-g66a760794	01d181618f27	stdlib@go1.20.1	1.25.10

Open the chart page →

2,002

terraformhashicorp

1.1.2

1 of 1 See more

terraform hashicorp 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
hashicorp/terraform-k8s :1.1.2	b19857bab620	stdlib@go1.18.8	1.25.10

Open the chart page →

2,733

trinotrino

1.42.2

1 of 1 See more

1,656

dagsterdagster

1.13.25

1 of 5 See more

dagster dagster 1.13.25

1 of the 5 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
library/postgres :14.6	f565573d74ae	stdlib@go1.18.2	1.25.10

Open the chart page →

4,211

zabbixzabbix-community

7.1.0

3 of 5 See more

zabbix zabbix-community 7.1.0

3 of the 5 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
library/postgres :16	1a6ab3f5345e	stdlib@go1.24.6	1.25.10
zabbix/zabbix-agent2 :ubuntu-7.0.23	7322a94c5d7a	stdlib@go1.24.10	1.25.10
zabbix/zabbix-web-service :ubuntu-7.0.23	915b3183e054	stdlib@go1.24.10	1.25.10

Open the chart page →

15,662

keycloakcloudpirates-keycloak

0.21.45

2 of 3 See more

keycloak cloudpirates-keycloak 0.21.45

2 of the 3 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
library/postgres :18.0	073e7c8b84e2	stdlib@go1.24.6	1.25.10
library/postgres :18.6	5a5a84b19854	stdlib@go1.24.6	1.25.10

Open the chart page →

4,965

graylogkong-z

3.0.36

1 See more

graylog kong-z 3.0.36

1 container image this version deploys carries CVE-2026-39836.

Container image	Digest	Package	Fixed in
quay.io/mongodb/mongodb-kubernetes-operator :0.13.0	2dcc6393e6f7	stdlib@go1.24.2	1.25.10

Open the chart page →

—

node-problem-detectordeliveryhero

2.4.1

1 of 1 See more

node-problem-detector deliveryhero 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
registry.k8s.io/node-problem-detector/node-problem-detector :v1.35.1	c380751accc5	stdlib@go1.25.5	1.25.10

Open the chart page →

2,353

openfaasopenfaas

15.0.13

3 of 6 See more

openfaas openfaas 15.0.13

3 of the 6 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
library/nats-streaming :0.25.6	0ad6861379c9	stdlib@go1.20.11	1.25.10
ghcr.io/openfaas/gateway :0.27.14	ee0eaecc490c	stdlib@go1.24.13	1.25.10
ghcr.io/openfaas/queue-worker :0.14.2	c18da04d70f6	stdlib@go1.23.4	1.25.10

Open the chart page →

4,651

flux2fluxcd-community

2.19.1

1 of 7 See more

flux2 fluxcd-community 2.19.1

1 of the 7 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
fluxcd/flux-cli :v2.9.5	704d55295355	stdlib@go1.26.2	1.25.10

Open the chart page →

2,925

jaeger-operatorjaegertracing

2.57.0

1 of 1 See more

jaeger-operator jaegertracing 2.57.0

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-operator :1.61.0	3f036ec60e61	stdlib@go1.22.3	1.25.10

Open the chart page →

948

keydbenapter

0.48.0

1 of 1 See more

keydb enapter 0.48.0

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
eqalpha/keydb :x86_64_v6.3.2	fd9351ce27a7	stdlib@go1.18.2	1.25.10

Open the chart page →

6,508

postgrescloudpirates-postgres

0.21.1

1 of 1 See more

postgres cloudpirates-postgres 0.21.1

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
library/postgres :18.6	5a5a84b19854	stdlib@go1.24.6	1.25.10

Open the chart page →

1,689

vault-secrets-operatorhashicorp

1.6.0

1 of 2 See more

vault-secrets-operator hashicorp 1.6.0

1 of the 2 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
quay.io/brancz/kube-rbac-proxy :v0.18.1	e6a323504999	stdlib@go1.23.0	1.25.10

Open the chart page →

1,339

linkerd-vizlinkerd2

30.12.11

1 of 5 See more

linkerd-viz linkerd2 30.12.11

1 of the 5 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
prom/prometheus :v2.48.0	b440bc0e8aa5	stdlib@go1.21.4	1.25.10

Open the chart page →

1,861

rocketchatrocketchat-server

7.0.2

5 of 12 See more

rocketchat rocketchat-server 7.0.2

5 of the 12 container images this version deploys carry CVE-2026-39836.

Container image	Digest	Package	Fixed in
bitnamilegacy/mongodb :6.0.10-debian-11-r8	42319decb591	stdlib@go1.19.12	1.25.10
bitnamilegacy/mongodb-exporter :0.39.0-debian-11-r106	de7256c7adcd	stdlib@go1.20.7	1.25.10
natsio/nats-box :0.19.2	8031d190c7ee	stdlib@go1.25.2	1.25.10
natsio/nats-server-config-reloader :0.21.1	10ff229eaf52	stdlib@go1.25.5	1.25.10
natsio/prometheus-nats-exporter :0.18.0	02469dc907bc	stdlib@go1.24.6	1.25.10