StackRadar

CVE-2026-39836

High

Advisory

Published 7 May 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
48th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4,218
of 17,985 indexed, latest versions
Container images
4,748
deployed by those charts
Fix available
1 of 1
affected package

Panic in Dial and LookupPort when handling NUL byte on Windows in net

Carried by container images the latest versions of 4,218 of 17,985 indexed charts deploy, on 4,748 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+183 more1.25.104,748
OSV records
GO-2026-4971
Also known as
BIT-golang-2026-39836

Charts affected

4,218 by stars
ChartLatestAffected imagesRadar Score
gripmockhelm-charts-nr1.1.31 of 1See more

gripmock helm-charts-nr 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
tkpd/gripmock:1.10.174441dadcfbd
stdlib@go1.14.6
1.25.10

Open the chart page →

3,738
hoppscotchhelm-charts-nr0.3.11 of 1See more

hoppscotch helm-charts-nr 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
stdlib@go1.21.10
1.25.10

Open the chart page →

4,140
k8s-cloudwatch-adapterhelm-charts-nr0.2.21 of 1See more

k8s-cloudwatch-adapter helm-charts-nr 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
chankh/k8s-cloudwatch-adapter:v0.9.0963c44c7f8b1
stdlib@go1.14.5
1.25.10

Open the chart page →

3,510
k8s-event-loggerhelm-charts-nr1.1.91 of 1See more

k8s-event-logger helm-charts-nr 1.1.9

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
maxrocketinternet/k8s-event-logger:2.111224534789d
stdlib@go1.20.5
1.25.10

Open the chart page →

1,353
killgravehelm-charts-nr1.0.21 of 1See more

killgrave helm-charts-nr 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
friendsofgo/killgrave:0.4.139cfbecca342
stdlib@go1.16.3
1.25.10

Open the chart page →

2,058
kube-benchhelm-charts-nr0.1.171 of 1See more

kube-bench helm-charts-nr 0.1.17

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
aquasec/kube-bench:v0.8.0ea3e33bc3c4e
stdlib@go1.21.7
1.25.10

Open the chart page →

2,114
labelsmanager-controllerhelm-charts-nr1.0.41 of 1See more

labelsmanager-controller helm-charts-nr 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
thomasnyambati/labelsmanager-controller:1.0.0148ae3f99fea
stdlib@go1.13.15
1.25.10

Open the chart page →

3,322
listmonkhelm-charts-nr0.1.121 of 1See more

listmonk helm-charts-nr 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
listmonk/listmonk:v2.1.0d2eac77ddfad
stdlib@go1.17.6
1.25.10

Open the chart page →

3,462
node-local-dnshelm-charts-nr2.1.41 of 1See more

node-local-dns helm-charts-nr 2.1.4

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
registry.k8s.io/dns/k8s-dns-node-cache:1.23.1e3dccb1a21d1
stdlib@go1.22.3
1.25.10

Open the chart page →

2,825
node-problem-detectorhelm-charts-nr2.3.171 of 1See more

node-problem-detector helm-charts-nr 2.3.17

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
registry.k8s.io/node-problem-detector/node-problem-detector:v0.8.2052f0618e9bc2
stdlib@go1.23.2
1.25.10

Open the chart page →

2,940
prometheus-aws-limits-exporterhelm-charts-nr0.2.21 of 1See more

prometheus-aws-limits-exporter helm-charts-nr 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
danielfm/aws-limits-exporter:0.6.07152b84e57cb
stdlib@go1.17.2
1.25.10

Open the chart page →

2,651
prometheus-locust-exporterhelm-charts-nr1.2.31 of 1See more

prometheus-locust-exporter helm-charts-nr 1.2.3

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
containersol/locust_exporter:v0.4.1a914972d19ad
stdlib@go1.15.8
1.25.10

Open the chart page →

2,163
prometheus-soti-mobicontrol-exporterhelm-charts-nr1.0.31 of 1See more

prometheus-soti-mobicontrol-exporter helm-charts-nr 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
maxrocketinternet/soti-mobicontrol-exporter:0.61a281b76efa3
stdlib@go1.14
1.25.10

Open the chart page →

2,579
prometheus-statsd-exporterhelm-charts-nr0.1.51 of 1See more

prometheus-statsd-exporter helm-charts-nr 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
prom/statsd-exporter:v0.18.0d23aca343b86
stdlib@go1.14.7
1.25.10

Open the chart page →

2,228
toxiproxyhelm-charts-nr1.3.91 of 2See more

toxiproxy helm-charts-nr 1.3.9

1 of the 2 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
ghcr.io/shopify/toxiproxy:2.7.0fc2d40f4904c
stdlib@go1.19.13
1.25.10

Open the chart page →

1,005
weblatehelm-charts-nr0.3.21 of 3See more

weblate helm-charts-nr 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
weblate/weblate:4.2.2-169c160d37a3c
stdlib@go1.13.5
1.25.10

Open the chart page →

10,597
dbapphelmcourseVerified publisher0.3.31 of 2See more

dbapp helmcourse 0.3.3

1 of the 2 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
stdlib@go1.18.2
1.25.10

Open the chart page →

4,723
mysqlhelmcourseVerified publisher0.2.41 of 1See more

mysql helmcourse 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
stdlib@go1.18.2
1.25.10

Open the chart page →

2,225
chart-bookhelm-deploy-book0.1.01 of 3See more

chart-book helm-deploy-book 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
dannielkil/book-db:latest433290c5c1db
stdlib@go1.18.2
1.25.10

Open the chart page →

10,484
jasperreportshelm-dojo8.0.0-v1.31 of 2See more

jasperreports helm-dojo 8.0.0-v1.3

1 of the 2 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
palopalepalo/jasperreports:8-v1.356b99b194d20
stdlib@go1.19.6
1.25.10

Open the chart page →

7,598
helmfile-gitops-agenthelmfile-gitops-agentVerified publisher1.1.992 of 3See more

helmfile-gitops-agent helmfile-gitops-agent 1.1.99

2 of the 3 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
fluxcd/flux-cli:v2.9.6b1ac18156f22
stdlib@go1.26.2
1.25.10
ghcr.io/helmfile/helmfile:v1.8.19c29ece2fb6e
stdlib@go1.23.4
1.25.10

Open the chart page →

2,190
affinehelmforgeVerified publisher1.0.11 of 3See more

affine helmforge 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
pgvector/pgvector:0.8.6-pg16-bookwormccc6e83d6e35
stdlib@go1.24.6
1.25.10

Open the chart page →

4,683
alfiohelmforgeVerified publisher1.2.121 of 3See more

alfio helmforge 1.2.12

1 of the 3 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
library/postgres:18.6-trixie86c951e05bf5
stdlib@go1.24.6
1.25.10

Open the chart page →

2,278
appwritehelmforgeVerified publisher2.0.21 of 5See more

appwrite helmforge 2.0.2

1 of the 5 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
library/mariadb:13.0.2d4fdec0510ad
stdlib@go1.24.6
1.25.10

Open the chart page →

5,210
automatischhelmforgeVerified publisher1.3.82 of 4See more

automatisch helmforge 1.3.8

2 of the 4 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
stdlib@go1.23.8
1.25.10
library/postgres:18.6-trixie5a5a84b19854
stdlib@go1.24.6
1.25.10

Open the chart page →

6,445
booklorehelmforgeVerified publisher2.0.21 of 3See more

booklore helmforge 2.0.2

1 of the 3 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
library/mariadb:13.0.2d4fdec0510ad
stdlib@go1.24.6
1.25.10

Open the chart page →

2,352
castopodhelmforgeVerified publisher1.2.92 of 3See more

castopod helmforge 1.2.9

2 of the 3 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
castopod/castopod:1.15.54e4f0440520f
stdlib@go1.25.7
1.25.10
library/mariadb:13.0.2d4fdec0510ad
stdlib@go1.24.6
1.25.10

Open the chart page →

10,457
chiefonboardinghelmforgeVerified publisher1.1.151 of 3See more

chiefonboarding helmforge 1.1.15

1 of the 3 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
library/postgres:18.6-trixie5a5a84b19854
stdlib@go1.24.6
1.25.10

Open the chart page →

8,057
ckanhelmforgeVerified publisher1.3.92 of 6See more

ckan helmforge 1.3.9

2 of the 6 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
ckan/ckan-solr:2.11-solr9ef8e5d3e6be1
stdlib@go1.18.1
1.25.10
library/postgres:18.6-trixie5a5a84b19854
stdlib@go1.24.6
1.25.10

Open the chart page →

11,364
countlyhelmforgeVerified publisher1.2.82 of 3See more

countly helmforge 1.2.8

2 of the 3 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
countly/countly-server:25.05.4e3c238248f99
stdlib@go1.21.11
1.25.10
library/mongo:8.3.115d7043a4ffe0
stdlib@go1.24.6
1.25.10

Open the chart page →

76,341
dawarichhelmforgeVerified publisher1.0.22 of 4See more

dawarich helmforge 1.0.2

2 of the 4 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
freikin/dawarich:1.15.2e58334ca5697
stdlib@go1.24.4
1.25.10
postgis/postgis:18-3.67e00e8c3539f
stdlib@go1.24.6
1.25.10

Open the chart page →

12,055
ddns-updaterhelmforgeVerified publisher1.4.121 of 1See more

ddns-updater helmforge 1.4.12

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
qmcgaw/ddns-updater:2.10.03e2aa558946b
stdlib@go1.26.2
1.25.10

Open the chart page →

373
discount-bandithelmforgeVerified publisher2.0.92 of 3See more

discount-bandit helmforge 2.0.9

2 of the 3 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
cybrarist/discount-bandit:v4.0.4e9e2447ac666
stdlib@go1.25.4
1.25.10
library/mysql:26.7.0ade067ae2fb1
stdlib@go1.24.6
1.25.10

Open the chart page →

33,407
druidhelmforgeVerified publisher1.3.62 of 4See more

druid helmforge 1.3.6

2 of the 4 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
library/postgres:18.6-trixie86c951e05bf5
stdlib@go1.24.6
1.25.10
library/zookeeper:3.9.57d0f24ebb67b
stdlib@go1.18.1
1.25.10

Open the chart page →

9,955
drupalhelmforgeVerified publisher1.2.151 of 2See more

drupal helmforge 1.2.15

1 of the 2 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
library/mysql:26.7.0ade067ae2fb1
stdlib@go1.24.6
1.25.10

Open the chart page →

4,278
entehelmforgeVerified publisher1.0.21 of 4See more

ente helmforge 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
library/postgres:18.6-trixie86c951e05bf5
stdlib@go1.24.6
1.25.10

Open the chart page →

4,829
ghosthelmforgeVerified publisher1.2.102 of 3See more

ghost helmforge 1.2.10

2 of the 3 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
library/ghost:6.65.090592b712b6b
stdlib@go1.24.6
1.25.10
library/mysql:8.4.110744ee5ef89c
stdlib@go1.24.6
1.25.10

Open the chart page →

3,465
gophishhelmforgeVerified publisher0.1.61 of 1See more

gophish helmforge 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
gophish/gophish:0.12.18a57cd171999
stdlib@go1.15.2
1.25.10

Open the chart page →

3,991
hermes-agenthelmforgeVerified publisher1.0.11 of 1See more

hermes-agent helmforge 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.9.24fca358f12efd
stdlib@go1.24.4
1.25.10

Open the chart page →

6,541
hoppscotchhelmforgeVerified publisher1.1.121 of 2See more

hoppscotch helmforge 1.1.12

1 of the 2 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
library/postgres:18.6-trixie5a5a84b19854
stdlib@go1.24.6
1.25.10

Open the chart page →

2,271
immichhelmforgeVerified publisher1.2.91 of 5See more

immich helmforge 1.2.9

1 of the 5 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0bcf63357191b
stdlib@go1.18.2
1.25.10

Open the chart page →

12,897
jenkinshelmforgeVerified publisher1.0.91 of 1See more

jenkins helmforge 1.0.9

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
jenkins/jenkins:2.568.3-lts-jdk21c1e4c349365f
stdlib@go1.25.3
1.25.10

Open the chart page →

3,140
komgahelmforgeVerified publisher1.4.161 of 1See more

komga helmforge 1.4.16

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
gotson/komga:1.27.19cf102f5fb78
stdlib@go1.17.8
1.25.10

Open the chart page →

36,096
listmonkhelmforgeVerified publisher1.1.143 of 3See more

listmonk helmforge 1.1.14

3 of the 3 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
library/postgres:18.6-trixie86c951e05bf5
stdlib@go1.24.6
1.25.10
library/postgres:17-alpineb0f9560a2de0
stdlib@go1.24.6
1.25.10
listmonk/listmonk:v6.2.0f535d59e1499
stdlib@go1.26.1
1.25.10

Open the chart page →

3,228
medikeephelmforgeVerified publisher2.0.22 of 3See more

medikeep helmforge 2.0.2

2 of the 3 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
library/postgres:18.6-trixie5a5a84b19854
stdlib@go1.24.6
1.25.10
ghcr.io/afairgiant/medikeep:v0.71.0086579173033
stdlib@go1.19.8
1.25.10

Open the chart page →

6,230
metabasehelmforgeVerified publisher1.2.301 of 3See more

metabase helmforge 1.2.30

1 of the 3 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
library/postgres:18.6-trixie5a5a84b19854
stdlib@go1.24.6
1.25.10

Open the chart page →

1,793
middlewarehelmforgeVerified publisher1.2.72 of 4See more

middleware helmforge 1.2.7

2 of the 4 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
library/postgres:18.6-trixie5a5a84b19854
stdlib@go1.24.6
1.25.10
middlewareeng/middleware:0.3.1747d880812f1
stdlib@go1.17.13
1.25.10

Open the chart page →

10,531
minecrafthelmforgeVerified publisher1.5.51 of 1See more

minecraft helmforge 1.5.5

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
itzg/minecraft-server:2026.9.2de5d1b1a83eb
stdlib@go1.24.6
1.25.10

Open the chart page →

4,730
mongodbhelmforgeVerified publisher1.8.21 of 1See more

mongodb helmforge 1.8.2

1 of the 1 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
library/mongo:8.3.115d7043a4ffe0
stdlib@go1.24.6
1.25.10

Open the chart page →

1,279
moodlehelmforgeVerified publisher1.1.21 of 2See more

moodle helmforge 1.1.2

1 of the 2 container images this version deploys carry CVE-2026-39836.

Container imageDigestPackageFixed in
library/postgres:18.6-trixie5a5a84b19854
stdlib@go1.24.6
1.25.10

Open the chart page →

6,917

Container images carrying it

4,748 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

No deployed image carries CVE-2026-39836.

syft 1.42.1 · advisories as of 3 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.