StackRadar

CVE-2026-40898

Medium

Advisory

Published 3 Jun 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.004
33rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
129
of 17,781 indexed, latest versions
Container images
120
deployed by those charts
Fix available
1 of 1
affected package

quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion

Carried by container images the latest versions of 129 of 17,781 indexed charts deploy, on 120 images.

Affected packageAffected versionsFixed inImages
github.com/quic-go/quic-gogolangv0.32.0, v0.33.0, v0.37.5, v0.38.1+27 more0.59.1120
OSV records
GHSA-vvgj-x9jq-8cj9
Also known as
GO-2026-5676

Charts affected

129 by stars
ChartLatestAffected imagesRadar Score
gotifyalexvanderberkelVerified publisher0.7.01 of 1See more

gotify alexvanderberkel 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
gotify/server:3.1.0be44495e4609
github.com/quic-go/quic-go@v0.59.0
0.59.1

Open the chart page →

320
celestia-localastria9.0.01 of 2See more

celestia-local astria 9.0.0

1 of the 2 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-node:v0.27.5-mocha4768ea1c5fd2
github.com/quic-go/quic-go@v0.54.0
0.59.1

Open the chart page →

3,281
celestia-nodeastria0.7.11 of 1See more

celestia-node astria 0.7.1

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-node:v0.27.5-mocha4768ea1c5fd2
github.com/quic-go/quic-go@v0.54.0
0.59.1

Open the chart page →

1,502
algorand-participationbiatec-repoVerified publisher4.4.11 of 1See more

algorand-participation biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
scholtz2/algorand-participation-mainnet-extended:4.4.1-stable5aaa5d4ab8b8
github.com/quic-go/quic-go@v0.49.1
0.59.1

Open the chart page →

7,190
algorand-relaybiatec-repoVerified publisher4.4.11 of 1See more

algorand-relay biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
scholtz2/algorand-relay-mainnet:4.4.1-stablee9af7d8ff6bb
github.com/quic-go/quic-go@v0.49.1
0.59.1

Open the chart page →

5,059
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
caddy/ingress:v0.2.118d1366fc0e9
github.com/quic-go/quic-go@v0.40.0
0.59.1

Open the chart page →

10,145
caddycaddyVerified publisher0.0.41 of 1See more

caddy caddy 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
library/caddy:2.11.2-alpine834468128c76
github.com/quic-go/quic-go@v0.59.0
0.59.1

Open the chart page →

1,677
caninecanine0.1.101 of 7See more

canine canine 0.1.10

1 of the 7 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
library/traefik:v3.7.16b9cbca6fac4
github.com/quic-go/quic-go@v0.59.0
0.59.1

Open the chart page →

14,130
traefikcanine40.2.01 of 1See more

traefik canine 40.2.0

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
library/traefik:v3.7.16b9cbca6fac4
github.com/quic-go/quic-go@v0.59.0
0.59.1

Open the chart page →

1,023
ranchercarbide-charts2.15.11 of 2See more

rancher carbide-charts 2.15.1

1 of the 2 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
rancher/rancher:v2.15.15f6c4dc52a05
github.com/quic-go/quic-go@v0.59.0
0.59.1

Open the chart page →

1,456
charon-relaycharonOfficialVerified publisher0.8.01 of 2See more

charon-relay charon 0.8.0

1 of the 2 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
obolnetwork/charon:v1.10.0278c7e2897b6
github.com/quic-go/quic-go@v0.59.0
0.59.1

Open the chart page →

4,396
dv-podcharonOfficialVerified publisher0.19.12 of 5See more

dv-pod charon 0.19.1

2 of the 5 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
obolnetwork/charon:v1.10.0278c7e2897b6
github.com/quic-go/quic-go@v0.59.0
0.59.1
obolnetwork/charon-dkg-sidecar:maine263be0a7440
github.com/quic-go/quic-go@v0.50.1
0.59.1

Open the chart page →

7,405
netbird-reverse-proxychristianhuthVerified publisher0.1.01 of 1See more

netbird-reverse-proxy christianhuth 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
netbirdio/reverse-proxy:0.72.43104d5ca3a76
github.com/quic-go/quic-go@v0.55.0
0.59.1

Open the chart page →

912
basechronicleVerified publisher0.0.81 of 1See more

base chronicle 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
ghcr.io/base-org/node:v0.11.11aba0ffe55ea
github.com/quic-go/quic-go@v0.46.0
0.59.1

Open the chart page →

4,810
spirechronicleVerified publisher0.3.61 of 1See more

spire chronicle 0.3.6

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
ghcr.io/chronicleprotocol/spire:0.68.379df4fb20322
github.com/quic-go/quic-go@v0.49.1
0.59.1

Open the chart page →

1,515
cosmo-traefikcosmoVerified publisher0.9.11 of 2See more

cosmo-traefik cosmo 0.9.1

1 of the 2 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
library/traefik:v2.10.11489caffaedb
github.com/quic-go/quic-go@v0.33.0
0.59.1

Open the chart page →

3,672
csi-driver-ipfscsi-driver-ipfs0.2.01 of 6See more

csi-driver-ipfs csi-driver-ipfs 0.2.0

1 of the 6 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
ghcr.io/ptrvsrg/csi-driver-ipfs:latest97d2d9ccd7a5
github.com/quic-go/quic-go@v0.59.0
0.59.1

Open the chart page →

3,629
ipfs-clustercsi-driver-ipfs0.2.02 of 2See more

ipfs-cluster csi-driver-ipfs 0.2.0

2 of the 2 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
ipfs/ipfs-cluster:v1.1.6a83266c524f1
github.com/quic-go/quic-go@v0.59.0
0.59.1
ipfs/kubo:v0.41.00661819c2e09
github.com/quic-go/quic-go@v0.59.0
0.59.1

Open the chart page →

1,475
cloudflareddamounVerified publisher3.3.01 of 1See more

cloudflared damoun 3.3.0

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
cloudflare/cloudflared:2024.5.05d5f70a59d5e
github.com/quic-go/quic-go@v0.42.0
0.59.1

Open the chart page →

1,306
dask-gatewaydask2026.3.01 of 2See more

dask-gateway dask 2026.3.0

1 of the 2 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
library/traefik:3.3.5104204dadedf
github.com/quic-go/quic-go@v0.48.2
0.59.1

Open the chart page →

1,994
uptime-kumadjjudas21Verified publisher1.5.181 of 1See more

uptime-kuma djjudas21 1.5.18

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.12bc6f244ecf27
github.com/quic-go/quic-go@v0.40.1-0.20240101045026-22b7f7744eb6
0.59.1

Open the chart page →

4,217
dnsmasq-k8sdnsmasq-k8s1.4.11 of 1See more

dnsmasq-k8s dnsmasq-k8s 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
deimosfr/dnsmasq-k8s:1.4.1284c4040fc6d
github.com/quic-go/quic-go@v0.57.1
0.59.1

Open the chart page →

3,032
corednsdoubanVerified publisher1.39.21 of 1See more

coredns douban 1.39.2

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
coredns/coredns:1.12.040384aa1f5ea
github.com/quic-go/quic-go@v0.48.1
0.59.1

Open the chart page →

1,132
service-proberdoubanVerified publisher0.1.01 of 1See more

service-prober douban 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
quay.io/prometheus/blackbox-exporter:v0.28.0e753ff9f3fc4
github.com/quic-go/quic-go@v0.57.1
0.59.1

Open the chart page →

594
iotaeclipse-aeriosVerified publisher1.0.21 of 4See more

iota eclipse-aerios 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
iotaledger/hornet:2.001206f1ba89c
github.com/quic-go/quic-go@v0.38.1
0.59.1

Open the chart page →

13,391
parrot-mirroremmas-chartsVerified publisher1.0.01 of 1See more

parrot-mirror emmas-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
registry.gitlab.com/parrotsec/project/parrot-mirror-docker:mainf91b602ca572
github.com/quic-go/quic-go@v0.37.5
0.59.1

Open the chart page →

2,237
armiarmaethereum-helm-chartsVerified publisher0.1.21 of 2See more

armiarma ethereum-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
ethpandaops/armiarma:master1a9c3264f0a9
github.com/quic-go/quic-go@v0.42.0
0.59.1

Open the chart page →

1,155
forkyethereum-helm-chartsVerified publisher0.2.01 of 1See more

forky ethereum-helm-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
ethpandaops/forky:debian-latestc937f4ba737c
github.com/quic-go/quic-go@v0.51.0
0.59.1

Open the chart page →

1,703
beeethersphereVerified publisher0.17.41 of 1See more

bee ethersphere 0.17.4

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
ethersphere/bee:2.2.0a884fd84b72f
github.com/quic-go/quic-go@v0.42.0
0.59.1

Open the chart page →

3,456
siyuanextrim-helm-chartsVerified publisher0.1.11 of 2See more

siyuan extrim-helm-charts 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
b3log/siyuan:v3.1.2595c0d129bc19
github.com/quic-go/quic-go@v0.50.0
0.59.1

Open the chart page →

1,247
gitlab-mr-conformgitlab-mr-conform0.5.21 of 1See more

gitlab-mr-conform gitlab-mr-conform 0.5.2

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
ghcr.io/chrxmvtik/gitlab-mr-conform:0.5.2b2eb79fc99cb
github.com/quic-go/quic-go@v0.59.0
0.59.1

Open the chart page →

428
traefikgpg-dev39.0.81 of 1See more

traefik gpg-dev 39.0.8

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
library/traefik:v3.6.1334d5089d0b41
github.com/quic-go/quic-go@v0.59.0
0.59.1

Open the chart page →

1,274
adguard-homehelm-chart-roeiVerified publisher0.107.591 of 2See more

adguard-home helm-chart-roei 0.107.59

1 of the 2 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
adguard/adguardhome:v0.107.595d5e3aef39a8
github.com/quic-go/quic-go@v0.49.0
0.59.1

Open the chart page →

761
hoppscotchhelm-charts-nr0.3.11 of 1See more

hoppscotch helm-charts-nr 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
github.com/quic-go/quic-go@v0.40.0
0.59.1

Open the chart page →

3,451
castopodhelmforgeVerified publisher1.2.71 of 3See more

castopod helmforge 1.2.7

1 of the 3 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
castopod/castopod:1.15.54e4f0440520f
github.com/quic-go/quic-go@v0.59.0
0.59.1

Open the chart page →

9,342
discount-bandithelmforgeVerified publisher2.0.81 of 3See more

discount-bandit helmforge 2.0.8

1 of the 3 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
cybrarist/discount-bandit:v4.0.4e9e2447ac666
github.com/quic-go/quic-go@v0.54.0
0.59.1

Open the chart page →

29,817
ryothelmforgeVerified publisher1.0.01 of 2See more

ryot helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
github.com/quic-go/quic-go@v0.48.2
0.59.1

Open the chart page →

6,012
hoppscotchhoppscotch0.1.11 of 1See more

hoppscotch hoppscotch 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.11.0538fe6ded4b6
github.com/quic-go/quic-go@v0.40.0
0.59.1

Open the chart page →

3,614
adguard-homejacobcolvinVerified publisher0.4.01 of 2See more

adguard-home jacobcolvin 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
adguard/adguardhome:v0.107.3843ec119419a9
github.com/quic-go/quic-go@v0.38.1
0.59.1

Open the chart page →

1,605
corednsjouveVerified publisher1.45.01 of 1See more

coredns jouve 1.45.0

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
coredns/coredns:1.13.19b9128672209
github.com/quic-go/quic-go@v0.55.0
0.59.1

Open the chart page →

887
kpingkpingOfficialVerified publisher0.3.51 of 1See more

kping kping 0.3.5

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
kayrosuno/kping:latestf3bd44b29b0d
github.com/quic-go/quic-go@v0.56.0
0.59.1

Open the chart page →

2,190
adguard-homekubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

adguard-home kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
adguard/adguardhome:v0.107.767157eb1dc3b2
github.com/quic-go/quic-go@v0.59.0
0.59.1

Open the chart page →

724
pocket-idkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 1See more

pocket-id kubernetes-homelab-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
ghcr.io/pocket-id/pocket-id:v2.7.045bdeaf3fcd6
github.com/quic-go/quic-go@v0.59.0
0.59.1

Open the chart page →

1,513
scrutinykubernetes-homelab-helm-chartsVerified publisher0.2.21 of 3See more

scrutiny kubernetes-homelab-helm-charts 0.2.2

1 of the 3 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
ghcr.io/analogj/scrutiny:v0.9.2-web71be54e99608
github.com/quic-go/quic-go@v0.59.0
0.59.1

Open the chart page →

5,500
syncthingkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 1See more

syncthing kubernetes-homelab-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
syncthing/syncthing:2.1.07c60eb0ec887
github.com/quic-go/quic-go@v0.59.0
0.59.1

Open the chart page →

1,310
easegresskubesphere-stable1.0.01 of 1See more

easegress kubesphere-stable 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
megaease/easegress:latestfad1c7452958
github.com/quic-go/quic-go@v0.40.1
0.59.1

Open the chart page →

1,308
edgemeshkubesphere-stable0.1.01 of 2See more

edgemesh kubesphere-stable 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
kubeedge/edgemesh-agent:latest460c6061b608
github.com/quic-go/quic-go@v0.33.0
0.59.1

Open the chart page →

4,096
pinglbenicio-communityVerified publisher0.1.11 of 1See more

ping lbenicio-community 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
quay.io/prometheus/blackbox-exporter:v0.28.0e753ff9f3fc4
github.com/quic-go/quic-go@v0.57.1
0.59.1

Open the chart page →

594
adguard-homelib42Verified publisher2.0.01 of 1See more

adguard-home lib42 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
adguard/adguardhome:v0.107.65d765078d2140
github.com/quic-go/quic-go@v0.53.0
0.59.1

Open the chart page →

1,060
otlp-gatewayloafoe0.0.21 of 2See more

otlp-gateway loafoe 0.0.2

1 of the 2 container images this version deploys carry CVE-2026-40898.

Container imageDigestPackageFixed in
ghcr.io/loafoe/caddy-token:v0.3.0528f2174fa2f
github.com/quic-go/quic-go@v0.44.0
0.59.1

Open the chart page →

2,155

Container images carrying it

120 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
github.com/quic-go/quic-go@v0.48.2
0.59.1
1
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
github.com/quic-go/quic-go@v0.46.0
0.59.1
1
ghcr.io/kite-org/kite:v0.15.14e4d09552f91
github.com/quic-go/quic-go@v0.59.0
0.59.1
1
ghcr.io/kubenetworks/kubevpn:v2.11.7cce8ff866f60
github.com/quic-go/quic-go@v0.50.1
0.59.1
1
ghcr.io/loafoe/caddy-token:v0.3.0528f2174fa2f
github.com/quic-go/quic-go@v0.44.0
0.59.1
1
ghcr.io/loafoe/solgate:v0.0.12b3256cbc7b68
github.com/quic-go/quic-go@v0.38.1
0.59.1
1
ghcr.io/mondu-ai/eks-pod-identity-webhook:latestc2ac3bad857d
github.com/quic-go/quic-go@v0.54.0
0.59.1
1
ghcr.io/okteto/okteto:3.22.0-beta.1e787b6bce27d
github.com/quic-go/quic-go@v0.59.0
0.59.1
1
ghcr.io/pocket-id/pocket-id:v2.7.045bdeaf3fcd6
github.com/quic-go/quic-go@v0.59.0
0.59.1
1
ghcr.io/ptrvsrg/csi-driver-ipfs:latest97d2d9ccd7a5
github.com/quic-go/quic-go@v0.59.0
0.59.1
1
ghcr.io/siafoundation/s3d:bf33bf3b3fcc85f7282
github.com/quic-go/quic-go@v0.59.0
0.59.1
1
ghcr.io/traefik/traefik-hub:v2.11.0322f5f8cc105
github.com/quic-go/quic-go@v0.39.0
0.59.1
1
ghcr.io/wasilak/go-hello-world:1.8.366d353e7693f
github.com/quic-go/quic-go@v0.57.1
0.59.1
1
public.ecr.aws/docker/library/caddy:2.6.387cbd356af2e
github.com/quic-go/quic-go@v0.32.0
0.59.1
1
quay.io/backube/volsync:0.16.00d03a6aad575
github.com/quic-go/quic-go@v0.52.0
0.59.1
1
quay.io/go-skynet/local-ai:latestd78cd113b2bc
github.com/quic-go/quic-go@v0.59.0
0.59.1
1
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
github.com/quic-go/quic-go@v0.58.0
0.59.1
1
registry.gitlab.com/parrotsec/project/parrot-mirror-docker:mainf91b602ca572
github.com/quic-go/quic-go@v0.37.5
0.59.1
1
registry.k8s.io/coredns/coredns:v1.13.294caebb89dcf
github.com/quic-go/quic-go@v0.57.0
0.59.1
1
registry.k8s.io/dns/k8s-dns-node-cache:1.26.78b9a78d101a1
github.com/quic-go/quic-go@v0.55.0
0.59.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.