StackRadar

CVE-2026-89090

Medium

Advisory

Published 8 Apr 2026In the index since 12 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.003
24th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
262
of 17,781 indexed, latest versions
Container images
246
deployed by those charts
Fix available
5 of 5
affected packages

Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder

Carried by container images the latest versions of 262 of 17,781 indexed charts deploy, on 246 images.

Affected packageAffected versionsFixed inImages
github.com/aws/aws-sdk-go-v2/service/s3golangv1.2.0, v1.5.0, v1.12.0, v1.16.0+73 more1.97.3220
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamgolangv1.0.0, v1.4.1, v1.4.4, v1.4.8+26 more1.7.8219
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogsgolangv1.5.2, v1.15.14, v1.15.17, v1.15.20+27 more1.65.064
github.com/aws/aws-sdk-go-v2/service/kinesisgolangv1.6.0, v1.15.13, v1.15.19, v1.15.20+21 more1.43.539
github.com/aws/aws-sdk-go-v2/service/lambdagolangv1.23.8, v1.24.6, v1.34.1, v1.35.0+14 more1.88.532
OSV records
GHSA-xmrv-pmrh-hhx2
Also known as
GO-2026-5764

Charts affected

262 by stars
ChartLatestAffected imagesRadar Score
argocdargo-helm-charts1.0.01 of 3See more

argocd argo-helm-charts 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.42.18186d6dd81f4
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.71.0
1.7.8
1.97.3

Open the chart page →

7,300
argonix-apiargonix0.2.01 of 4See more

argonix-api argonix 0.2.0

1 of the 4 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/argonix-io/argonix-api:1.0.068e17a8aaa40
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.51.4
1.7.8
1.97.3

Open the chart page →

4,923
celestia-localastria9.0.02 of 2See more

celestia-local astria 9.0.0

2 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-app:v6.1.0-rc0a604aefa3fae
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.88.3
1.7.8
1.97.3
ghcr.io/celestiaorg/celestia-node:v0.27.5-mocha4768ea1c5fd2
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.88.1
1.7.8
1.97.3

Open the chart page →

3,281
celestia-nodeastria0.7.11 of 1See more

celestia-node astria 0.7.1

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-node:v0.27.5-mocha4768ea1c5fd2
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.88.1
1.7.8
1.97.3

Open the chart page →

1,502
firehoseblip-firehoseVerified publisher0.0.181 of 11See more

firehose blip-firehose 0.0.18

1 of the 11 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.26b4e5dadf082
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.31.0
1.7.8
1.97.3

Open the chart page →

13,459
pyroscopebook-k8sinfra-v21.10.01 of 3See more

pyroscope book-k8sinfra-v2 1.10.0

1 of the 3 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
grafana/alloy:v1.1.1c3dac4e26471
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.49.0
1.7.8
1.97.3

Open the chart page →

3,244
accelerationbuttahtoastVerified publisher0.1.01 of 1See more

acceleration buttahtoast 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
goharbor/harbor-acceld:0.2.13451103a6c8d8
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.30.6
1.7.8
1.97.3

Open the chart page →

1,400
catalyst-agentscatalyst-agents0.1.301 of 18See more

catalyst-agents catalyst-agents 0.1.30

1 of the 18 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
alpine/k8s:1.32.3eec354133193
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.45.14
github.com/aws/aws-sdk-go-v2/service/s3@v1.70.0
1.7.8
1.65.0
1.97.3

Open the chart page →

15,027
arbitrumchronicleVerified publisher0.3.41 of 1See more

arbitrum chronicle 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
offchainlabs/nitro-node:v3.7.6-c0fe95e9f779fa84b7b
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.64.1
1.7.8
1.97.3

Open the chart page →

6,998
goferchronicleVerified publisher0.4.41 of 1See more

gofer chronicle 0.4.4

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/chronicleprotocol/gofer:0.613915d2e41e04
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.51.4
1.7.8
1.97.3

Open the chart page →

721
cp4d-deployercloud-native-toolkit1.0.01 of 1See more

cp4d-deployer cloud-native-toolkit 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.31.0
1.7.8
1.97.3

Open the chart page →

25,151
ocs-operatorcloud-native-toolkit0.2.41 of 1See more

ocs-operator cloud-native-toolkit 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.4
1.7.8
1.97.3

Open the chart page →

369
refarch-infraconfigcloud-native-toolkit0.2.21 of 1See more

refarch-infraconfig cloud-native-toolkit 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.4
1.7.8
1.97.3

Open the chart page →

369
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad1 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

1 of the 6 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/formancehq/dex:v1.0.4b803fbe1cdb8
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.10
1.7.8
1.97.3

Open the chart page →

18,293
monitoringcluster-deploy0.3.02 of 11See more

monitoring cluster-deploy 0.3.0

2 of the 11 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
grafana/grafana:12.4.1e932bd6ed0e0
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.11
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.84.0
1.7.8
1.65.0
1.97.3
grafana/loki:3.6.73c8fd3570dd9
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.3
1.7.8
1.97.3

Open the chart page →

8,183
door-agentcnoVerified publisher3.0.151 of 15See more

door-agent cno 3.0.15

1 of the 15 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
library/docker:27-dindaa3df78ecf32
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.5.4
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.32.0
1.7.8
1.65.0

Open the chart page →

19,338
containers-security-chartscontainers-security0.1.02 of 7See more

containers-security-charts containers-security 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
falcosecurity/falco-driver-loader:0.33.11fe583eee4af
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.8
github.com/aws/aws-sdk-go-v2/service/s3@v1.27.11
1.7.8
1.97.3
falcosecurity/falco-no-driver:0.33.10d427b8d5fc6
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.8
github.com/aws/aws-sdk-go-v2/service/s3@v1.27.11
1.7.8
1.97.3

Open the chart page →

9,146
falcocontainers-security2.4.62 of 2See more

falco containers-security 2.4.6

2 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
falcosecurity/falco-driver-loader:0.33.11fe583eee4af
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.8
github.com/aws/aws-sdk-go-v2/service/s3@v1.27.11
1.7.8
1.97.3
falcosecurity/falco-no-driver:0.33.10d427b8d5fc6
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.8
github.com/aws/aws-sdk-go-v2/service/s3@v1.27.11
1.7.8
1.97.3

Open the chart page →

2,540
electric-mailcryptexlabsVerified publisher0.0.11 of 5See more

electric-mail cryptexlabs 0.0.1

1 of the 5 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
hashicorp/vault:1.8.34db614d40d0e
github.com/aws/aws-sdk-go-v2/service/s3@v1.5.0
1.97.3

Open the chart page →

5,973
purple-piecryptexlabsVerified publisher0.0.11 of 4See more

purple-pie cryptexlabs 0.0.1

1 of the 4 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
hashicorp/vault:1.8.34db614d40d0e
github.com/aws/aws-sdk-go-v2/service/s3@v1.5.0
1.97.3

Open the chart page →

5,973
csghubcsghubVerified publisher2.4.34 of 34See more

csghub csghub 2.4.3

4 of the 34 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
casbin/casdoor:3.62.0e08231f16c00
github.com/aws/aws-sdk-go-v2/service/s3@v1.95.0
1.97.3
opencsghq/gitlab-gitaly:v17.5.0bdd2c58b9744
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.1
1.7.8
1.97.3
opencsghq/gitlab-shell:v17.5.0f6d7e7d6be5d
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.10
1.7.8
1.97.3
temporalio/auto-setup:1.29.7f14912b699cf
github.com/aws/aws-sdk-go-v2/service/lambda@v1.88.0
1.88.5

Open the chart page →

58,897
csgshipcsghubVerified publisher0.4.61 of 10See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
casbin/casdoor:3.62.17729da148c61
github.com/aws/aws-sdk-go-v2/service/s3@v1.95.0
1.97.3

Open the chart page →

11,335
custom-rhcl-consolecustom-rhcl-consoleVerified publisher0.1.21 of 3See more

custom-rhcl-console custom-rhcl-console 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.4
1.7.8
1.97.3

Open the chart page →

1,885
cw-container-insightcwci0.7.01 of 1See more

cw-container-insight cwci 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
amazon/cloudwatch-agent:latest-arm649dea6643715a
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.46.0
1.7.8
1.65.0

Open the chart page →

274
dapr-agentsdapr-agents-devVerified publisher0.1.53 of 31See more

dapr-agents dapr-agents-dev 0.1.5

3 of the 31 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
grafana/grafana:12.3.39e1e77ade304
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.11
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.84.0
1.7.8
1.65.0
1.97.3
grafana/loki:3.6.5847c287ada0e
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.3
1.7.8
1.97.3
otel/opentelemetry-collector-contrib:0.145.0a7343f018690
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.63.1
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.42.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.95.1
1.7.8
1.65.0
1.43.5
1.97.3

Open the chart page →

22,193
garage-webuideimosfr-charts1.1.01 of 1See more

garage-webui deimosfr-charts 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
khairul169/garage-webui:1.1.017c793551873
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.59.0
1.7.8
1.97.3

Open the chart page →

567
devtron-enterprisedevtron48.0.03 of 28See more

devtron-enterprise devtron 48.0.0

3 of the 28 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.79.4
1.7.8
1.97.3
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.15.20
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.15.19
github.com/aws/aws-sdk-go-v2/service/lambda@v1.24.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.33.1
1.7.8
1.65.0
1.43.5
1.88.5
1.97.3
quay.io/devtron/kubectl:latest2ad610626658
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.10
1.7.8
1.97.3

Open the chart page →

68,240
zincdevtron0.1.21 of 1See more

zinc devtron 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
public.ecr.aws/zinclabs/zinc:latestfefa9ee7256a
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.30.1
1.7.8
1.97.3

Open the chart page →

1,507
devtron-enterprisedevtron-labs48.0.03 of 28See more

devtron-enterprise devtron-labs 48.0.0

3 of the 28 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.79.4
1.7.8
1.97.3
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.15.20
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.15.19
github.com/aws/aws-sdk-go-v2/service/lambda@v1.24.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.33.1
1.7.8
1.65.0
1.43.5
1.88.5
1.97.3
quay.io/devtron/kubectl:latest2ad610626658
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.10
1.7.8
1.97.3

Open the chart page →

68,240
devtron-operatordevtron-labs0.23.32 of 11See more

devtron-operator devtron-labs 0.23.3

2 of the 11 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.79.4
1.7.8
1.97.3
quay.io/devtron/kubectl:latest2ad610626658
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.10
1.7.8
1.97.3

Open the chart page →

32,902
zincdevtron-labs0.1.21 of 1See more

zinc devtron-labs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
public.ecr.aws/zinclabs/zinc:latestfefa9ee7256a
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.30.1
1.7.8
1.97.3

Open the chart page →

1,507
k8s-crondoubanVerified publisher0.2.01 of 1See more

k8s-cron douban 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
alpine/k8s:1.28.2fc059f056ad0
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.24.0
1.65.0

Open the chart page →

3,659
arbitrumdysnixVerified publisher0.1.11 of 1See more

arbitrum dysnix 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
offchainlabs/nitro-node:v3.1.0-7d1d84ce95865866129
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.9
1.7.8
1.97.3

Open the chart page →

9,244
kube-ecp-stackemqx-operator2.5.11 of 16See more

kube-ecp-stack emqx-operator 2.5.1

1 of the 16 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
library/telegraf:1.27507a3eecf809
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.12
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.20.9
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.18.2
github.com/aws/aws-sdk-go-v2/service/s3@v1.35.0
1.7.8
1.65.0
1.43.5
1.97.3

Open the chart page →

23,685
benchmarkoor-apiethereum-helm-chartsVerified publisher0.1.01 of 1See more

benchmarkoor-api ethereum-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/ethpandaops/benchmarkoor:latest5470b2ec3161
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.0
1.7.8
1.97.3

Open the chart page →

899
forkyethereum-helm-chartsVerified publisher0.2.01 of 1See more

forky ethereum-helm-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ethpandaops/forky:debian-latestc937f4ba737c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.33.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.43.5
1.97.3

Open the chart page →

1,703
tracoor-agentethereum-helm-chartsVerified publisher0.0.11 of 1See more

tracoor-agent ethereum-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ethpandaops/tracoor:latestd8514b9f4c59
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.5.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.48.1
1.7.8
1.97.3

Open the chart page →

905
tracoor-serverethereum-helm-chartsVerified publisher0.0.21 of 1See more

tracoor-server ethereum-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ethpandaops/tracoor:latestd8514b9f4c59
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.5.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.48.1
1.7.8
1.97.3

Open the chart page →

905
tracoor-singleethereum-helm-chartsVerified publisher0.0.51 of 2See more

tracoor-single ethereum-helm-charts 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ethpandaops/tracoor:latestd8514b9f4c59
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.5.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.48.1
1.7.8
1.97.3

Open the chart page →

905
siyuanextrim-helm-chartsVerified publisher0.1.11 of 2See more

siyuan extrim-helm-charts 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
b3log/siyuan:v3.1.2595c0d129bc19
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.97.3

Open the chart page →

1,247
fairwinds-insightsfairwinds-stableVerified publisher10.1.102 of 13See more

fairwinds-insights fairwinds-stable 10.1.10

2 of the 13 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.31.2dbc5fcd6ee8f
github.com/aws/aws-sdk-go-v2/service/lambda@v1.88.0
1.88.5
temporalio/server:1.31.2b5ecdb8282be
github.com/aws/aws-sdk-go-v2/service/lambda@v1.88.0
1.88.5

Open the chart page →

3,797
farm-observabilityfarm-observabilityOfficialVerified publisher0.27.23 of 18See more

farm-observability farm-observability 0.27.2

3 of the 18 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
grafana/alloy:v1.12.2f94b1c82957a
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.2
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.58.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.89.0
1.7.8
1.65.0
1.97.3
grafana/grafana:13.0.1-security-012d1f9ae67c17
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.3
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.89.2
1.7.8
1.65.0
1.97.3
grafana/loki:3.6.73c8fd3570dd9
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.3
1.7.8
1.97.3

Open the chart page →

13,255
apm-hubflanksourceVerified publisher0.0.471 of 2See more

apm-hub flanksource 0.0.47

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
flanksource/apm-hub:v0.0.471dacc3195bf9
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.20.11
github.com/aws/aws-sdk-go-v2/service/s3@v1.33.1
1.7.8
1.65.0
1.97.3

Open the chart page →

6,078
batchrunnerflanksourceVerified publisher1.0.441 of 1See more

batchrunner flanksource 1.0.44

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
flanksource/batch-runner:v1.0.44689687a7cf95
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.2
github.com/aws/aws-sdk-go-v2/service/s3@v1.79.2
1.7.8
1.97.3

Open the chart page →

5,292
forwardforward1.3.11 of 1See more

forward forward 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
udhos/forward:1.1.312e120d39fdb
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/lambda@v1.35.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.33.1
1.7.8
1.88.5
1.97.3

Open the chart page →

2,212
glassflow-etlglassflowVerified publisher0.5.211 of 16See more

glassflow-etl glassflow 0.5.21

1 of the 16 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.108.0923eb1cfae32
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.4
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.29.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.53.1
1.7.8
1.43.5
1.97.3

Open the chart page →

12,056
gnp-stackgnp-stack0.0.52 of 14See more

gnp-stack gnp-stack 0.0.5

2 of the 14 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
grafana/grafana:12.2.135c41e0fd029
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.11
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.65.0
1.97.3
ghcr.io/openconfig/gnmic:0.45.0d422a9ebd4a2
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.10
1.7.8
1.97.3

Open the chart page →

7,659
harborgpg-dev1.18.31 of 8See more

harbor gpg-dev 1.18.3

1 of the 8 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.14.35c6f7162804c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.92.0
1.7.8
1.97.3

Open the chart page →

3,376
kube-prometheus-stackgpg-dev84.0.01 of 6See more

kube-prometheus-stack gpg-dev 84.0.0

1 of the 6 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
grafana/grafana:13.0.10f86bada30d6
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.3
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.89.2
1.7.8
1.65.0
1.97.3

Open the chart page →

4,288
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.114.037fa87091cfa
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.6
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.32.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.66.3
1.7.8
1.43.5
1.97.3

Open the chart page →

49,025

Container images carrying it

246 by charts deploying them

A fixed version is listed for 5 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
alpine/k8s:1.28.13e5c0b053fed7
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.2
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.35.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.55.1
1.7.8
1.65.0
1.97.3
1
alpine/k8s:1.32.3eec354133193
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.45.14
github.com/aws/aws-sdk-go-v2/service/s3@v1.70.0
1.7.8
1.65.0
1.97.3
1
alpine/k8s:1.28.2fc059f056ad0
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.24.0
1.65.0
1
amazon/cloudwatch-agent:latest-arm649dea6643715a
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.46.0
1.7.8
1.65.0
1
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.80.1
1.7.8
1.97.3
1
aquasec/harbor-scanner-trivy:0.31.26e790e233872
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.2
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.30.1
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.24.6
github.com/aws/aws-sdk-go-v2/service/lambda@v1.49.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.53.1
1.7.8
1.65.0
1.43.5
1.88.5
1.97.3
1
aquasec/trivy:0.43.1944a04445179
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.8
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.15.20
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.15.19
github.com/aws/aws-sdk-go-v2/service/lambda@v1.24.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.27.11
1.7.8
1.65.0
1.43.5
1.88.5
1.97.3
1
aquasec/trivy:0.32.0973d0df16189
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.4
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.15.14
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.15.13
github.com/aws/aws-sdk-go-v2/service/lambda@v1.23.8
github.com/aws/aws-sdk-go-v2/service/s3@v1.27.5
1.7.8
1.65.0
1.43.5
1.88.5
1.97.3
1
aquasec/trivy:0.69.3bcc376de8d77
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.92.0
1.7.8
1.97.3
1
artifacthub/hub:v1.19.0111918d8c399
github.com/aws/aws-sdk-go-v2/service/s3@v1.54.2
1.97.3
1
artifacthub/scanner:v1.23.02d8365601f0e
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.92.0
1.7.8
1.97.3
1
artifacthub/scanner:v1.19.0323d026e78c3
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.1
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.30.1
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.24.6
github.com/aws/aws-sdk-go-v2/service/lambda@v1.49.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.54.2
1.7.8
1.65.0
1.43.5
1.88.5
1.97.3
1
artifacthub/tracker:v1.19.06596c8c4d955
github.com/aws/aws-sdk-go-v2/service/s3@v1.54.2
1.97.3
1
b3log/siyuan:v3.1.2595c0d129bc19
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.97.3
1
bitnami/mongodb-exporter:latestf7034c13af4e
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.95.1
1.7.8
1.97.3
1
burningalchemist/sql_exporter:0.16.0b8e4757c7def
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.2
github.com/aws/aws-sdk-go-v2/service/s3@v1.53.1
1.7.8
1.97.3
1
bytesafe/bytesafe-ce:v1.0.4ee287384c005
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.33.1
1.7.8
1.97.3
1
casbin/casdoor:3.62.17729da148c61
github.com/aws/aws-sdk-go-v2/service/s3@v1.95.0
1.97.3
1
casbin/casdoor:3.62.0e08231f16c00
github.com/aws/aws-sdk-go-v2/service/s3@v1.95.0
1.97.3
1
darthsim/imgproxy:v3.30.13b709e4a0e5e
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.88.1
1.7.8
1.97.3
1
darthsim/imgproxy:v3.26476cb08c816a
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.66.1
1.7.8
1.97.3
1
darthsim/imgproxy:v3.29.17d12c7c8fc66
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.11
github.com/aws/aws-sdk-go-v2/service/s3@v1.83.0
1.7.8
1.97.3
1
devopstales/trivy-operator:2.575136aa7a26e
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.8
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.15.20
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.15.19
github.com/aws/aws-sdk-go-v2/service/lambda@v1.24.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.27.11
1.7.8
1.65.0
1.43.5
1.88.5
1.97.3
1
dexidp/dex:v2.39.1-distroless43655afd1a8f
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.10
1.7.8
1.97.3
1
dutchcoders/transfer.sh:v1.6.1-noroot8db9ade72a0d
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.33.1
1.7.8
1.97.3
1
ethpandaops/forky:debian-latestc937f4ba737c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.33.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.43.5
1.97.3
1
falcosecurity/falcosidekick:2.32.01976da721518
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.1
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.47.3
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.35.4
github.com/aws/aws-sdk-go-v2/service/lambda@v1.77.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.88.0
1.7.8
1.65.0
1.43.5
1.88.5
1.97.3
1
flanksource/apm-hub:v0.0.471dacc3195bf9
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.20.11
github.com/aws/aws-sdk-go-v2/service/s3@v1.33.1
1.7.8
1.65.0
1.97.3
1
flanksource/batch-runner:v1.0.44689687a7cf95
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.2
github.com/aws/aws-sdk-go-v2/service/s3@v1.79.2
1.7.8
1.97.3
1
gitea/act_runner:0.2.11-dind-rootless6120b1165f3a
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.5.4
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.32.0
1.7.8
1.65.0
1
gobitfly/eth2-beaconchain-explorer:latest1d08a7986348
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.13
github.com/aws/aws-sdk-go-v2/service/s3@v1.38.5
1.7.8
1.97.3
1
goharbor/harbor-acceld:0.2.13451103a6c8d8
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.30.6
1.7.8
1.97.3
1
goharbor/trivy-adapter-photon:v2.14.35c6f7162804c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.92.0
1.7.8
1.97.3
1
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.8
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.15.20
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.15.19
github.com/aws/aws-sdk-go-v2/service/lambda@v1.24.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.27.11
1.7.8
1.65.0
1.43.5
1.88.5
1.97.3
1
grafana/agent:v0.44.23364714a2f64
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.49.0
1.7.8
1.97.3
1
grafana/agent:v0.40.3f6cbec9409be
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.49.0
1.7.8
1.97.3
1
grafana/alloy:v1.5.101a63f4e032c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.49.0
1.7.8
1.97.3
1
grafana/alloy:v1.4.306bdcbb51fc2
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.49.0
1.7.8
1.97.3
1
grafana/alloy:v1.11.38c7256f412fe
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.1
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.54.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.87.3
1.7.8
1.65.0
1.97.3
1
grafana/alloy:v1.1.1c3dac4e26471
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.49.0
1.7.8
1.97.3
1
grafana/alloy:v1.14.0f50931848bd8
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.61.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.0
1.7.8
1.65.0
1.97.3
1
grafana/grafana:13.0.10f86bada30d6
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.3
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.89.2
1.7.8
1.65.0
1.97.3
1
grafana/grafana:13.0.1-security-012d1f9ae67c17
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.3
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.89.2
1.7.8
1.65.0
1.97.3
1
grafana/grafana:12.2.22ebef928d7e5
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.11
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.65.0
1.97.3
1
grafana/grafana:12.2.135c41e0fd029
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.11
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.65.0
1.97.3
1
grafana/grafana:11.5.15781759b3d27
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.3
1.7.8
1.97.3
1
grafana/grafana:11.6.062d2b9d20a19
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.3
1.7.8
1.97.3
1
grafana/grafana:12.3.070d9599b186c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.11
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.84.0
1.7.8
1.65.0
1.97.3
1
grafana/grafana:12.2.074144189b384
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.11
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.65.0
1.97.3
1
grafana/grafana:11.5.28b37a2f028f1
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.3
1.7.8
1.97.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.