StackRadar

CVE-2026-89090

Medium

Advisory

Published 8 Apr 2026In the index since 12 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.003
24th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
262
of 17,781 indexed, latest versions
Container images
246
deployed by those charts
Fix available
5 of 5
affected packages

Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder

Carried by container images the latest versions of 262 of 17,781 indexed charts deploy, on 246 images.

Affected packageAffected versionsFixed inImages
github.com/aws/aws-sdk-go-v2/service/s3golangv1.2.0, v1.5.0, v1.12.0, v1.16.0+73 more1.97.3220
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamgolangv1.0.0, v1.4.1, v1.4.4, v1.4.8+26 more1.7.8219
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogsgolangv1.5.2, v1.15.14, v1.15.17, v1.15.20+27 more1.65.064
github.com/aws/aws-sdk-go-v2/service/kinesisgolangv1.6.0, v1.15.13, v1.15.19, v1.15.20+21 more1.43.539
github.com/aws/aws-sdk-go-v2/service/lambdagolangv1.23.8, v1.24.6, v1.34.1, v1.35.0+14 more1.88.532
OSV records
GHSA-xmrv-pmrh-hhx2
Also known as
GO-2026-5764

Charts affected

262 by stars
ChartLatestAffected imagesRadar Score
beaconchain-explorerethereum-helm-chartsVerified publisher0.1.61 of 2See more

beaconchain-explorer ethereum-helm-charts 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
gobitfly/eth2-beaconchain-explorer:latest1d08a7986348
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.13
github.com/aws/aws-sdk-go-v2/service/s3@v1.38.5
1.7.8
1.97.3

Open the chart page →

3,048
file-manager-serverfile-manager-server1.11.01 of 1See more

file-manager-server file-manager-server 1.11.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
public.ecr.aws/cloudnatix/llmariner/file-manager-server:1.11.0301216788e93
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.2
1.7.8
1.97.3

Open the chart page →

763
memosgabe565Verified publisher0.17.01 of 1See more

memos gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/usememos/memos:0.24.04723d86e6797
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.8
github.com/aws/aws-sdk-go-v2/service/s3@v1.75.2
1.7.8
1.97.3

Open the chart page →

1,323
gateboardgateboard1.12.51 of 1See more

gateboard gateboard 1.12.5

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
udhos/gateboard:1.12.53acc0e7599bf
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.2
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.58.3
github.com/aws/aws-sdk-go-v2/service/lambda@v1.78.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.88.5
1.7.8
1.65.0
1.88.5
1.97.3

Open the chart page →

1,463
gateboard-discoverygateboard1.9.51 of 1See more

gateboard-discovery gateboard 1.9.5

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
udhos/gateboard-discovery:1.9.55567c9363c4c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.2
github.com/aws/aws-sdk-go-v2/service/lambda@v1.78.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.88.5
1.7.8
1.88.5
1.97.3

Open the chart page →

1,190
meta-monitoringgrafana1.3.01 of 2See more

meta-monitoring grafana 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
grafana/alloy:v1.4.306bdcbb51fc2
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.49.0
1.7.8
1.97.3

Open the chart page →

3,518
velerohelmforgeVerified publisher1.4.101 of 2See more

velero helmforge 1.4.10

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
velero/velero-plugin-for-aws:v1.14.07e82f717f44e
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.5.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.48.0
1.7.8
1.97.3

Open the chart page →

1,420
webhook-broker-chartimytech0.2.41 of 1See more

webhook-broker-chart imytech 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
public.ecr.aws/optimizely/webhook-broker:v0.2.3cfc92cc2de65
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.3
1.7.8
1.97.3

Open the chart page →

1,246
irsa-managerirsa-managerVerified publisher0.3.21 of 1See more

irsa-manager irsa-manager 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/kkb0318/irsa-manager:0.3.296d600ae97b4
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.2
1.7.8
1.97.3

Open the chart page →

820
job-manager-dispatcherjob-manager-dispatcher1.27.01 of 1See more

job-manager-dispatcher job-manager-dispatcher 1.27.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
public.ecr.aws/cloudnatix/llmariner/job-manager-dispatcher:1.27.0582508903cb0
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.2
1.7.8
1.97.3

Open the chart page →

472
job-manager-serverjob-manager-server1.27.01 of 1See more

job-manager-server job-manager-server 1.27.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
public.ecr.aws/cloudnatix/llmariner/job-manager-server:1.27.0fe9de719f91e
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.2
1.7.8
1.97.3

Open the chart page →

750
todo-appjunktext-direct1.1.41 of 1See more

todo-app junktext-direct 1.1.4

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
junktext/getting-started:1.0.5a70936c04aed
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.21.2
github.com/aws/aws-sdk-go-v2/service/lambda@v1.37.0
1.7.8
1.65.0
1.88.5

Open the chart page →

3,369
k8s-grafana-stackk8s-grafana-stackVerified publisher0.2.323 of 17See more

k8s-grafana-stack k8s-grafana-stack 0.2.32

3 of the 17 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
grafana/alloy:v1.14.0f50931848bd8
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.61.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.0
1.7.8
1.65.0
1.97.3
grafana/grafana:12.3.12175aaa91c96
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.11
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.84.0
1.7.8
1.65.0
1.97.3
grafana/loki:3.6.73c8fd3570dd9
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.3
1.7.8
1.97.3

Open the chart page →

15,418
authz-pdplabs64io-helm-chartsVerified publisher0.6.01 of 1See more

authz-pdp labs64io-helm-charts 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/cerbos/cerbos:0.51.08d35a64e4a99
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.95.1
1.7.8
1.97.3

Open the chart page →

800
lagoon-remotelagoon-chartsVerified publisher0.106.01 of 1See more

lagoon-remote lagoon-charts 0.106.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
uselagoon/docker-host:v3.6.12c89ed939b8b
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.3
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.32.0
1.7.8
1.65.0

Open the chart page →

2,113
linkerd-jaegerlinkerd2-edgeVerified publisher30.14.11-edge1 of 4See more

linkerd-jaeger linkerd2-edge 30.14.11-edge

1 of the 4 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.83.071fcef33ae71
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.12
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.18.2
github.com/aws/aws-sdk-go-v2/service/s3@v1.31.0
1.7.8
1.43.5
1.97.3

Open the chart page →

4,389
model-manager-loadermodel-manager-loader1.27.01 of 1See more

model-manager-loader model-manager-loader 1.27.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
public.ecr.aws/cloudnatix/llmariner/model-manager-loader:1.27.026ac7263a823
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.2
1.7.8
1.97.3

Open the chart page →

2,680
transfer.shobeoneVerified publisher1.0.51 of 1See more

transfer.sh obeone 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
dutchcoders/transfer.sh:v1.6.1-noroot8db9ade72a0d
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.33.1
1.7.8
1.97.3

Open the chart page →

1,171
prometheus-sql-exporterprometheus-communityVerified publisher0.5.01 of 1See more

prometheus-sql-exporter prometheus-community 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/justwatchcom/sql_exporter:v0.8c4b1d3d0f052
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.2
github.com/aws/aws-sdk-go-v2/service/s3@v1.53.1
1.7.8
1.97.3

Open the chart page →

1,199
rclonercloneVerified publisher2.2.01 of 1See more

rclone rclone 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
rclone/rclone:1.6874c51b8817e5
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.3
1.7.8
1.97.3

Open the chart page →

1,672
backup-repository-serverriotkit-org4.0.01 of 1See more

backup-repository-server riotkit-org 4.0.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/riotkit-org/backup-repository:v4.0.0ab41ffa78f69
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.3
1.7.8
1.97.3

Open the chart page →

2,049
artifact-hubsoftonic1.19.04 of 8See more

artifact-hub softonic 1.19.0

4 of the 8 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
aquasec/trivy:0.43.1944a04445179
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.8
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.15.20
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.15.19
github.com/aws/aws-sdk-go-v2/service/lambda@v1.24.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.27.11
1.7.8
1.65.0
1.43.5
1.88.5
1.97.3
artifacthub/hub:v1.19.0111918d8c399
github.com/aws/aws-sdk-go-v2/service/s3@v1.54.2
1.97.3
artifacthub/scanner:v1.19.0323d026e78c3
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.1
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.30.1
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.24.6
github.com/aws/aws-sdk-go-v2/service/lambda@v1.49.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.54.2
1.7.8
1.65.0
1.43.5
1.88.5
1.97.3
artifacthub/tracker:v1.19.06596c8c4d955
github.com/aws/aws-sdk-go-v2/service/s3@v1.54.2
1.97.3

Open the chart page →

14,491
sp-otel-collectorsp-otel-collectorVerified publisher1.1.61 of 1See more

sp-otel-collector sp-otel-collector 1.1.6

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
quay.io/geored/spmm-collector-contrib:1.0.063baf86a49ac
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.17.14
github.com/aws/aws-sdk-go-v2/service/s3@v1.31.0
1.7.8
1.43.5
1.97.3

Open the chart page →

2,022
stackradar-scannerstackradarVerified publisher0.3.01 of 1See more

stackradar-scanner stackradar 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/lockdep/stackradar-scanner:0.3.0dd8a35d50c2d
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.95.0
1.7.8
1.97.3

Open the chart page →

1,209
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
darthsim/imgproxy:v3.30.13b709e4a0e5e
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.88.1
1.7.8
1.97.3

Open the chart page →

18,075
upbot-operatorupbot-operator0.0.201 of 2See more

upbot-operator upbot-operator 0.0.20

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
alpine/k8s:1.28.13e5c0b053fed7
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.2
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.35.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.55.1
1.7.8
1.65.0
1.97.3

Open the chart page →

4,460
user-manager-serveruser-manager-server1.27.11 of 1See more

user-manager-server user-manager-server 1.27.1

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
public.ecr.aws/cloudnatix/llmariner/user-manager-server:1.27.1628a14449241
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.2
1.7.8
1.97.3

Open the chart page →

750
vault-gcp-secretsvault-gcp-secrets1.19.51 of 1See more

vault-gcp-secrets vault-gcp-secrets 1.19.5

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/tjm/vault-gcp-secrets:v1.19.59f157fe035f1
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.2
github.com/aws/aws-sdk-go-v2/service/s3@v1.53.1
1.7.8
1.97.3

Open the chart page →

2,289
popeyeadnoctemVerified publisher0.3.01 of 1See more

popeye adnoctem 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
derailed/popeye:v0.22.18e68e22c7663
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.8
github.com/aws/aws-sdk-go-v2/service/s3@v1.74.1
1.7.8
1.97.3

Open the chart page →

1,196
aerospike-backup-serviceaerospike-helmVerified publisher2.0.131 of 1See more

aerospike-backup-service aerospike-helm 2.0.13

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
aerospike/aerospike-backup-service:3.5.1be40d709c583
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.4
1.7.8
1.97.3

Open the chart page →

628
akto-aws-api-gateway-connectorakto0.1.11 of 1See more

akto-aws-api-gateway-connector akto 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
aktosecurity/mirror-api-logging:api-gateway-logging-multi-logging1a1bc76d50fe
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.45.5
1.7.8
1.65.0

Open the chart page →

413
api-gateway-loggingakto0.1.21 of 1See more

api-gateway-logging akto 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
aktosecurity/mirror-api-logging:api-gateway-logging-openapi12ed2544756f
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.45.5
1.7.8
1.65.0

Open the chart page →

413
versitygwalpineworks0.1.21 of 1See more

versitygw alpineworks 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
versity/versitygw:v1.0.145192635d0353
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.79.4
1.7.8
1.97.3

Open the chart page →

1,114
versitygw-webhook-pulsar-proxyalpineworks0.1.11 of 1See more

versitygw-webhook-pulsar-proxy alpineworks 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/alpineworks/versitygw-webhook-pulsar-proxy:v1.0.06e9ced773732
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.79.4
1.7.8
1.97.3

Open the chart page →

893
amorphieamorphie0.1.21 of 18See more

amorphie amorphie 0.1.2

1 of the 18 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.26b4e5dadf082
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.31.0
1.7.8
1.97.3

Open the chart page →

28,131
ddosifyanteonVerified publisher1.7.51 of 13See more

ddosify anteon 1.7.5

1 of the 13 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
library/influxdb:2.6.1-alpine44a366dd7724
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.0.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.19.0
1.7.8
1.97.3

Open the chart page →

25,669
accounts-uiappscodeVerified publisher2026.9.111 of 1See more

accounts-ui appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.72.2
1.7.8
1.97.3

Open the chart page →

2,592
aceappscodeVerified publisher2026.9.111 of 2See more

ace appscode 2026.9.11

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.72.2
1.7.8
1.97.3

Open the chart page →

2,894
ace-installerappscodeVerified publisher2026.9.111 of 2See more

ace-installer appscode 2026.9.11

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.72.2
1.7.8
1.97.3

Open the chart page →

3,225
ace-installer-certifiedappscodeVerified publisher2026.9.111 of 2See more

ace-installer-certified appscode 2026.9.11

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.72.2
1.7.8
1.97.3

Open the chart page →

3,225
billingappscodeVerified publisher2026.9.111 of 1See more

billing appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.72.2
1.7.8
1.97.3

Open the chart page →

2,592
cluster-importerappscodeVerified publisher2026.9.111 of 1See more

cluster-importer appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/ace:v0.2.0b8e03da90e70
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.97.3

Open the chart page →

999
kubedb-provider-awsappscodeVerified publisher2026.7.101 of 1See more

kubedb-provider-aws appscode 2026.7.10

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/kubedb/provider-aws:v0.27.049b1c312e342
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.20.11
github.com/aws/aws-sdk-go-v2/service/lambda@v1.34.1
1.7.8
1.65.0
1.88.5

Open the chart page →

2,527
kubeform-provider-awsappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-aws appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-aws:v0.0.1e3d1f1302e49
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.20.11
github.com/aws/aws-sdk-go-v2/service/lambda@v1.34.1
1.7.8
1.65.0
1.88.5

Open the chart page →

2,796
license-proxyserverappscodeVerified publisher2026.2.161 of 1See more

license-proxyserver appscode 2026.2.16

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/license-proxyserver:v0.1.1e192ad567e0b
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.97.3

Open the chart page →

1,106
license-proxyserver-managerappscodeVerified publisher2026.2.161 of 1See more

license-proxyserver-manager appscode 2026.2.16

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/license-proxyserver:v0.1.1e192ad567e0b
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.97.3

Open the chart page →

1,106
marketplace-apiappscodeVerified publisher2026.9.111 of 1See more

marketplace-api appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.72.2
1.7.8
1.97.3

Open the chart page →

2,592
offline-license-serverappscodeVerified publisher2026.9.111 of 2See more

offline-license-server appscode 2026.9.11

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/offline-license-server:v0.0.76e4b66308d8f6
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.97.3

Open the chart page →

1,681
platform-apiappscodeVerified publisher2026.9.111 of 3See more

platform-api appscode 2026.9.11

1 of the 3 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.72.2
1.7.8
1.97.3

Open the chart page →

37,268
platform-linksappscodeVerified publisher2026.9.111 of 1See more

platform-links appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/fileserver:v0.0.2b1857871e06c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.51.4
1.7.8
1.97.3

Open the chart page →

771

Container images carrying it

246 by charts deploying them

A fixed version is listed for 5 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/dexidp/dex:v2.37.0f579d00721b0
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.10
1.7.8
1.97.3
1
ghcr.io/digitalis-io/vals-operator:v0.8.17c776499b8c9
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.0
1.7.8
1.97.3
1
ghcr.io/ethpandaops/benchmarkoor:latest5470b2ec3161
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.0
1.7.8
1.97.3
1
ghcr.io/formancehq/dex:v1.0.4b803fbe1cdb8
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.10
1.7.8
1.97.3
1
ghcr.io/helmfile/helmfile:v1.7.4f20e612d5a98
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.79.2
1.7.8
1.97.3
1
ghcr.io/imgproxy/imgproxy:v3.30.074c1bee92e04
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.88.1
1.7.8
1.97.3
1
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.5.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.47.2
1.7.8
1.97.3
1
ghcr.io/justwatchcom/sql_exporter:v0.8c4b1d3d0f052
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.2
github.com/aws/aws-sdk-go-v2/service/s3@v1.53.1
1.7.8
1.97.3
1
ghcr.io/kedacore/keda:2.16.002348a19aeae
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.6
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.32.3
1.7.8
1.43.5
1
ghcr.io/kedacore/keda:2.17.0112fc427d933
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.33.2
1.7.8
1.43.5
1
ghcr.io/kedacore/keda:2.17.272dc058e478d
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.33.2
1.7.8
1.43.5
1
ghcr.io/kedacore/keda-metrics-apiserver:2.17.0167fd532bd43
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.33.2
1.7.8
1.43.5
1
ghcr.io/kedacore/keda-metrics-apiserver:2.16.073a2ebae4413
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.6
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.32.3
1.7.8
1.43.5
1
ghcr.io/kedacore/keda-metrics-apiserver:2.17.2f312f50ddc57
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.33.2
1.7.8
1.43.5
1
ghcr.io/kgma74/dockyard:0.4.0b40439329191
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.2
1.97.3
1
ghcr.io/kkb0318/irsa-manager:0.3.296d600ae97b4
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.2
1.7.8
1.97.3
1
ghcr.io/kubedb/provider-aws:v0.27.049b1c312e342
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.20.11
github.com/aws/aws-sdk-go-v2/service/lambda@v1.34.1
1.7.8
1.65.0
1.88.5
1
ghcr.io/kubeform/provider-aws:v0.0.1e3d1f1302e49
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.20.11
github.com/aws/aws-sdk-go-v2/service/lambda@v1.34.1
1.7.8
1.65.0
1.88.5
1
ghcr.io/lockdep/stackradar-scanner:0.3.0dd8a35d50c2d
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.95.0
1.7.8
1.97.3
1
ghcr.io/loft-sh/devpod-pro:0.0.0-ci.4-do-not-use5dfa86b6451f
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.15.17
1.65.0
1
ghcr.io/loft-sh/vcluster-control-plane:0.0.0-ci.4-do-not-use45e744fc623f
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.15.17
1.65.0
1
ghcr.io/loft-sh/vcluster-platform:4.12.0ef92da4621e6
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.97.1
1.7.8
1.97.3
1
ghcr.io/m9sweeper/trawler:1.6.0df917c5a7e54
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.14
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.23.5
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.18.5
github.com/aws/aws-sdk-go-v2/service/lambda@v1.39.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.40.2
1.7.8
1.65.0
1.43.5
1.88.5
1.97.3
1
ghcr.io/manzil-infinity180/deploydefender:ea3ab0bb646cdbeddd1aca483ecf650f9ac0d0847fbc6855c8b3
github.com/aws/aws-sdk-go-v2/service/s3@v1.59.0
1.97.3
1
ghcr.io/openconfig/gnmic:0.45.0d422a9ebd4a2
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.10
1.7.8
1.97.3
1
ghcr.io/openlit/openlit:1.24.02434560e8f0e
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.3
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.61.0
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.42.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.92.0
1.7.8
1.65.0
1.43.5
1.97.3
1
ghcr.io/pipe-cd/pipecd:v0.39.00fae829caf29
github.com/aws/aws-sdk-go-v2/service/s3@v1.2.0
1.97.3
1
ghcr.io/qjoly/spindle:v1.16.1-alphaaab0c99d313f
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.97.1
1.7.8
1.97.3
1
ghcr.io/riotkit-org/backup-repository:v4.0.0ab41ffa78f69
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.3
1.7.8
1.97.3
1
ghcr.io/runatlantis/atlantis:v0.47.1511231955463
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.97.1
1.7.8
1.97.3
1
ghcr.io/shaharia-lab/teredix:0.0.2ec727be4417a
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.5.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.47.7
1.7.8
1.97.3
1
ghcr.io/siderolabs/talos-backup:v0.1.0-beta.203a71e140f1d
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.60.1
1.7.8
1.97.3
1
ghcr.io/streamingfast/go-ethereum:geth-v1.16.9-fh3.08e3cb38953a3
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.71.0
1.7.8
1.97.3
1
ghcr.io/tjm/vault-gcp-secrets:v1.19.59f157fe035f1
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.2
github.com/aws/aws-sdk-go-v2/service/s3@v1.53.1
1.7.8
1.97.3
1
ghcr.io/usememos/memos:0.24.04723d86e6797
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.8
github.com/aws/aws-sdk-go-v2/service/s3@v1.75.2
1.7.8
1.97.3
1
ghcr.io/warpstreamlabs/bento:1.8.121715979aefa
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.6
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.24.7
github.com/aws/aws-sdk-go-v2/service/lambda@v1.50.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.53.1
1.7.8
1.43.5
1.88.5
1.97.3
1
public.ecr.aws/aws-observability/aws-otel-collector:v0.43.38aa9ea5f67b8
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.71.1
1.7.8
1.97.3
1
public.ecr.aws/boundless-software/switchblade:release-v0.0.19-lcm01d8413d5075
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.1
github.com/aws/aws-sdk-go-v2/service/lambda@v1.53.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.53.0
1.7.8
1.88.5
1.97.3
1
public.ecr.aws/groundcovercom/temporalio/server:1.29.6-mini-20260702-170f191d0a80e
github.com/aws/aws-sdk-go-v2/service/lambda@v1.88.0
1.88.5
1
public.ecr.aws/optimizely/webhook-broker:v0.2.3cfc92cc2de65
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.3
1.7.8
1.97.3
1
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.31.0
1.7.8
1.97.3
1
quay.io/geored/spmm-collector-contrib:1.0.063baf86a49ac
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.17.14
github.com/aws/aws-sdk-go-v2/service/s3@v1.31.0
1.7.8
1.43.5
1.97.3
1
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.8
github.com/aws/aws-sdk-go-v2/service/s3@v1.75.3
1.7.8
1.97.3
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.0
1.7.8
1.97.3
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.0
1.7.8
1.97.3
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.97.1
1.7.8
1.97.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.