StackRadar

CVE-2026-89090

Medium

Advisory

Published 8 Apr 2026In the index since 12 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.003
24th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
262
of 17,781 indexed, latest versions
Container images
246
deployed by those charts
Fix available
5 of 5
affected packages

Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder

Carried by container images the latest versions of 262 of 17,781 indexed charts deploy, on 246 images.

Affected packageAffected versionsFixed inImages
github.com/aws/aws-sdk-go-v2/service/s3golangv1.2.0, v1.5.0, v1.12.0, v1.16.0+73 more1.97.3220
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamgolangv1.0.0, v1.4.1, v1.4.4, v1.4.8+26 more1.7.8219
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogsgolangv1.5.2, v1.15.14, v1.15.17, v1.15.20+27 more1.65.064
github.com/aws/aws-sdk-go-v2/service/kinesisgolangv1.6.0, v1.15.13, v1.15.19, v1.15.20+21 more1.43.539
github.com/aws/aws-sdk-go-v2/service/lambdagolangv1.23.8, v1.24.6, v1.34.1, v1.35.0+14 more1.88.532
OSV records
GHSA-xmrv-pmrh-hhx2
Also known as
GO-2026-5764

Charts affected

262 by stars
ChartLatestAffected imagesRadar Score
beaconchain-explorerethereum-helm-chartsVerified publisher0.1.61 of 2See more

beaconchain-explorer ethereum-helm-charts 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
gobitfly/eth2-beaconchain-explorer:latest1d08a7986348
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.13
github.com/aws/aws-sdk-go-v2/service/s3@v1.38.5
1.7.8
1.97.3

Open the chart page →

3,048
file-manager-serverfile-manager-server1.11.01 of 1See more

file-manager-server file-manager-server 1.11.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
public.ecr.aws/cloudnatix/llmariner/file-manager-server:1.11.0301216788e93
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.2
1.7.8
1.97.3

Open the chart page →

763
memosgabe565Verified publisher0.17.01 of 1See more

memos gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/usememos/memos:0.24.04723d86e6797
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.8
github.com/aws/aws-sdk-go-v2/service/s3@v1.75.2
1.7.8
1.97.3

Open the chart page →

1,323
gateboardgateboard1.12.51 of 1See more

gateboard gateboard 1.12.5

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
udhos/gateboard:1.12.53acc0e7599bf
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.2
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.58.3
github.com/aws/aws-sdk-go-v2/service/lambda@v1.78.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.88.5
1.7.8
1.65.0
1.88.5
1.97.3

Open the chart page →

1,463
gateboard-discoverygateboard1.9.51 of 1See more

gateboard-discovery gateboard 1.9.5

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
udhos/gateboard-discovery:1.9.55567c9363c4c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.2
github.com/aws/aws-sdk-go-v2/service/lambda@v1.78.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.88.5
1.7.8
1.88.5
1.97.3

Open the chart page →

1,190
meta-monitoringgrafana1.3.01 of 2See more

meta-monitoring grafana 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
grafana/alloy:v1.4.306bdcbb51fc2
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.49.0
1.7.8
1.97.3

Open the chart page →

3,518
velerohelmforgeVerified publisher1.4.101 of 2See more

velero helmforge 1.4.10

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
velero/velero-plugin-for-aws:v1.14.07e82f717f44e
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.5.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.48.0
1.7.8
1.97.3

Open the chart page →

1,420
webhook-broker-chartimytech0.2.41 of 1See more

webhook-broker-chart imytech 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
public.ecr.aws/optimizely/webhook-broker:v0.2.3cfc92cc2de65
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.3
1.7.8
1.97.3

Open the chart page →

1,246
irsa-managerirsa-managerVerified publisher0.3.21 of 1See more

irsa-manager irsa-manager 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/kkb0318/irsa-manager:0.3.296d600ae97b4
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.2
1.7.8
1.97.3

Open the chart page →

820
job-manager-dispatcherjob-manager-dispatcher1.27.01 of 1See more

job-manager-dispatcher job-manager-dispatcher 1.27.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
public.ecr.aws/cloudnatix/llmariner/job-manager-dispatcher:1.27.0582508903cb0
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.2
1.7.8
1.97.3

Open the chart page →

472
job-manager-serverjob-manager-server1.27.01 of 1See more

job-manager-server job-manager-server 1.27.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
public.ecr.aws/cloudnatix/llmariner/job-manager-server:1.27.0fe9de719f91e
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.2
1.7.8
1.97.3

Open the chart page →

750
todo-appjunktext-direct1.1.41 of 1See more

todo-app junktext-direct 1.1.4

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
junktext/getting-started:1.0.5a70936c04aed
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.21.2
github.com/aws/aws-sdk-go-v2/service/lambda@v1.37.0
1.7.8
1.65.0
1.88.5

Open the chart page →

3,369
k8s-grafana-stackk8s-grafana-stackVerified publisher0.2.323 of 17See more

k8s-grafana-stack k8s-grafana-stack 0.2.32

3 of the 17 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
grafana/alloy:v1.14.0f50931848bd8
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.61.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.0
1.7.8
1.65.0
1.97.3
grafana/grafana:12.3.12175aaa91c96
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.11
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.84.0
1.7.8
1.65.0
1.97.3
grafana/loki:3.6.73c8fd3570dd9
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.3
1.7.8
1.97.3

Open the chart page →

15,418
authz-pdplabs64io-helm-chartsVerified publisher0.6.01 of 1See more

authz-pdp labs64io-helm-charts 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/cerbos/cerbos:0.51.08d35a64e4a99
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.95.1
1.7.8
1.97.3

Open the chart page →

800
lagoon-remotelagoon-chartsVerified publisher0.106.01 of 1See more

lagoon-remote lagoon-charts 0.106.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
uselagoon/docker-host:v3.6.12c89ed939b8b
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.3
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.32.0
1.7.8
1.65.0

Open the chart page →

2,113
linkerd-jaegerlinkerd2-edgeVerified publisher30.14.11-edge1 of 4See more

linkerd-jaeger linkerd2-edge 30.14.11-edge

1 of the 4 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.83.071fcef33ae71
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.12
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.18.2
github.com/aws/aws-sdk-go-v2/service/s3@v1.31.0
1.7.8
1.43.5
1.97.3

Open the chart page →

4,389
model-manager-loadermodel-manager-loader1.27.01 of 1See more

model-manager-loader model-manager-loader 1.27.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
public.ecr.aws/cloudnatix/llmariner/model-manager-loader:1.27.026ac7263a823
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.2
1.7.8
1.97.3

Open the chart page →

2,680
transfer.shobeoneVerified publisher1.0.51 of 1See more

transfer.sh obeone 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
dutchcoders/transfer.sh:v1.6.1-noroot8db9ade72a0d
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.33.1
1.7.8
1.97.3

Open the chart page →

1,171
prometheus-sql-exporterprometheus-communityVerified publisher0.5.01 of 1See more

prometheus-sql-exporter prometheus-community 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/justwatchcom/sql_exporter:v0.8c4b1d3d0f052
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.2
github.com/aws/aws-sdk-go-v2/service/s3@v1.53.1
1.7.8
1.97.3

Open the chart page →

1,199
rclonercloneVerified publisher2.2.01 of 1See more

rclone rclone 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
rclone/rclone:1.6874c51b8817e5
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.3
1.7.8
1.97.3

Open the chart page →

1,672
backup-repository-serverriotkit-org4.0.01 of 1See more

backup-repository-server riotkit-org 4.0.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/riotkit-org/backup-repository:v4.0.0ab41ffa78f69
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.3
1.7.8
1.97.3

Open the chart page →

2,049
artifact-hubsoftonic1.19.04 of 8See more

artifact-hub softonic 1.19.0

4 of the 8 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
aquasec/trivy:0.43.1944a04445179
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.8
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.15.20
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.15.19
github.com/aws/aws-sdk-go-v2/service/lambda@v1.24.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.27.11
1.7.8
1.65.0
1.43.5
1.88.5
1.97.3
artifacthub/hub:v1.19.0111918d8c399
github.com/aws/aws-sdk-go-v2/service/s3@v1.54.2
1.97.3
artifacthub/scanner:v1.19.0323d026e78c3
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.1
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.30.1
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.24.6
github.com/aws/aws-sdk-go-v2/service/lambda@v1.49.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.54.2
1.7.8
1.65.0
1.43.5
1.88.5
1.97.3
artifacthub/tracker:v1.19.06596c8c4d955
github.com/aws/aws-sdk-go-v2/service/s3@v1.54.2
1.97.3

Open the chart page →

14,491
sp-otel-collectorsp-otel-collectorVerified publisher1.1.61 of 1See more

sp-otel-collector sp-otel-collector 1.1.6

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
quay.io/geored/spmm-collector-contrib:1.0.063baf86a49ac
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.17.14
github.com/aws/aws-sdk-go-v2/service/s3@v1.31.0
1.7.8
1.43.5
1.97.3

Open the chart page →

2,022
stackradar-scannerstackradarVerified publisher0.3.01 of 1See more

stackradar-scanner stackradar 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/lockdep/stackradar-scanner:0.3.0dd8a35d50c2d
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.95.0
1.7.8
1.97.3

Open the chart page →

1,209
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
darthsim/imgproxy:v3.30.13b709e4a0e5e
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.88.1
1.7.8
1.97.3

Open the chart page →

18,075
upbot-operatorupbot-operator0.0.201 of 2See more

upbot-operator upbot-operator 0.0.20

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
alpine/k8s:1.28.13e5c0b053fed7
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.2
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.35.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.55.1
1.7.8
1.65.0
1.97.3

Open the chart page →

4,460
user-manager-serveruser-manager-server1.27.11 of 1See more

user-manager-server user-manager-server 1.27.1

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
public.ecr.aws/cloudnatix/llmariner/user-manager-server:1.27.1628a14449241
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.2
1.7.8
1.97.3

Open the chart page →

750
vault-gcp-secretsvault-gcp-secrets1.19.51 of 1See more

vault-gcp-secrets vault-gcp-secrets 1.19.5

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/tjm/vault-gcp-secrets:v1.19.59f157fe035f1
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.2
github.com/aws/aws-sdk-go-v2/service/s3@v1.53.1
1.7.8
1.97.3

Open the chart page →

2,289
popeyeadnoctemVerified publisher0.3.01 of 1See more

popeye adnoctem 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
derailed/popeye:v0.22.18e68e22c7663
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.8
github.com/aws/aws-sdk-go-v2/service/s3@v1.74.1
1.7.8
1.97.3

Open the chart page →

1,196
aerospike-backup-serviceaerospike-helmVerified publisher2.0.131 of 1See more

aerospike-backup-service aerospike-helm 2.0.13

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
aerospike/aerospike-backup-service:3.5.1be40d709c583
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.4
1.7.8
1.97.3

Open the chart page →

628
akto-aws-api-gateway-connectorakto0.1.11 of 1See more

akto-aws-api-gateway-connector akto 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
aktosecurity/mirror-api-logging:api-gateway-logging-multi-logging1a1bc76d50fe
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.45.5
1.7.8
1.65.0

Open the chart page →

413
api-gateway-loggingakto0.1.21 of 1See more

api-gateway-logging akto 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
aktosecurity/mirror-api-logging:api-gateway-logging-openapi12ed2544756f
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.45.5
1.7.8
1.65.0

Open the chart page →

413
versitygwalpineworks0.1.21 of 1See more

versitygw alpineworks 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
versity/versitygw:v1.0.145192635d0353
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.79.4
1.7.8
1.97.3

Open the chart page →

1,114
versitygw-webhook-pulsar-proxyalpineworks0.1.11 of 1See more

versitygw-webhook-pulsar-proxy alpineworks 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/alpineworks/versitygw-webhook-pulsar-proxy:v1.0.06e9ced773732
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.79.4
1.7.8
1.97.3

Open the chart page →

893
amorphieamorphie0.1.21 of 18See more

amorphie amorphie 0.1.2

1 of the 18 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.26b4e5dadf082
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.31.0
1.7.8
1.97.3

Open the chart page →

28,131
ddosifyanteonVerified publisher1.7.51 of 13See more

ddosify anteon 1.7.5

1 of the 13 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
library/influxdb:2.6.1-alpine44a366dd7724
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.0.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.19.0
1.7.8
1.97.3

Open the chart page →

25,669
accounts-uiappscodeVerified publisher2026.9.111 of 1See more

accounts-ui appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.72.2
1.7.8
1.97.3

Open the chart page →

2,592
aceappscodeVerified publisher2026.9.111 of 2See more

ace appscode 2026.9.11

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.72.2
1.7.8
1.97.3

Open the chart page →

2,894
ace-installerappscodeVerified publisher2026.9.111 of 2See more

ace-installer appscode 2026.9.11

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.72.2
1.7.8
1.97.3

Open the chart page →

3,225
ace-installer-certifiedappscodeVerified publisher2026.9.111 of 2See more

ace-installer-certified appscode 2026.9.11

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.72.2
1.7.8
1.97.3

Open the chart page →

3,225
billingappscodeVerified publisher2026.9.111 of 1See more

billing appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.72.2
1.7.8
1.97.3

Open the chart page →

2,592
cluster-importerappscodeVerified publisher2026.9.111 of 1See more

cluster-importer appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/ace:v0.2.0b8e03da90e70
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.97.3

Open the chart page →

999
kubedb-provider-awsappscodeVerified publisher2026.7.101 of 1See more

kubedb-provider-aws appscode 2026.7.10

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/kubedb/provider-aws:v0.27.049b1c312e342
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.20.11
github.com/aws/aws-sdk-go-v2/service/lambda@v1.34.1
1.7.8
1.65.0
1.88.5

Open the chart page →

2,527
kubeform-provider-awsappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-aws appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-aws:v0.0.1e3d1f1302e49
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.20.11
github.com/aws/aws-sdk-go-v2/service/lambda@v1.34.1
1.7.8
1.65.0
1.88.5

Open the chart page →

2,796
license-proxyserverappscodeVerified publisher2026.2.161 of 1See more

license-proxyserver appscode 2026.2.16

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/license-proxyserver:v0.1.1e192ad567e0b
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.97.3

Open the chart page →

1,106
license-proxyserver-managerappscodeVerified publisher2026.2.161 of 1See more

license-proxyserver-manager appscode 2026.2.16

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/license-proxyserver:v0.1.1e192ad567e0b
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.97.3

Open the chart page →

1,106
marketplace-apiappscodeVerified publisher2026.9.111 of 1See more

marketplace-api appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.72.2
1.7.8
1.97.3

Open the chart page →

2,592
offline-license-serverappscodeVerified publisher2026.9.111 of 2See more

offline-license-server appscode 2026.9.11

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/offline-license-server:v0.0.76e4b66308d8f6
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.97.3

Open the chart page →

1,681
platform-apiappscodeVerified publisher2026.9.111 of 3See more

platform-api appscode 2026.9.11

1 of the 3 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.72.2
1.7.8
1.97.3

Open the chart page →

37,268
platform-linksappscodeVerified publisher2026.9.111 of 1See more

platform-links appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/appscode/fileserver:v0.0.2b1857871e06c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.51.4
1.7.8
1.97.3

Open the chart page →

771

Container images carrying it

246 by charts deploying them

A fixed version is listed for 5 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.72.2
1.7.8
1.97.3
7
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.4
1.7.8
1.97.3
7
quay.io/devtron/kubectl:latest2ad610626658
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.10
1.7.8
1.97.3
6
grafana/loki:3.6.73c8fd3570dd9
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.3
1.7.8
1.97.3
4
derailed/popeye:v0.22.18e68e22c7663
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.8
github.com/aws/aws-sdk-go-v2/service/s3@v1.74.1
1.7.8
1.97.3
3
ethpandaops/tracoor:latestd8514b9f4c59
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.5.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.48.1
1.7.8
1.97.3
3
ghcr.io/dexidp/dex:v2.45.18499afd690c4
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.95.1
1.7.8
1.97.3
3
public.ecr.aws/zinclabs/zinc:latestfefa9ee7256a
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.30.1
1.7.8
1.97.3
3
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.79.4
1.7.8
1.97.3
3
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.79.4
1.7.8
1.97.3
3
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.15.20
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.15.19
github.com/aws/aws-sdk-go-v2/service/lambda@v1.24.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.33.1
1.7.8
1.65.0
1.43.5
1.88.5
1.97.3
3
alpine/k8s:1.32.12048f8d9c8cc7
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.63.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.0
1.7.8
1.65.0
1.97.3
2
bitnamilegacy/influxdb:2.6.1-debian-11-r18d17df1f9d745
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.0.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.19.0
1.7.8
1.97.3
2
falcosecurity/falco-driver-loader:0.33.11fe583eee4af
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.8
github.com/aws/aws-sdk-go-v2/service/s3@v1.27.11
1.7.8
1.97.3
2
falcosecurity/falco-no-driver:0.33.10d427b8d5fc6
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.8
github.com/aws/aws-sdk-go-v2/service/s3@v1.27.11
1.7.8
1.97.3
2
grafana/alloy:v1.8.17790f6f7fbd8
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.46.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.65.0
1.97.3
2
grafana/alloy:v1.12.2f94b1c82957a
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.2
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.58.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.89.0
1.7.8
1.65.0
1.97.3
2
grafana/grafana:12.3.12175aaa91c96
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.11
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.84.0
1.7.8
1.65.0
1.97.3
2
grafana/grafana:12.3.39e1e77ade304
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.11
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.84.0
1.7.8
1.65.0
1.97.3
2
grafana/grafana:12.4.1e932bd6ed0e0
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.11
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.84.0
1.7.8
1.65.0
1.97.3
2
hashicorp/vault:1.8.34db614d40d0e
github.com/aws/aws-sdk-go-v2/service/s3@v1.5.0
1.97.3
2
hashicorp/vault:1.15.26b4e5dadf082
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.31.0
1.7.8
1.97.3
2
hashicorp/vault:1.12.18de4d5f31b38
github.com/aws/aws-sdk-go-v2/service/s3@v1.12.0
1.97.3
2
library/influxdb:2.6.1-alpine44a366dd7724
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.0.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.19.0
1.7.8
1.97.3
2
library/influxdb:2.7b8d940ca9376
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.2
github.com/aws/aws-sdk-go-v2/service/s3@v1.54.4
1.7.8
1.97.3
2
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.1
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.27.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.31.0
1.7.8
1.43.5
1.97.3
2
rclone/rclone:1.6874c51b8817e5
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.3
1.7.8
1.97.3
2
uselagoon/docker-host:v3.6.12c89ed939b8b
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.3
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.32.0
1.7.8
1.65.0
2
ghcr.io/appscode/license-proxyserver:v0.1.1e192ad567e0b
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.97.3
2
ghcr.io/celestiaorg/celestia-node:v0.27.5-mocha4768ea1c5fd2
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.88.1
1.7.8
1.97.3
2
ghcr.io/nucleuscloud/neosync/api:0.5.41e2abb798f29f
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.29.3
github.com/aws/aws-sdk-go-v2/service/lambda@v1.56.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.43.5
1.88.5
1.97.3
2
ghcr.io/nucleuscloud/neosync/worker:0.5.4196f42450c5b1
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.29.3
github.com/aws/aws-sdk-go-v2/service/lambda@v1.56.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.43.5
1.88.5
1.97.3
2
public.ecr.aws/cloudnatix/llmariner/file-manager-server:1.11.0301216788e93
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.2
1.7.8
1.97.3
2
public.ecr.aws/cloudnatix/llmariner/job-manager-dispatcher:1.27.0582508903cb0
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.2
1.7.8
1.97.3
2
public.ecr.aws/cloudnatix/llmariner/job-manager-server:1.27.0fe9de719f91e
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.2
1.7.8
1.97.3
2
public.ecr.aws/cloudnatix/llmariner/model-manager-loader:1.27.026ac7263a823
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.2
1.7.8
1.97.3
2
public.ecr.aws/cloudnatix/llmariner/user-manager-server:1.27.1628a14449241
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.2
1.7.8
1.97.3
2
aerospike/aerospike-backup-service:3.5.1be40d709c583
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.4
1.7.8
1.97.3
1
aktosecurity/mirror-api-logging:api-gateway-logging-openapi12ed2544756f
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.45.5
1.7.8
1.65.0
1
aktosecurity/mirror-api-logging:api-gateway-logging-multi-logging1a1bc76d50fe
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.45.5
1.7.8
1.65.0
1
alpine/k8s:1.27.321b24e6bf801
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.20.11
1.65.0
1
alpine/k8s:1.36.244ef4942e171
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.6
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.64.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.93.2
1.7.8
1.65.0
1.97.3
1
alpine/k8s:1.31.106dbe6f391eda
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.50.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.77.1
1.7.8
1.65.0
1.97.3
1
alpine/k8s:1.31.137a319b15cfc9
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.56.2
github.com/aws/aws-sdk-go-v2/service/s3@v1.79.2
1.7.8
1.65.0
1.97.3
1
alpine/k8s:1.32.47e1e7d5b7a96
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.47.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.77.1
1.7.8
1.65.0
1.97.3
1
alpine/k8s:1.31.49c4976d47656
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.45.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.70.0
1.7.8
1.65.0
1.97.3
1
alpine/k8s:1.35.6b7a12c5ddf26
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.6
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.64.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.93.2
1.7.8
1.65.0
1.97.3
1
alpine/k8s:1.30.0bd01dae02676
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.14
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.33.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.40.1
1.7.8
1.65.0
1.97.3
1
alpine/k8s:1.30.2cd560fce90f7
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.2
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.35.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.55.1
1.7.8
1.65.0
1.97.3
1
alpine/k8s:1.35.5d870622d0040
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.6
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.64.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.93.2
1.7.8
1.65.0
1.97.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.