StackRadar

CVE-2026-89090

Medium

Advisory

Published 8 Apr 2026In the index since 12 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.003
24th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
262
of 17,781 indexed, latest versions
Container images
246
deployed by those charts
Fix available
5 of 5
affected packages

Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder

Carried by container images the latest versions of 262 of 17,781 indexed charts deploy, on 246 images.

Affected packageAffected versionsFixed inImages
github.com/aws/aws-sdk-go-v2/service/s3golangv1.2.0, v1.5.0, v1.12.0, v1.16.0+73 more1.97.3220
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamgolangv1.0.0, v1.4.1, v1.4.4, v1.4.8+26 more1.7.8219
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogsgolangv1.5.2, v1.15.14, v1.15.17, v1.15.20+27 more1.65.064
github.com/aws/aws-sdk-go-v2/service/kinesisgolangv1.6.0, v1.15.13, v1.15.19, v1.15.20+21 more1.43.539
github.com/aws/aws-sdk-go-v2/service/lambdagolangv1.23.8, v1.24.6, v1.34.1, v1.35.0+14 more1.88.532
OSV records
GHSA-xmrv-pmrh-hhx2
Also known as
GO-2026-5764

Charts affected

262 by stars
ChartLatestAffected imagesRadar Score
argocdargo-helm-charts1.0.01 of 3See more

argocd argo-helm-charts 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.42.18186d6dd81f4
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.71.0
1.7.8
1.97.3

Open the chart page →

7,300
argonix-apiargonix0.2.01 of 4See more

argonix-api argonix 0.2.0

1 of the 4 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/argonix-io/argonix-api:1.0.068e17a8aaa40
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.51.4
1.7.8
1.97.3

Open the chart page →

4,923
celestia-localastria9.0.02 of 2See more

celestia-local astria 9.0.0

2 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-app:v6.1.0-rc0a604aefa3fae
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.88.3
1.7.8
1.97.3
ghcr.io/celestiaorg/celestia-node:v0.27.5-mocha4768ea1c5fd2
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.88.1
1.7.8
1.97.3

Open the chart page →

3,281
celestia-nodeastria0.7.11 of 1See more

celestia-node astria 0.7.1

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-node:v0.27.5-mocha4768ea1c5fd2
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.88.1
1.7.8
1.97.3

Open the chart page →

1,502
firehoseblip-firehoseVerified publisher0.0.181 of 11See more

firehose blip-firehose 0.0.18

1 of the 11 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.26b4e5dadf082
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.31.0
1.7.8
1.97.3

Open the chart page →

13,459
pyroscopebook-k8sinfra-v21.10.01 of 3See more

pyroscope book-k8sinfra-v2 1.10.0

1 of the 3 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
grafana/alloy:v1.1.1c3dac4e26471
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.49.0
1.7.8
1.97.3

Open the chart page →

3,244
accelerationbuttahtoastVerified publisher0.1.01 of 1See more

acceleration buttahtoast 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
goharbor/harbor-acceld:0.2.13451103a6c8d8
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.30.6
1.7.8
1.97.3

Open the chart page →

1,400
catalyst-agentscatalyst-agents0.1.301 of 18See more

catalyst-agents catalyst-agents 0.1.30

1 of the 18 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
alpine/k8s:1.32.3eec354133193
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.45.14
github.com/aws/aws-sdk-go-v2/service/s3@v1.70.0
1.7.8
1.65.0
1.97.3

Open the chart page →

15,027
arbitrumchronicleVerified publisher0.3.41 of 1See more

arbitrum chronicle 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
offchainlabs/nitro-node:v3.7.6-c0fe95e9f779fa84b7b
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.64.1
1.7.8
1.97.3

Open the chart page →

6,998
goferchronicleVerified publisher0.4.41 of 1See more

gofer chronicle 0.4.4

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/chronicleprotocol/gofer:0.613915d2e41e04
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.51.4
1.7.8
1.97.3

Open the chart page →

721
cp4d-deployercloud-native-toolkit1.0.01 of 1See more

cp4d-deployer cloud-native-toolkit 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.31.0
1.7.8
1.97.3

Open the chart page →

25,151
ocs-operatorcloud-native-toolkit0.2.41 of 1See more

ocs-operator cloud-native-toolkit 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.4
1.7.8
1.97.3

Open the chart page →

369
refarch-infraconfigcloud-native-toolkit0.2.21 of 1See more

refarch-infraconfig cloud-native-toolkit 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.4
1.7.8
1.97.3

Open the chart page →

369
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad1 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

1 of the 6 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/formancehq/dex:v1.0.4b803fbe1cdb8
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.10
1.7.8
1.97.3

Open the chart page →

18,293
monitoringcluster-deploy0.3.02 of 11See more

monitoring cluster-deploy 0.3.0

2 of the 11 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
grafana/grafana:12.4.1e932bd6ed0e0
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.11
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.84.0
1.7.8
1.65.0
1.97.3
grafana/loki:3.6.73c8fd3570dd9
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.3
1.7.8
1.97.3

Open the chart page →

8,183
door-agentcnoVerified publisher3.0.151 of 15See more

door-agent cno 3.0.15

1 of the 15 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
library/docker:27-dindaa3df78ecf32
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.5.4
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.32.0
1.7.8
1.65.0

Open the chart page →

19,338
containers-security-chartscontainers-security0.1.02 of 7See more

containers-security-charts containers-security 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
falcosecurity/falco-driver-loader:0.33.11fe583eee4af
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.8
github.com/aws/aws-sdk-go-v2/service/s3@v1.27.11
1.7.8
1.97.3
falcosecurity/falco-no-driver:0.33.10d427b8d5fc6
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.8
github.com/aws/aws-sdk-go-v2/service/s3@v1.27.11
1.7.8
1.97.3

Open the chart page →

9,146
falcocontainers-security2.4.62 of 2See more

falco containers-security 2.4.6

2 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
falcosecurity/falco-driver-loader:0.33.11fe583eee4af
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.8
github.com/aws/aws-sdk-go-v2/service/s3@v1.27.11
1.7.8
1.97.3
falcosecurity/falco-no-driver:0.33.10d427b8d5fc6
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.8
github.com/aws/aws-sdk-go-v2/service/s3@v1.27.11
1.7.8
1.97.3

Open the chart page →

2,540
electric-mailcryptexlabsVerified publisher0.0.11 of 5See more

electric-mail cryptexlabs 0.0.1

1 of the 5 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
hashicorp/vault:1.8.34db614d40d0e
github.com/aws/aws-sdk-go-v2/service/s3@v1.5.0
1.97.3

Open the chart page →

5,973
purple-piecryptexlabsVerified publisher0.0.11 of 4See more

purple-pie cryptexlabs 0.0.1

1 of the 4 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
hashicorp/vault:1.8.34db614d40d0e
github.com/aws/aws-sdk-go-v2/service/s3@v1.5.0
1.97.3

Open the chart page →

5,973
csghubcsghubVerified publisher2.4.34 of 34See more

csghub csghub 2.4.3

4 of the 34 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
casbin/casdoor:3.62.0e08231f16c00
github.com/aws/aws-sdk-go-v2/service/s3@v1.95.0
1.97.3
opencsghq/gitlab-gitaly:v17.5.0bdd2c58b9744
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.1
1.7.8
1.97.3
opencsghq/gitlab-shell:v17.5.0f6d7e7d6be5d
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.10
1.7.8
1.97.3
temporalio/auto-setup:1.29.7f14912b699cf
github.com/aws/aws-sdk-go-v2/service/lambda@v1.88.0
1.88.5

Open the chart page →

58,897
csgshipcsghubVerified publisher0.4.61 of 10See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
casbin/casdoor:3.62.17729da148c61
github.com/aws/aws-sdk-go-v2/service/s3@v1.95.0
1.97.3

Open the chart page →

11,335
custom-rhcl-consolecustom-rhcl-consoleVerified publisher0.1.21 of 3See more

custom-rhcl-console custom-rhcl-console 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.4
1.7.8
1.97.3

Open the chart page →

1,885
cw-container-insightcwci0.7.01 of 1See more

cw-container-insight cwci 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
amazon/cloudwatch-agent:latest-arm649dea6643715a
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.46.0
1.7.8
1.65.0

Open the chart page →

274
dapr-agentsdapr-agents-devVerified publisher0.1.53 of 31See more

dapr-agents dapr-agents-dev 0.1.5

3 of the 31 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
grafana/grafana:12.3.39e1e77ade304
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.11
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.84.0
1.7.8
1.65.0
1.97.3
grafana/loki:3.6.5847c287ada0e
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.3
1.7.8
1.97.3
otel/opentelemetry-collector-contrib:0.145.0a7343f018690
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.63.1
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.42.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.95.1
1.7.8
1.65.0
1.43.5
1.97.3

Open the chart page →

22,193
garage-webuideimosfr-charts1.1.01 of 1See more

garage-webui deimosfr-charts 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
khairul169/garage-webui:1.1.017c793551873
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.59.0
1.7.8
1.97.3

Open the chart page →

567
devtron-enterprisedevtron48.0.03 of 28See more

devtron-enterprise devtron 48.0.0

3 of the 28 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.79.4
1.7.8
1.97.3
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.15.20
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.15.19
github.com/aws/aws-sdk-go-v2/service/lambda@v1.24.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.33.1
1.7.8
1.65.0
1.43.5
1.88.5
1.97.3
quay.io/devtron/kubectl:latest2ad610626658
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.10
1.7.8
1.97.3

Open the chart page →

68,240
zincdevtron0.1.21 of 1See more

zinc devtron 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
public.ecr.aws/zinclabs/zinc:latestfefa9ee7256a
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.30.1
1.7.8
1.97.3

Open the chart page →

1,507
devtron-enterprisedevtron-labs48.0.03 of 28See more

devtron-enterprise devtron-labs 48.0.0

3 of the 28 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.79.4
1.7.8
1.97.3
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.15.20
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.15.19
github.com/aws/aws-sdk-go-v2/service/lambda@v1.24.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.33.1
1.7.8
1.65.0
1.43.5
1.88.5
1.97.3
quay.io/devtron/kubectl:latest2ad610626658
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.10
1.7.8
1.97.3

Open the chart page →

68,240
devtron-operatordevtron-labs0.23.32 of 11See more

devtron-operator devtron-labs 0.23.3

2 of the 11 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.79.4
1.7.8
1.97.3
quay.io/devtron/kubectl:latest2ad610626658
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.10
1.7.8
1.97.3

Open the chart page →

32,902
zincdevtron-labs0.1.21 of 1See more

zinc devtron-labs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
public.ecr.aws/zinclabs/zinc:latestfefa9ee7256a
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.30.1
1.7.8
1.97.3

Open the chart page →

1,507
k8s-crondoubanVerified publisher0.2.01 of 1See more

k8s-cron douban 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
alpine/k8s:1.28.2fc059f056ad0
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.24.0
1.65.0

Open the chart page →

3,659
arbitrumdysnixVerified publisher0.1.11 of 1See more

arbitrum dysnix 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
offchainlabs/nitro-node:v3.1.0-7d1d84ce95865866129
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.9
1.7.8
1.97.3

Open the chart page →

9,244
kube-ecp-stackemqx-operator2.5.11 of 16See more

kube-ecp-stack emqx-operator 2.5.1

1 of the 16 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
library/telegraf:1.27507a3eecf809
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.12
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.20.9
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.18.2
github.com/aws/aws-sdk-go-v2/service/s3@v1.35.0
1.7.8
1.65.0
1.43.5
1.97.3

Open the chart page →

23,685
benchmarkoor-apiethereum-helm-chartsVerified publisher0.1.01 of 1See more

benchmarkoor-api ethereum-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ghcr.io/ethpandaops/benchmarkoor:latest5470b2ec3161
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.0
1.7.8
1.97.3

Open the chart page →

899
forkyethereum-helm-chartsVerified publisher0.2.01 of 1See more

forky ethereum-helm-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ethpandaops/forky:debian-latestc937f4ba737c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.33.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.43.5
1.97.3

Open the chart page →

1,703
tracoor-agentethereum-helm-chartsVerified publisher0.0.11 of 1See more

tracoor-agent ethereum-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ethpandaops/tracoor:latestd8514b9f4c59
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.5.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.48.1
1.7.8
1.97.3

Open the chart page →

905
tracoor-serverethereum-helm-chartsVerified publisher0.0.21 of 1See more

tracoor-server ethereum-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ethpandaops/tracoor:latestd8514b9f4c59
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.5.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.48.1
1.7.8
1.97.3

Open the chart page →

905
tracoor-singleethereum-helm-chartsVerified publisher0.0.51 of 2See more

tracoor-single ethereum-helm-charts 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
ethpandaops/tracoor:latestd8514b9f4c59
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.5.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.48.1
1.7.8
1.97.3

Open the chart page →

905
siyuanextrim-helm-chartsVerified publisher0.1.11 of 2See more

siyuan extrim-helm-charts 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
b3log/siyuan:v3.1.2595c0d129bc19
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.97.3

Open the chart page →

1,247
fairwinds-insightsfairwinds-stableVerified publisher10.1.102 of 13See more

fairwinds-insights fairwinds-stable 10.1.10

2 of the 13 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.31.2dbc5fcd6ee8f
github.com/aws/aws-sdk-go-v2/service/lambda@v1.88.0
1.88.5
temporalio/server:1.31.2b5ecdb8282be
github.com/aws/aws-sdk-go-v2/service/lambda@v1.88.0
1.88.5

Open the chart page →

3,797
farm-observabilityfarm-observabilityOfficialVerified publisher0.27.23 of 18See more

farm-observability farm-observability 0.27.2

3 of the 18 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
grafana/alloy:v1.12.2f94b1c82957a
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.2
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.58.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.89.0
1.7.8
1.65.0
1.97.3
grafana/grafana:13.0.1-security-012d1f9ae67c17
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.3
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.89.2
1.7.8
1.65.0
1.97.3
grafana/loki:3.6.73c8fd3570dd9
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.3
1.7.8
1.97.3

Open the chart page →

13,255
apm-hubflanksourceVerified publisher0.0.471 of 2See more

apm-hub flanksource 0.0.47

1 of the 2 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
flanksource/apm-hub:v0.0.471dacc3195bf9
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.20.11
github.com/aws/aws-sdk-go-v2/service/s3@v1.33.1
1.7.8
1.65.0
1.97.3

Open the chart page →

6,078
batchrunnerflanksourceVerified publisher1.0.441 of 1See more

batchrunner flanksource 1.0.44

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
flanksource/batch-runner:v1.0.44689687a7cf95
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.2
github.com/aws/aws-sdk-go-v2/service/s3@v1.79.2
1.7.8
1.97.3

Open the chart page →

5,292
forwardforward1.3.11 of 1See more

forward forward 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
udhos/forward:1.1.312e120d39fdb
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/lambda@v1.35.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.33.1
1.7.8
1.88.5
1.97.3

Open the chart page →

2,212
glassflow-etlglassflowVerified publisher0.5.211 of 16See more

glassflow-etl glassflow 0.5.21

1 of the 16 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.108.0923eb1cfae32
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.4
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.29.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.53.1
1.7.8
1.43.5
1.97.3

Open the chart page →

12,056
gnp-stackgnp-stack0.0.52 of 14See more

gnp-stack gnp-stack 0.0.5

2 of the 14 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
grafana/grafana:12.2.135c41e0fd029
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.11
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.65.0
1.97.3
ghcr.io/openconfig/gnmic:0.45.0d422a9ebd4a2
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.10
1.7.8
1.97.3

Open the chart page →

7,659
harborgpg-dev1.18.31 of 8See more

harbor gpg-dev 1.18.3

1 of the 8 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.14.35c6f7162804c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.92.0
1.7.8
1.97.3

Open the chart page →

3,376
kube-prometheus-stackgpg-dev84.0.01 of 6See more

kube-prometheus-stack gpg-dev 84.0.0

1 of the 6 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
grafana/grafana:13.0.10f86bada30d6
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.3
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.89.2
1.7.8
1.65.0
1.97.3

Open the chart page →

4,288
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-89090.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.114.037fa87091cfa
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.6
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.32.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.66.3
1.7.8
1.43.5
1.97.3

Open the chart page →

49,025

Container images carrying it

246 by charts deploying them

A fixed version is listed for 5 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.72.2
1.7.8
1.97.3
7
quay.io/openshift/origin-cli:latest605eaa5d469c
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.4
1.7.8
1.97.3
7
quay.io/devtron/kubectl:latest2ad610626658
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.26.10
1.7.8
1.97.3
6
grafana/loki:3.6.73c8fd3570dd9
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.3
1.7.8
1.97.3
4
derailed/popeye:v0.22.18e68e22c7663
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.8
github.com/aws/aws-sdk-go-v2/service/s3@v1.74.1
1.7.8
1.97.3
3
ethpandaops/tracoor:latestd8514b9f4c59
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.5.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.48.1
1.7.8
1.97.3
3
ghcr.io/dexidp/dex:v2.45.18499afd690c4
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
github.com/aws/aws-sdk-go-v2/service/s3@v1.95.1
1.7.8
1.97.3
3
public.ecr.aws/zinclabs/zinc:latestfefa9ee7256a
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.30.1
1.7.8
1.97.3
3
quay.io/devtron/devtron:9450794d-930-394159795f3f9f031
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.79.4
1.7.8
1.97.3
3
quay.io/devtron/hyperion:0874dcaf-280-3928701d5d8c4cecb
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.79.4
1.7.8
1.97.3
3
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.15.20
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.15.19
github.com/aws/aws-sdk-go-v2/service/lambda@v1.24.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.33.1
1.7.8
1.65.0
1.43.5
1.88.5
1.97.3
3
alpine/k8s:1.32.12048f8d9c8cc7
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.4
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.63.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.0
1.7.8
1.65.0
1.97.3
2
bitnamilegacy/influxdb:2.6.1-debian-11-r18d17df1f9d745
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.0.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.19.0
1.7.8
1.97.3
2
falcosecurity/falco-driver-loader:0.33.11fe583eee4af
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.8
github.com/aws/aws-sdk-go-v2/service/s3@v1.27.11
1.7.8
1.97.3
2
falcosecurity/falco-no-driver:0.33.10d427b8d5fc6
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.8
github.com/aws/aws-sdk-go-v2/service/s3@v1.27.11
1.7.8
1.97.3
2
grafana/alloy:v1.8.17790f6f7fbd8
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.46.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.65.0
1.97.3
2
grafana/alloy:v1.12.2f94b1c82957a
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.2
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.58.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.89.0
1.7.8
1.65.0
1.97.3
2
grafana/grafana:12.3.12175aaa91c96
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.11
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.84.0
1.7.8
1.65.0
1.97.3
2
grafana/grafana:12.3.39e1e77ade304
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.11
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.84.0
1.7.8
1.65.0
1.97.3
2
grafana/grafana:12.4.1e932bd6ed0e0
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.11
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.51.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.84.0
1.7.8
1.65.0
1.97.3
2
hashicorp/vault:1.8.34db614d40d0e
github.com/aws/aws-sdk-go-v2/service/s3@v1.5.0
1.97.3
2
hashicorp/vault:1.15.26b4e5dadf082
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.31.0
1.7.8
1.97.3
2
hashicorp/vault:1.12.18de4d5f31b38
github.com/aws/aws-sdk-go-v2/service/s3@v1.12.0
1.97.3
2
library/influxdb:2.6.1-alpine44a366dd7724
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.0.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.19.0
1.7.8
1.97.3
2
library/influxdb:2.7b8d940ca9376
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.2
github.com/aws/aws-sdk-go-v2/service/s3@v1.54.4
1.7.8
1.97.3
2
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.1
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.27.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.31.0
1.7.8
1.43.5
1.97.3
2
rclone/rclone:1.6874c51b8817e5
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.58.3
1.7.8
1.97.3
2
uselagoon/docker-host:v3.6.12c89ed939b8b
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.3
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.32.0
1.7.8
1.65.0
2
ghcr.io/appscode/license-proxyserver:v0.1.1e192ad567e0b
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.97.3
2
ghcr.io/celestiaorg/celestia-node:v0.27.5-mocha4768ea1c5fd2
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.88.1
1.7.8
1.97.3
2
ghcr.io/nucleuscloud/neosync/api:0.5.41e2abb798f29f
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.29.3
github.com/aws/aws-sdk-go-v2/service/lambda@v1.56.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.43.5
1.88.5
1.97.3
2
ghcr.io/nucleuscloud/neosync/worker:0.5.4196f42450c5b1
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/kinesis@v1.29.3
github.com/aws/aws-sdk-go-v2/service/lambda@v1.56.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.78.2
1.7.8
1.43.5
1.88.5
1.97.3
2
public.ecr.aws/cloudnatix/llmariner/file-manager-server:1.11.0301216788e93
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.2
1.7.8
1.97.3
2
public.ecr.aws/cloudnatix/llmariner/job-manager-dispatcher:1.27.0582508903cb0
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.2
1.7.8
1.97.3
2
public.ecr.aws/cloudnatix/llmariner/job-manager-server:1.27.0fe9de719f91e
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.2
1.7.8
1.97.3
2
public.ecr.aws/cloudnatix/llmariner/model-manager-loader:1.27.026ac7263a823
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.2
1.7.8
1.97.3
2
public.ecr.aws/cloudnatix/llmariner/user-manager-server:1.27.1628a14449241
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.5
github.com/aws/aws-sdk-go-v2/service/s3@v1.63.2
1.7.8
1.97.3
2
aerospike/aerospike-backup-service:3.5.1be40d709c583
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.6
github.com/aws/aws-sdk-go-v2/service/s3@v1.96.4
1.7.8
1.97.3
1
aktosecurity/mirror-api-logging:api-gateway-logging-openapi12ed2544756f
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.45.5
1.7.8
1.65.0
1
aktosecurity/mirror-api-logging:api-gateway-logging-multi-logging1a1bc76d50fe
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.45.5
1.7.8
1.65.0
1
alpine/k8s:1.27.321b24e6bf801
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.20.11
1.65.0
1
alpine/k8s:1.36.244ef4942e171
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.6
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.64.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.93.2
1.7.8
1.65.0
1.97.3
1
alpine/k8s:1.31.106dbe6f391eda
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.50.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.77.1
1.7.8
1.65.0
1.97.3
1
alpine/k8s:1.31.137a319b15cfc9
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.10
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.56.2
github.com/aws/aws-sdk-go-v2/service/s3@v1.79.2
1.7.8
1.65.0
1.97.3
1
alpine/k8s:1.32.47e1e7d5b7a96
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.47.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.77.1
1.7.8
1.65.0
1.97.3
1
alpine/k8s:1.31.49c4976d47656
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.7
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.45.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.70.0
1.7.8
1.65.0
1.97.3
1
alpine/k8s:1.35.6b7a12c5ddf26
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.6
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.64.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.93.2
1.7.8
1.65.0
1.97.3
1
alpine/k8s:1.30.0bd01dae02676
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.4.14
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.33.3
github.com/aws/aws-sdk-go-v2/service/s3@v1.40.1
1.7.8
1.65.0
1.97.3
1
alpine/k8s:1.30.2cd560fce90f7
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.6.2
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.35.1
github.com/aws/aws-sdk-go-v2/service/s3@v1.55.1
1.7.8
1.65.0
1.97.3
1
alpine/k8s:1.35.5d870622d0040
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream@v1.7.6
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.64.0
github.com/aws/aws-sdk-go-v2/service/s3@v1.93.2
1.7.8
1.65.0
1.97.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.