StackRadar

CVE-2026-94439

High

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.003
23rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
5,263
of 18,131 indexed, latest versions
Container images
6,077
deployed by those charts
Fix available
1 of 2
affected packages

HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

Carried by container images the latest versions of 5,263 of 18,131 indexed charts deploy, on 6,077 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+209 more1.26.96,077
golang-1.19deb1.19.8-2no fix listed1
OSV records
DEBIAN-CVE-2026-94439GO-2026-6613
Trending
Rank 8 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,263 by stars
ChartLatestAffected imagesRadar Score
catalog-managerappscodeVerified publisher2026.10.121 of 1See more

catalog-manager appscode 2026.10.12

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/catalog-manager:v0.14.05e9a05238ed5
stdlib@go1.25.13
1.26.9

Open the chart page →

351
cattlesetappscodeVerified publisher2026.7.81 of 1See more

cattleset appscode 2026.7.8

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/cattleset:v0.0.145554a03e448
stdlib@go1.25.11
1.26.9

Open the chart page →

1,050
cert-manager-csi-driver-cacertsappscodeVerified publisher2026.9.183 of 3See more

cert-manager-csi-driver-cacerts appscode 2026.9.18

3 of the 3 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/csi-driver-cacerts:v0.6.0ab213b156017
stdlib@go1.25.13
1.26.9
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.14.05244abbe87e0
stdlib@go1.24.2
1.26.9
registry.k8s.io/sig-storage/livenessprobe:v2.16.088092d100909
stdlib@go1.24.2
1.26.9

Open the chart page →

3,981
cert-manager-webhook-aceappscodeVerified publisher2026.10.121 of 1See more

cert-manager-webhook-ace appscode 2026.10.12

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/cert-manager-webhook-ace:v0.0.2dc6b5fdcec06
stdlib@go1.25.5
1.26.9

Open the chart page →

1,823
clickhouse-uiappscodeVerified publisher2026.3.301 of 1See more

clickhouse-ui appscode 2026.3.30

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/caioricciuti/ch-ui:v2.14.180f4d92c2d8d
stdlib@go1.26.8
1.26.9

Open the chart page →

213
cluster-auth-agentappscodeVerified publisher2026.2.161 of 1See more

cluster-auth-agent appscode 2026.2.16

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/kluster-manager/cluster-auth:v0.5.1fba6fb872281
stdlib@go1.25.7
1.26.9

Open the chart page →

1,444
cluster-auth-managerappscodeVerified publisher2026.2.161 of 1See more

cluster-auth-manager appscode 2026.2.16

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/kluster-manager/cluster-auth:v0.5.1fba6fb872281
stdlib@go1.25.7
1.26.9

Open the chart page →

1,444
cluster-connectorappscodeVerified publisher2025.12.151 of 1See more

cluster-connector appscode 2025.12.15

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/cluster-connector:v0.0.140efd9d9ef6ca
stdlib@go1.25.5
1.26.9

Open the chart page →

1,066
cluster-gatewayappscodeVerified publisher2026.6.261 of 1See more

cluster-gateway appscode 2026.6.26

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/kluster-manager/cluster-gateway:v1.12.158bed8d1e7fc
stdlib@go1.25.11
1.26.9

Open the chart page →

1,056
cluster-gateway-managerappscodeVerified publisher2026.6.261 of 1See more

cluster-gateway-manager appscode 2026.6.26

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/kluster-manager/cluster-gateway-manager:v1.12.1f22cae0e6cf3
stdlib@go1.25.11
1.26.9

Open the chart page →

1,056
cluster-importerappscodeVerified publisher2026.10.121 of 1See more

cluster-importer appscode 2026.10.12

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/ace:v0.2.0b8e03da90e70
stdlib@go1.25.9
1.26.9

Open the chart page →

1,484
cluster-manager-hubappscodeVerified publisher2026.2.161 of 1See more

cluster-manager-hub appscode 2026.2.16

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/kluster-manager/registration-operator:v1.2.00cbced8e6240
stdlib@go1.25.7
1.26.9

Open the chart page →

1,568
cluster-presetsappscodeVerified publisher2026.10.121 of 1See more

cluster-presets appscode 2026.10.12

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/cluster-presets:v0.0.128fbdd2479645
stdlib@go1.25.11
1.26.9

Open the chart page →

750
cluster-profile-managerappscodeVerified publisher2026.9.181 of 1See more

cluster-profile-manager appscode 2026.9.18

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/kluster-manager/cluster-profile:v0.13.0b8b0aaef2543
stdlib@go1.25.13
1.26.9

Open the chart page →

404
cluster-proxyappscodeVerified publisher2024.2.251 of 1See more

cluster-proxy appscode 2024.2.25

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/kluster-manager/cluster-proxy:latest27a5c64b7ea8
stdlib@go1.21.8
1.26.9

Open the chart page →

1,768
cluster-proxy-managerappscodeVerified publisher2026.6.261 of 1See more

cluster-proxy-manager appscode 2026.6.26

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/kluster-manager/cluster-proxy:v0.10.1a7fce69e171c
stdlib@go1.25.11
1.26.9

Open the chart page →

2,276
crd-managerappscodeVerified publisher2026.10.101 of 1See more

crd-manager appscode 2026.10.10

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/voyagermesh/crd-manager:v0.4.04466bb77dc78
stdlib@go1.25.13
1.26.9

Open the chart page →

1,106
dns-proxyappscodeVerified publisher2026.10.121 of 1See more

dns-proxy appscode 2026.10.12

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/cloudflare-dns-proxy:v0.0.5dfbef0285e14
stdlib@go1.25.5
1.26.9

Open the chart page →

1,100
docker-machine-operatorappscodeVerified publisher2024.7.91 of 1See more

docker-machine-operator appscode 2024.7.9

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/docker-machine-operator:v0.0.481f6007abb4e
stdlib@go1.22.4
1.26.9

Open the chart page →

2,962
external-dns-operatorappscodeVerified publisher2026.6.221 of 1See more

external-dns-operator appscode 2026.6.22

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/external-dns-operator:v0.4.05605f97e636d
stdlib@go1.25.12
1.26.9

Open the chart page →

686
falco-ui-serverappscodeVerified publisher2026.1.152 of 2See more

falco-ui-server appscode 2026.1.15

2 of the 2 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
rancher/kine:v0.11.412889bbcd1e8
stdlib@go1.21.5
1.26.9
ghcr.io/appscode/falco-ui-server:v0.0.66ec488d89b56
stdlib@go1.25.5
1.26.9

Open the chart page →

4,093
fargocdappscodeVerified publisher2026.9.181 of 1See more

fargocd appscode 2026.9.18

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/fargocd:v0.1.0c59d775d9a7c
stdlib@go1.25.13
1.26.9

Open the chart page →

750
fargocd-managerappscodeVerified publisher2026.9.181 of 1See more

fargocd-manager appscode 2026.9.18

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/fargocd:v0.1.0c59d775d9a7c
stdlib@go1.25.13
1.26.9

Open the chart page →

750
fluxcd-addon-managerappscodeVerified publisher2024.2.251 of 1See more

fluxcd-addon-manager appscode 2024.2.25

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/kluster-manager/fluxcd-addon:v0.0.23acba3df8827
stdlib@go1.22.3
1.26.9

Open the chart page →

1,925
fluxcd-managerappscodeVerified publisher2026.9.181 of 1See more

fluxcd-manager appscode 2026.9.18

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/kluster-manager/fluxcd-addon:v0.0.1137105f529ed0
stdlib@go1.25.13
1.26.9

Open the chart page →

695
gateway-converterappscodeVerified publisher2024.8.301 of 1See more

gateway-converter appscode 2024.8.30

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/voyagermesh/gateway-converter:v0.0.1b92123805584
stdlib@go1.23.1
1.26.9

Open the chart page →

1,845
gcp-credential-managerappscodeVerified publisher2026.3.111 of 1See more

gcp-credential-manager appscode 2026.3.11

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/gcp-credential-manager:v0.1.0b58345fe8209
stdlib@go1.25.8
1.26.9

Open the chart page →

1,486
gh-ci-webhookappscodeVerified publisher2026.10.121 of 1See more

gh-ci-webhook appscode 2026.10.12

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/gh-ci-webhook:v0.0.2036ce246d884e
stdlib@go1.24.0
1.26.9

Open the chart page →

2,005
grafanaappscodeVerified publisher2026.10.121 of 1See more

grafana appscode 2026.10.12

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/grafana:v2025.2.367d18880448c
stdlib@go1.17.1
1.26.9

Open the chart page →

3,483
grafana-operatorappscodeVerified publisher2026.6.121 of 1See more

grafana-operator appscode 2026.6.12

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/grafana-tools:v0.8.077c9d29080eb
stdlib@go1.25.13
1.26.9

Open the chart page →

642
grafana-opscenterappscodeVerified publisher2023.3.231 of 1See more

grafana-opscenter appscode 2023.3.23

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/grafana-tools:v0.0.22c7b9b0a9101
stdlib@go1.20.2
1.26.9

Open the chart page →

2,228
grafana-ui-serverappscodeVerified publisher2022.6.141 of 1See more

grafana-ui-server appscode 2022.6.14

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/grafana-tools:v0.0.1f60324bca644
stdlib@go1.19.4
1.26.9

Open the chart page →

2,423
inbox-agentappscodeVerified publisher2026.6.22 of 2See more

inbox-agent appscode 2026.6.2

2 of the 2 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/inbox-agent:v0.0.6f630e47772c9
stdlib@go1.25.13
1.26.9
ghcr.io/appscode/kube-rbac-proxy:v0.15.0d8cc6ffb9819
stdlib@go1.21.3
1.26.9

Open the chart page →

2,827
inbox-server-distributedappscodeVerified publisher2025.12.251 of 4See more

inbox-server-distributed appscode 2025.12.25

1 of the 4 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/cassandra:4.1.37cbcec0086ac
stdlib@go1.18.2
1.26.9

Open the chart page →

18,295
james-komposeappscodeVerified publisher0.1.01 of 4See more

james-kompose appscode 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/cassandra:4.1.37cbcec0086ac
stdlib@go1.18.2
1.26.9

Open the chart page →

19,759
kube-auth-managerappscodeVerified publisher2023.11.141 of 1See more

kube-auth-manager appscode 2023.11.14

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/kube-auth-manager:v0.0.1789692ab9193
stdlib@go1.20.2
1.26.9

Open the chart page →

2,740
kube-auth-proxyappscodeVerified publisher2023.11.141 of 1See more

kube-auth-proxy appscode 2023.11.14

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/kube-auth-manager:v0.0.1789692ab9193
stdlib@go1.20.2
1.26.9

Open the chart page →

2,740
kube-bind-serverappscodeVerified publisher2023.3.231 of 1See more

kube-bind-server appscode 2023.3.23

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/kube-bind-server:v0.0.11762f3f6bb71
stdlib@go1.20.2
1.26.9

Open the chart page →

2,848
kubedb-certifiedappscodeVerified publisher2026.7.108 of 8See more

kubedb-certified appscode 2026.7.10

8 of the 8 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/kubectl-nonroot:1.340b26892cec94
stdlib@go1.24.13
1.26.9
ghcr.io/appscode/petset:v0.1.093fa0daf603c
stdlib@go1.25.10
1.26.9
ghcr.io/appscode/sidekick:v0.0.15d1036b07e348
stdlib@go1.25.11
1.26.9
ghcr.io/kubedb/kubedb-autoscaler:v0.51.05d1182ac21f0
stdlib@go1.25.12
1.26.9
ghcr.io/kubedb/kubedb-crd-manager:v0.21.09506a6cb98d1
stdlib@go1.25.12
1.26.9
ghcr.io/kubedb/kubedb-ops-manager:v0.53.06d4c9fe66e4f
stdlib@go1.25.12
1.26.9
ghcr.io/kubedb/kubedb-provisioner:v0.66.0e7041c3b41e7
stdlib@go1.25.13
1.26.9
ghcr.io/kubedb/kubedb-webhook-server:v0.42.0e0f4431c4704
stdlib@go1.25.13
1.26.9

Open the chart page →

7,477
kubedb-communityappscodeVerified publisher0.24.21 of 2See more

kubedb-community appscode 0.24.2

1 of the 2 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
kubedb/operator:v0.24.01a06ff0bda52
stdlib@go1.17.6
1.26.9

Open the chart page →

3,852
kubedb-enterpriseappscodeVerified publisher0.11.21 of 2See more

kubedb-enterprise appscode 0.11.2

1 of the 2 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
kubedb/kubedb-enterprise:v0.11.05829bcedcb0d
stdlib@go1.17.3
1.26.9

Open the chart page →

3,890
kubedb-migratorappscodeVerified publisher0.5.01 of 1See more

kubedb-migrator appscode 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/kubedb/migrator-operator:v0.5.098ffb48f5b60
stdlib@go1.25.11
1.26.9

Open the chart page →

589
kubedb-oneappscodeVerified publisher2023.12.289 of 10See more

kubedb-one appscode 2023.12.28

9 of the 10 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
prom/pushgateway:v1.4.2a684e7c830a4
stdlib@go1.16.9
1.26.9
ghcr.io/kubedb/kubedb-autoscaler:v0.25.0df6b11907d33
stdlib@go1.21.5
1.26.9
ghcr.io/kubedb/kubedb-dashboard:v0.16.07bfe1c07bd9b
stdlib@go1.20.7
1.26.9
ghcr.io/kubedb/kubedb-ops-manager:v0.27.1ec36422b09af
stdlib@go1.20.14
1.26.9
ghcr.io/kubedb/kubedb-provisioner:v0.40.242574f512837
stdlib@go1.20.14
1.26.9
ghcr.io/kubedb/kubedb-schema-manager:v0.16.09518de37eed5
stdlib@go1.20.7
1.26.9
ghcr.io/kubedb/kubedb-webhook-server:v0.16.2e24894e32cbc
stdlib@go1.20.14
1.26.9
ghcr.io/stashed/stash-crd-installer:v0.32.0c6f2a844b5dd
stdlib@go1.20.8
1.26.9
ghcr.io/stashed/stash-enterprise:v0.32.0e9bde36e34b7
stdlib@go1.20.7
1.26.9

Open the chart page →

22,532
kubedb-provider-awsappscodeVerified publisher2026.10.121 of 1See more

kubedb-provider-aws appscode 2026.10.12

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/kubedb/provider-aws:v0.29.049b1c312e342
stdlib@go1.20.7
1.26.9

Open the chart page →

3,311
kubedb-provider-azureappscodeVerified publisher2026.10.121 of 1See more

kubedb-provider-azure appscode 2026.10.12

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/kubedb/provider-azure:v0.29.03c7961c8b9ae
stdlib@go1.19.3
1.26.9

Open the chart page →

3,639
kubedb-provider-gcpappscodeVerified publisher2026.10.122 of 2See more

kubedb-provider-gcp appscode 2026.10.12

2 of the 2 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/appscode/kubectl-nonroot:1.340b26892cec94
stdlib@go1.24.13
1.26.9
ghcr.io/kubedb/provider-gcp:v0.29.0a1d4cf8b8fe1
stdlib@go1.19.1
1.26.9

Open the chart page →

4,373
kubedb-ui-serverappscodeVerified publisher2021.12.211 of 1See more

kubedb-ui-server appscode 2021.12.21

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
kubedb/kubedb-ui-server:v0.0.1_linux_amd647d27865514ee
stdlib@go1.17.8
1.26.9

Open the chart page →

3,109
kubeform-provider-awsappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-aws appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-aws:v0.0.1e3d1f1302e49
stdlib@go1.19.1
1.26.9

Open the chart page →

3,736
kubeform-provider-azureappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-azure appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-azure:v0.0.1ac8459f70f85
stdlib@go1.20.5
1.26.9

Open the chart page →

3,650
kubeform-provider-gcpappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-gcp appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-gcp:v0.0.1af77073c184f
stdlib@go1.19.9
1.26.9

Open the chart page →

3,677

Container images carrying it

6,077 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

No deployed image carries CVE-2026-94439.

syft 1.42.1 · advisories as of 14 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.