StackRadar

CVE-2026-94439

High

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.003
23rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
5,360
of 18,104 indexed, latest versions
Container images
6,205
deployed by those charts
Fix available
1 of 2
affected packages

HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

Carried by container images the latest versions of 5,360 of 18,104 indexed charts deploy, on 6,205 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+212 more1.26.96,205
golang-1.19deb1.19.8-2no fix listed1
OSV records
DEBIAN-CVE-2026-94439GO-2026-6613
Trending
Rank 7 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,360 by stars
ChartLatestAffected imagesRadar Score
commafeedmt1905028.2.01 of 3See more

commafeed mt190502 8.2.0

1 of the 3 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/postgres:18fc973eb97c9f
stdlib@go1.24.6
1.26.9

Open the chart page →

4,303
filestashmt1905024.0.01 of 1See more

filestash mt190502 4.0.0

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
machines/filestash:latestaff504cd28a8
stdlib@go1.26.8
1.26.9

Open the chart page →

3,774
ghostmt1905028.25.12 of 3See more

ghost mt190502 8.25.1

2 of the 3 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
stdlib@go1.24.6
1.26.9
library/mysql:86ea90827b110
stdlib@go1.24.6
1.26.9

Open the chart page →

6,557
keycloakmt1905021.4.61 of 3See more

keycloak mt190502 1.4.6

1 of the 3 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/postgres:1874935e722416
stdlib@go1.24.6
1.26.9

Open the chart page →

3,320
maddymt1905024.1.21 of 1See more

maddy mt190502 4.1.2

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
foxcpp/maddy:0.9.2a4b839985b9b
stdlib@go1.23.12
1.26.9

Open the chart page →

1,609
memosmt1905027.3.22 of 3See more

memos mt190502 7.3.2

2 of the 3 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/postgres:1874935e722416
stdlib@go1.24.6
1.26.9
neosmemo/memos:0.26.23eefcc231141
stdlib@go1.25.7
1.26.9

Open the chart page →

3,284
minifluxmt1905021.1.62 of 3See more

miniflux mt190502 1.1.6

2 of the 3 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/postgres:18fc973eb97c9f
stdlib@go1.24.6
1.26.9
miniflux/miniflux:2.2.18a3ca6bbc1f74
stdlib@go1.26.1
1.26.9

Open the chart page →

3,309
nightscoutmt1905021.1.01 of 3See more

nightscout mt190502 1.1.0

1 of the 3 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
stdlib@go1.21.12
1.26.9

Open the chart page →

7,540
open-webuimt1905022.3.101 of 3See more

open-webui mt190502 2.3.10

1 of the 3 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/postgres:1874935e722416
stdlib@go1.24.6
1.26.9

Open the chart page →

1,802
paperless-ngxmt1905027.6.142 of 4See more

paperless-ngx mt190502 7.6.14

2 of the 4 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/postgres:1874935e722416
stdlib@go1.24.6
1.26.9
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
stdlib@go1.24.4
1.26.9

Open the chart page →

14,117
umamimt1905028.1.41 of 3See more

umami mt190502 8.1.4

1 of the 3 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/postgres:1874935e722416
stdlib@go1.24.6
1.26.9

Open the chart page →

4,315
vaultwardenmt1905027.3.41 of 3See more

vaultwarden mt190502 7.3.4

1 of the 3 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/postgres:1874935e722416
stdlib@go1.24.6
1.26.9

Open the chart page →

5,348
vikunjamt1905027.1.22 of 3See more

vikunja mt190502 7.1.2

2 of the 3 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/postgres:1874935e722416
stdlib@go1.24.6
1.26.9
vikunja/vikunja:0.24.6ed1f3ed467fe
stdlib@go1.23.4
1.26.9

Open the chart page →

3,967
mongodbmulti-chart-app0.1.01 of 1See more

mongodb multi-chart-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/mongo:71f995ad6fdb9
stdlib@go1.26.8
1.26.9

Open the chart page →

2,610
my-multi-chart-appmulti-chart-app0.1.01 of 2See more

my-multi-chart-app multi-chart-app 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/mongo:71f995ad6fdb9
stdlib@go1.26.8
1.26.9

Open the chart page →

4,556
multusmultusVerified publisher0.2.02 of 2See more

multus multus 0.2.0

2 of the 2 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/k8snetworkplumbingwg/multus-cni:v4.1.409fdfb7ce090
stdlib@go1.23.4
1.26.9
ghcr.io/k8snetworkplumbingwg/multus-dynamic-networks-controller:v0.3.72a2bb32c0ea8
stdlib@go1.22.12
1.26.9

Open the chart page →

2,978
devops-demomungari-development-charts1.0.44 of 4See more

devops-demo mungari-development-charts 1.0.4

4 of the 4 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/postgres:latestfc973eb97c9f
stdlib@go1.24.6
1.26.9
ghcr.io/perceptolab/devops-demo-app:0.0.2cdc0658c40fb
stdlib@go1.18.4
1.26.9
quay.io/prometheus/alertmanager:lateste9733bafb1bd
stdlib@go1.26.8
1.26.9
quay.io/prometheus/prometheus:latestefd719c99d83
stdlib@go1.27.1
1.26.9

Open the chart page →

10,620
pagesmuthu-pages1.0.01 of 3See more

pages muthu-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.26.9

Open the chart page →

21,310
approuvezmvisonneau0.1.11 of 1See more

approuvez mvisonneau 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/mvisonneau/approuvez:v0.1.0441da62e6cb3
stdlib@go1.15.6
1.26.9

Open the chart page →

3,162
unpollermvisonneau0.1.01 of 1See more

unpoller mvisonneau 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
golift/unifi-poller:v2.9.2585a29a06d05
stdlib@go1.21.0
1.26.9

Open the chart page →

1,897
ingress-nginxmxytest4.15.12 of 2See more

ingress-nginx mxytest 4.15.1

2 of the 2 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.15.1594ceea76b01
stdlib@go1.26.1
1.26.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.901038e7de14b
stdlib@go1.26.1
1.26.9

Open the chart page →

2,350
danboorumy0nVerified publisher0.0.21 of 1See more

danbooru my0n 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
stdlib@go1.18
1.26.9

Open the chart page →

106,214
danbooru-stackmy0nVerified publisher0.0.31 of 4See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
stdlib@go1.18
1.26.9

Open the chart page →

106,214
authmyaVerified publisher22.4.31 of 1See more

auth mya 22.4.3

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
cesanta/docker_auth:1.6.04d16885f3d4c
stdlib@go1.13.7
1.26.9

Open the chart page →

3,619
clickhousemyaVerified publisher0.2403.11 of 1See more

clickhouse mya 0.2403.1

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:24.2ed9640bfff07
stdlib@go1.19.10
1.26.9

Open the chart page →

4,364
cognativemyaVerified publisher0.2403.33 of 3See more

cognative mya 0.2403.3

3 of the 3 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:24.2ed9640bfff07
stdlib@go1.19.10
1.26.9
grafana/grafana:10.4.0f9811e4e687f
stdlib@go1.21.8
1.26.9
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
stdlib@go1.21.7
1.26.9

Open the chart page →

9,524
giteamyaVerified publisher23.12.51 of 1See more

gitea mya 23.12.5

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
gitea/gitea:1.21.6ac73e0da341f
stdlib@go1.21.7
1.26.9

Open the chart page →

4,325
redismyaVerified publisher22.4.101 of 2See more

redis mya 22.4.10

1 of the 2 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
quay.io/oliver006/redis_exporter:v1.35.1908dbee5c546
stdlib@go1.17.7
1.26.9

Open the chart page →

1,936
redis-queuemyaVerified publisher22.4.61 of 2See more

redis-queue mya 22.4.6

1 of the 2 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
quay.io/oliver006/redis_exporter:v1.35.1908dbee5c546
stdlib@go1.17.7
1.26.9

Open the chart page →

1,936
redis-raftmyaVerified publisher22.5.41 of 2See more

redis-raft mya 22.5.4

1 of the 2 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
quay.io/oliver006/redis_exporter:v1.35.1908dbee5c546
stdlib@go1.17.7
1.26.9

Open the chart page →

1,936
apachemy-chart-repo0.1.01 of 2See more

apache my-chart-repo 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
bitnami/mongodb:latestad05bb9a19fa
stdlib@go1.26.8
1.26.9

Open the chart page →

2,048
myhelmappmyhelmapp0.1.11 of 1See more

myhelmapp myhelmapp 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
tobirachel/node-project3:v17d9f37154994
stdlib@go1.17.5
1.26.9

Open the chart page →

4,547
my-helm-chartmy-helm-chart0.1.01 of 3See more

my-helm-chart my-helm-chart 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/postgres:latest5a5a84b19854
stdlib@go1.24.6
1.26.9

Open the chart page →

4,833
Practica_4_helmmy-heml-appVerified publisher0.1.03 of 7See more

Practica_4_helm my-heml-app 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.09fb4c11e6a49
stdlib@go1.18.10
1.26.9
library/mongo:5.0.6-focal8e70544b6c76
stdlib@go1.16.7
1.26.9
library/mysql:8.0.28fc77d54cacef
stdlib@go1.16.7
1.26.9

Open the chart page →

32,836
grafana-chartmy-personal-grafana0.1.01 of 1See more

grafana-chart my-personal-grafana 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
grafana/grafana:latestb28bae15e219
stdlib@go1.26.7
1.26.9

Open the chart page →

335
influxdbmy-personal-influxdb20.1.01 of 1See more

influxdb my-personal-influxdb2 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/influxdb:2.7b8d940ca9376
stdlib@go1.18.2
1.26.9

Open the chart page →

5,192
phonebook-chartmy-phonebook-chart0.1.01 of 3See more

phonebook-chart my-phonebook-chart 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
stdlib@go1.18.2
1.26.9

Open the chart page →

3,883
mychartmysqlweb0.1.01 of 1See more

mychart mysqlweb 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
qichenxu4pd/mysqlweb:1.2d758d41d9c6b
stdlib@go1.18.2
1.26.9

Open the chart page →

2,010
myweatherhelmmyweather1.3.111 of 7See more

myweatherhelm myweather 1.3.11

1 of the 7 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/rabbitmq:3-managemente582c0bc7766
stdlib@go1.22.2
1.26.9

Open the chart page →

20,272
fargate-sidecar-injectormziyaboVerified publisher0.1.51 of 1See more

fargate-sidecar-injector mziyabo 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
mziyabo/fargate-eks-sidecar-injector:latest3067dce17983
stdlib@go1.19.13
1.26.9

Open the chart page →

2,087
haproxy-ingressn42-gateway0.16.21 of 1See more

haproxy-ingress n42-gateway 0.16.2

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
quay.io/jcmoraisjr/haproxy-ingress:v0.16.242bcf39842db
stdlib@go1.26.8
1.26.9

Open the chart page →

236
victoria-metrics-singlenaps0.0.61 of 1See more

victoria-metrics-single naps 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
victoriametrics/victoria-metrics:v1.34.7b50d5c0153f9
stdlib@go1.14.1
1.26.9

Open the chart page →

2,398
pagesnarain1.0.01 of 3See more

pages narain 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.26.9

Open the chart page →

21,310
pagesnarasimha-pages1.0.01 of 3See more

pages narasimha-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.26.9

Open the chart page →

21,310
traefik-forward-auth-openidnas-helm-chartsVerified publisher1.0.11 of 1See more

traefik-forward-auth-openid nas-helm-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
thomseddon/traefik-forward-auth:latestb364aa6a4117
stdlib@go1.13.15
1.26.9

Open the chart page →

3,430
nats-kafkanatsVerified publisher0.15.41 of 1See more

nats-kafka nats 0.15.4

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
natsio/nats-kafka:1.4.2bb241956b0dc
stdlib@go1.20
1.26.9

Open the chart page →

2,579
nats-operatornatsVerified publisher0.8.31 of 1See more

nats-operator nats 0.8.3

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
natsio/nats-operator:0.8.31261dae38389
stdlib@go1.16.10
1.26.9

Open the chart page →

3,451
account-servernatz-operatorVerified publisher0.9.51 of 1See more

account-server natz-operator 0.9.5

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
ghcr.io/zeiss/natz-operator/account-server:0.9.5b380b5f17c3f
stdlib@go1.23.3
1.26.9

Open the chart page →

1,279
navidromenavidrome0.2.51 of 1See more

navidrome navidrome 0.2.5

1 of the 1 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
deluan/navidrome:0.41.1fc4d8b6ad9f9
stdlib@go1.16.2
1.26.9

Open the chart page →

4,603
pagesnavin-brixton1.0.01 of 3See more

pages navin-brixton 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-94439.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.26.9

Open the chart page →

21,310

Container images carrying it

6,205 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
goharbor/registry-photon:v2.15.2c4ebef61ceb5
stdlib@go1.26.4
1.26.9
3
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
stdlib@go1.26.4
1.26.9
3
grafana/grafana:8.2.500568d89c4f8
stdlib@go1.17
1.26.9
3
grafana/grafana:13.1.0121a7a9ece6d
stdlib@go1.25.7
1.26.9
3
grafana/grafana:11.3.0a0f881232a6f
stdlib@go1.23.1
1.26.9
3
grafana/loki:3.7.8:latest1107dd5274e0
stdlib@go1.26.6
1.26.9
3
grafana/loki:3.6.1144148ad243c0
stdlib@go1.26.2
1.26.9
3
grafana/loki:3.4.258a6c186ce78
stdlib@go1.23.6
1.26.9
3
grafana/loki-canary:3.6.70dac7d5cb383
stdlib@go1.24.13
1.26.9
3
grafana/promtail:2.4.2626900031c4e
stdlib@go1.17.2
1.26.9
3
groundnuty/k8s-wait-for:v2.0c14d7271e401
stdlib@go1.19.3
1.26.9
3
hashicorp/consul:2.0.41c59f007df8e
stdlib@go1.26.7
1.26.9
3
hashicorp/consul-k8s-control-plane:2.0.49334d7f4bcf0
stdlib@go1.26.7
1.26.9
3
hashicorp/http-echo:1.0.0:latestfcb75f691c8b
stdlib@go1.21.1
1.26.9
3
hashicorp/vault:2.0.45be49781ecf7
stdlib@go1.26.5
1.26.9
3
hashicorp/vault-k8s:1.7.655e27b080c9b
stdlib@go1.26.5
1.26.9
3
hetznercloud/hcloud-csi-driver:v2.23.0024ea4b07161
stdlib@go1.26.7
1.26.9
3
jacobalberty/unifi:v10.0.162896c0ab82d33
stdlib@go1.24.6
1.26.9
3
kubegems/kubegems:v1.24.10a730bcf9322a
stdlib@go1.24.10
1.26.9
3
kubernetesui/dashboard-api:1.14.096a702cfd339
stdlib@go1.23.12
1.26.9
3
kubernetesui/dashboard-auth:1.4.053e9917898bf
stdlib@go1.23.12
1.26.9
3
kubernetesui/dashboard-metrics-scraper:1.2.25154b68252bd
stdlib@go1.23.4
1.26.9
3
kubernetesui/dashboard-web:1.7.0cc7c31bd2d84
stdlib@go1.23.9
1.26.9
3
kubespheredev/kube-webhook-certgen:v1.1.123a03c9c381f
stdlib@go1.16.9
1.26.9
3
l7mp/stunner-auth-server:devc4654dade66e
stdlib@go1.27.1
1.26.9
3
library/caddy:latestf2a1290d0463
stdlib@go1.26.8
1.26.9
3
library/docker:20.10-dind:20-dindaf96c680a7e1
stdlib@go1.19.7
1.26.9
3
library/mariadb:13.0.2:latestd4fdec0510ad
stdlib@go1.26.7
1.26.9
3
library/nats:2.10-alpineb83efabe3e7d
stdlib@go1.24.2
1.26.9
3
library/nats:latestcd3fcd4ecdda
stdlib@go1.27.1
1.26.9
3
library/postgres:14.13162a6ead070
stdlib@go1.16.7
1.26.9
3
library/postgres:15.7-alpine:15.7-alpine3.20468d34fefd63
stdlib@go1.18.2
1.26.9
3
library/postgres:14-alpine4ea9e5ed0659
stdlib@go1.24.6
1.26.9
3
library/postgres:115d2aa4a7b5f9
stdlib@go1.16.7
1.26.9
3
library/postgres:1665b16a8b326e
stdlib@go1.24.6
1.26.9
3
library/postgres:18:18.6-trixie6737476511d4
stdlib@go1.24.6
1.26.9
3
library/postgres:15724292da1f2e
stdlib@go1.24.6
1.26.9
3
library/registry:3.1.1:latest1be55279f18a
stdlib@go1.25.9
1.26.9
3
library/traefik:v3.7.1324841fe2de73
stdlib@go1.26.8
1.26.9
3
mcp/grafana:latest9362bcf6aa0e
stdlib@go1.26.5
1.26.9
3
mikefarah/yq:2.4.16fc625c402de
stdlib@go1.13.3
1.26.9
3
minio/operator:v4.3.754393e03f3b2
stdlib@go1.17.4
1.26.9
3
mintel/dex-k8s-authenticator:1.4.0caf71cee7b9a
stdlib@go1.13.11
1.26.9
3
natsio/nats-account-server:1.0.0a3381560aab6
stdlib@go1.16.6
1.26.9
3
natsio/nats-server-config-reloader:0.13.0b3359eeb10bf
stdlib@go1.20.5
1.26.9
3
natsio/prometheus-nats-exporter:0.17.326c826662ac8
stdlib@go1.24.2
1.26.9
3
oamdev/kube-webhook-certgen:v2.4.1231c423c2b17
stdlib@go1.17.11
1.26.9
3
oliver006/redis_exporter:v1.93.06ca518a72f30
stdlib@go1.27.1
1.26.9
3
opencsghq/postgres:15.19b98600564e07
stdlib@go1.24.6
1.26.9
3
opencsghq/stakater-reloader:v1.4.190491782f7bac
stdlib@go1.26.4
1.26.9
3

syft 1.42.1 · advisories as of 11 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.