VDB
GO-2026-6089
GO-2026-6089
PUBLISHED
Record from OSV · Published August 13, 2026
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| pulumi-kubernetes-operator | Chainguard | 2.9.0-r2 |
| crossplane-provider-aws-datapipeline | Chainguard | 2.7.0-r1 |
| rancher-webhook-fips-0.9 | Chainguard | 0.9.7-r3 |
| grafana-zipkin-datasource | Chainguard | 12.4.6-r0 |
| containerd-1 | Chainguard | 1.7.34-r5 |
| opentelemetry-collector-k8s | Chainguard | 0.158.0-r1 |
| nginx-prometheus-exporter | Chainguard | 1.5.3-r0 |
| starrocks-kubernetes-operator-fips | Chainguard | 1.11.7-r1 |
| aactl | Wolfi | 0.4.12-r68 |
| grafana-mimir-3.0 | Chainguard | 3.0.9-r4, 3.0.8-r3 |
| victoriametrics | Chainguard | 1.152.0-r0, 1.149.0-r1 |
| crossplane-provider-aws-athena-fips | Chainguard | 2.7.0-r1 |
87 more packages have a fixed version. See every fix in Lookup.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | nri-nginx | * |
| chainguard | mapotf-fips | * |
| chainguard | mattmoor-chainit | * |
| chainguard | capslock | * |
| chainguard | containerd-1 | 0 |
| chainguard | nats-top | * |
| chainguard | livekit-cli | * |
| chainguard | opentelemetry-collector-k8s | 0 |
| chainguard | nginx-prometheus-exporter | 0 |
| chainguard | starrocks-kubernetes-operator-fips | 0 |
| wolfi | aactl | 0 |
| chainguard | grafana-mimir-3.0 | 0, 0 |
| chainguard | victoriametrics | 0, 0 |
| chainguard | delve | * |
| chainguard | crossplane-provider-aws-athena-fips | 0 |
| chainguard | kserve-modelmesh-serving | 0 |
| chainguard | staticcheck | * |
| chainguard | atlas-fips-1.3 | * |
| chainguard | kubernetes-csi-node-driver-registrar-2.16 | 0 |
| chainguard | configmap-reload-fips-0.12 | 0 |
…and 2888 more
Timeline
- Aug 13, 2026 CVE Published
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GO-2026-6089
vulnetix vdb fixes GO-2026-6089Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GO-2026-6089/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart