StackRadar

CVE-2025-47911

Unscored

Advisory

Published 5 Feb 2026In the index since 5 Sept 2026
Severity
Unscored
worst across findings
CVSS
—
base score, highest
EPSS
0.005
43rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,617
of 17,844 indexed, latest versions
Container images
3,118
deployed by those charts
Fix available
1 of 1
affected package

Quadratic parsing complexity in golang.org/x/net/html

Carried by container images the latest versions of 2,617 of 17,844 indexed charts deploy, on 3,118 images.

Affected packageAffected versionsFixed inImages
golang.org/x/netgolangv0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+213 more0.45.03,118
OSV records
GO-2026-4440
Also known as
GHSA-w4gw-w5jq-g9jh

Charts affected

2,617 by stars
ChartLatestAffected imagesRadar Score
waardepapieren-registerwaardepapieren-register1.1.01 of 4See more

waardepapieren-register waardepapieren-register 1.1.0

1 of the 4 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/waardepapieren-register-php:latest9affab218351
golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9
0.45.0

Open the chart page →

7,442
webhook-testerwebhook-testerVerified publisher2.3.01 of 1See more

webhook-tester webhook-tester 2.3.0

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
ghcr.io/tarampampam/webhook-tester:2.3.085818267b450
golang.org/x/net@v0.38.0
0.45.0

Open the chart page →

217
frpcwener1.0.11 of 1See more

frpc wener 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
wener/frpc:v0.37.0cc9fd4da44c0
golang.org/x/net@v0.0.0-20200520004742-59133d7f0dd7
0.45.0

Open the chart page →

3,363
frpswener1.0.11 of 1See more

frps wener 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
wener/frps:v0.37.05c92cc9e8597
golang.org/x/net@v0.0.0-20200520004742-59133d7f0dd7
0.45.0

Open the chart page →

3,363
seaweedfswener2.92.01 of 1See more

seaweedfs wener 2.92.0

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
chrislusf/seaweedfs:2.92db095fe8a8d6
golang.org/x/net@v0.0.0-20210813160813-60bc85c4be6d
0.45.0

Open the chart page →

2,748
cockroachdbwenerme22.0.41 of 3See more

cockroachdb wenerme 22.0.4

1 of the 3 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
cockroachdb/cockroach-self-signer-cert:1.10b0fcc6c8147a
golang.org/x/net@v0.38.0
0.45.0

Open the chart page →

273
frpswenerme1.0.11 of 1See more

frps wenerme 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
wener/frps:v0.37.05c92cc9e8597
golang.org/x/net@v0.0.0-20200520004742-59133d7f0dd7
0.45.0

Open the chart page →

3,363
wharf-ainowharf-helmVerified publisher0.1.55 of 7See more

wharf-aino wharf-helm 0.1.5

5 of the 7 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
quay.io/iver-wharf/wharf-api:v5.2.0b736b345437d
golang.org/x/net@v0.0.0-20220325170049-de3da57026de
0.45.0
quay.io/iver-wharf/wharf-cmd:v0.8.2e98d13459cdc
golang.org/x/net@v0.0.0-20220412020605-290c469a71a5
0.45.0
quay.io/iver-wharf/wharf-provider-azuredevops:v3.0.12fe7e4dcffdf
golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4
0.45.0
quay.io/iver-wharf/wharf-provider-github:v3.0.177a22cb45c2a
golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4
0.45.0
quay.io/iver-wharf/wharf-provider-gitlab:v2.0.1d7079e0890da
golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4
0.45.0

Open the chart page →

13,495
wharf-cmdwharf-helmVerified publisher0.3.31 of 1See more

wharf-cmd wharf-helm 0.3.3

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
quay.io/iver-wharf/wharf-cmd:v0.8.2e98d13459cdc
golang.org/x/net@v0.0.0-20220412020605-290c469a71a5
0.45.0

Open the chart page →

3,439
spark-operatorwikimedia2.2.71 of 1See more

spark-operator wikimedia 2.2.7

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
ghcr.io/kubeflow/spark-operator/controller:2.2.1865ff4da5686
golang.org/x/net@v0.38.0
0.45.0

Open the chart page →

53,956
external-monitoringwiremindVerified publisher0.3.01 of 1See more

external-monitoring wiremind 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
quay.io/prometheus/blackbox-exporter:v0.24.03af31f8bd1ad
golang.org/x/net@v0.9.0
0.45.0

Open the chart page →

1,301
kubemodwiremindVerified publisher0.1.51 of 2See more

kubemod wiremind 0.1.5

1 of the 2 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
kubemod/kubemod:v0.13.0cadca39288ad
golang.org/x/net@v0.0.0-20200520004742-59133d7f0dd7
0.45.0

Open the chart page →

3,031
db-backup-retentionwjentner-chartsVerified publisher1.1.01 of 1See more

db-backup-retention wjentner-charts 1.1.0

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
ghcr.io/wjentner/k8s-db-backup-retention:v1.1.08027bb46d1f4
golang.org/x/net@v0.26.0
0.45.0

Open the chart page →

1,044
workflows-informerworkflows-informerVerified publisher0.4.41 of 1See more

workflows-informer workflows-informer 0.4.4

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
registry.gitlab.com/dyff/workflows-informer:0.4.4bfbadc49635d
golang.org/x/net@v0.17.0
0.45.0

Open the chart page →

1,191
wraftwraft0.1.121 of 9See more

wraft wraft 0.1.12

1 of the 9 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2023-07-21T21-12-44Z8e5e9490cd50
golang.org/x/net@v0.12.0
0.45.0

Open the chart page →

9,365
pi-hole-exporterwyrihaximusnetVerified publisher0.1.31 of 1See more

pi-hole-exporter wyrihaximusnet 0.1.3

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
ekofr/pihole-exporter:0.0.109fdad6f352e0
golang.org/x/net@v0.0.0-20190620200207-3b0461eec859
0.45.0

Open the chart page →

1,810
redis-db-assignment-operatorwyrihaximusnetVerified publisher1.0.61 of 1See more

redis-db-assignment-operator wyrihaximusnet 1.0.6

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
ghcr.io/wyrihaximusnet/kubernetes-redis-db-assignment-operator:v1.0.831060be60bec
golang.org/x/net@v0.0.0-20220225172249-27dd8689420f
0.45.0

Open the chart page →

2,236
prometheusalertxxl-job-adminVerified publisher1.4.01 of 1See more

prometheusalert xxl-job-admin 1.4.0

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
feiyu563/prometheus-alert:v4.9.28192368b0578
golang.org/x/net@v0.24.0
0.45.0

Open the chart page →

1,116
heistyouniqx-ossVerified publisher1.1.2091 of 1See more

heist youniqx-oss 1.1.209

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
quay.io/youniqx/heist:v1.1.209c43b3a9d98ae
golang.org/x/net@v0.28.0
0.45.0

Open the chart page →

806
tailscale-relayzeet0.1.51 of 1See more

tailscale-relay zeet 0.1.5

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
zeetdev/tailscale-relay:v1.24.21967aa2840b6
golang.org/x/net@v0.0.0-20220407224826-aac1ed45d8e3
0.45.0

Open the chart page →

2,167
cloudflare-zero-trust-operatorzelic-io0.7.11 of 1See more

cloudflare-zero-trust-operator zelic-io 0.7.1

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
ghcr.io/bojanzelic/cloudflare-zero-trust-operator:0.7.1f4b2dbc19a78
golang.org/x/net@v0.33.0
0.45.0

Open the chart page →

591
mikochizer0tonin1.11.01 of 1See more

mikochi zer0tonin 1.11.0

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
zer0tonin/mikochi:1.11.009872bae1554
golang.org/x/net@v0.40.0
0.45.0

Open the chart page →

1,050
abstract-nodeabstract-nodeVerified publisher0.1.491 of 2See more

abstract-node abstract-node 0.1.49

1 of the 2 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
ghcr.io/abstract-foundation/zksync-external-node-sidecar:v1.0.03e705d0eb1ce
golang.org/x/net@v0.7.0
0.45.0

Open the chart page →

4,623
jenkinsaditisingh-jenkins1.0.01 of 1See more

jenkins aditisingh-jenkins 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
golang.org/x/net@v0.38.0
0.45.0

Open the chart page →

2,577
gobackupadnoctemVerified publisher0.4.01 of 1See more

gobackup adnoctem 0.4.0

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
huacnlee/gobackup:v3.1.1560be93229a5
golang.org/x/net@v0.17.0
0.45.0

Open the chart page →

1,845
popeyeadnoctemVerified publisher0.3.01 of 1See more

popeye adnoctem 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
derailed/popeye:v0.22.18e68e22c7663
golang.org/x/net@v0.34.0
0.45.0

Open the chart page →

1,343
adresserviceadresservice1.1.01 of 5See more

adresservice adresservice 1.1.0

1 of the 5 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/adresservice-php:latestc5075f0320cd
golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9
0.45.0

Open the chart page →

7,460
bootaerokube1.0.12 of 4See more

boot aerokube 1.0.1

2 of the 4 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
quay.io/aerokube/boot:1.0.13c269612053f
golang.org/x/net@v0.24.0
0.45.0
quay.io/aerokube/keygen:1.0.1578934444f04
golang.org/x/net@v0.8.0
0.45.0

Open the chart page →

8,050
browser-opsaerokube2.6.71 of 1See more

browser-ops aerokube 2.6.7

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
quay.io/aerokube/browser-ops:2.6.7807c1bb67086
golang.org/x/net@v0.23.0
0.45.0

Open the chart page →

553
moonaerokube1.1.373 of 3See more

moon aerokube 1.1.37

3 of the 3 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
aerokube/moon:1.9.17da76ca51220d
golang.org/x/net@v0.25.0
0.45.0
aerokube/moon-api:1.9.176b6323e75785
golang.org/x/net@v0.25.0
0.45.0
aerokube/selenoid-ui:1.10.113f3e299509fd
golang.org/x/net@v0.10.0
0.45.0

Open the chart page →

2,473
agendaserviceagendaservice1.0.01 of 3See more

agendaservice agendaservice 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
conduction/agendaservice-php:latest9cfeeb6c7c20
golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9
0.45.0

Open the chart page →

7,220
agentkube-operatoragentkube-operator0.3.01 of 1See more

agentkube-operator agentkube-operator 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.43.0f5c29683a301
golang.org/x/net@v0.8.0
0.45.0

Open the chart page →

1,734
mt-channel-brokerahhhhVerified publisher0.1.03 of 3See more

mt-channel-broker ahhhh 0.1.0

3 of the 3 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
gcr.io/knative-releases/knative.dev/eventing/cmd/broker/filterdigest-pinnedd675f211a40f
golang.org/x/net@v0.30.0
0.45.0
gcr.io/knative-releases/knative.dev/eventing/cmd/broker/ingressdigest-pinnedec4b544499ba
golang.org/x/net@v0.30.0
0.45.0
gcr.io/knative-releases/knative.dev/eventing/cmd/mtchannel_brokerdigest-pinned395f4ff1bd34
golang.org/x/net@v0.30.0
0.45.0

Open the chart page →

2,631
net-istioahhhhVerified publisher0.1.12 of 2See more

net-istio ahhhh 0.1.1

2 of the 2 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
gcr.io/knative-releases/knative.dev/net-istio/cmd/controllerdigest-pinnede70bc675f977
golang.org/x/net@v0.30.0
0.45.0
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhookdigest-pinned7d76a6d42d13
golang.org/x/net@v0.30.0
0.45.0

Open the chart page →

1,128
net-kourierahhhhVerified publisher0.18.11 of 1See more

net-kourier ahhhh 0.18.1

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourierdigest-pinned15a601147ef4
golang.org/x/net@v0.39.0
0.45.0

Open the chart page →

516
pod-sweeperairbyteVerified publisher1.5.11 of 1See more

pod-sweeper airbyte 1.5.1

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
airbyte/pod-sweeper:1.5.198d2c39d512e
golang.org/x/net@v0.26.0
0.45.0

Open the chart page →

5,043
airbyteairbyte-v2Verified publisher2.3.02 of 10See more

airbyte airbyte-v2 2.3.0

2 of the 10 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
airbyte/minio:RELEASE.2023-11-20T22-40-07Zfdae972eaf0e
golang.org/x/net@v0.17.0
0.45.0
temporalio/auto-setup:1.27.2b44cbfeb43db
golang.org/x/net@v0.34.0
0.45.0

Open the chart page →

12,226
airports-kafkaairports-kafka0.1.01 of 2See more

airports-kafka airports-kafka 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
golang.org/x/net@v0.0.0-20211216030914-fe4d6282115f
0.45.0

Open the chart page →

4,579
akriakri0.12.551 of 3See more

akri akri 0.12.55

1 of the 3 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.1.164d8c73dca98
golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023
0.45.0

Open the chart page →

1,546
aktoakto0.2.01 of 7See more

akto akto 0.2.0

1 of the 7 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
keelhq/keel:latest73714afb4443
golang.org/x/net@v0.33.0
0.45.0

Open the chart page →

13,988
akto-ai-guardrails-v2akto0.3.01 of 6See more

akto-ai-guardrails-v2 akto 0.3.0

1 of the 6 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
aktosecurity/data-ingestion-service:1.4.946ed5bcb04b2
golang.org/x/net@v0.40.0
0.45.0

Open the chart page →

42,697
akto-hybrid-redactakto1.44.71 of 5See more

akto-hybrid-redact akto 1.44.7

1 of the 5 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
keelhq/keel:latest73714afb4443
golang.org/x/net@v0.33.0
0.45.0

Open the chart page →

4,997
akto-k8s-ebpfakto0.1.31 of 1See more

akto-k8s-ebpf akto 0.1.3

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
aktosecurity/mirror-api-logging:k8s_ebpf3e506f5e5f47
golang.org/x/net@v0.38.0
0.45.0

Open the chart page →

539
akto-mini-testingakto1.45.71 of 5See more

akto-mini-testing akto 1.45.7

1 of the 5 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/keelhq-keel:akto_v1.0.01eb61443d68e
golang.org/x/net@v0.33.0
0.45.0

Open the chart page →

6,665
akto-mini-testing-kafkaakto1.42.11 of 5See more

akto-mini-testing-kafka akto 1.42.1

1 of the 5 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
keelhq/keel:latest73714afb4443
golang.org/x/net@v0.33.0
0.45.0

Open the chart page →

6,551
akto-protectionakto0.1.01 of 4See more

akto-protection akto 0.1.0

1 of the 4 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
keelhq/keel:latest73714afb4443
golang.org/x/net@v0.33.0
0.45.0

Open the chart page →

11,425
akto-testing-db-layerakto1.42.171 of 2See more

akto-testing-db-layer akto 1.42.17

1 of the 2 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
keelhq/keel:latest73714afb4443
golang.org/x/net@v0.33.0
0.45.0

Open the chart page →

35,342
kpubberalekcVerified publisher0.0.41 of 1See more

kpubber alekc 0.0.4

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
ghcr.io/alekc/kpubber:v0.0.2a462d5797e14
golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023
0.45.0

Open the chart page →

2,230
valkey-operatoralekcVerified publisher0.4.01 of 1See more

valkey-operator alekc 0.4.0

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
ghcr.io/hyperspike/valkey-operator:v0.0.617d8c669f11a4
golang.org/x/net@v0.44.0
0.45.0

Open the chart page →

333
qbittorrentalexmorbo-qbittorrentVerified publisher1.2.11 of 1See more

qbittorrent alexmorbo-qbittorrent 1.2.1

1 of the 1 container images this version deploys carry CVE-2025-47911.

Container imageDigestPackageFixed in
ghcr.io/squat/generic-device-plugin:36bfc606bba2064de6ede0ff2764cbb52edff70dba6f0b4cf6c8
golang.org/x/net@v0.17.0
0.45.0

Open the chart page →

889

Container images carrying it

3,118 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/csi-resizer:v1.12.0ab774734705a
golang.org/x/net@v0.28.0
0.45.0
1
registry.k8s.io/sig-storage/csi-snapshotter:v6.1.0291334908ddf
golang.org/x/net@v0.0.0-20220909164309-bea034e7d591
0.45.0
1
registry.k8s.io/sig-storage/csi-snapshotter:v8.0.25f051159c95f
golang.org/x/net@v0.28.0
0.45.0
1
registry.k8s.io/sig-storage/csi-snapshotter:v8.2.15f4bb469fec5
golang.org/x/net@v0.33.0
0.45.0
1
registry.k8s.io/sig-storage/csi-snapshotter:v4.2.1818f35653f2e
golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023
0.45.0
1
registry.k8s.io/sig-storage/csi-snapshotter:v5.0.189e900a160a9
golang.org/x/net@v0.0.0-20210825183410-e898025ed96a
0.45.0
1
registry.k8s.io/sig-storage/hostpathplugin:v1.9.092257881c1d6
golang.org/x/net@v0.0.0-20201209123823-ac852fbbde11
0.45.0
1
registry.k8s.io/sig-storage/livenessprobe:v2.9.02b10b24dafdc
golang.org/x/net@v0.4.0
0.45.0
1
registry.k8s.io/sig-storage/livenessprobe:v2.11.082adbebdf5d5
golang.org/x/net@v0.13.0
0.45.0
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.8.03e2bf2eaef9f
golang.org/x/net@v0.37.0
0.45.0
1
registry.k8s.io/sig-storage/nfsplugin:v4.11.0ce5b5ccd5eb0
golang.org/x/net@v0.37.0
0.45.0
1
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.03ce0fdba4d8e
golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9
0.45.0
1
registry.k8s.io/sig-storage/objectstorage-sidecar:v0.2.2c7166a73a303
golang.org/x/net@v0.40.0
0.45.0
1
registry.k8s.io/sig-storage/snapshot-controller:v8.2.1472fa35a89da
golang.org/x/net@v0.33.0
0.45.0
1
registry.k8s.io/sig-storage/snapshot-controller:v4.2.195587f8777d7
golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023
0.45.0
1
registry.k8s.io/sig-storage/snapshot-controller:v6.2.198bab4eaf23c
golang.org/x/net@v0.4.0
0.45.0
1
registry.k8s.io/sig-storage/snapshot-controller:v6.3.1ce6ca3c0e30b
golang.org/x/net@v0.17.0
0.45.0
1
registry.k8s.io/sig-storage/volume-data-source-validator:v1.0.0d35884236461
golang.org/x/net@v0.0.0-20211209124913-491a49abca63
0.45.0
1

syft 1.42.1 · advisories as of 24 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.