CVE-2026-25680

Medium

Advisory

Published 22 May 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.5; base score, highest
EPSS: 0.003; 26th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 3,015; of 17,787 indexed, latest versions
Container images: 3,690; deployed by those charts
Fix available: 1 of 1; affected package

Go Net HTML parser is vulnerable to denial of service

Carried by container images the latest versions of 3,015 of 17,787 indexed charts deploy, on 3,690 images.

Affected package	Affected versions	Fixed in	Images
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+220 more	0.55.0	3,690

OSV records: GHSA-5cv4-jp36-h3mw
Also known as: GO-2026-5028

Charts affected

3,015 by stars

Chart

Latest

Affected images

Radar Score

swo-k8s-collectorsolarwinds

5.3.0

2 of 3 See more

swo-k8s-collector solarwinds 5.3.0

2 of the 3 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
ghcr.io/open-telemetry/opentelemetry-ebpf-instrumentation/ebpf-instrument :v0.9.0	26f82b148dfe	golang.org/x/net@v0.53.0	0.55.0
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.19.0	6b2f0b6f2f86	golang.org/x/net@v0.51.0	0.55.0

Open the chart page →

2,347

sops-operatorsops-operator

0.10.1

1 of 2 See more

sops-operator sops-operator 0.10.1

1 of the 2 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
clastix/kubectl :v1.31	22918a06c253	golang.org/x/net@v0.26.0	0.55.0

Open the chart page →

1,250

thehivestrangebee-helm

1.0.6

4 of 7 See more

thehive strangebee-helm 1.0.6

4 of the 7 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
bitnamilegacy/elasticsearch :9.1.2-debian-12-r0	00176a47afa0	golang.org/x/net@v0.42.0	0.55.0
bitnamilegacy/os-shell :12-debian-12-r51	77e65e9d633e	golang.org/x/net@v0.42.0	0.55.0
minio/mc :RELEASE.2025-08-13T08-35-41Z	a7fe349ef4bd	golang.org/x/net@v0.42.0	0.55.0
minio/minio :RELEASE.2025-09-07T16-13-09Z	14cea493d9a3	golang.org/x/net@v0.39.0	0.55.0

Open the chart page →

16,161

truenas-csptruenas-csp

1.2.4

10 of 11 See more

truenas-csp truenas-csp 1.2.4

10 of the 11 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
quay.io/hpestorage/csi-driver :v3.2.0	ef7f4e1544fa	golang.org/x/net@v0.48.0	0.55.0
quay.io/hpestorage/csi-extensions :v1.2.11	89146672a7ac	golang.org/x/net@v0.48.0	0.55.0
quay.io/hpestorage/volume-group-provisioner :v1.0.10	7bf9d8f16a5d	golang.org/x/net@v0.48.0	0.55.0
quay.io/hpestorage/volume-group-snapshotter :v1.0.10	caeaaffe7e2b	golang.org/x/net@v0.48.0	0.55.0
quay.io/hpestorage/volume-mutator :v1.3.10	9e98b2e697bd	golang.org/x/net@v0.48.0	0.55.0
registry.k8s.io/sig-storage/csi-attacher :v4.12.0	b9dc9a714a48	golang.org/x/net@v0.54.0	0.55.0
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.17.0	f9de845b1701	golang.org/x/net@v0.54.0	0.55.0
registry.k8s.io/sig-storage/csi-provisioner :v6.2.0	6be9f63ca4ca	golang.org/x/net@v0.51.0	0.55.0
registry.k8s.io/sig-storage/csi-resizer :v2.1.0	589e525cddef	golang.org/x/net@v0.48.0	0.55.0
registry.k8s.io/sig-storage/csi-snapshotter :v8.5.0	da081c27e8a6	golang.org/x/net@v0.49.0	0.55.0

Open the chart page →

5,851

uffizzi-controlleruffizzi-controller

2.4.6

8 of 11 See more

uffizzi-controller uffizzi-controller 2.4.6

8 of the 11 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
uffizzi/controller :latest	0344805f267b	golang.org/x/net@v0.12.0	0.55.0
uffizzi/uffizzi-cluster-operator :v1.6.5	5ca448a08783	golang.org/x/net@v0.8.0	0.55.0
quay.io/jetstack/cert-manager-cainjector :v1.14.5	4ffda7facb4d	golang.org/x/net@v0.24.0	0.55.0
quay.io/jetstack/cert-manager-controller :v1.14.5	9c0527cab629	golang.org/x/net@v0.24.0	0.55.0
quay.io/jetstack/cert-manager-startupapicheck :v1.14.5	0f5b104bdd1b	golang.org/x/net@v0.24.0	0.55.0
quay.io/jetstack/cert-manager-webhook :v1.14.5	ef419261a209	golang.org/x/net@v0.24.0	0.55.0
registry.k8s.io/ingress-nginx/controller :v1.10.1	e24f39d3eed6	golang.org/x/net@v0.22.0	0.55.0
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.4.1	36d05b4077fb	golang.org/x/net@v0.22.0	0.55.0

Open the chart page →

14,266

filebrowserutkuozdemir

1.0.0

1 of 1 See more

filebrowser utkuozdemir 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
filebrowser/filebrowser :v2.23.0	86e8449ff8ff	golang.org/x/net@v0.0.0-20220412020605-290c469a71a5	0.55.0

Open the chart page →

3,073

vsphere-csivsphere-tmm

3.8.1

7 of 7 See more

vsphere-csi vsphere-tmm 3.8.1

7 of the 7 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
registry.k8s.io/csi-vsphere/driver :v3.5.0	4bb8350a5a62	golang.org/x/net@v0.38.0	0.55.0
registry.k8s.io/csi-vsphere/syncer :v3.5.0	bb88468fff2a	golang.org/x/net@v0.38.0	0.55.0
registry.k8s.io/sig-storage/csi-attacher :v4.8.1	69888dba5815	golang.org/x/net@v0.34.0	0.55.0
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.13.0	d7138bcc3aa5	golang.org/x/net@v0.32.0	0.55.0
registry.k8s.io/sig-storage/csi-provisioner :v4.0.1	bf5a235b67d8	golang.org/x/net@v0.19.0	0.55.0
registry.k8s.io/sig-storage/csi-resizer :v1.14.0	5e7cbb63fd49	golang.org/x/net@v0.39.0	0.55.0
registry.k8s.io/sig-storage/livenessprobe :v2.15.0	2c5f9dc4ea5a	golang.org/x/net@v0.32.0	0.55.0

Open the chart page →

3,911

wazuhwazuh-helm

0.0.8

1 of 4 See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
wazuh/wazuh-manager :4.11.1	1da5c38c6a78	golang.org/x/net@v0.0.0-20200202094626-16171245cfb2	0.55.0

Open the chart page →

6,168

zigbee2mqttzigbee2mqtt

2.14.1

1 of 2 See more

zigbee2mqtt zigbee2mqtt 2.14.1

1 of the 2 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
mikefarah/yq :4.45.1	2c100efaca06	golang.org/x/net@v0.33.0	0.55.0

Open the chart page →

1,032

aad-pod-identityaad-pod-identity

4.1.18

2 of 2 See more

aad-pod-identity aad-pod-identity 4.1.18

2 of the 2 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
mcr.microsoft.com/oss/azure/aad-pod-identity/mic :v1.8.17	3004b93fcb74	golang.org/x/net@v0.7.0	0.55.0
mcr.microsoft.com/oss/azure/aad-pod-identity/nmi :v1.8.17	77788bf38938	golang.org/x/net@v0.7.0	0.55.0

Open the chart page →

2,858

abcdesktopabcdesktop

4.4.12

1 of 9 See more

abcdesktop abcdesktop 4.4.12

1 of the 9 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
ghcr.io/abcdesktopio/keysgenerator :4.4	ca0662bc92a4	golang.org/x/net@v0.49.0	0.55.0

Open the chart page →

806

agonesagones

1.60.0

1 of 5 See more

agones agones 1.60.0

1 of the 5 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
alpine/kubectl :1.35.4	9ccd82364762	golang.org/x/net@v0.47.0	0.55.0

Open the chart page →

1,122

kubedbappscode

2026.7.10

3 of 8 See more

kubedb appscode 2026.7.10

3 of the 8 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/kubectl-nonroot :1.34	0b26892cec94	golang.org/x/net@v0.38.0	0.55.0
ghcr.io/appscode/petset :v0.1.0	93fa0daf603c	golang.org/x/net@v0.47.0	0.55.0
ghcr.io/appscode/sidekick :v0.0.15	d1036b07e348	golang.org/x/net@v0.47.0	0.55.0

Open the chart page →

4,048

cloudflaredartur9010

1.0.9

3 of 3 See more

cloudflared artur9010 1.0.9

3 of the 3 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
cloudflare/cloudflared :2026.3.0	6b599ca3e974	golang.org/x/net@v0.40.0	0.55.0
registry.k8s.io/ingress-nginx/controller :v1.15.1	594ceea76b01	golang.org/x/net@v0.52.0	0.55.0
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.6.9	01038e7de14b	golang.org/x/net@v0.52.0	0.55.0

Open the chart page →

2,990

baserowbaserow-chart

1.0.56

2 of 6 See more

baserow baserow-chart 1.0.56

2 of the 6 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
bitnamilegacy/minio :2024.7.4-debian-12-r0	952f86d1116c	golang.org/x/net@v0.26.0	0.55.0
caddy/ingress :v0.2.1	18d1366fc0e9	golang.org/x/net@v0.17.0	0.55.0

Open the chart page →

17,346

mysql-operatorbitpoke

0.6.3

2 of 2 See more

mysql-operator bitpoke 0.6.3

2 of the 2 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
bitpoke/mysql-operator :v0.6.3	f44fa86ab27e	golang.org/x/net@v0.8.0	0.55.0
bitpoke/mysql-operator-orchestrator :v0.6.3	d86560c75bed	golang.org/x/net@v0.8.0	0.55.0

Open the chart page →

3,354

cadvisorcadvisor

0.1.15

1 of 1 See more

cadvisor cadvisor 0.1.15

1 of the 1 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
gcr.io/cadvisor/cadvisor :v0.47.2	e6c562b5e983	golang.org/x/net@v0.8.0	0.55.0

Open the chart page →

1,698

celestia-appcelestia-labs

0.5.0

1 of 3 See more

celestia-app celestia-labs 0.5.0

1 of the 3 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
ghcr.io/celestiaorg/celestia-app :v3.7.0-arabica	23a9ec9b1879	golang.org/x/net@v0.34.0	0.55.0

Open the chart page →

1,066

cert-manager-webhook-hetznercert-manager-webhook-hetzner

0.2.1

1 of 1 See more

cert-manager-webhook-hetzner cert-manager-webhook-hetzner 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
deyaeddin/cert-manager-webhook-hetzner :latest	797b0d06210a	golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110	0.55.0

Open the chart page →

3,080

fadicetic

0.3.1

2 of 25 See more

fadi cetic 0.3.1

2 of the 25 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
grafana/grafana :7.3.5	511bc20bfcd1	golang.org/x/net@v0.0.0-20201022231255-08b38378de70	0.55.0
library/traefik :2.5.4	7d0228d19042	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e	0.55.0

Open the chart page →

53,012

openstack-cloud-controller-managercloud-provider-openstack

2.36.5

1 of 1 See more

openstack-cloud-controller-manager cloud-provider-openstack 2.36.5

1 of the 1 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
registry.k8s.io/provider-os/openstack-cloud-controller-manager :v1.36.0	e354e40db2d0	golang.org/x/net@v0.53.0	0.55.0

Open the chart page →

498

immudbcodenotary

1.9.7

1 of 1 See more

immudb codenotary 1.9.7

1 of the 1 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
codenotary/immudb :1.9.7	7c85d7cc4f22	golang.org/x/net@v0.17.0	0.55.0

Open the chart page →

1,247

routercosmo-router

0.18.0

1 of 1 See more

router cosmo-router 0.18.0

1 of the 1 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
ghcr.io/wundergraph/cosmo/router :0.243.0	5afcab98d9d7	golang.org/x/net@v0.38.0	0.55.0

Open the chart page →

1,669

dolibarrcowboysysop

9.0.3

1 of 3 See more

dolibarr cowboysysop 9.0.3

1 of the 3 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
wait4x/wait4x :3.3.1	4dcd86307de1	golang.org/x/net@v0.39.0	0.55.0

Open the chart page →

9,154

csi-wekafsplugincsi-wekafs

0.6.2-0

1 of 6 See more

csi-wekafsplugin csi-wekafs 0.6.2-0

1 of the 6 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
quay.io/k8scsi/csi-node-driver-registrar :v1.3.0	e6df72478956	golang.org/x/net@v0.0.0-20180301190904-22ae77b79946	0.55.0

Open the chart page →

2,824

daskhubdask

2024.1.1

2 of 9 See more

daskhub dask 2024.1.1

2 of the 9 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
library/traefik :2.10.6	1957e3314f43	golang.org/x/net@v0.17.0	0.55.0
registry.k8s.io/kube-scheduler :v1.26.11	0684e23172d9	golang.org/x/net@v0.17.0	0.55.0

Open the chart page →

14,134

seafiledatamate

0.6.0

4 of 6 See more

seafile datamate 0.6.0

4 of the 6 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
bitnamilegacy/elasticsearch :8.12.1-debian-11-r2	9cfd2df1294d	golang.org/x/net@v0.21.0	0.55.0
bitnamilegacy/minio :2024.8.3-debian-12-r1	5501c419f42e	golang.org/x/net@v0.26.0	0.55.0
bitnamilegacy/os-shell :11-debian-11-r96	8643af4facff	golang.org/x/net@v0.19.0	0.55.0
datamate/seafile-professional :11.0.20	2dd66b722464	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781	0.55.0

Open the chart page →

27,358

k8s-event-loggerdeliveryhero

1.4.0

1 of 1 See more

k8s-event-logger deliveryhero 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
maxrocketinternet/k8s-event-logger :2.7	0234bdec4626	golang.org/x/net@v0.38.0	0.55.0

Open the chart page →

273

drone-runner-dockerdrone

0.7.0

2 of 3 See more

drone-runner-docker drone 0.7.0

2 of the 3 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
drone/drone-runner-docker :1.8.1	137e79c5e23c	golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3	0.55.0
library/docker :20-dind	af96c680a7e1	golang.org/x/net@v0.4.0	0.55.0

Open the chart page →

5,674

k8s-image-swapperestahn

1.11.0

1 of 2 See more

k8s-image-swapper estahn 1.11.0

1 of the 2 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
ghcr.io/estahn/k8s-image-swapper :1.5.10	2f5be9cde5f9	golang.org/x/net@v0.19.0	0.55.0

Open the chart page →

1,980

loadtesterflagger

0.39.0

1 of 1 See more

loadtester flagger 0.39.0

1 of the 1 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
ghcr.io/fluxcd/flagger-loadtester :0.39.0	6a8546993cb5	golang.org/x/net@v0.28.0	0.55.0

Open the chart page →

1,760

flyteflyte

1.16.8

1 of 11 See more

flyte flyte 1.16.8

1 of the 11 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
kubernetesui/dashboard :v2.2.0	148991563e37	golang.org/x/net@v0.0.0-20201224014010-6772e930b67b	0.55.0

Open the chart page →

3,282

lndfold

0.3.15

3 of 4 See more

lnd fold 0.3.15

3 of the 4 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
thesisrobot/lnd :v0.16.4-beta-c	287129953689	golang.org/x/net@v0.8.0	0.55.0
thesisrobot/loop :v0.11.1-beta	89ae07e787ca	golang.org/x/net@v0.0.0-20191002035440-2ec189313ef0	0.55.0
thesisrobot/pool :v0.3.3-alpha	2d1c388a4bda	golang.org/x/net@v0.0.0-20191112182307-2180aed22343	0.55.0

Open the chart page →

8,834

intel-gpu-plugingeek-cookbook

4.4.2

1 of 1 See more

intel-gpu-plugin geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
intel/intel-gpu-plugin :0.20.0	143f0a45e174	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b	0.55.0

Open the chart page →

1,738

geonode-k8sgeonode-k8s

2.0.0

2 of 10 See more

geonode-k8s geonode-k8s 2.0.0

2 of the 10 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
jwilder/dockerize :v0.10.0	839cd6793d19	golang.org/x/net@v0.49.0	0.55.0
registry.k8s.io/kubectl :v1.32.0	8ccae74fc039	golang.org/x/net@v0.30.0	0.55.0

Open the chart page →

14,043

haproxy-ingresshaproxy-ingress

0.16.1

1 of 1 See more

haproxy-ingress haproxy-ingress 0.16.1

1 of the 1 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
quay.io/jcmoraisjr/haproxy-ingress :v0.16.1	6fd744191ef6	golang.org/x/net@v0.47.0	0.55.0

Open the chart page →

794

hertzbeathertzbeat

1.8.1

1 of 4 See more

hertzbeat hertzbeat 1.8.1

1 of the 4 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
victoriametrics/victoria-metrics :v1.95.1	f52723a08a44	golang.org/x/net@v0.18.0	0.55.0

Open the chart page →

14,109

permission-managerkfirfer

1.0.7

1 of 1 See more

permission-manager kfirfer 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
quay.io/sighup/permission-manager :v1.7.1-rc1	f5e6a5dcee33	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9	0.55.0

Open the chart page →

2,266

klusterviewklusterview

0.1.0

1 of 4 See more

klusterview klusterview 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	golang.org/x/net@v0.51.0	0.55.0

Open the chart page →

3,796

gateway-operatorkong

0.6.1

1 of 1 See more

gateway-operator kong 0.6.1

1 of the 1 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
kong/gateway-operator :1.6	03510967482b	golang.org/x/net@v0.39.0	0.55.0

Open the chart page →

842

kong-meshkong-mesh

2.14.4

1 of 3 See more

kong-mesh kong-mesh 2.14.4

1 of the 3 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
registry.k8s.io/kubectl :v1.36.1	d08f476d04d0	golang.org/x/net@v0.49.0	0.55.0

Open the chart page →

529

kubeflowkubeflow

1.6.2

25 of 45 See more

kubeflow kubeflow 1.6.2

25 of the 45 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
istio/proxyv2 :1.9.6	87a9db561d2e	golang.org/x/net@v0.0.0-20201224014010-6772e930b67b	0.55.0
istio/proxyv2 :1.14.1	df69c1a7af7c	golang.org/x/net@v0.0.0-20220412020605-290c469a71a5	0.55.0
kserve/kserve-controller :v0.8.0	f0692a9ea09f	golang.org/x/net@v0.0.0-20211205041911-012df41ee64c	0.55.0
kubeflow/training-operator :v1-e1434f6	ff847e2b6af0	golang.org/x/net@v0.0.0-20220607020251-c690dde0001d	0.55.0
kubeflownotebookswg/kfam :v1.6.1	f226fb44db57	golang.org/x/net@v0.0.0-20200602114024-627f9648deb9	0.55.0
kubeflownotebookswg/notebook-controller :v1.6.1	85e2e685abd6	golang.org/x/net@v0.0.0-20210825183410-e898025ed96a	0.55.0
kubeflownotebookswg/poddefaults-webhook :v1.6.1	7d42600e1524	golang.org/x/net@v0.0.0-20211209124913-491a49abca63	0.55.0
kubeflownotebookswg/profile-controller :v1.6.1	9f01767a460f	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd	0.55.0
kubeflownotebookswg/tensorboard-controller :v1.6.1	82ffdd2da285	golang.org/x/net@v0.0.0-20210825183410-e898025ed96a	0.55.0
metacontrollerio/metacontroller :v2.0.4	897c9601d2cc	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781	0.55.0
gcr.io/knative-releases/knative.dev/net-istio/cmd/controller :v1.2.0	f253b82941c2	golang.org/x/net@v0.0.0-20211209124913-491a49abca63	0.55.0
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhook :v1.2.0	a705c1ea8e9e	golang.org/x/net@v0.0.0-20211209124913-491a49abca63	0.55.0
gcr.io/knative-releases/knative.dev/serving/cmd/activator :v1.2.5	93ff6e693577	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f	0.55.0
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler :v1.2.5	007820fdb75b	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f	0.55.0
gcr.io/knative-releases/knative.dev/serving/cmd/controller :v1.2.5	75cfdcfa050a	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f	0.55.0
gcr.io/knative-releases/knative.dev/serving/cmd/domain-mapping :v1.2.5	23baa1932232	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f	0.55.0
gcr.io/knative-releases/knative.dev/serving/cmd/domain-mapping-webhook :v1.2.5	847bb97e3844	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f	0.55.0
gcr.io/knative-releases/knative.dev/serving/cmd/webhook :v1.2.5	9084ea8498ea	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f	0.55.0
gcr.io/ml-pipeline/api-server :2.0.0-alpha.5	dc6ca05bb94f	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd	0.55.0
gcr.io/ml-pipeline/cache-server :2.0.0-alpha.5	83e79c709df3	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd	0.55.0
gcr.io/ml-pipeline/persistenceagent :2.0.0-alpha.5	00db9796a37b	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd	0.55.0
gcr.io/ml-pipeline/scheduledworkflow :2.0.0-alpha.5	795a0c8a0e13	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd	0.55.0
gcr.io/ml-pipeline/viewer-crd-controller :2.0.0-alpha.5	34403f9f94be	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd	0.55.0
gcr.io/ml-pipeline/workflow-controller :v3.3.8-license-compliance	6c8e4e2a6443	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd	0.55.0
quay.io/dexidp/dex :v2.24.0	c9b7f6d0d953	golang.org/x/net@v0.0.0-20190813141303-74dc4d7220e7	0.55.0

Open the chart page →

97,040

testkubekubeshop

2.13.2

2 of 5 See more

testkube kubeshop 2.13.2

2 of the 5 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
kubeshop/bitnami-mongodb :8.3.8	d48b172d99d8	golang.org/x/net@v0.48.0	0.55.0
kubeshop/testkube-minio :2025.10	d8e1af6aca99	golang.org/x/net@v0.48.0	0.55.0

Open the chart page →

5,012

openelbkubesphere-stable

0.5.0

2 of 2 See more

openelb kubesphere-stable 0.5.0

2 of the 2 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
kubesphere/openelb :v0.5.0	b5b665c4672c	golang.org/x/net@v0.0.0-20200528225125-3c3fba18258b	0.55.0
kubespheredev/kube-webhook-certgen :v1.1.1	23a03c9c381f	golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023	0.55.0

Open the chart page →

4,329

operatorkube-starrocks

1.11.7

1 of 1 See more

operator kube-starrocks 1.11.7

1 of the 1 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
starrocks/operator :v1.11.7	8c20435a7579	golang.org/x/net@v0.17.0	0.55.0

Open the chart page →

556

venti-stackkuoss

0.5.0

3 of 9 See more

venti-stack kuoss 0.5.0

3 of the 9 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
ghcr.io/kuoss/eventrouter :v0.4.15	6226040e1346	golang.org/x/net@v0.38.0	0.55.0
ghcr.io/kuoss/lethe :v0.3.3	ebdf55fd5705	golang.org/x/net@v0.41.0	0.55.0
ghcr.io/kuoss/venti :v0.3.3	8ee3e70d77f1	golang.org/x/net@v0.42.0	0.55.0

Open the chart page →

3,810

librechatlibrechat-openshift

1.9.0

1 of 3 See more

librechat librechat-openshift 1.9.0

1 of the 3 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
library/mongo :8.0.20	098862b1339f	golang.org/x/net@v0.47.0	0.55.0

Open the chart page →

5,833

vclustermain

0.17.0

7 of 10 See more

vcluster main 0.17.0

7 of the 10 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
quay.io/kubermatic/machine-controller :v1.57.0	476ae867ae56	golang.org/x/net@v0.8.0	0.55.0
quay.io/kubermatic/operating-system-manager :v1.3.0	10081473da43	golang.org/x/net@v0.9.0	0.55.0
registry.k8s.io/etcd :3.6.4-0	e36c08168342	golang.org/x/net@v0.38.0	0.55.0
registry.k8s.io/kas-network-proxy/proxy-server :v0.0.37	c2f596cae3c6	golang.org/x/net@v0.7.0	0.55.0
registry.k8s.io/kube-apiserver :v1.25.0	f6902791fb9a	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b	0.55.0
registry.k8s.io/kube-controller-manager :v1.25.0	66ce7d460e53	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b	0.55.0
registry.k8s.io/kube-scheduler :v1.25.0	9330c53feca7	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b	0.55.0

Open the chart page →

11,556

headplanenbcloud

0.1.2

2 of 4 See more

headplane nbcloud 0.1.2

2 of the 4 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
bitnamilegacy/kubectl :latest	cd354d5b2556	golang.org/x/net@v0.41.0	0.55.0
headscale/headscale :0.25.1	a7a8ae9616bb	golang.org/x/net@v0.34.0	0.55.0

Open the chart page →

7,968

netris-operatornetrisai

3.0.2

1 of 2 See more

netris-operator netrisai 3.0.2

1 of the 2 container images this version deploys carry CVE-2026-25680.

Container image	Digest	Package	Fixed in
netrisai/netris-operator :v4.0.2	44f60aa0d898	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f	0.55.0

Open the chart page →

1,588

Container images carrying it

3,690 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
bsgrigorov/helm-operator :latest	45ab095f09c8	golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb	0.55.0	1
buddyspencer/gickup :0.10.38	6b656f19b0c1	golang.org/x/net@v0.37.0	0.55.0	1
buddyspencer/gickup :0.10.30	9e7dbf923c12	golang.org/x/net@v0.24.0	0.55.0	1
buildkite/agent :3.25.0	aec38cfaae0e	golang.org/x/net@v0.0.0-20200202094626-16171245cfb2	0.55.0	1
bulich/domain-exporter :latest	6d0b780f7c7b	golang.org/x/net@v0.10.0	0.55.0	1
burganbank/vault-initializer :v1	9259c34e4037	golang.org/x/net@v0.23.0	0.55.0	1
burningalchemist/sql_exporter :0.16.0	b8e4757c7def	golang.org/x/net@v0.30.0	0.55.0	1
bytesafe/bytesafe-ce :v1.0.4	ee287384c005	golang.org/x/net@v0.10.0	0.55.0	1
caarlos0/domain_exporter :v1.23.0	d11dec138900	golang.org/x/net@v0.20.0	0.55.0	1
calico/cni :v3.28.0	cef0c907b8f4	golang.org/x/net@v0.24.0	0.55.0	1
calico/cni :v3.28.1	e486870cfde8	golang.org/x/net@v0.24.0	0.55.0	1
calico/kube-controllers :v3.28.0	8f04e4772a2b	golang.org/x/net@v0.24.0	0.55.0	1
calico/kube-controllers :v3.28.1	eadb3a25109a	golang.org/x/net@v0.24.0	0.55.0	1
calico/node :v3.28.0	385bf6391fea	golang.org/x/net@v0.24.0	0.55.0	1
calico/node :v3.28.1	d8c644a8a3ee	golang.org/x/net@v0.24.0	0.55.0	1
camptocamp/bucket-cloner :latest	acfafc308d88	golang.org/x/net@v0.0.0-20210415231046-e915ea6b2b7d	0.55.0	1
captnbp/freebox-exporter :1.0.0-r0	1600c5a253e0	golang.org/x/net@v0.17.0	0.55.0	1
caroga/commentoplusplus :v1.8.7	f3233882b3bd	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e	0.55.0	1
casbin/casdoor :v1.224.0	66f836ef778b	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd	0.55.0	1
casbin/casdoor :v1.753.0	770ad9ec3190	golang.org/x/net@v0.21.0	0.55.0	1
casbin/casdoor :3.62.1	7729da148c61	golang.org/x/net@v0.49.0	0.55.0	1
casbin/casdoor :4.4.0	8511c0757ac3	golang.org/x/net@v0.49.0	0.55.0	1
casbin/casdoor :3.62.0	e08231f16c00	golang.org/x/net@v0.49.0	0.55.0	1
castopod/castopod :1.15.5	4e4f0440520f	golang.org/x/net@v0.50.0	0.55.0	1
cbeneke/hcloud-fip-controller :v0.4.1	dc658078d7ba	golang.org/x/net@v0.0.0-20200114155413-6afb5195e5aa	0.55.0	1
censedata/floating-server :v1.6.3	ebfffb9dd4c0	golang.org/x/net@v0.40.0	0.55.0	1
cesanta/docker_auth :1.14.0	98e0307e0d2d	golang.org/x/net@v0.38.0	0.55.0	1
cfcontainerization/cf-operator :v2.3.0-0.g27a91cdf	82fa261c18a8	golang.org/x/net@v0.0.0-20190813141303-74dc4d7220e7	0.55.0	1
cfcontainerization/quarks-job :v0.0.0-0.g70ae34b	58fb1c173a46	golang.org/x/net@v0.0.0-20190813141303-74dc4d7220e7	0.55.0	1
cgtysylr/cluster-octopus :1.0.0	aec0f8a38a77	golang.org/x/net@v0.13.0	0.55.0	1
chaerr/kridge :demo-operator-v0.1.2	66833deec017	golang.org/x/net@v0.7.0	0.55.0	1
chandanteekinavar/findery-market-payment-service :1.0	c96f759b6ce4	golang.org/x/net@v0.25.0	0.55.0	1
chaosnative/cle-auth-server :2.7.0	72ee352bc333	golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110	0.55.0	1
chaosnative/cle-license-module :2.7.0	62cf6adc355e	golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023	0.55.0	1
chaosnative/cle-server :2.7.0	e7bcff4a20c0	golang.org/x/net@v0.0.0-20211118161319-6a13c67c3ce4	0.55.0	1
charmcli/soft-serve :v0.4.0	39523c1a6ba8	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd	0.55.0	1
checkmk/check-mk-community :2.5.0p6	c11b422210c4	golang.org/x/net@v0.53.0	0.55.0	1
chirpstack/chirpstack-application-server :3.17.6	e0b23dfd24d6	golang.org/x/net@v0.0.0-20201224014010-6772e930b67b	0.55.0	1
chirpstack/chirpstack-application-server :3	fb7667fe037f	golang.org/x/net@v0.0.0-20220726230323-06994584191e	0.55.0	1
chirpstack/chirpstack-gateway-bridge :3.13.2	ce3f2cdca8a9	golang.org/x/net@v0.0.0-20201209123823-ac852fbbde11	0.55.0	1
chirpstack/chirpstack-network-server :3	c0bbbb7a3f1e	golang.org/x/net@v0.8.0	0.55.0	1
chirpstack/chirpstack-network-server :3.16.1	c98d7fe06bce	golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb	0.55.0	1
chrislusf/seaweedfs :3.64	634b094b2183	golang.org/x/net@v0.21.0	0.55.0	1
chrislusf/seaweedfs :3.56	ed80f00fde46	golang.org/x/net@v0.14.0	0.55.0	1
chriswells0/first-mate :1.0.5	f3918ec8471c	golang.org/x/net@v0.8.0	0.55.0	1
circleci/container-agent :3	4d8d0ae5efc3	golang.org/x/net@v0.8.0	0.55.0	1
ciscolabs/msm-nc :07102023	36d02faad958	golang.org/x/net@v0.10.0	0.55.0	1
clastix/capsule-rancher-addon :v0.1.1	43d301afbca8	golang.org/x/net@v0.4.0	0.55.0	1
cloudbees/cert-requester :2.3.3	1d44fb4f799b	golang.org/x/net@v0.0.0-20200927032502-5d4f70055728	0.55.0	1
cloudbees/sidecar-injector :2.3.3	8f102ef0383a	golang.org/x/net@v0.0.0-20200927032502-5d4f70055728	0.55.0	1