StackRadar

CVE-2026-27136

Unscored

Advisory

Published 22 May 2026In the index since 5 Sept 2026
Severity
Unscored
worst across findings
CVSS
—
base score, highest
EPSS
0.002
13th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,999
of 17,797 indexed, latest versions
Container images
3,673
deployed by those charts
Fix available
1 of 1
affected package

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

Carried by container images the latest versions of 2,999 of 17,797 indexed charts deploy, on 3,673 images.

Affected packageAffected versionsFixed inImages
golang.org/x/netgolangv0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+220 more0.55.03,673
OSV records
GO-2026-5030

Charts affected

2,999 by stars
ChartLatestAffected imagesRadar Score

Container images carrying it

3,673 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/chaos-mesh/chaos-coredns:v0.2.838bfdf5e3774
golang.org/x/net@v0.0.0-20210614182718-04defd469f4e
0.55.0
2
ghcr.io/chaos-mesh/chaos-coredns:v0.2.678dc63bc5b89
golang.org/x/net@v0.0.0-20210614182718-04defd469f4e
0.55.0
2
ghcr.io/cloudnative-pg/cloudnative-pg:1.25.1b5210df46c05
golang.org/x/net@v0.35.0
0.55.0
2
ghcr.io/containerd/nydus-snapshotter:v0.9.056f8617363b4
golang.org/x/net@v0.8.0
0.55.0
2
ghcr.io/cosmos/gaia:v25.1.0f115777d1112
golang.org/x/net@v0.40.0
0.55.0
2
ghcr.io/cubed-it/inlets:4.0.0f02325f099bc
golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b
0.55.0
2
ghcr.io/dergeberl/kubeteach:v0.2.3-alphacf4428a3c79e
golang.org/x/net@v0.1.0
0.55.0
2
ghcr.io/dexidp/dex:v2.28.15e88f2205de1
golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb
0.55.0
2
ghcr.io/eosc-lot-1/curl-jq:8156beafae7ca
golang.org/x/net@v0.15.0
0.55.0
2
ghcr.io/fluxcd/flux-cli:v2.9.1020edbaee890
golang.org/x/net@v0.49.0
0.55.0
2
ghcr.io/glassflow/glassflow-etl-k8s-operator:v3.2.1e70364e88629
golang.org/x/net@v0.43.0
0.55.0
2
ghcr.io/google/fleetspeak:v0.1.17cd264d33efd4
golang.org/x/net@v0.24.0
0.55.0
2
ghcr.io/grafana/helm-chart-toolbox-kubectl:0.1.1c137478627cc
golang.org/x/net@v0.23.0
0.55.0
2
ghcr.io/jkroepke/kube-webhook-certgen:1.7.47a62bba56a7c
golang.org/x/net@v0.48.0
0.55.0
2
ghcr.io/jkroepke/kube-webhook-certgen:1.8.38ce13c365c8e
golang.org/x/net@v0.54.0
0.55.0
2
ghcr.io/jont828/cluster-api-visualizer:v1.5.0678ba6833297
golang.org/x/net@v0.42.0
0.55.0
2
ghcr.io/juniorjpdj/containers/openssl-kubectl:1.36.1-r358afba209ea0
golang.org/x/net@v0.48.0
0.55.0
2
ghcr.io/k8snetworkplumbingwg/multus-cni:v4.1.409fdfb7ce090
golang.org/x/net@v0.23.0
0.55.0
2
ghcr.io/keptn/certificate-operator:v3.0.0b82064b0e339
golang.org/x/net@v0.30.0
0.55.0
2
ghcr.io/keptn/lifecycle-operator:v2.0.0866ced256a8c
golang.org/x/net@v0.30.0
0.55.0
2
ghcr.io/keptn/metrics-operator:v2.1.0dc48471c7cf8
golang.org/x/net@v0.37.0
0.55.0
2
ghcr.io/klicktipp/kubectl:1.36.30c2402d92b5c
golang.org/x/net@v0.49.0
0.55.0
2
ghcr.io/kluster-manager/cluster-auth:v0.5.1fba6fb872281
golang.org/x/net@v0.47.0
0.55.0
2
ghcr.io/konpyutaika/docker-images/nifikop:v1.14.1-release6bb00c592a82
golang.org/x/net@v0.38.0
0.55.0
2
ghcr.io/matrix-org/sliding-sync:v0.99.19b940cab56435
golang.org/x/net@v0.17.0
0.55.0
2
ghcr.io/nucleuscloud/neosync/api:0.5.41e2abb798f29f
golang.org/x/net@v0.37.0
0.55.0
2
ghcr.io/nucleuscloud/neosync/worker:0.5.4196f42450c5b1
golang.org/x/net@v0.37.0
0.55.0
2
ghcr.io/parca-dev/parca:v0.20.00d1df8f436f7
golang.org/x/net@v0.17.0
0.55.0
2
ghcr.io/rabbitmq/messaging-topology-operator:1.19.124c4649ef3ef
golang.org/x/net@v0.53.0
0.55.0
2
ghcr.io/sigstore/scaffolding/createcerts7f59f7c08d1a
golang.org/x/net@v0.46.0
0.55.0
2
ghcr.io/smarter-project/smarter-device-manager:v1.20.12228f7f44594a
golang.org/x/net@v0.2.0
0.55.0
2
ghcr.io/spiffe/spiffe-csi-driver:0.2.79dfe4f0caff0
golang.org/x/net@v0.34.0
0.55.0
2
ghcr.io/spiffe/spiffe-helper:0.11.01c92e5998ad3
golang.org/x/net@v0.42.0
0.55.0
2
ghcr.io/squat/generic-device-plugin:36bfc606bba2064de6ede0ff2764cbb52edff70dba6f0b4cf6c8
golang.org/x/net@v0.17.0
0.55.0
2
ghcr.io/stashed/stash-ui-server:v0.23.047cffbc65700
golang.org/x/net@v0.38.0
0.55.0
2
ghcr.io/wg-easy/wg-easy:15:15.4.00e7bc9d34e86
golang.org/x/net@v0.44.0
0.55.0
2
public.ecr.aws/cloudnatix/llmariner/api-usage-server:1.16.08f9c32b866b0
golang.org/x/net@v0.38.0
0.55.0
2
public.ecr.aws/cloudnatix/llmariner/cluster-manager-server:1.8.0364b3ff0fcb7
golang.org/x/net@v0.38.0
0.55.0
2
public.ecr.aws/cloudnatix/llmariner/cluster-monitor-server:0.10.22d28f9e3eab4
golang.org/x/net@v0.38.0
0.55.0
2
public.ecr.aws/cloudnatix/llmariner/file-manager-server:1.11.0301216788e93
golang.org/x/net@v0.38.0
0.55.0
2
public.ecr.aws/cloudnatix/llmariner/inference-manager-engine:1.46.0c46f109c3d0b
golang.org/x/net@v0.48.0
0.55.0
2
public.ecr.aws/cloudnatix/llmariner/job-manager-dispatcher:1.27.0582508903cb0
golang.org/x/net@v0.38.0
0.55.0
2
public.ecr.aws/cloudnatix/llmariner/job-manager-server:1.27.0fe9de719f91e
golang.org/x/net@v0.38.0
0.55.0
2
public.ecr.aws/cloudnatix/llmariner/model-manager-loader:1.27.026ac7263a823
golang.org/x/net@v0.38.0
0.55.0
2
public.ecr.aws/cloudnatix/llmariner/model-manager-server:1.27.0c057dcdd9ef3
golang.org/x/net@v0.38.0
0.55.0
2
public.ecr.aws/cloudnatix/llmariner/rbac-server:1.19.1df1adeb86679
golang.org/x/net@v0.38.0
0.55.0
2
public.ecr.aws/cloudnatix/llmariner/user-manager-server:1.27.1628a14449241
golang.org/x/net@v0.38.0
0.55.0
2
public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver:v1.16.11564359e1e0e
golang.org/x/net@v0.4.0
0.55.0
2
public.ecr.aws/eks-distro/etcd-io/etcd:v3.5.6-eks-1-24-7efa6dee17ed2
golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2
0.55.0
2
public.ecr.aws/eks-distro/kubernetes-csi/external-attacher:v4.1.0-eks-1-25-latest701eea03388c
golang.org/x/net@v0.4.0
0.55.0
2

syft 1.42.1 · advisories as of 17 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.