StackRadar

CVE-2026-27141

Unscored

Advisory

Published 26 Feb 2026In the index since 5 Sept 2026
Severity
Unscored
worst across findings
CVSS
—
base score, highest
EPSS
0.005
41st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
39
of 17,781 indexed, latest versions
Container images
41
deployed by those charts
Fix available
1 of 1
affected package

Sending certain HTTP/2 frames can cause a server to panic in golang.org/x/net

Carried by container images the latest versions of 39 of 17,781 indexed charts deploy, on 41 images.

Affected packageAffected versionsFixed inImages
golang.org/x/netgolangv0.50.00.51.041
OSV records
GO-2026-4559

Charts affected

39 by stars
ChartLatestAffected imagesRadar Score
argo-cdargoOfficialVerified publisher10.9.01 of 3See more

argo-cd argo 10.9.0

1 of the 3 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.45.18499afd690c4
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

3,218
argo-cdargo-cd-oci10.9.01 of 3See more

argo-cd argo-cd-oci 10.9.0

1 of the 3 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.45.18499afd690c4
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

3,218
connectonepassword-connect2.4.12 of 2See more

connect onepassword-connect 2.4.1

2 of the 2 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
1password/connect-api:1.8.2e915c0c84397
golang.org/x/net@v0.50.0
0.51.0
1password/connect-sync:1.8.26297ca6136c0
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

2,550
concourseconcourseVerified publisher20.3.01 of 2See more

concourse concourse 20.3.0

1 of the 2 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
concourse/concourse:8.3.040a143ce5873
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

2,022
gethethereum-helm-chartsVerified publisher1.1.41 of 2See more

geth ethereum-helm-charts 1.1.4

1 of the 2 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
ethereum/client-go:stableb8ab3451a117
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

616
coreinstill-aiOfficialVerified publisher0.1.751 of 15See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
instill/artifact-backend:b28766ac4a393e601ed
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

30,816
mattermost-rtcdmattermostVerified publisher1.4.11 of 1See more

mattermost-rtcd mattermost 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
mattermost/rtcd:latesta27058aaa53a
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

589
argo-cdwenerme10.9.01 of 3See more

argo-cd wenerme 10.9.0

1 of the 3 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.45.18499afd690c4
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

3,218
clustereye-stackclustereyeVerified publisher0.1.11 of 5See more

clustereye-stack clustereye 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
johnblack77/clustereye-api:latest9b8dbc0264ac
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

4,855
dkim-managerdkim-managerVerified publisher0.2.01 of 1See more

dkim-manager dkim-manager 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
ghcr.io/hsn723/dkim-manager:1.4.00312232b31a2
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

293
enbuildenbuildVerified publisher0.0.502 of 6See more

enbuild enbuild 0.0.50

2 of the 6 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
golang.org/x/net@v0.50.0
0.51.0
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

31,510
k8s-grafana-stackk8s-grafana-stackVerified publisher0.2.321 of 17See more

k8s-grafana-stack k8s-grafana-stack 0.2.32

1 of the 17 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
grafana/alloy:v1.14.0f50931848bd8
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

15,418
kymaroskymarosVerified publisher0.6.91 of 1See more

kymaros kymaros 0.6.9

1 of the 1 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
ghcr.io/kymaroshq/kymaros:0.6.9fb3b88633381
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

269
aerospike-backup-serviceaerospike-helmVerified publisher2.0.131 of 1See more

aerospike-backup-service aerospike-helm 2.0.13

1 of the 1 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
aerospike/aerospike-backup-service:3.5.1be40d709c583
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

628
buildkitbuildkit0.1.01 of 1See more

buildkit buildkit 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
moby/buildkit:master-rootless07115a67cd22
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

620
buildkit-privilegedbuildkit-privileged0.1.01 of 1See more

buildkit-privileged buildkit-privileged 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
moby/buildkit:masterbc964521ee58
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

403
cert-manager-webhook-pdnscert-manager-webhook-pdns3.2.51 of 1See more

cert-manager-webhook-pdns cert-manager-webhook-pdns 3.2.5

1 of the 1 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
zachomedia/cert-manager-webhook-pdns:v2.5.54940e227a39b
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

1,072
checker-edgechecker-edge1.1.111 of 1See more

checker-edge checker-edge 1.1.11

1 of the 1 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
ghcr.io/imcitius/checker-edge:1.1.1174426c1fe00f
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

660
pulsarcloudve0.2.01 of 2See more

pulsar cloudve 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
library/docker:dind5efed980cba3
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

6,162
clusterfactoryclusterfactory0.2.01 of 5See more

clusterfactory clusterfactory 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
gitea/act_runner:0.3.1c2a169c5e998
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

7,168
coder-logstream-kubecoder-logstream-kube0.0.151 of 1See more

coder-logstream-kube coder-logstream-kube 0.0.15

1 of the 1 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
ghcr.io/coder/coder-logstream-kube:v0.0.1510ae596d296e
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

885
dev-code-servercosmoVerified publisher0.0.71 of 2See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
library/docker:dind5efed980cba3
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

14,559
cospacecospace0.0.341 of 3See more

cospace cospace 0.0.34

1 of the 3 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
ghcr.io/twigex/cospace:lateste5ecfd607e42
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

2,253
emissary-ingressemissary-ingress4.1.01 of 1See more

emissary-ingress emissary-ingress 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
ghcr.io/emissary-ingress/emissary:4.1.04a981156abee
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

932
exalsius-operatorexalsius-operatorVerified publisher0.12.01 of 1See more

exalsius-operator exalsius-operator 0.12.0

1 of the 1 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
ghcr.io/exalsius/exalsius-operator:0.12.0d24a579a3c75
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

204
gnp-stackgnp-stack0.0.51 of 14See more

gnp-stack gnp-stack 0.0.5

1 of the 14 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
ghcr.io/openconfig/gnmic:0.45.0d422a9ebd4a2
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

7,659
castopodhelmforgeVerified publisher1.2.71 of 3See more

castopod helmforge 1.2.7

1 of the 3 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
castopod/castopod:1.15.54e4f0440520f
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

9,342
kagentkagent0.10.11 of 6See more

kagent kagent 0.10.1

1 of the 6 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
ghcr.io/kagent-dev/kagent/tools:0.2.150b431281d3e
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

2,900
kestra-starterkestraOfficialVerified publisher2.0.11 of 5See more

kestra-starter kestra 2.0.1

1 of the 5 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
library/docker:dind-rootlesse17fa54c2ffd
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

5,455
kuberecordkuberecordVerified publisher0.4.01 of 1See more

kuberecord kuberecord 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
ghcr.io/kuberecord/kuberecord:v0.4.02a19792ad2ec
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

176
adguard-homemt1905024.0.121 of 2See more

adguard-home mt190502 4.0.12

1 of the 2 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
adguard/adguardhome:v0.107.737fbf01d73ecb
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

1,166
netris-dpu-agentnetrisai0.1.01 of 1See more

netris-dpu-agent netrisai 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
netrisai/bare-metal-dpu-agent:4.7.0.003c271efe749d0
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

1,523
operator-lifecycle-manageroperator-lifecycle-manager1.2.22 of 2See more

operator-lifecycle-manager operator-lifecycle-manager 1.2.2

2 of the 2 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
quay.io/operator-framework/catalogd:v1.8.06ff40fa6257f
golang.org/x/net@v0.50.0
0.51.0
quay.io/operator-framework/operator-controller:v1.8.0bca5dfcc67ca
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

1,821
picoclawpicoclawVerified publisher0.1.261 of 1See more

picoclaw picoclaw 0.1.26

1 of the 1 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
ghcr.io/mattn/picoclaw:latest517556c8b144
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

1,556
ocean-vpaspot1.0.72 of 4See more

ocean-vpa spot 1.0.7

2 of the 4 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
registry.k8s.io/autoscaling/vpa-admission-controller:1.6.080e487edff02
golang.org/x/net@v0.50.0
0.51.0
registry.k8s.io/autoscaling/vpa-updater:1.6.0b39d1dfa19cb
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

1,195
steadybit-agentsteadybit3.1.1612 of 6See more

steadybit-agent steadybit 3.1.161

2 of the 6 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
ghcr.io/steadybit/extension-container:v1.8.0dd31d4713ef6
golang.org/x/net@v0.50.0
0.51.0
ghcr.io/steadybit/extension-host:v1.8.0a198ac7bc8c1
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

4,277
act-runnertektonops0.1.21 of 2See more

act-runner tektonops 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
gitea/act_runner:nightly7940221bcfc9
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

4,212
trivy-webhook-aws-security-hubtrivy-webhook-aws-security-hubVerified publisher0.1.201 of 1See more

trivy-webhook-aws-security-hub trivy-webhook-aws-security-hub 0.1.20

1 of the 1 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
ghcr.io/csepulveda/trivy-webhook-aws-security-hub:v0.1.206836b779b060
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

616
wallarm-oobwallarmVerified publisher0.23.01 of 3See more

wallarm-oob wallarm 0.23.0

1 of the 3 container images this version deploys carry CVE-2026-27141.

Container imageDigestPackageFixed in
wallarm/node-native-processing:0.23.07db2da8fce0b
golang.org/x/net@v0.50.0
0.51.0

Open the chart page →

2,824

Container images carrying it

41 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/dexidp/dex:v2.45.18499afd690c4
golang.org/x/net@v0.50.0
0.51.0
3
library/docker:dind5efed980cba3
golang.org/x/net@v0.50.0
0.51.0
2
1password/connect-api:1.8.2e915c0c84397
golang.org/x/net@v0.50.0
0.51.0
1
1password/connect-sync:1.8.26297ca6136c0
golang.org/x/net@v0.50.0
0.51.0
1
adguard/adguardhome:v0.107.737fbf01d73ecb
golang.org/x/net@v0.50.0
0.51.0
1
aerospike/aerospike-backup-service:3.5.1be40d709c583
golang.org/x/net@v0.50.0
0.51.0
1
castopod/castopod:1.15.54e4f0440520f
golang.org/x/net@v0.50.0
0.51.0
1
concourse/concourse:8.3.040a143ce5873
golang.org/x/net@v0.50.0
0.51.0
1
ethereum/client-go:stableb8ab3451a117
golang.org/x/net@v0.50.0
0.51.0
1
gitea/act_runner:nightly7940221bcfc9
golang.org/x/net@v0.50.0
0.51.0
1
gitea/act_runner:0.3.1c2a169c5e998
golang.org/x/net@v0.50.0
0.51.0
1
grafana/alloy:v1.14.0f50931848bd8
golang.org/x/net@v0.50.0
0.51.0
1
instill/artifact-backend:b28766ac4a393e601ed
golang.org/x/net@v0.50.0
0.51.0
1
johnblack77/clustereye-api:latest9b8dbc0264ac
golang.org/x/net@v0.50.0
0.51.0
1
library/docker:dind-rootlesse17fa54c2ffd
golang.org/x/net@v0.50.0
0.51.0
1
mattermost/rtcd:latesta27058aaa53a
golang.org/x/net@v0.50.0
0.51.0
1
moby/buildkit:master-rootless07115a67cd22
golang.org/x/net@v0.50.0
0.51.0
1
moby/buildkit:masterbc964521ee58
golang.org/x/net@v0.50.0
0.51.0
1
netrisai/bare-metal-dpu-agent:4.7.0.003c271efe749d0
golang.org/x/net@v0.50.0
0.51.0
1
wallarm/node-native-processing:0.23.07db2da8fce0b
golang.org/x/net@v0.50.0
0.51.0
1
zachomedia/cert-manager-webhook-pdns:v2.5.54940e227a39b
golang.org/x/net@v0.50.0
0.51.0
1
ghcr.io/coder/coder-logstream-kube:v0.0.1510ae596d296e
golang.org/x/net@v0.50.0
0.51.0
1
ghcr.io/csepulveda/trivy-webhook-aws-security-hub:v0.1.206836b779b060
golang.org/x/net@v0.50.0
0.51.0
1
ghcr.io/emissary-ingress/emissary:4.1.04a981156abee
golang.org/x/net@v0.50.0
0.51.0
1
ghcr.io/exalsius/exalsius-operator:0.12.0d24a579a3c75
golang.org/x/net@v0.50.0
0.51.0
1
ghcr.io/hsn723/dkim-manager:1.4.00312232b31a2
golang.org/x/net@v0.50.0
0.51.0
1
ghcr.io/imcitius/checker-edge:1.1.1174426c1fe00f
golang.org/x/net@v0.50.0
0.51.0
1
ghcr.io/kagent-dev/kagent/tools:0.2.150b431281d3e
golang.org/x/net@v0.50.0
0.51.0
1
ghcr.io/kuberecord/kuberecord:v0.4.02a19792ad2ec
golang.org/x/net@v0.50.0
0.51.0
1
ghcr.io/kymaroshq/kymaros:0.6.9fb3b88633381
golang.org/x/net@v0.50.0
0.51.0
1
ghcr.io/mattn/picoclaw:latest517556c8b144
golang.org/x/net@v0.50.0
0.51.0
1
ghcr.io/openconfig/gnmic:0.45.0d422a9ebd4a2
golang.org/x/net@v0.50.0
0.51.0
1
ghcr.io/steadybit/extension-container:v1.8.0dd31d4713ef6
golang.org/x/net@v0.50.0
0.51.0
1
ghcr.io/steadybit/extension-host:v1.8.0a198ac7bc8c1
golang.org/x/net@v0.50.0
0.51.0
1
ghcr.io/twigex/cospace:lateste5ecfd607e42
golang.org/x/net@v0.50.0
0.51.0
1
quay.io/operator-framework/catalogd:v1.8.06ff40fa6257f
golang.org/x/net@v0.50.0
0.51.0
1
quay.io/operator-framework/operator-controller:v1.8.0bca5dfcc67ca
golang.org/x/net@v0.50.0
0.51.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
golang.org/x/net@v0.50.0
0.51.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
golang.org/x/net@v0.50.0
0.51.0
1
registry.k8s.io/autoscaling/vpa-admission-controller:1.6.080e487edff02
golang.org/x/net@v0.50.0
0.51.0
1
registry.k8s.io/autoscaling/vpa-updater:1.6.0b39d1dfa19cb
golang.org/x/net@v0.50.0
0.51.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.