CVE-2026-33814

Unscored

Advisory

Published 7 May 2026In the index since 5 Sept 2026

Severity: Unscored; worst across findings
CVSS: —; base score, highest
EPSS: 0.008; 54th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,043; of 17,797 indexed, latest versions
Container images: 4,670; deployed by those charts
Fix available: 2 of 2; affected packages

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Carried by container images the latest versions of 4,043 of 17,797 indexed charts deploy, on 4,670 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+179 more	1.25.10	4,519
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+218 more	0.53.0	3,570

OSV records: GO-2026-4918
Also known as: BIT-golang-2026-33814

Charts affected

4,043 by stars

Chart

Latest

Affected images

Radar Score

mortalgpumortalgpu

1.3.7

1 of 1 See more

mortalgpu mortalgpu 1.3.7

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
quay.io/maxiv/mortalgpu :1.3.7	e1c5c194bbf0	stdlib@go1.26.0	1.25.10

Open the chart page →

379

move2kubemove2kube

0.3.15

1 of 1 See more

move2kube move2kube 0.3.15

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
quay.io/konveyor/move2kube-ui :latest	ec6ab507c5da	golang.org/x/net@v0.0.0-20211216030914-fe4d6282115f stdlib@go1.19	0.53.0 1.25.10

Open the chart page →

3,803

nebraskanebraska

3.0.0

1 of 2 See more

nebraska nebraska 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
ghcr.io/flatcar/nebraska :4.0.0	5c9e99ff7167	golang.org/x/net@v0.44.0 stdlib@go1.24.13	0.53.0 1.25.10

Open the chart page →

4,096

keycloak-operatornewsaktuell

0.1.7

1 of 1 See more

keycloak-operator newsaktuell 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak-operator :19.0.3-legacy	09d52508fee9	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.13.8	0.53.0 1.25.10

Open the chart page →

5,067

gateway-apinicklasfrahm-gateway-api

0.2.0

1 of 1 See more

gateway-api nicklasfrahm-gateway-api 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
alpine/kubectl :1.33.3	2c59a3f0726c	golang.org/x/net@v0.38.0 stdlib@go1.24.4	0.53.0 1.25.10

Open the chart page →

1,258

observalobserval

1.13.1

1 of 8 See more

observal observal 1.13.1

1 of the 8 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
library/postgres :16	f1c3376c26f2	stdlib@go1.24.6	1.25.10

Open the chart page →

5,952

aws-xrayokgolove

5.0.0

1 of 1 See more

aws-xray okgolove 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
public.ecr.aws/xray/aws-xray-daemon :3.6.2	43d051eed000	golang.org/x/net@v0.38.0 stdlib@go1.25.7	0.53.0 1.25.10

Open the chart page →

273

flagsmithone-acre-fund

0.1.5

1 of 6 See more

flagsmith one-acre-fund 0.1.5

1 of the 6 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
jwilder/dockerize :latest	f94fb59fb4f6	golang.org/x/net@v0.47.0 stdlib@go1.25.5	0.53.0 1.25.10

Open the chart page →

6,881

kobotoolboxone-acre-fund

0.7.4

2 of 9 See more

kobotoolbox one-acre-fund 0.7.4

2 of the 9 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
enketo/enketo-express :3.0.4	dcad9c2273f6	stdlib@go1.17.1	1.25.10
jwilder/dockerize :latest	f94fb59fb4f6	golang.org/x/net@v0.47.0 stdlib@go1.25.5	0.53.0 1.25.10

Open the chart page →

18,543

secrets-injectoronepassword-connect

1.2.0

1 of 1 See more

secrets-injector onepassword-connect 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
1password/kubernetes-secrets-injector :1.0.2	5884757f7879	golang.org/x/net@v0.8.0 stdlib@go1.20.5	0.53.0 1.25.10

Open the chart page →

891

openclaw-with-brainopenclaw-with-brain

0.1.67

1 of 3 See more

openclaw-with-brain openclaw-with-brain 0.1.67

1 of the 3 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
alpine/git :2.47.2	062a01ad7a0e	golang.org/x/net@v0.23.0 stdlib@go1.23.9	0.53.0 1.25.10

Open the chart page →

5,224

opentelemetry-ebpfopentelemetry-helm

0.1.7

1 of 4 See more

opentelemetry-ebpf opentelemetry-helm 0.1.7

1 of the 4 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
otel/opentelemetry-ebpf-k8s-watcher :v0.10.2	63a0d1dd2cac	golang.org/x/net@v0.7.0 stdlib@go1.20	0.53.0 1.25.10

Open the chart page →

2,582

oesopsmx

4.0.32

10 of 25 See more

oes opsmx 4.0.32

10 of the 25 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
minio/mc :RELEASE.2020-11-25T23-04-07Z	bf85c57cdfcc	golang.org/x/net@v0.0.0-20201021035429-f5854403a974 stdlib@go1.15.5	0.53.0 1.25.10
minio/minio :RELEASE.2020-12-03T05-49-24Z	053f103f4894	golang.org/x/net@v0.0.0-20200904194848-62affa334b73 stdlib@go1.15.5	0.53.0 1.25.10
quay.io/opsmxpublic/awsgit :v2-openssh	0d21ba756f44	stdlib@go1.17.2	1.25.10
quay.io/opsmxpublic/awsgit :v3-js	15a6faada3d4	stdlib@go1.16.15	1.25.10
quay.io/opsmxpublic/create-secret :v4.0.4	defc3263e0e9	golang.org/x/net@v0.7.0 stdlib@go1.20.3	0.53.0 1.25.10
quay.io/opsmxpublic/forwarder-controller :v3.5.7	f0c5bebaec96	golang.org/x/net@v0.0.0-20220826154423-83b083e8dc8b stdlib@go1.19.1	0.53.0 1.25.10
quay.io/opsmxpublic/opa :opa-sidecar-v1.0	3dcbf3caa454	golang.org/x/net@v0.38.0 stdlib@go1.24.11	0.53.0 1.25.10
quay.io/opsmxpublic/opa :1.12.0	84fb1af7401c	golang.org/x/net@v0.47.0 stdlib@go1.25.5	0.53.0 1.25.10
quay.io/opsmxpublic/rabbitmq :4.2-management	3408107e5cc4	stdlib@go1.22.2	1.25.10
quay.io/opsmxpublic/spin-sample-pipeline :v1.0.1	c6a934439421	golang.org/x/net@v0.0.0-20200226121028-0de0cce0169b stdlib@go1.13.1	0.53.0 1.25.10

Open the chart page →

108,354

ipfs-clusterparadeum-team

0.0.19

2 of 2 See more

ipfs-cluster paradeum-team 0.0.19

2 of the 2 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
ipfs/go-ipfs :v0.13.1	17259397f587	golang.org/x/net@v0.0.0-20220517181318-183a9ca12b87 stdlib@go1.18.3	0.53.0 1.25.10
ipfs/ipfs-cluster :1.0.2	1511f6d57994	golang.org/x/net@v0.0.0-20220517181318-183a9ca12b87 stdlib@go1.18.3	0.53.0 1.25.10

Open the chart page →

3,771

permifypermify

0.5.0

1 of 1 See more

permify permify 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
ghcr.io/permify/permify :v1.3.5	f0c6f7d7daa6	golang.org/x/net@v0.26.0 stdlib@go1.22.4	0.53.0 1.25.10

Open the chart page →

1,004

platzioplatz-io

0.6.5

1 of 2 See more

platzio platz-io 0.6.5

1 of the 2 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
platzio/backend :v0.6.5	d5e5972f344b	golang.org/x/net@v0.38.0 stdlib@go1.24.3	0.53.0 1.25.10

Open the chart page →

2,879

plecopleco

0.24.0

1 of 1 See more

pleco pleco 0.24.0

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
public.ecr.aws/r3m4q3r9/pleco :0.24.0	651739583336	golang.org/x/net@v0.39.0 stdlib@go1.21.6	0.53.0 1.25.10

Open the chart page →

1,353

ipmi-exporterpnnl-miscscripts

0.1.15

1 of 1 See more

ipmi-exporter pnnl-miscscripts 0.1.15

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
pnnlmiscscripts/ipmi-exporter :1.2.0-1	81e18992d8e3	stdlib@go1.13.10	1.25.10

Open the chart page →

2,994

pomeriumpomerium

34.0.1

1 of 1 See more

pomerium pomerium 34.0.1

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
pomerium/pomerium :v0.22.1	9c69b10a2126	golang.org/x/net@v0.9.0 stdlib@go1.20.3	0.53.0 1.25.10

Open the chart page →

1,949

prometheus-systemd-exporterprometheus-community

0.5.2

1 of 1 See more

prometheus-systemd-exporter prometheus-community 0.5.2

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
quay.io/prometheuscommunity/systemd-exporter :v0.7.0	78c03f875dfb	golang.org/x/net@v0.33.0 stdlib@go1.24.1	0.53.0 1.25.10

Open the chart page →

725

kube-prometheus-stackprometheus-worawutchan

12.8.0

4 of 6 See more

kube-prometheus-stack prometheus-worawutchan 12.8.0

4 of the 6 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
grafana/grafana :7.2.1	733842cca5bd	golang.org/x/net@v0.0.0-20200813134508-3edf25e44fcc stdlib@go1.15.1	0.53.0 1.25.10
jettech/kube-webhook-certgen :v1.5.0	fb7c2cd46ccf	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.15.3	0.53.0 1.25.10
quay.io/prometheus-operator/prometheus-operator :v0.44.0	983627001c89	golang.org/x/net@v0.0.0-20201006153459-a7d1128ccaa0 stdlib@go1.14.12	0.53.0 1.25.10
quay.io/prometheus/node-exporter :v1.0.1	cf66a6bbd573	golang.org/x/net@v0.0.0-20200513185701-a91f0712d120 stdlib@go1.14.4	0.53.0 1.25.10

Open the chart page →

12,134

qgis-serverqgis-server

0.1.10

1 of 3 See more

qgis-server qgis-server 0.1.10

1 of the 3 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
ghcr.io/cloudnative-pg/cloudnative-pg :1.25.1	b5210df46c05	golang.org/x/net@v0.35.0 stdlib@go1.24.0	0.53.0 1.25.10

Open the chart page →

5,483

nfs-server-provisionerraphael

1.3.0

1 of 1 See more

nfs-server-provisioner raphael 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
gcr.io/k8s-staging-sig-storage/nfs-provisioner :v3.0.0	2de1d15fc1f2	golang.org/x/net@v0.0.0-20190812203447-cdfb69ac37fc stdlib@go1.15	0.53.0 1.25.10

Open the chart page →

2,731

repoflowrepoflow-helm-public

0.9.1

2 of 8 See more

repoflow repoflow-helm-public 0.9.1

2 of the 8 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
library/postgres :16.2	4aea012537ed	stdlib@go1.18.2	1.25.10
minio/minio :RELEASE.2025-07-23T15-54-02Z	d249d1fb6966	golang.org/x/net@v0.39.0 stdlib@go1.24.5	0.53.0 1.25.10

Open the chart page →

13,692

backrestrobertobochet

0.7.0

1 of 1 See more

backrest robertobochet 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
garethgeorge/backrest :v1.14.1	b85297975428	stdlib@go1.26.0	1.25.10

Open the chart page →

866

supabaserock8s

0.0.6

1 of 1 See more

supabase rock8s 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
library/postgres :15-alpine	fe0737ba566a	stdlib@go1.24.6	1.25.10

Open the chart page →

494

rqliterqlite

2.0.0

1 of 1 See more

rqlite rqlite 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
rqlite/rqlite :9.1.3	7b992a526eee	golang.org/x/net@v0.46.0 stdlib@go1.25.3	0.53.0 1.25.10

Open the chart page →

1,319

qbittorrent-vpnrtomik-helm-charts

0.0.2

1 of 2 See more

qbittorrent-vpn rtomik-helm-charts 0.0.2

1 of the 2 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
qmcgaw/gluetun :v3.40.0	2b42bfa04675	golang.org/x/net@v0.31.0 stdlib@go1.23.4	0.53.0 1.25.10

Open the chart page →

1,219

satisfactory-serversatisfactory

0.1.6

1 of 1 See more

satisfactory-server satisfactory 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
wolveix/satisfactory-server :v1.9.10	e103700ae6ae	stdlib@go1.18.1	1.25.10

Open the chart page →

3,476

seaweedfs-csi-driverseaweedfs-csi-driver

0.2.38

5 of 7 See more

seaweedfs-csi-driver seaweedfs-csi-driver 0.2.38

5 of the 7 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-attacher :v4.3.0	4eb73137b663	golang.org/x/net@v0.8.0 stdlib@go1.20.3	0.53.0 1.25.10
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.8.0	f6717ce72a26	golang.org/x/net@v0.8.0 stdlib@go1.20.3	0.53.0 1.25.10
registry.k8s.io/sig-storage/csi-provisioner :v3.5.0	d078dc174323	golang.org/x/net@v0.8.0 stdlib@go1.20.3	0.53.0 1.25.10
registry.k8s.io/sig-storage/csi-resizer :v1.8.0	2e2b44393539	golang.org/x/net@v0.8.0 stdlib@go1.20.3	0.53.0 1.25.10
registry.k8s.io/sig-storage/livenessprobe :v2.10.0	4dc0b87ccd69	golang.org/x/net@v0.8.0 stdlib@go1.20.3	0.53.0 1.25.10

Open the chart page →

5,321

seldon-core-operatorseldon

1.19.0

1 of 1 See more

seldon-core-operator seldon 1.19.0

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
seldonio/seldon-core-operator :1.19.0	544e3bf71bd1	golang.org/x/net@v0.44.0 stdlib@go1.24.11	0.53.0 1.25.10

Open the chart page →

860

bentoself-hosters-by-night

0.9.1

1 of 1 See more

bento self-hosters-by-night 0.9.1

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
ghcr.io/warpstreamlabs/bento :1.8.1	21715979aefa	golang.org/x/net@v0.37.0 stdlib@go1.23.10	0.53.0 1.25.10

Open the chart page →

1,053

lldapself-hosters-by-night

0.5.2

2 of 2 See more

lldap self-hosters-by-night 0.5.2

2 of the 2 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
library/postgres :18.1	1090bc3a8ccf	stdlib@go1.24.6	1.25.10
ghcr.io/lldap/lldap :2025-05-19	3de697c3ba57	stdlib@go1.18.2	1.25.10

Open the chart page →

3,441

appshini4i

0.4.0

1 of 1 See more

app shini4i 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
traefik/whoami :v1.10.2	1474027c3166	golang.org/x/net@v0.25.0 stdlib@go1.22.2	0.53.0 1.25.10

Open the chart page →

537

skypilotskypilot

0.13.0

3 of 3 See more

skypilot skypilot 0.13.0

3 of the 3 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
berkeleyskypilot/skypilot :0.13.0	3bc8bf8f4d83	golang.org/x/net@v0.38.0 stdlib@go1.26.2	0.53.0 1.25.10
registry.k8s.io/ingress-nginx/controller :v1.11.8	695d79381ee6	golang.org/x/net@v0.41.0 stdlib@go1.24.4	0.53.0 1.25.10
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.6.0	c9f76a75fd00	golang.org/x/net@v0.41.0 stdlib@go1.24.4	0.53.0 1.25.10

Open the chart page →

5,943

corednssoftizy

0.2.0

1 of 1 See more

coredns softizy 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
coredns/coredns :1.10.1	a0ead06651cf	golang.org/x/net@v0.4.0 stdlib@go1.20	0.53.0 1.25.10

Open the chart page →

1,670

knative-servingsoftonic

3.0.0

5 of 5 See more

knative-serving softonic 3.0.0

5 of the 5 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
gcr.io/knative-releases/knative.dev/net-certmanager/cmd/webhookdigest-pinned	873b968f02b5	golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e stdlib@go1.14.2	0.53.0 1.25.10
gcr.io/knative-releases/knative.dev/serving/cmd/activatordigest-pinned	a5de0fb75046	golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e stdlib@go1.14.2	0.53.0 1.25.10
gcr.io/knative-releases/knative.dev/serving/cmd/autoscalerdigest-pinned	2ef460356b17	golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e stdlib@go1.14.2	0.53.0 1.25.10
gcr.io/knative-releases/knative.dev/serving/cmd/controllerdigest-pinned	30ce73388ae5	golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e stdlib@go1.14.2	0.53.0 1.25.10
gcr.io/knative-releases/knative.dev/serving/cmd/webhookdigest-pinned	f16c0e022203	golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e stdlib@go1.14.2	0.53.0 1.25.10

Open the chart page →

12,537

miniosolidcharts

0.5.0

1 of 1 See more

minio solidcharts 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
ghcr.io/coollabsio/minio :RELEASE.2025-10-15T17-29-55Z	69b55a1c1c5d	golang.org/x/net@v0.42.0 stdlib@go1.24.6	0.53.0 1.25.10

Open the chart page →

1,070

forecastlestakater

2.1.1

1 of 1 See more

forecastle stakater 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
stakater/forecastle :v2.0.2	382cd9572352	golang.org/x/net@v0.51.0	0.53.0

Open the chart page →

711

ingressmonitorcontrollerstakater

2.2.13

1 of 1 See more

ingressmonitorcontroller stakater 2.2.13

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
ghcr.io/stakater/ingressmonitorcontroller :v2.2.13	3301afb61c10	golang.org/x/net@v0.47.0 stdlib@go1.24.13	0.53.0 1.25.10

Open the chart page →

583

sn-platformstreamnative

1.11.44

6 of 9 See more

sn-platform streamnative 1.11.44

6 of the 9 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
jimmidyson/configmap-reload :v0.8.0	5af9d3041d12	stdlib@go1.19.2	1.25.10
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	golang.org/x/net@v0.8.0 stdlib@go1.20.4	0.53.0 1.25.10
streamnative/pulsar_vault_init :v1.0.7	31533fa9fab7	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.17.11	0.53.0 1.25.10
quay.io/prometheus/alertmanager :v0.25.0	fd4d9a3dd1fd	golang.org/x/net@v0.4.0 stdlib@go1.19.4	0.53.0 1.25.10
quay.io/prometheus/node-exporter :v1.5.0	39c642b2b337	golang.org/x/net@v0.2.0 stdlib@go1.19.3	0.53.0 1.25.10
quay.io/prometheus/prometheus :v2.43.0	f5c29683a301	golang.org/x/net@v0.8.0 stdlib@go1.19.7	0.53.0 1.25.10

Open the chart page →

15,620

pocketbasetechwolf12

0.29.3

1 of 1 See more

pocketbase techwolf12 0.29.3

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
ghcr.io/techwolf12/pocketbase :0.29.3	106099641679	golang.org/x/net@v0.43.0 stdlib@go1.24.6	0.53.0 1.25.10

Open the chart page →

1,448

pretixtechwolf12

2026.7.0

1 of 3 See more

pretix techwolf12 2026.7.0

1 of the 3 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
library/postgres :18.4	a02db8cac496	stdlib@go1.24.6	1.25.10

Open the chart page →

10,046

mealieth-charts

0.5.1

1 of 1 See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
ghcr.io/mealie-recipes/mealie :v3.7.0	bb2939094eed	stdlib@go1.24.4	1.25.10

Open the chart page →

3,834

thingsboard-clusterthingsboard-cluster-betta

0.2.26

3 of 6 See more

thingsboard-cluster thingsboard-cluster-betta 0.2.26

3 of the 6 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
bitnamilegacy/kafka :3.5.0-debian-11-r0	8657bb93a581	stdlib@go1.20.5	1.25.10
bitnamilegacy/redis :7.2.1-debian-11-r0	fa288394f402	stdlib@go1.19.12	1.25.10
bitnamilegacy/zookeeper :3.9.0-debian-11-r11	10ed1ea3c8d1	stdlib@go1.19.12	1.25.10

Open the chart page →

14,578

feedbacksystemthm-mni-ii

0.47.1

6 of 10 See more

feedbacksystem thm-mni-ii 0.47.1

6 of the 10 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
bitnamilegacy/minio :2023.12.23-debian-11-r2	5bb0aa825d16	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.53.0 1.25.10
bitnamilegacy/mongodb :6.0.10-debian-11-r8	42319decb591	golang.org/x/net@v0.14.0 stdlib@go1.19.12	0.53.0 1.25.10
bitnamilegacy/mysql :8.0.35-debian-11-r2	be03e8ea6129	stdlib@go1.21.5	1.25.10
library/docker :20.10.21-dind	3153fa63f546	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.18.7	0.53.0 1.25.10
thmmniii/fbs-qcm-frontend :v1.27.1	a347f7f4d144	stdlib@go1.20.12	1.25.10
thmmniii/fbs-runner :v1.27.1	86105349c1a3	golang.org/x/net@v0.17.0 stdlib@go1.20.11	0.53.0 1.25.10

Open the chart page →

28,692

topaztopaz

0.2.5

1 of 1 See more

topaz topaz 0.2.5

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
ghcr.io/aserto-dev/topaz :0.32.59	4c708ecf7dc4	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.53.0 1.25.10

Open the chart page →

1,503

maeshtraefik

2.1.2

1 of 7 See more

maesh traefik 2.1.2

1 of the 7 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
containous/maesh :v1.3.2	587162516502	golang.org/x/net@v0.0.0-20200301022130-244492dfa37a stdlib@go1.14.4	0.53.0 1.25.10

Open the chart page →

4,145

traefik-meshtraefik

4.1.1

3 of 7 See more

traefik-mesh traefik 4.1.1

3 of the 7 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
jaegertracing/all-in-one :1.18	db45c07f2e1b	golang.org/x/net@v0.0.0-20200202094626-16171245cfb2 stdlib@go1.14.4	0.53.0 1.25.10
library/traefik :v2.5	7d5a6ae66572	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.17.6	0.53.0 1.25.10
traefik/mesh :v1.4.8	cf071f3e165c	golang.org/x/net@v0.0.0-20220624214902-1bab6f366d9e stdlib@go1.19	0.53.0 1.25.10

Open the chart page →

9,271

k8s-ttl-controllertwin

0.4.0

1 of 1 See more

k8s-ttl-controller twin 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-33814.

Container image	Digest	Package	Fixed in
ghcr.io/twin/k8s-ttl-controller :v1.4.0	0525a7def93d	golang.org/x/net@v0.26.0 stdlib@go1.24.1	0.53.0 1.25.10

Open the chart page →

471

Container images carrying it

4,670 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
minio/minio :RELEASE.2020-12-03T05-49-24Z	053f103f4894	golang.org/x/net@v0.0.0-20200904194848-62affa334b73 stdlib@go1.15.5	0.53.0 1.25.10	1
minio/minio :RELEASE.2022-01-04T07-41-07Z	1484c87239ea	golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2 stdlib@go1.17.5	0.53.0 1.25.10	1
minio/minio :RELEASE.2024-05-28T17-19-04Z	391d1d45fdbe	golang.org/x/net@v0.25.0 stdlib@go1.22.3	0.53.0 1.25.10	1
minio/minio :RELEASE.2024-01-16T16-07-38Z	4c4a4876193f	golang.org/x/net@v0.19.0 stdlib@go1.21.6	0.53.0 1.25.10	1
minio/minio :RELEASE.2024-01-18T22-51-28Z	551682a57a94	golang.org/x/net@v0.19.0 stdlib@go1.21.6	0.53.0 1.25.10	1
minio/minio :RELEASE.2023-03-20T20-16-18Z	6d770d7f255c	golang.org/x/net@v0.8.0 stdlib@go1.19.7	0.53.0 1.25.10	1
minio/minio :RELEASE.2025-07-23T15-54-02Z	d249d1fb6966	golang.org/x/net@v0.39.0 stdlib@go1.24.5	0.53.0 1.25.10	1
minio/minio :RELEASE.2020-09-17T04-49-20Z	e2b7b633c250	golang.org/x/net@v0.0.0-20200904194848-62affa334b73 stdlib@go1.14.9	0.53.0 1.25.10	1
minio/minio :RELEASE.2020-01-03T19-12-21Z	f00aa6ef2b72	golang.org/x/net@v0.0.0-20190923162816-aa69164e4478 stdlib@go1.13.5	0.53.0 1.25.10	1
minio/minio :RELEASE.2022-10-24T18-35-07Z	f9576903f19d	golang.org/x/net@v0.1.0 stdlib@go1.19.2	0.53.0 1.25.10	1
minio/minio :RELEASE.2023-01-12T02-06-16Z	fc6bedc99355	golang.org/x/net@v0.5.0 stdlib@go1.19.4	0.53.0 1.25.10	1
minio/operator :v5.0.9	170b154d2c61	golang.org/x/net@v0.13.0 stdlib@go1.21.1	0.53.0 1.25.10	1
minio/operator :v4.1.0	2adc5be088f5	golang.org/x/net@v0.0.0-20210421230115-4e50805a0758 stdlib@go1.16.3	0.53.0 1.25.10	1
mintel/gcp-quota-exporter :v0.3.2	0e0707b7732b	golang.org/x/net@v0.0.0-20190311183353-d8887717615a stdlib@go1.13.12	0.53.0 1.25.10	1
mirrorgitlabcontainers/gitaly :v13.2.2	83599461ef8b	golang.org/x/net@v0.0.0-20200114155413-6afb5195e5aa stdlib@go1.13.9	0.53.0 1.25.10	1
mirrorgitlabcontainers/gitlab-container-registry :v2.9.1-gitlab	06b19a4bc805	golang.org/x/net@v0.0.0-20191014212845-da9a3fd4c582 stdlib@go1.13.9	0.53.0 1.25.10	1
mirrorgitlabcontainers/gitlab-shell :v13.3.0	9f3654f1eafc	golang.org/x/net@v0.0.0-20200114155413-6afb5195e5aa stdlib@go1.13.9	0.53.0 1.25.10	1
mirrorgitlabcontainers/gitlab-workhorse-ce :v13.2.2	a6d7bf42805a	golang.org/x/net@v0.0.0-20200226121028-0de0cce0169b stdlib@go1.13.9	0.53.0 1.25.10	1
mirrorgitlabcontainers/kubectl :1.13.12	99931bd06b41	stdlib@go1.13.3	1.25.10	1
mitre/vulcan :latest	2bc4dfb8150f	stdlib@go1.25.5	1.25.10	1
moby/buildkit :master-rootless	07115a67cd22	golang.org/x/net@v0.50.0 stdlib@go1.25.7	0.53.0 1.25.10	1
moby/buildkit :v0.33.0	6c2fa84a6b61	golang.org/x/net@v0.43.0 stdlib@go1.25.7	0.53.0 1.25.10	1
moby/buildkit :v0.33.0-rootless	80b15f0735e8	golang.org/x/net@v0.43.0 stdlib@go1.25.7	0.53.0 1.25.10	1
moby/buildkit :v0.31.0	a095b3d11ce1	golang.org/x/net@v0.35.0 stdlib@go1.25.7	0.53.0 1.25.10	1
moby/buildkit :master	bc964521ee58	golang.org/x/net@v0.50.0 stdlib@go1.25.7	0.53.0 1.25.10	1
moby/buildkit :v0.10.0	c2aeafaed434	golang.org/x/net@v0.0.0-20211216030914-fe4d6282115f stdlib@go1.17.8	0.53.0 1.25.10	1
moikot/basic-git-server :0.0.2	0d941bd30ffa	stdlib@go1.14.9	1.25.10	1
moikot/smartthings-metrics :0.1.0	8625f53aa9b7	golang.org/x/net@v0.0.0-20200602114024-627f9648deb9 stdlib@go1.14.13	0.53.0 1.25.10	1
moikot/smartthings-metrics :feat-log-details	fb8565140106	golang.org/x/net@v0.0.0-20200602114024-627f9648deb9 stdlib@go1.14.15	0.53.0 1.25.10	1
mongodb/mongodb-atlas-local :8	925c3d34f0c6	stdlib@go1.25.9	1.25.10	1
monitoror/monitoror :4	4b88edcf51ff	golang.org/x/net@v0.0.0-20191209160850-c0dbc17a3553 stdlib@go1.14.6	0.53.0 1.25.10	1
moonrailgun/tianji :1.11.2	b528c8f8fcc4	stdlib@go1.20.12	1.25.10	1
moul/sshportal :v1.19.3	332b603727c3	stdlib@go1.17.6	1.25.10	1
mpioperator/mpi-operator :0.3.0	3ccfa8d8b7bf	golang.org/x/net@v0.0.0-20200226121028-0de0cce0169b stdlib@go1.15.13	0.53.0 1.25.10	1
mrnim94/metrics-server-exporter :v2.4.0	86c4807a4bca	golang.org/x/net@v0.47.0	0.53.0	1
muonsoft/openapi-mock :latest	c9afe1295484	stdlib@go1.20.2	1.25.10	1
murtazashah46/helmfile :latest	4d11726cf803	golang.org/x/net@v0.5.0 stdlib@go1.22.8	0.53.0 1.25.10	1
mvisonneau/tailscale :v1.68.1	fc45ad8abf10	golang.org/x/net@v0.24.0 stdlib@go1.22.4	0.53.0 1.25.10	1
mzinc/configmapsecret-controller :v0.5.1	eebbcbf2d1f7	golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110 stdlib@go1.16.1	0.53.0 1.25.10	1
mziyabo/fargate-eks-sidecar-injector :latest	3067dce17983	golang.org/x/net@v0.7.0 stdlib@go1.19.13	0.53.0 1.25.10	1
n8nio/n8n :1.86.0	8b39ed5a2de9	stdlib@go1.24.0	1.25.10	1
n8nio/n8n :1.115.1	ed16e560c40e	stdlib@go1.24.6	1.25.10	1
nacos/nacos-peer-finder-plugin :latest	a9c769301fa6	stdlib@go1.13.5	1.25.10	1
nadoo/glider :0.16	38aadefbd607	golang.org/x/net@v0.28.0 stdlib@go1.20.14	0.53.0 1.25.10	1
nathanfirmo/dbgate :latest	6b0487e6e987	stdlib@go1.24.5	1.25.10	1
natsio/nats-box :0.14.3	1cc420186664	golang.org/x/net@v0.22.0 stdlib@go1.22.1	0.53.0 1.25.10	1
natsio/nats-box :0.13.5	59cf2e949181	stdlib@go1.19.5	1.25.10	1
natsio/nats-box :0.18.0	abdc9f9f0120	golang.org/x/net@v0.40.0 stdlib@go1.24.3	0.53.0 1.25.10	1
natsio/nats-box :0.13.3	c507bd7e3831	golang.org/x/net@v0.4.0 stdlib@go1.19.4	0.53.0 1.25.10	1
natsio/nats-box :0.14.2	e808e0644ce1	golang.org/x/net@v0.17.0 stdlib@go1.21.5	0.53.0 1.25.10	1