CVE-2026-39821

High

Advisory

Published 22 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,556; of 17,790 indexed, latest versions
Container images: 5,324; deployed by those charts
Fix available: 3 of 3; affected packages

Red Hat Security Advisory: git-lfs security update

Carried by container images the latest versions of 4,556 of 17,790 indexed charts deploy, on 5,324 images.

Affected package	Affected versions	Fixed in	Images
git-lfsrpm	2.13.3-3.el8_6	0:3.4.1-11.el8_10	1
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+189 more	1.25.13	5,288
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+220 more	0.55.0	3,695

OSV records: RHSA-2026:30853 GO-2026-5026

Charts affected

4,556 by stars

Chart

Latest

Affected images

Radar Score

scaffoldsigstore

0.6.115

11 of 15 See more

scaffold sigstore 0.6.115

11 of the 15 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/redisdigest-pinned	148bb5411c18	stdlib@go1.18.2	1.25.13
gcr.io/trillian-opensource-ci/db_serverdigest-pinned	2a685a38dd01	stdlib@go1.18.2	1.25.13
ghcr.io/sigstore/fulcio :v1.8.8	ef72cf56c64b	stdlib@go1.26.4	1.25.13
ghcr.io/sigstore/rekor/rekor-server :v1.5.4	100d793d68d0	stdlib@go1.26.4	1.25.13
ghcr.io/sigstore/scaffolding/createcertsdigest-pinned	7f59f7c08d1a	golang.org/x/net@v0.46.0 stdlib@go1.25.0	0.55.0 1.25.13
ghcr.io/sigstore/scaffolding/createctconfig :v0.7.31	3a061734c5be	golang.org/x/net@v0.46.0 stdlib@go1.25.0	0.55.0 1.25.13
ghcr.io/sigstore/scaffolding/createdbdigest-pinned	3cee6c78973b	golang.org/x/net@v0.46.0 stdlib@go1.25.0	0.55.0 1.25.13
ghcr.io/sigstore/scaffolding/createtreedigest-pinned:v0.7.31	e5232e8c9122	golang.org/x/net@v0.46.0 stdlib@go1.25.0	0.55.0 1.25.13
ghcr.io/sigstore/scaffolding/ct_server :v0.7.31	66664ba563e7	golang.org/x/net@v0.46.0 stdlib@go1.25.0	0.55.0 1.25.13
ghcr.io/sigstore/scaffolding/trillian_log_serverdigest-pinned	5a878e4e4f03	stdlib@go1.26.0	1.25.13
ghcr.io/sigstore/scaffolding/trillian_log_signerdigest-pinned	28c5ff40963f	stdlib@go1.26.0	1.25.13

Open the chart page →

7,686

simply-dns-webhooksimply-dns-webhook

1.10.0

1 of 1 See more

simply-dns-webhook simply-dns-webhook 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/runnerm/simply-dns-webhook :v1.10.0	fdfffa3984a5	golang.org/x/net@v0.52.0 stdlib@go1.26.4	0.55.0 1.25.13

Open the chart page →

422

mongodb-backupsinextra

1.1.0

1 of 1 See more

mongodb-backup sinextra 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/sergelogvinov/mongodb :8.0.10	1eee8e20a87f	golang.org/x/net@v0.40.0 stdlib@go1.23.8	0.55.0 1.25.13

Open the chart page →

4,277

postgresql-singlesinextra

1.15.1

1 of 1 See more

postgresql-single sinextra 1.15.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/sergelogvinov/postgresql :16.15	fafb72e98f22	golang.org/x/net@v0.47.0 stdlib@go1.24.6	0.55.0 1.25.13

Open the chart page →

4,937

altinity-clickhouse-operatorslamdev

0.1.2

2 of 2 See more

altinity-clickhouse-operator slamdev 0.1.2

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.20.0	8f0f582d41f0	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.17.13	0.55.0 1.25.13
altinity/metrics-exporter :0.20.0	1a46d104406d	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.17.13	0.55.0 1.25.13

Open the chart page →

6,420

docker-registry-uislamdev

0.0.1

1 of 1 See more

docker-registry-ui slamdev 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quiq/docker-registry-ui :0.9.4	91281da47036	golang.org/x/net@v0.0.0-20211015210444-4f30a5c0130f stdlib@go1.18	0.55.0 1.25.13

Open the chart page →

2,200

external-secrets-operatorslamdev

0.0.15

1 of 1 See more

external-secrets-operator slamdev 0.0.15

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
slamdev/external-secrets-operator :0.0.8	855f6625dda4	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.15	0.55.0 1.25.13

Open the chart page →

2,301

wg-easyslybase-wg-easy

1.2.0

1 of 1 See more

wg-easy slybase-wg-easy 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/wg-easy/wg-easy :15.4.0	0e7bc9d34e86	golang.org/x/net@v0.44.0 stdlib@go1.26.3	0.55.0 1.25.13

Open the chart page →

725

wireguardslybase-wireguard

2.0.6

1 of 1 See more

wireguard slybase-wireguard 2.0.6

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
linuxserver/wireguard :1.0.20260223-r0-ls122	dca67384e3e9	golang.org/x/net@v0.47.0	0.55.0

Open the chart page →

443

smallest-self-hostsmallest-self-host

0.2.2

6 of 12 See more

smallest-self-host smallest-self-host 0.2.2

6 of the 12 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
grafana/grafana :11.0.0	0dc5a246ab16	golang.org/x/net@v0.23.0 stdlib@go1.21.10	0.55.0 1.25.13
quay.io/prometheus-operator/prometheus-operator :v0.74.0	6b3f6d8b4c0a	golang.org/x/net@v0.25.0 stdlib@go1.22.3	0.55.0 1.25.13
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v20221220-controller-v1.5.1-58-g787ea74b6	4d99688e5573	golang.org/x/net@v0.1.0 stdlib@go1.19.4	0.55.0 1.25.13
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.12.0	b401fae262a5	golang.org/x/net@v0.22.0 stdlib@go1.21.8	0.55.0 1.25.13
registry.k8s.io/nfd/node-feature-discovery :v0.16.6	19ebca8b3804	golang.org/x/net@v0.25.0 stdlib@go1.22.8	0.55.0 1.25.13
registry.k8s.io/prometheus-adapter/prometheus-adapter :v0.12.0	932eae60e2bc	golang.org/x/net@v0.24.0 stdlib@go1.22.2	0.55.0 1.25.13

Open the chart page →

7,705

smarter-edgesmarter

0.0.15

1 of 1 See more

smarter-edge smarter 0.0.15

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/smarter-project/smarter-device-manager :v1.20.12	228f7f44594a	golang.org/x/net@v0.2.0 stdlib@go1.19.3	0.55.0 1.25.13

Open the chart page →

1,151

aws-otel-collectorsnowplow-devops

0.16.0

1 of 1 See more

aws-otel-collector snowplow-devops 0.16.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-observability/aws-otel-collector :v0.49.0	d2bdfff2c377	stdlib@go1.26.5	1.25.13

Open the chart page →

160

yopasssoftizy

1.0.1

1 of 2 See more

yopass softizy 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
jhaals/yopass :11.4.6	9516e3b3e88c	stdlib@go1.19.1	1.25.13

Open the chart page →

1,461

artifact-hubsoftonic

1.19.0

6 of 8 See more

artifact-hub softonic 1.19.0

6 of the 8 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
aquasec/trivy :0.43.1	944a04445179	golang.org/x/net@v0.11.0 stdlib@go1.19.10	0.55.0 1.25.13
artifacthub/db-migrator :v1.19.0	2a746b289fcd	stdlib@go1.22.4	1.25.13
artifacthub/hub :v1.19.0	111918d8c399	golang.org/x/net@v0.26.0 stdlib@go1.22.4	0.55.0 1.25.13
artifacthub/postgres :latest	4fd34fa635cc	stdlib@go1.24.6	1.25.13
artifacthub/scanner :v1.19.0	323d026e78c3	golang.org/x/net@v0.21.0 stdlib@go1.21.8	0.55.0 1.25.13
artifacthub/tracker :v1.19.0	6596c8c4d955	golang.org/x/net@v0.26.0 stdlib@go1.22.4	0.55.0 1.25.13

Open the chart page →

14,550

gcp-quota-exportersoftonic

2.0.2

1 of 1 See more

gcp-quota-exporter softonic 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
mintel/gcp-quota-exporter :v0.3.2	0e0707b7732b	golang.org/x/net@v0.0.0-20190311183353-d8887717615a stdlib@go1.13.12	0.55.0 1.25.13

Open the chart page →

2,643

go-ratelimitsoftonic

1.0.7

2 of 3 See more

go-ratelimit softonic 1.0.7

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
envoyproxy/ratelimit :v1.4.0	71081616da3e	golang.org/x/net@v0.0.0-20191209160850-c0dbc17a3553 stdlib@go1.14	0.55.0 1.25.13
oliver006/redis_exporter :v1.9.0	4af75e9f16f6	stdlib@go1.14.4	1.25.13

Open the chart page →

5,105

node-policy-webhooksoftonic

0.1.10

1 of 1 See more

node-policy-webhook softonic 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
softonic/node-policy-webhook :0.1.2	ab6098c04a53	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.14.6	0.55.0 1.25.13

Open the chart page →

2,591

redis-shardedsoftonic

0.5.0

1 of 2 See more

redis-sharded softonic 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
oliver006/redis_exporter :v1.9.0	4af75e9f16f6	stdlib@go1.14.4	1.25.13

Open the chart page →

2,330

sogosogo

0.3.5

1 of 2 See more

sogo sogo 0.3.5

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
sonroyaalmerol/docker-sogo :5.12.4	3f60f3abe990	golang.org/x/net@v0.49.0 stdlib@go1.24.13	0.55.0 1.25.13

Open the chart page →

7,204

postgresql-ha-chartsoldevelo-postgresql-ha-chart

16.3.4

1 of 2 See more

postgresql-ha-chart soldevelo-postgresql-ha-chart 16.3.4

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
soldevelo/pgpool :4.6.3-debian-12-r0	044d16a65129	stdlib@go1.25.4	1.25.13

Open the chart page →

4,604

rabbitmqsolidcharts

0.7.5

1 of 2 See more

rabbitmq solidcharts 0.7.5

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/rabbitmq :4.3.5-management	ffd1b50c522a	stdlib@go1.22.2	1.25.13

Open the chart page →

1,045

thanossolidcharts

0.12.2

1 of 1 See more

thanos solidcharts 0.12.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.42.4	b567818fe608	stdlib@go1.26.5	1.25.13

Open the chart page →

203

gloosolo-gloo-edge

0.0.0-fork

4 of 5 See more

gloo solo-gloo-edge 0.0.0-fork

4 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/solo-io/certgen :0.0.0-fork	b17a8c7d1f32	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.1	0.55.0 1.25.13
quay.io/solo-io/discovery :0.0.0-fork	5b62aaade3c9	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.1	0.55.0 1.25.13
quay.io/solo-io/gloo :0.0.0-fork	9a6c84560d44	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.1	0.55.0 1.25.13
quay.io/solo-io/gloo-envoy-wrapper :0.0.0-fork	26ae185e835a	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.1	0.55.0 1.25.13

Open the chart page →

9,256

sp-otel-collectorsp-otel-collector

1.1.6

1 of 1 See more

sp-otel-collector sp-otel-collector 1.1.6

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/geored/spmm-collector-contrib :1.0.0	63baf86a49ac	golang.org/x/net@v0.11.0 stdlib@go1.20.5	0.55.0 1.25.13

Open the chart page →

2,032

sql-operatorsql-operator

0.11.2

1 of 1 See more

sql-operator sql-operator 0.11.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/stenic/sql-operator :1.13.2	f4324baa2aad	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.17.13	0.55.0 1.25.13

Open the chart page →

1,594

stackradar-scannerstackradar

0.3.0

1 of 1 See more

stackradar-scanner stackradar 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/lockdep/stackradar-scanner :0.3.0	dd8a35d50c2d	golang.org/x/net@v0.49.0 stdlib@go1.25.7	0.55.0 1.25.13

Open the chart page →

1,218

gitwebhookproxystakater

0.2.79

1 of 1 See more

gitwebhookproxy stakater 0.2.79

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
stakater/gitwebhookproxy :v0.2.79	c1226e5270cd	stdlib@go1.13.1	1.25.13

Open the chart page →

1,503

splunk-operatorstakater

0.0.6

1 of 2 See more

splunk-operator stakater 0.0.6

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
splunk/splunk-operator :2.0.0	c4e0d3146226	golang.org/x/net@v0.0.0-20211029224645-99673261e6eb stdlib@go1.17.12	0.55.0 1.25.13

Open the chart page →

11,459

gethstakewise

2.5.8

1 of 3 See more

geth stakewise 2.5.8

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ethereum/client-go :v1.15.10	1f36ca5922a5	golang.org/x/net@v0.36.0 stdlib@go1.24.2	0.55.0 1.25.13

Open the chart page →

1,143

graph-nodestakewise

3.1.0

2 of 3 See more

graph-node stakewise 3.1.0

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
graphprotocol/graph-node :v0.37.0	f4452cdedd68	stdlib@go1.24.1	1.25.13
ipfs/kubo :v0.24.0	e3de33bd746b	golang.org/x/net@v0.17.0 stdlib@go1.19.8	0.55.0 1.25.13

Open the chart page →

4,694

mayastorstartechnica

0.2.0

3 of 13 See more

mayastor startechnica 0.2.0

3 of the 13 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-attacher :v4.0.0	9a685020911e	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.18	0.55.0 1.25.13
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.6.0	f1c25991bac2	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.18	0.55.0 1.25.13
registry.k8s.io/sig-storage/livenessprobe :v2.8.0	cacee2b5c36d	golang.org/x/net@v0.0.0-20220921203646-d300de134e69 stdlib@go1.18	0.55.0 1.25.13

Open the chart page →

4,367

multusstartechnica

0.1.2

1 of 1 See more

multus startechnica 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/k8snetworkplumbingwg/multus-cni :stable	ec4e5dfe12b6	golang.org/x/net@v0.48.0 stdlib@go1.25.11	0.55.0 1.25.13

Open the chart page →

512

statpingstatping

0.1.14

1 of 1 See more

statping statping 0.1.14

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
statping/statping :v0.90.74	e874da513a5c	golang.org/x/net@v0.0.0-20200904194848-62affa334b73 stdlib@go1.14.13	0.55.0 1.25.13

Open the chart page →

3,378

thanosstevehipwell-helm-charts-thanos

1.24.1

1 of 1 See more

thanos stevehipwell-helm-charts-thanos 1.24.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.42.4	b567818fe608	stdlib@go1.26.5	1.25.13

Open the chart page →

203

stornxstornx

1.1.1

9 of 9 See more

stornx stornx 1.1.1

9 of the 9 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
alazidis/kube-netlag :1.1.0	0e8c84152201	golang.org/x/net@v0.33.0 stdlib@go1.24.13	0.55.0 1.25.13
alazidis/stornx :1.1.1	602d4f7f090c	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.55.0 1.25.13
istio/pilot :1.29.1	f8b0e412ac4a	golang.org/x/net@v0.48.0 stdlib@go1.25.8	0.55.0 1.25.13
quay.io/kiali/kiali :v2.23.0	7652b1285f50	golang.org/x/net@v0.49.0 stdlib@go1.25.0	0.55.0 1.25.13
quay.io/prometheus-operator/prometheus-config-reloader :v0.90.0	e5aab3be6873	golang.org/x/net@v0.52.0 stdlib@go1.25.8	0.55.0 1.25.13
quay.io/prometheus/node-exporter :v1.10.2	337ff1d356b6	golang.org/x/net@v0.44.0 stdlib@go1.25.3	0.55.0 1.25.13
quay.io/prometheus/prometheus :v3.10.0	7571a304e67f	golang.org/x/net@v0.49.0 stdlib@go1.26.0	0.55.0 1.25.13
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.18.0	1545919b72e3	golang.org/x/net@v0.48.0 stdlib@go1.25.5	0.55.0 1.25.13
registry.k8s.io/metrics-server/metrics-server :v0.8.0	89258156d0e9	golang.org/x/net@v0.40.0 stdlib@go1.24.4	0.55.0 1.25.13

Open the chart page →

11,735

stunner-gateway-operatorstunner

1.1.0

2 of 2 See more

stunner-gateway-operator stunner 1.1.0

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
l7mp/stunner-auth-server :1.1.0	2f8114477ba6	golang.org/x/net@v0.36.0 stdlib@go1.23.8	0.55.0 1.25.13
l7mp/stunner-gateway-operator :1.1.0	c34f7c931491	golang.org/x/net@v0.36.0 stdlib@go1.23.8	0.55.0 1.25.13

Open the chart page →

1,292

hlf-k8ssubstra

10.2.4

4 of 7 See more

hlf-k8s substra 10.2.4

4 of the 7 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
hyperledger/fabric-ca :1.5.0	f270dfeee91d	golang.org/x/net@v0.0.0-20201006153459-a7d1128ccaa0 stdlib@go1.15.7	0.55.0 1.25.13
jwilder/dockerize :latest	f94fb59fb4f6	golang.org/x/net@v0.47.0 stdlib@go1.25.5	0.55.0 1.25.13
ghcr.io/substra/fabric-peer :0.2.4	f681e0343a31	golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110 stdlib@go1.18.10	0.55.0 1.25.13
ghcr.io/substra/fabric-tools :0.2.4	3491a0f31c4a	golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110 stdlib@go1.18.10	0.55.0 1.25.13

Open the chart page →

12,030

supabasesupabse

0.8.0

4 of 11 See more

supabase supabse 0.8.0

4 of the 11 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
darthsim/imgproxy :v3.30.1	3b709e4a0e5e	golang.org/x/net@v0.44.0 stdlib@go1.25.1	0.55.0 1.25.13
library/postgres :17-alpine	18cfe3ef5e68	stdlib@go1.24.6	1.25.13
supabase/gotrue :v2.189.0	385184459f57	golang.org/x/net@v0.52.0 stdlib@go1.25.8	0.55.0 1.25.13
supabase/postgres :17.6.1.136	f371b5f3f2ac	stdlib@go1.26.1	1.25.13

Open the chart page →

18,327

Grafanasurajwarbhe-grafana

0.1.0

1 of 1 See more

Grafana surajwarbhe-grafana 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
surajwarbhe/grafana :v1	85248611e9f1	golang.org/x/net@v0.0.0-20200202094626-16171245cfb2 stdlib@go1.14.3	0.55.0 1.25.13

Open the chart page →

2,604

switchboardswitchboard

0.7.4

1 of 1 See more

switchboard switchboard 0.7.4

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/borchero/switchboard :0.7.4	54a193b757da	golang.org/x/net@v0.51.0 stdlib@go1.26.1	0.55.0 1.25.13

Open the chart page →

844

synology-proxy-operatorsynology-proxy-operator

0.0.8

1 of 1 See more

synology-proxy-operator synology-proxy-operator 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/phoeluga/synology-proxy-operator :0.0.8	b26510b26b31	golang.org/x/net@v0.52.0 stdlib@go1.26.2	0.55.0 1.25.13

Open the chart page →

210

hello-appsysintelligent

2.0.1

1 of 1 See more

hello-app sysintelligent 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
sysintelligent/hello-app :2.0.1	77fb30df847d	golang.org/x/net@v0.19.0 stdlib@go1.19.3	0.55.0 1.25.13

Open the chart page →

1,880

system-upgrade-controllersystem-upgrade

0.2.13

1 of 1 See more

system-upgrade-controller system-upgrade 0.2.13

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
rancher/system-upgrade-controller :v0.20.1	aaf4dbf64057	golang.org/x/net@v0.53.0 stdlib@go1.26.5	0.55.0 1.25.13

Open the chart page →

125

system-upgrade-controllersystem-upgrade-controller

1.12.0

1 of 1 See more

system-upgrade-controller system-upgrade-controller 1.12.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
rancher/system-upgrade-controller :v0.20.1	aaf4dbf64057	golang.org/x/net@v0.53.0 stdlib@go1.26.5	0.55.0 1.25.13

Open the chart page →

125

headscaleszpadel-charts

0.30.2

2 of 3 See more

headscale szpadel-charts 0.30.2

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/juanfont/headscale :0.29.1	8453e47ea6bf	stdlib@go1.26.4	1.25.13
ghcr.io/tale/headplane :0.6.3	9476cc5adb12	golang.org/x/net@v0.42.0 stdlib@go1.25.1	0.55.0 1.25.13

Open the chart page →

1,880

tekton-events-relaytekton-events-relay

0.10.1

1 of 1 See more

tekton-events-relay tekton-events-relay 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/fabioluciano/tekton-events-relay :0.10.1	84cb5a2b8b81	stdlib@go1.26.4	1.25.13

Open the chart page →

174

tbotteleport-agent-kube

18.11.0

1 of 1 See more

tbot teleport-agent-kube 18.11.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
public.ecr.aws/gravitational/tbot-distroless :18.11.0	4ba5ace31fea	stdlib@go1.25.12	1.25.13

Open the chart page →

472

tenuretenure

1.0.6

2 of 2 See more

tenure tenure 1.0.6

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
mongodb/mongodb-atlas-local :8	925c3d34f0c6	stdlib@go1.26.5	1.25.13
tenureai/tenure :v1.0.28	5f5b222df9a5	stdlib@go1.26.2	1.25.13

Open the chart page →

2,563

terraform-controllerterraform-controller

0.0.20

1 of 1 See more

terraform-controller terraform-controller 0.0.20

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
absaoss/terraform-controller :v0.0.20	ad538a1285a0	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.14.8	0.55.0 1.25.13

Open the chart page →

3,538

jenkinstestchart

0.1.9

1 of 2 See more

jenkins testchart 0.1.9

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
jenkins/jenkins :2.426.1-jdk11	b470bcdc4ecd	golang.org/x/net@v0.7.0 stdlib@go1.20.6	0.55.0 1.25.13

Open the chart page →

9,119

Container images carrying it

5,324 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/iver-wharf/wharf-cmd :v0.8.2	e98d13459cdc	golang.org/x/net@v0.0.0-20220412020605-290c469a71a5 stdlib@go1.18.2	0.55.0 1.25.13	2
quay.io/iver-wharf/wharf-provider-azuredevops :v3.0.1	2fe7e4dcffdf	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4 stdlib@go1.18.2	0.55.0 1.25.13	2
quay.io/iver-wharf/wharf-provider-github :v3.0.1	77a22cb45c2a	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4 stdlib@go1.18.2	0.55.0 1.25.13	2
quay.io/iver-wharf/wharf-provider-gitlab :v2.0.1	d7079e0890da	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4 stdlib@go1.18.2	0.55.0 1.25.13	2
quay.io/jcmoraisjr/haproxy-ingress :v0.16.1	6fd744191ef6	golang.org/x/net@v0.47.0 stdlib@go1.25.9	0.55.0 1.25.13	2
quay.io/jetstack/cert-manager-cainjector :v1.11.0	5c3eb25b0854	golang.org/x/net@v0.5.0 stdlib@go1.19.5	0.55.0 1.25.13	2
quay.io/jetstack/cert-manager-cainjector :v1.13.2	858fee0c4af0	golang.org/x/net@v0.17.0 stdlib@go1.20.10	0.55.0 1.25.13	2
quay.io/jetstack/cert-manager-cainjector :v1.14.3	9395dec77fcf	golang.org/x/net@v0.19.0 stdlib@go1.21.7	0.55.0 1.25.13	2
quay.io/jetstack/cert-manager-cainjector :v1.15.3	e0ce8ae280c8	golang.org/x/net@v0.26.0 stdlib@go1.22.5	0.55.0 1.25.13	2
quay.io/jetstack/cert-manager-cainjector :v1.17.2	ec56edb1161d	golang.org/x/net@v0.38.0 stdlib@go1.23.8	0.55.0 1.25.13	2
quay.io/jetstack/cert-manager-controller :v1.17.2	2c314feeb5e8	golang.org/x/net@v0.38.0 stdlib@go1.23.8	0.55.0 1.25.13	2
quay.io/jetstack/cert-manager-controller :v1.14.3	64adcb95ce09	golang.org/x/net@v0.19.0 stdlib@go1.21.7	0.55.0 1.25.13	2
quay.io/jetstack/cert-manager-controller :v1.13.2	9c67cf8c92d8	golang.org/x/net@v0.17.0 stdlib@go1.20.10	0.55.0 1.25.13	2
quay.io/jetstack/cert-manager-controller :v1.11.0	d429b6d696e0	golang.org/x/net@v0.5.0 stdlib@go1.19.5	0.55.0 1.25.13	2
quay.io/jetstack/cert-manager-controller :v1.15.3	eee34b3de2dd	golang.org/x/net@v0.26.0 stdlib@go1.22.5	0.55.0 1.25.13	2
quay.io/jetstack/cert-manager-ctl :v1.11.0	74611761f052	golang.org/x/net@v0.5.0 stdlib@go1.19.5	0.55.0 1.25.13	2
quay.io/jetstack/cert-manager-startupapicheck :v1.15.3	4cbc1b022a23	golang.org/x/net@v0.26.0 stdlib@go1.22.5	0.55.0 1.25.13	2
quay.io/jetstack/cert-manager-startupapicheck :v1.14.3	df8677135139	golang.org/x/net@v0.19.0 stdlib@go1.21.7	0.55.0 1.25.13	2
quay.io/jetstack/cert-manager-startupapicheck :v1.17.2	e18989b4f912	golang.org/x/net@v0.38.0 stdlib@go1.23.8	0.55.0 1.25.13	2
quay.io/jetstack/cert-manager-webhook :v1.13.2	0a9470447ebf	golang.org/x/net@v0.17.0 stdlib@go1.20.10	0.55.0 1.25.13	2
quay.io/jetstack/cert-manager-webhook :v1.17.2	37b16a9dff00	golang.org/x/net@v0.38.0 stdlib@go1.23.8	0.55.0 1.25.13	2
quay.io/jetstack/cert-manager-webhook :v1.11.0	6730d96fc382	golang.org/x/net@v0.5.0 stdlib@go1.19.5	0.55.0 1.25.13	2
quay.io/jetstack/cert-manager-webhook :v1.14.3	d8ad5515f44f	golang.org/x/net@v0.19.0 stdlib@go1.21.7	0.55.0 1.25.13	2
quay.io/jetstack/cert-manager-webhook :v1.15.3	fdcb9ac4963f	golang.org/x/net@v0.26.0 stdlib@go1.22.5	0.55.0 1.25.13	2
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.15.2	0.55.0 1.25.13	2
quay.io/kubevirt/kubevirt-cloud-controller-manager :v0.6.0	37ad4c475941	golang.org/x/net@v0.49.0 stdlib@go1.24.13	0.55.0 1.25.13	2
quay.io/kubevirt/kubevirt-csi-driver :latest	7b31b21b3f1e	golang.org/x/net@v0.49.0 stdlib@go1.24.13	0.55.0 1.25.13	2
quay.io/metallb/controller :v0.16.1	f51ab515de9c	golang.org/x/net@v0.53.0 stdlib@go1.25.9	0.55.0 1.25.13	2
quay.io/metallb/frr-k8s :v0.0.25	1cb06fb2d553	golang.org/x/net@v0.39.0 stdlib@go1.25.8	0.55.0 1.25.13	2
quay.io/metallb/speaker :v0.13.10	00406ccb1fa0	golang.org/x/net@v0.8.0 stdlib@go1.19.5	0.55.0 1.25.13	2
quay.io/metallb/speaker :v0.16.1	16561e96531e	golang.org/x/net@v0.53.0 stdlib@go1.25.9	0.55.0 1.25.13	2
quay.io/minio/mc :RELEASE.2023-09-29T16-41-22Z	a784ce6e3b1b	golang.org/x/net@v0.15.0 stdlib@go1.21.1	0.55.0 1.25.13	2
quay.io/minio/mc :RELEASE.2023-01-28T20-29-38Z	ad34abeba912	golang.org/x/net@v0.4.0 stdlib@go1.19.4	0.55.0 1.25.13	2
quay.io/minio/minio :RELEASE.2023-09-30T07-02-29Z	6262bc9a2730	golang.org/x/net@v0.15.0 stdlib@go1.21.1	0.55.0 1.25.13	2
quay.io/minio/minio :RELEASE.2023-07-21T21-12-44Z	8e5e9490cd50	golang.org/x/net@v0.12.0 stdlib@go1.19.11	0.55.0 1.25.13	2
quay.io/minio/minio :RELEASE.2023-02-10T18-48-39Z	a0a002cb113c	golang.org/x/net@v0.5.0 stdlib@go1.19.4	0.55.0 1.25.13	2
quay.io/mongodb/mongodb-kubernetes-operator :0.13.0	2dcc6393e6f7	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.55.0 1.25.13	2
quay.io/oauth2-proxy/oauth2-proxy :v7.3.0	8c21390be87d	golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2 stdlib@go1.17.10	0.55.0 1.25.13	2
quay.io/open-cluster-management/registration-operator :v1.3.1	df6c926a2b54	golang.org/x/net@v0.52.0 stdlib@go1.25.10	0.55.0 1.25.13	2
quay.io/openshift/origin-cli :4.7	464a3af4dfe0	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.15.14	0.55.0 1.25.13	2
quay.io/openshift/origin-cli :4.8	bb5e052770e5	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.16.12	0.55.0 1.25.13	2
quay.io/openshift/origin-csi-livenessprobe :latest	e9236513d24a	stdlib@go1.26.5	1.25.13	2
quay.io/opstree/redis-operator :v0.22.2	464ac61a6eb4	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13	2
quay.io/prometheus/blackbox-exporter :v0.24.0	3af31f8bd1ad	golang.org/x/net@v0.9.0 stdlib@go1.20.4	0.55.0 1.25.13	2
quay.io/prometheuscommunity/elasticsearch-exporter :v1.11.0	a056739b095d	stdlib@go1.26.5	1.25.13	2
quay.io/prometheuscommunity/json-exporter :v0.7.0	3a777171d39a	golang.org/x/net@v0.33.0 stdlib@go1.23.6	0.55.0 1.25.13	2
quay.io/prometheus/node-exporter :v1.3.0	23ff46c728b9	golang.org/x/net@v0.0.0-20210525063256-abc453219eb5 stdlib@go1.17.3	0.55.0 1.25.13	2
quay.io/prometheus/node-exporter :v1.11.1-distroless	6112664fd761	golang.org/x/net@v0.52.0 stdlib@go1.26.1	0.55.0 1.25.13	2
quay.io/prometheus/node-exporter :v1.0.0	8a3a33cad0bd	golang.org/x/net@v0.0.0-20200513185701-a91f0712d120 stdlib@go1.14.3	0.55.0 1.25.13	2
quay.io/prometheus/node-exporter :v1.3.1	f2269e73124d	golang.org/x/net@v0.0.0-20210525063256-abc453219eb5 stdlib@go1.17.3	0.55.0 1.25.13	2