CVE-2026-39821

High

Advisory

Published 22 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,642; of 17,813 indexed, latest versions
Container images: 5,366; deployed by those charts
Fix available: 3 of 3; affected packages

Red Hat Security Advisory: git-lfs security update

Carried by container images the latest versions of 4,642 of 17,813 indexed charts deploy, on 5,366 images.

Affected package	Affected versions	Fixed in	Images
git-lfsrpm	2.13.3-3.el8_6	0:3.4.1-11.el8_10	1
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+191 more	1.25.13	5,324
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+220 more	0.55.0	3,744

OSV records: RHSA-2026:30853 GO-2026-5026

Charts affected

4,642 by stars

Chart

Latest

Affected images

Radar Score

prometheusleechistest

11.6.0

4 of 6 See more

prometheus leechistest 11.6.0

4 of the 6 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
prom/alertmanager :v0.20.0	7e4e9f7a0954	golang.org/x/net@v0.0.0-20190724013045-ca1201d0de80 stdlib@go1.13.5	0.55.0 1.25.13
prom/prometheus :v2.19.0	bfad037f95e5	golang.org/x/net@v0.0.0-20200602114024-627f9648deb9 stdlib@go1.14.4	0.55.0 1.25.13
prom/pushgateway :v1.2.0	0a9031142481	stdlib@go1.13.8	1.25.13
quay.io/prometheus/node-exporter :v1.0.1	cf66a6bbd573	golang.org/x/net@v0.0.0-20200513185701-a91f0712d120 stdlib@go1.14.4	0.55.0 1.25.13

Open the chart page →

8,495

kube-benchlemontech

0.1.0

1 of 1 See more

kube-bench lemontech 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
aquasec/kube-bench :v0.6.9	c329d73fea58	stdlib@go1.19	1.25.13

Open the chart page →

1,633

trivy-serverlemontech

0.1.0

1 of 1 See more

trivy-server lemontech 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
aquasec/trivy :0.32.0	973d0df16189	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.19	0.55.0 1.25.13

Open the chart page →

4,282

adguard-homelib42

2.0.0

1 of 1 See more

adguard-home lib42 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
adguard/adguardhome :v0.107.65	d765078d2140	golang.org/x/net@v0.43.0 stdlib@go1.24.6	0.55.0 1.25.13

Open the chart page →

1,206

libredb-studiolibredb-studio-oci

0.1.66

1 of 1 See more

libredb-studio libredb-studio-oci 0.1.66

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/libredb/libredb-studio :0.16.1	1d0aa4f090ac	stdlib@go1.24.4	1.25.13

Open the chart page →

1,200

librenmslibrenms

10.1.2

2 of 5 See more

librenms librenms 10.1.2

2 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/mysql :9.7.2	29abb0a17998	stdlib@go1.24.6	1.25.13
librenms/librenms :26.8.2	8194a4a9ff49	stdlib@go1.24.6	1.25.13

Open the chart page →

2,748

kltlifecycle-toolkit

0.2.6

4 of 4 See more

klt lifecycle-toolkit 0.2.6

4 of the 4 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/keptn/certificate-operator :v1.1.0	8fdd311a6d33	golang.org/x/net@v0.14.0 stdlib@go1.20.4	0.55.0 1.25.13
ghcr.io/keptn/lifecycle-operator :v0.8.2	487bfc37c4b4	golang.org/x/net@v0.14.0 stdlib@go1.20.4	0.55.0 1.25.13
ghcr.io/keptn/metrics-operator :v0.8.2	acf22310e9dd	golang.org/x/net@v0.14.0 stdlib@go1.20.4	0.55.0 1.25.13
ghcr.io/keptn/scheduler :v0.8.2	0f7d277bb2b2	golang.org/x/net@v0.14.0 stdlib@go1.20.4	0.55.0 1.25.13

Open the chart page →

4,696

kube-iptables-tailerlifen

0.2.3

1 of 1 See more

kube-iptables-tailer lifen 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
honestica/kube-iptables-tailer :master-91	a393242fb939	golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb stdlib@go1.13.8	0.55.0 1.25.13

Open the chart page →

4,481

op-scim-bridgelifen

1.0.3

1 of 2 See more

op-scim-bridge lifen 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
1password/scim :v2.3.1	29d0c6cb67eb	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.16.8	0.55.0 1.25.13

Open the chart page →

2,788

op-scim-bridgelifen-charts

1.0.3

1 of 2 See more

op-scim-bridge lifen-charts 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
1password/scim :v2.3.1	29d0c6cb67eb	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.16.8	0.55.0 1.25.13

Open the chart page →

2,788

lightsteplightstep-microsat

2.0.21

1 of 1 See more

lightstep lightstep-microsat 2.0.21

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
lightstep/microsatellite :2024-01-22_17-52-59Z	c800e05e1eff	golang.org/x/net@v0.20.0 stdlib@go1.22.1	0.55.0 1.25.13

Open the chart page →

1,135

komgalinkding

0.2.3

1 of 1 See more

komga linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
gotson/komga :1.22.0	ba892ab3e082	stdlib@go1.17.8	1.25.13

Open the chart page →

3,125

linkerd-preview-vizlinkerd-buoyant

25.4.3

4 of 5 See more

linkerd-preview-viz linkerd-buoyant 25.4.3

4 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/buoyantio/metrics-api :preview-25.4.3	2cef2a3f97da	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.55.0 1.25.13
ghcr.io/buoyantio/prometheus :v2.55.1	2659f4c2ebb7	golang.org/x/net@v0.28.0 stdlib@go1.23.2	0.55.0 1.25.13
ghcr.io/buoyantio/tap :preview-25.4.3	e02a8bd9e2c3	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.55.0 1.25.13
ghcr.io/buoyantio/web :preview-25.4.3	3ee1b62aa111	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.55.0 1.25.13

Open the chart page →

3,464

linkerd-dashboardlinkerd-dashboard

0.11.1

2 of 2 See more

linkerd-dashboard linkerd-dashboard 0.11.1

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/buoyantio/linkerd-dashboard-server :0.11.1	dd6a29588242	stdlib@go1.26.5	1.25.13
ghcr.io/buoyantio/prometheus :v3.3.1	e2b8aa62b648	golang.org/x/net@v0.35.0 stdlib@go1.24.2	0.55.0 1.25.13

Open the chart page →

1,060

linode-blockstorage-csi-driverlinode-blockstorage-csi-driver

1.1.4

5 of 5 See more

linode-blockstorage-csi-driver linode-blockstorage-csi-driver 1.1.4

5 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
linode/linode-blockstorage-csi-driver :v1.1.4	09f3282bf53d	stdlib@go1.26.5	1.25.13
registry.k8s.io/sig-storage/csi-attacher :v4.11.0	b74b05b39501	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.55.0 1.25.13
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.16.0	ab482308a492	golang.org/x/net@v0.49.0 stdlib@go1.25.7	0.55.0 1.25.13
registry.k8s.io/sig-storage/csi-provisioner :v6.2.0	6be9f63ca4ca	golang.org/x/net@v0.51.0 stdlib@go1.25.7	0.55.0 1.25.13
registry.k8s.io/sig-storage/csi-resizer :v2.1.0	589e525cddef	golang.org/x/net@v0.48.0 stdlib@go1.25.7	0.55.0 1.25.13

Open the chart page →

2,999

ccm-linodelinode-cloud-controller-manager

0.9.8

1 of 1 See more

ccm-linode linode-cloud-controller-manager 0.9.8

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
linode/linode-cloud-controller-manager :v0.9.8	cd8c17512206	stdlib@go1.26.4	1.25.13

Open the chart page →

167

school-botlinuxoid69

0.1.0

1 of 1 See more

school-bot linuxoid69 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/linuxoid69/school-bot :v0.3.3	c8872438f1e0	stdlib@go1.23.3	1.25.13

Open the chart page →

772

liqo-upgrade-operatorliqo-upgrade-operator

0.1.0

1 of 1 See more

liqo-upgrade-operator liqo-upgrade-operator 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
kazem26/liqo-upgrade-operator :v0.1	268b7c6a59dd	golang.org/x/net@v0.38.0 stdlib@go1.24.13	0.55.0 1.25.13

Open the chart page →

382

listmonklistmonk-chart

2.0.1

2 of 2 See more

listmonk listmonk-chart 2.0.1

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :15	9b1d34adbce1	stdlib@go1.24.6	1.25.13
listmonk/listmonk :v6.0.0	bf3903d54a46	golang.org/x/net@v0.47.0 stdlib@go1.24.1	0.55.0 1.25.13

Open the chart page →

3,143

pocketbase-halitesql

0.0.3

1 of 1 See more

pocketbase-ha litesql 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/litesql/pocketbase-ha :latest	c5b28608958b	stdlib@go1.26.5	1.25.13

Open the chart page →

1,170

ingresslivekit-server

1.2.2

1 of 1 See more

ingress livekit-server 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
livekit/ingress :v1.2.2	1ab01641b366	golang.org/x/net@v0.18.0 stdlib@go1.20.7	0.55.0 1.25.13

Open the chart page →

10,844

livekit-recorderlivekit-server

0.3.13

1 of 1 See more

livekit-recorder livekit-server 0.3.13

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
livekit/livekit-recorder :v0.3.13	ecf1409c75e0	golang.org/x/net@v0.0.0-20211004195052-b30845b58a23 stdlib@go1.16.2	0.55.0 1.25.13

Open the chart page →

2,136

livekit-serverlivekit-server

1.9.0

1 of 1 See more

livekit-server livekit-server 1.9.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
livekit/livekit-server :v1.9.0	3602a85840d5	golang.org/x/net@v0.40.0 stdlib@go1.24.3	0.55.0 1.25.13

Open the chart page →

1,562

pagesliviu884422-pages

1.0.0

1 of 3 See more

pages liviu884422-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.13

Open the chart page →

20,285

llmarinerllmariner

1.53.1

15 of 21 See more

llmariner llmariner 1.53.1

15 of the 21 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
public.ecr.aws/cloudnatix/llmariner/api-usage-cleaner :1.16.0	d47f43484055	stdlib@go1.23.12	1.25.13
public.ecr.aws/cloudnatix/llmariner/api-usage-server :1.16.0	8f9c32b866b0	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/cluster-manager-server :1.8.0	364b3ff0fcb7	golang.org/x/net@v0.38.0 stdlib@go1.24.5	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/cluster-monitor-server :0.10.2	2d28f9e3eab4	golang.org/x/net@v0.38.0 stdlib@go1.23.11	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/database-creator :1.17.0	97065ced2942	stdlib@go1.23.11	1.25.13
public.ecr.aws/cloudnatix/llmariner/file-manager-server :1.11.0	301216788e93	golang.org/x/net@v0.38.0 stdlib@go1.23.11	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/inference-manager-engine :1.46.0	c46f109c3d0b	golang.org/x/net@v0.48.0 stdlib@go1.25.9	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/inference-manager-server :1.45.0	90b890f800ab	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/job-manager-dispatcher :1.27.0	582508903cb0	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/job-manager-server :1.27.0	fe9de719f91e	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/model-manager-loader :1.27.0	26ac7263a823	golang.org/x/net@v0.38.0 stdlib@go1.24.0	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/model-manager-server :1.27.0	c057dcdd9ef3	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/rbac-server :1.19.1	df1adeb86679	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/session-manager-server :1.9.0	f24ecd37fbaa	golang.org/x/net@v0.38.0 stdlib@go1.23.11	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/user-manager-server :1.27.1	628a14449241	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13

Open the chart page →

12,185

llm-dllm-d

1.0.23

1 of 2 See more

llm-d llm-d 1.0.23

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/llm-d/llm-d-model-service :v0.0.15	8b99a8104a2f	golang.org/x/net@v0.40.0 stdlib@go1.24.3	0.55.0 1.25.13

Open the chart page →

2,564

home-assistantlmatfy

0.1.38

1 of 1 See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
homeassistant/home-assistant :2026.7	5a531753cea9	golang.org/x/net@v0.49.0 stdlib@go1.25.6	0.55.0 1.25.13

Open the chart page →

2,488

go-ocpp-serverloafoe

0.2.1

1 of 1 See more

go-ocpp-server loafoe 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/go-ocpp-server :v0.2.1	45bb960674ab	stdlib@go1.21.13	1.25.13

Open the chart page →

399

mcp-notifierloafoe

0.2.0

1 of 1 See more

mcp-notifier loafoe 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/mcp-notifier :v0.2.0	ea958b832415	stdlib@go1.26.4	1.25.13

Open the chart page →

mt-mcp-grafanaloafoe

0.10.0

2 of 2 See more

mt-mcp-grafana loafoe 0.10.0

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
grafana/mcp-grafana :0.14.0	42f541f22063	golang.org/x/net@v0.53.0 stdlib@go1.26.3	0.55.0 1.25.13
ghcr.io/loafoe/mt-mcp-grafana :v0.1.1	2332d9b47475	stdlib@go1.26.2	1.25.13

Open the chart page →

1,988

mt-mcp-proxyloafoe

0.3.0

1 of 2 See more

mt-mcp-proxy loafoe 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/mt-mcp-proxy :v0.1.0	221835f9340f	stdlib@go1.26.4	1.25.13

Open the chart page →

505

otlp-gatewayloafoe

0.0.2

2 of 2 See more

otlp-gateway loafoe 0.0.2

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/jimmidyson/configmap-reload :v0.13.1	ca0c14eef541	stdlib@go1.22.4	1.25.13
ghcr.io/loafoe/caddy-token :v0.3.0	528f2174fa2f	golang.org/x/net@v0.27.0 stdlib@go1.22.5	0.55.0 1.25.13

Open the chart page →

2,180

patch-operatorloafoe

0.11.3

1 of 2 See more

patch-operator loafoe 0.11.3

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/redhat-cop/kube-rbac-proxy :v0.11.0	c68135620167	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.15.15	0.55.0 1.25.13

Open the chart page →

4,912

picoclawloafoe

0.1.1

1 of 2 See more

picoclaw loafoe 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/picoclaw :v0.0.19	42e1b6862913	golang.org/x/net@v0.53.0 stdlib@go1.26.2	0.55.0 1.25.13

Open the chart page →

479

solgateloafoe

0.0.12

1 of 1 See more

solgate loafoe 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/solgate :v0.0.12	b3256cbc7b68	golang.org/x/net@v0.14.0 stdlib@go1.21.0	0.55.0 1.25.13

Open the chart page →

2,126

tempo-distributedloafoe

1.20.1

1 of 2 See more

tempo-distributed loafoe 1.20.1

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
grafana/tempo :2.6.0	f55a8a1937ff	golang.org/x/net@v0.27.0 stdlib@go1.22.6	0.55.0 1.25.13

Open the chart page →

2,038

local-path-exporterlocal-path-exporter

0.2.3

1 of 1 See more

local-path-exporter local-path-exporter 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/tmusial99/local-path-exporter :1.1.0	82476692c680	stdlib@go1.26.4	1.25.13

Open the chart page →

weather-app-chartlocal-weatherapp

0.1.0

2 of 4 See more

weather-app-chart local-weatherapp 0.1.0

2 of the 4 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
bitnamilegacy/mysql :8.0.36-debian-11-r3	8aad73aa0c6d	stdlib@go1.21.6	1.25.13
youssef11gaber10/deployment-auth-go :latest	6597b26959d2	golang.org/x/net@v0.10.0 stdlib@go1.26.1	0.55.0 1.25.13

Open the chart page →

5,915

ocatiecataloguslocatiecatalogus

1.0.0

1 of 3 See more

ocatiecatalogus locatiecatalogus 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/ocatiecatalogus-php :latest	c22764cbfa97	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.55.0 1.25.13

Open the chart page →

7,521

locust-pluginslocust-plugins

0.0.4

2 of 3 See more

locust-plugins locust-plugins 0.0.4

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
sky5367/locust-plugins-grafana :latest	d51bf68d4b26	golang.org/x/net@v0.22.0 stdlib@go1.21.8	0.55.0 1.25.13
sky5367/locust-plugins-timescale :latest	d3150f201471	stdlib@go1.18.7	1.25.13

Open the chart page →

7,581

uptime-kumaloeken-at-home

2.3.2

1 of 1 See more

uptime-kuma loeken-at-home 2.3.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :2.3.2	9aeb4e51d038	golang.org/x/net@v0.40.0 stdlib@go1.20.5	0.55.0 1.25.13

Open the chart page →

33,925

central-hostpath-mapperloft

0.2.9

1 of 1 See more

central-hostpath-mapper loft 0.2.9

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/central-hostpath-mapper :0.2.9	fa6dba122171	golang.org/x/net@v0.26.0 stdlib@go1.23.2	0.55.0 1.25.13

Open the chart page →

931

devpod-proloft

0.0.0-ci.4-do-not-use

1 of 1 See more

devpod-pro loft 0.0.0-ci.4-do-not-use

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/devpod-pro :0.0.0-ci.4-do-not-use	5dfa86b6451f	golang.org/x/net@v0.21.0 stdlib@go1.20.10	0.55.0 1.25.13

Open the chart page →

3,242

devspace-cloudloft

0.3.3

2 of 8 See more

devspace-cloud loft 0.3.3

2 of the 8 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
devspacecloud/manager :0.3.3	49c397413f7b	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.8	0.55.0 1.25.13
library/postgres :11	5d2aa4a7b5f9	stdlib@go1.16.7	1.25.13

Open the chart page →

9,893

kioskloft

0.2.11

1 of 1 See more

kiosk loft 0.2.11

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
kiosksh/kiosk :0.2.11	501725ba2025	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.15.7	0.55.0 1.25.13

Open the chart page →

3,096

license-serverloft

0.6.0

1 of 1 See more

license-server loft 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/license-server :0.6.0	69ce001bb4b0	golang.org/x/net@v0.53.0 stdlib@go1.24.3	0.55.0 1.25.13

Open the chart page →

804

loft-agentloft

3.2.4

1 of 1 See more

loft-agent loft 3.2.4

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/agent :3.2.4	5c109914ff73	golang.org/x/net@v0.6.0 stdlib@go1.18.10	0.55.0 1.25.13

Open the chart page →

2,460

loft-direct-cluster-endpointloft

1.14.0

1 of 1 See more

loft-direct-cluster-endpoint loft 1.14.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
loftsh/directclusterendpoint :1.14.0	310cc7d690f5	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.16.6	0.55.0 1.25.13

Open the chart page →

3,120

vcluster-control-planeloft

0.0.0-ci.4-do-not-use

1 of 1 See more

vcluster-control-plane loft 0.0.0-ci.4-do-not-use

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/vcluster-control-plane :0.0.0-ci.4-do-not-use	45e744fc623f	golang.org/x/net@v0.21.0 stdlib@go1.22.0	0.55.0 1.25.13

Open the chart page →

3,242

vcluster-headloft

0.0.0-035ec6e

1 of 2 See more

vcluster-head loft 0.0.0-035ec6e

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/kubernetes :v1.35.0	90097a08b87c	golang.org/x/net@v0.42.0 stdlib@go1.24.11	0.55.0 1.25.13

Open the chart page →

1,309

Container images carrying it

5,366 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/prometheus-operator/prometheus-operator :v0.77.1	dde69a8b6f4b	golang.org/x/net@v0.29.0 stdlib@go1.23.1	0.55.0 1.25.13	2
quay.io/prometheus/prometheus :v2.53.0	075b1ba2c4eb	golang.org/x/net@v0.26.0 stdlib@go1.22.4	0.55.0 1.25.13	2
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	golang.org/x/net@v0.32.0 stdlib@go1.23.4	0.55.0 1.25.13	2
quay.io/prometheus/prometheus :v2.22.1	b899dbd1b901	golang.org/x/net@v0.0.0-20201006153459-a7d1128ccaa0 stdlib@go1.15.3	0.55.0 1.25.13	2
quay.io/prometheus/prometheus :v2.47.0	c5dd35038287	golang.org/x/net@v0.12.0 stdlib@go1.21.0	0.55.0 1.25.13	2
quay.io/prometheus/prometheus :v2.36.2	df0cd5887887	golang.org/x/net@v0.0.0-20220520000938-2e3eb7b945c2 stdlib@go1.18.3	0.55.0 1.25.13	2
quay.io/prometheus/pushgateway :v1.11.2	49ed9fdf3780	golang.org/x/net@v0.46.0 stdlib@go1.25.3	0.55.0 1.25.13	2
quay.io/prometheus/pushgateway :v1.6.2	979a69ab4a40	golang.org/x/net@v0.10.0 stdlib@go1.21.1	0.55.0 1.25.13	2
quay.io/prometheus/pushgateway :v1.11.0	99392035ae99	golang.org/x/net@v0.34.0 stdlib@go1.23.4	0.55.0 1.25.13	2
quay.io/thanos/thanos :v0.39.2	1d022ef4b8ef	golang.org/x/net@v0.41.0 stdlib@go1.24.0	0.55.0 1.25.13	2
quay.io/zncdatadev/sig-storage/csi-provisioner :v5.1.0	672e45d6a556	golang.org/x/net@v0.28.0 stdlib@go1.22.5	0.55.0 1.25.13	2
quay.io/zncdatadev/sig-storage/livenessprobe :v2.14.0	33692aed26aa	golang.org/x/net@v0.28.0 stdlib@go1.22.5	0.55.0 1.25.13	2
quay.io/zncdatadev/tools :1.0.0-kubedoop0.0.0-dev	382fca2054c9	golang.org/x/net@v0.26.0 stdlib@go1.22.6	0.55.0 1.25.13	2
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra :latest	b1198ea741d1	golang.org/x/net@v0.47.0 stdlib@go1.24.11	0.55.0 1.25.13	2
registry.k8s.io/etcd :3.5.6-0	dd75ec974b0a	golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2 stdlib@go1.16.15	0.55.0 1.25.13	2
registry.k8s.io/ingress-nginx/controller :v1.9.4	5b161f051d01	golang.org/x/net@v0.17.0 stdlib@go1.21.3	0.55.0 1.25.13	2
registry.k8s.io/ingress-nginx/controller :v1.11.8	695d79381ee6	golang.org/x/net@v0.41.0 stdlib@go1.24.4	0.55.0 1.25.13	2
registry.k8s.io/ingress-nginx/controller :v1.9.5	b3aba22b1da8	golang.org/x/net@v0.17.0 stdlib@go1.21.5	0.55.0 1.25.13	2
registry.k8s.io/ingress-nginx/controller :v1.12.1	d2fbc4ec70d8	golang.org/x/net@v0.37.0 stdlib@go1.24.1	0.55.0 1.25.13	2
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v20230312-helm-chart-4.5.2-28-g66a760794	01d181618f27	golang.org/x/net@v0.7.0 stdlib@go1.20.1	0.55.0 1.25.13	2
registry.k8s.io/kube-apiserver :v1.26.1	99e1ed9fbc8a	golang.org/x/net@v0.3.1-0.20221206200815-1e63c2f08a10 stdlib@go1.19.5	0.55.0 1.25.13	2
registry.k8s.io/kube-controller-manager :v1.26.1	40adecbe3a40	golang.org/x/net@v0.3.1-0.20221206200815-1e63c2f08a10 stdlib@go1.19.5	0.55.0 1.25.13	2
registry.k8s.io/kubectl :v1.37.0	5ed410ebac5d	stdlib@go1.26.5	1.25.13	2
registry.k8s.io/kube-scheduler :v1.30.14	74a5cf9cfa9f	golang.org/x/net@v0.23.0 stdlib@go1.23.10	0.55.0 1.25.13	2
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.5.0	09a36e2be1db	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.3	0.55.0 1.25.13	2
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.7.0	a15ca437f230	golang.org/x/net@v0.0.0-20221014081412-f15817d10f9b stdlib@go1.19.3	0.55.0 1.25.13	2
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.10.1	af8220f53493	golang.org/x/net@v0.17.0 stdlib@go1.20.10	0.55.0 1.25.13	2
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.6.0	bdab4e49d71d	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.5	0.55.0 1.25.13	2
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.15.0	db384bf43222	golang.org/x/net@v0.33.0 stdlib@go1.23.5	0.55.0 1.25.13	2
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.10.0	ec5d6f6be228	golang.org/x/net@v0.10.0 stdlib@go1.20.7	0.55.0 1.25.13	2
registry.k8s.io/metrics-server/metrics-server :v0.8.0	89258156d0e9	golang.org/x/net@v0.40.0 stdlib@go1.24.4	0.55.0 1.25.13	2
registry.k8s.io/nfd/node-feature-discovery :v0.19.0	2fa1c99ad09b	stdlib@go1.26.3	1.25.13	2
registry.k8s.io/sig-storage/csi-attacher :v4.9.0	5aaefc24f315	golang.org/x/net@v0.40.0 stdlib@go1.24.2	0.55.0 1.25.13	2
registry.k8s.io/sig-storage/csi-attacher :v3.4.0	8b9c313c05f5	golang.org/x/net@v0.0.0-20210825183410-e898025ed96a stdlib@go1.17.3	0.55.0 1.25.13	2
registry.k8s.io/sig-storage/csi-attacher :v4.0.0	9a685020911e	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.18	0.55.0 1.25.13	2
registry.k8s.io/sig-storage/csi-attacher :v4.8.0	a399393ff5bd	golang.org/x/net@v0.32.0 stdlib@go1.23.1	0.55.0 1.25.13	2
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.5.1	0103eee7c35e	golang.org/x/net@v0.0.0-20210825183410-e898025ed96a stdlib@go1.17.3	0.55.0 1.25.13	2
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.5.0	4fd21f36075b	golang.org/x/net@v0.0.0-20210825183410-e898025ed96a stdlib@go1.17.3	0.55.0 1.25.13	2
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.9.0	cd21e19cd8bb	golang.org/x/net@v0.13.0 stdlib@go1.20.5	0.55.0 1.25.13	2
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.6.0	f1c25991bac2	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.18	0.55.0 1.25.13	2
registry.k8s.io/sig-storage/csi-provisioner :v3.1.0	122bfb8c1eda	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.17.3	0.55.0 1.25.13	2
registry.k8s.io/sig-storage/csi-provisioner :v6.1.1	d992c36d4ddd	golang.org/x/net@v0.43.0 stdlib@go1.24.6	0.55.0 1.25.13	2
registry.k8s.io/sig-storage/csi-provisioner :v6.1.0	e5900dc98b0d	golang.org/x/net@v0.43.0 stdlib@go1.24.6	0.55.0 1.25.13	2
registry.k8s.io/sig-storage/csi-resizer :v1.5.0	8f7520bd957e	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.18	0.55.0 1.25.13	2
registry.k8s.io/sig-storage/csi-resizer :v1.4.0	9ebbf9f023e7	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.17.3	0.55.0 1.25.13	2
registry.k8s.io/sig-storage/csi-snapshotter :v6.0.1	ad16874e2140	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.18	0.55.0 1.25.13	2
registry.k8s.io/sig-storage/csi-snapshotter :v8.3.0	bc7be893ecc3	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.55.0 1.25.13	2
registry.k8s.io/sig-storage/csi-snapshotter :v8.2.0	dd788d79cf4c	golang.org/x/net@v0.31.0 stdlib@go1.23.1	0.55.0 1.25.13	2
registry.k8s.io/sig-storage/livenessprobe :v2.15.0	2c5f9dc4ea5a	golang.org/x/net@v0.32.0 stdlib@go1.23.1	0.55.0 1.25.13	2
registry.k8s.io/sig-storage/livenessprobe :v2.12.0	5baeb4a6d7d5	golang.org/x/net@v0.18.0 stdlib@go1.21.5	0.55.0 1.25.13	2