CVE-2026-39821

High

Advisory

Published 22 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,556; of 17,790 indexed, latest versions
Container images: 5,324; deployed by those charts
Fix available: 3 of 3; affected packages

Red Hat Security Advisory: git-lfs security update

Carried by container images the latest versions of 4,556 of 17,790 indexed charts deploy, on 5,324 images.

Affected package	Affected versions	Fixed in	Images
git-lfsrpm	2.13.3-3.el8_6	0:3.4.1-11.el8_10	1
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+189 more	1.25.13	5,288
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+220 more	0.55.0	3,695

OSV records: RHSA-2026:30853 GO-2026-5026

Charts affected

4,556 by stars

Chart

Latest

Affected images

Radar Score

temporalcastai

0.54.2

10 of 14 See more

temporal castai 0.54.2

10 of the 14 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
grafana/grafana :11.0.0	0dc5a246ab16	golang.org/x/net@v0.23.0 stdlib@go1.21.10	0.55.0 1.25.13
temporalio/admin-tools :1.26.2	37e2e33dbd7b	golang.org/x/net@v0.31.0 stdlib@go1.22.5	0.55.0 1.25.13
temporalio/server :1.26.2	1e2626efcbc1	golang.org/x/net@v0.31.0 stdlib@go1.23.2	0.55.0 1.25.13
temporalio/ui :2.33.0	5c586a3c8ec5	golang.org/x/net@v0.17.0 stdlib@go1.23.0	0.55.0 1.25.13
quay.io/prometheus-operator/prometheus-config-reloader :v0.74.0	d55631c7a740	golang.org/x/net@v0.25.0 stdlib@go1.22.3	0.55.0 1.25.13
quay.io/prometheus/alertmanager :v0.27.0	e13b6ed5cb92	golang.org/x/net@v0.20.0 stdlib@go1.21.7	0.55.0 1.25.13
quay.io/prometheus/node-exporter :v1.8.1	fa7fa12a57ef	golang.org/x/net@v0.23.0 stdlib@go1.22.3	0.55.0 1.25.13
quay.io/prometheus/prometheus :v2.53.0	075b1ba2c4eb	golang.org/x/net@v0.26.0 stdlib@go1.22.4	0.55.0 1.25.13
quay.io/prometheus/pushgateway :v1.8.0	c159e946abf4	golang.org/x/net@v0.22.0 stdlib@go1.22.1	0.55.0 1.25.13
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.12.0	b401fae262a5	golang.org/x/net@v0.22.0 stdlib@go1.21.8	0.55.0 1.25.13

Open the chart page →

16,232

catalyst-agentscatalyst-agents

0.1.31

14 of 18 See more

catalyst-agents catalyst-agents 0.1.31

14 of the 18 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
alpine/k8s :1.32.3	eec354133193	golang.org/x/net@v0.37.0 stdlib@go1.23.6	0.55.0 1.25.13
grafana/grafana :13.1.3	ab5cb380e3ff	golang.org/x/net@v0.49.0 stdlib@go1.26.5	0.55.0 1.25.13
grafana/loki :3.0.0	757b5fadf816	golang.org/x/net@v0.22.0 stdlib@go1.21.9	0.55.0 1.25.13
grafana/loki-canary :3.0.0	28d7c00588aa	golang.org/x/net@v0.22.0 stdlib@go1.21.9	0.55.0 1.25.13
grafana/tempo :2.5.0	f0200a9bff6d	golang.org/x/net@v0.24.0 stdlib@go1.21.3	0.55.0 1.25.13
otel/opentelemetry-collector-contrib :0.156.0	125bdbeb7590	stdlib@go1.26.4	1.25.13
prom/memcached-exporter :v0.14.2	d8a61419b841	golang.org/x/net@v0.17.0 stdlib@go1.21.5	0.55.0 1.25.13
ghcr.io/chaos-mesh/chaos-coredns :v0.2.8	38bfdf5e3774	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e stdlib@go1.25.5	0.55.0 1.25.13
ghcr.io/chaos-mesh/chaos-daemon :v2.8.3	69b1d3c09cfa	golang.org/x/net@v0.52.0 stdlib@go1.25.11	0.55.0 1.25.13
ghcr.io/chaos-mesh/chaos-mesh :v2.8.3	bdb31f3121a2	golang.org/x/net@v0.52.0 stdlib@go1.25.11	0.55.0 1.25.13
ghcr.io/jkroepke/kube-webhook-certgen :1.8.5	d0e80b2f62fe	stdlib@go1.26.5	1.25.13
quay.io/prometheus-operator/prometheus-operator :v0.93.0	a001ed10a382	stdlib@go1.26.5	1.25.13
quay.io/prometheus/node-exporter :v1.12.1-distroless	8c9bac11973b	stdlib@go1.26.5	1.25.13
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.19.1	85108987d044	stdlib@go1.26.4	1.25.13

Open the chart page →

17,099

mongodb-operatorccowley

0.1.1

1 of 1 See more

mongodb-operator ccowley 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/mongodb/mongodb-kubernetes-operator :0.3.0	107a7c73af59	golang.org/x/net@v0.0.0-20200226121028-0de0cce0169b stdlib@go1.14.10	0.55.0 1.25.13

Open the chart page →

6,389

openldapccowley

2.0.4

1 of 3 See more

openldap ccowley 2.0.4

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
osixia/openldap :1.4.0	ccd95cc6e61e	golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3 stdlib@go1.13.4	0.55.0 1.25.13

Open the chart page →

6,219

openldap_exporterccowley

0.1.0

1 of 1 See more

openldap_exporter ccowley 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/chriscowley/openldap_exporter :v2.1.1	6c308e9732e1	stdlib@go1.15.7	1.25.13

Open the chart page →

2,143

kube-ceemsceems

1.40.0

1 of 5 See more

kube-ceems ceems 1.40.0

1 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
grafana/grafana :13.2.1-distroless	3600073f45a9	golang.org/x/net@v0.51.0 stdlib@go1.26.4	0.55.0 1.25.13

Open the chart page →

647

cerberuscerberus

0.16.0

1 of 1 See more

cerberus cerberus 0.16.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/tsouza/cerberus :1.20.0	ef384585f9a3	stdlib@go1.26.2	1.25.13

Open the chart page →

162

cert-manager-csi-driver-spiffecert-manager

0.15.0

4 of 4 See more

cert-manager-csi-driver-spiffe cert-manager 0.15.0

4 of the 4 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/jetstack/cert-manager-csi-driver-spiffe :v0.15.0	1755a3802efd	stdlib@go1.26.5	1.25.13
quay.io/jetstack/cert-manager-csi-driver-spiffe-approver :v0.15.0	5f7a9bbb95fb	stdlib@go1.26.5	1.25.13
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.17.0	f9de845b1701	golang.org/x/net@v0.54.0 stdlib@go1.26.3	0.55.0 1.25.13
registry.k8s.io/sig-storage/livenessprobe :v2.19.0	06da0d5b8908	golang.org/x/net@v0.54.0 stdlib@go1.26.3	0.55.0 1.25.13

Open the chart page →

585

cert-manager-acm-synccert-manager-acm-sync

0.7.4

1 of 1 See more

cert-manager-acm-sync cert-manager-acm-sync 0.7.4

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/camilorivera/cert-manager-acm-sync :0.7.4	89a83796a550	golang.org/x/net@v0.49.0 stdlib@go1.26.4	0.55.0 1.25.13

Open the chart page →

132

cert-manager-alidns-webhookcert-manager-alidns-webhook

0.1.4

1 of 1 See more

cert-manager-alidns-webhook cert-manager-alidns-webhook 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/crazygit/cert-manager-alidns-webhook :0.1.4	976be6506eb6	golang.org/x/net@v0.47.0 stdlib@go1.25.3	0.55.0 1.25.13

Open the chart page →

1,328

cert-manager-desec-webhookcert-manager-desec-webhook

1.0.1

1 of 1 See more

cert-manager-desec-webhook cert-manager-desec-webhook 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/luzifer/cert-manager-desec-webhook :v1.0.1	fa1f6b2e9a6e	golang.org/x/net@v0.26.0 stdlib@go1.23.4	0.55.0 1.25.13

Open the chart page →

1,271

cert-manager-webhook-abioncert-manager-webhook-abion

1.3.2

1 of 1 See more

cert-manager-webhook-abion cert-manager-webhook-abion 1.3.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
abiondevelopment/cert-manager-webhook-abion :latest	c741988fbd23	golang.org/x/net@v0.44.0 stdlib@go1.25.1	0.55.0 1.25.13

Open the chart page →

1,094

cert-manager-webhook-bunnycert-manager-webhook-bunny

1.0.2

1 of 1 See more

cert-manager-webhook-bunny cert-manager-webhook-bunny 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/o0th/cert-manager-webhook-bunny :1.0.2	fe7ce555a12d	golang.org/x/net@v0.34.0 stdlib@go1.23.5	0.55.0 1.25.13

Open the chart page →

839

cert-manager-webhook-civocert-manager-webhook-civo

0.0.0-05b683cb6efdc99135f68af18007954e74f18404

1 of 1 See more

cert-manager-webhook-civo cert-manager-webhook-civo 0.0.0-05b683cb6efdc99135f68af18007954e74f18404

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
okteto/civo-webhook :0.5.3	57cd51176538	golang.org/x/net@v0.15.0 stdlib@go1.21.3	0.55.0 1.25.13

Open the chart page →

1,278

cert-manager-webhook-hcloud-zonescert-manager-webhook-hcloud-zones

0.1.5

1 of 1 See more

cert-manager-webhook-hcloud-zones cert-manager-webhook-hcloud-zones 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/xmv-solutions-gmbh/cert-manager-webhook-hcloud-zones :0.1.5	a7a846bba3e8	golang.org/x/net@v0.52.0 stdlib@go1.25.11	0.55.0 1.25.13

Open the chart page →

415

cert-manager-webhook-infoblox-wapicert-manager-webhook-infoblox-wapi

1.5.2

1 of 1 See more

cert-manager-webhook-infoblox-wapi cert-manager-webhook-infoblox-wapi 1.5.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/luisico/cert-manager-webhook-infoblox-wapi :1.5	ded797477896	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.16.15	0.55.0 1.25.13

Open the chart page →

2,352

cert-manager-webhook-namecheapcert-manager-webhook-namecheap

0.1.2

1 of 1 See more

cert-manager-webhook-namecheap cert-manager-webhook-namecheap 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/extrality/cert-manager-webhook-namecheap :latest	e3552fa0c68a	golang.org/x/net@v0.10.0 stdlib@go1.20.6	0.55.0 1.25.13

Open the chart page →

1,759

cert-manager-webhook-pdnscert-manager-webhook-pdns

3.2.5

1 of 1 See more

cert-manager-webhook-pdns cert-manager-webhook-pdns 3.2.5

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
zachomedia/cert-manager-webhook-pdns :v2.5.5	4940e227a39b	golang.org/x/net@v0.50.0 stdlib@go1.26.1	0.55.0 1.25.13

Open the chart page →

1,080

cert-manager-webhook-regerycert-manager-webhook-regery

1.0.0

1 of 1 See more

cert-manager-webhook-regery cert-manager-webhook-regery 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
darioackermann/cert-manager-webhook-regery :latest	0d450bc4acc4	golang.org/x/net@v0.26.0 stdlib@go1.22.10	0.55.0 1.25.13

Open the chart page →

889

cert-manager-webhook-solidservercert-manager-webhook-solidserver

1.0.2

1 of 1 See more

cert-manager-webhook-solidserver cert-manager-webhook-solidserver 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/niklas-letz/cert-manager-webhook-solidserver :1.0.2	f19a306ce759	stdlib@go1.26.4	1.25.13

Open the chart page →

527

cert-utils-operatorcert-utils-operator

1.3.12

2 of 2 See more

cert-utils-operator cert-utils-operator 1.3.12

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/redhat-cop/cert-utils-operator :v1.3.12	0290e7b2800a	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.19.13	0.55.0 1.25.13
quay.io/redhat-cop/kube-rbac-proxy :v0.11.0	c68135620167	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.15.15	0.55.0 1.25.13

Open the chart page →

7,783

getoutlinecfi2017

1.2.0

1 of 4 See more

getoutline cfi2017 1.2.0

1 of the 4 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :18.0	6f3e42ad37de	stdlib@go1.24.6	1.25.13

Open the chart page →

4,459

opencvecfi2017

0.1.2

3 of 7 See more

opencve cfi2017 0.1.2

3 of the 7 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :18.0	6f3e42ad37de	stdlib@go1.24.6	1.25.13
prom/statsd-exporter :v0.28.0	4e7a1f00b9b2	golang.org/x/net@v0.29.0 stdlib@go1.23.2	0.55.0 1.25.13
ghcr.io/cfi2017/opencve-scheduler :3.0.0	8d943799621b	stdlib@go1.22.10	1.25.13

Open the chart page →

15,490

clechaosnative

0.2.7

3 of 6 See more

cle chaosnative 0.2.7

3 of the 6 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
chaosnative/cle-auth-server :2.7.0	72ee352bc333	golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110 stdlib@go1.16.15	0.55.0 1.25.13
chaosnative/cle-license-module :2.7.0	62cf6adc355e	golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023 stdlib@go1.16.15	0.55.0 1.25.13
chaosnative/cle-server :2.7.0	e7bcff4a20c0	golang.org/x/net@v0.0.0-20211118161319-6a13c67c3ce4 stdlib@go1.16.15	0.55.0 1.25.13

Open the chart page →

16,412

charon-relaycharon

0.8.0

2 of 2 See more

charon-relay charon 0.8.0

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
alpine/kubectl :1.35.2	ec8f734b0a10	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.55.0 1.25.13
obolnetwork/charon :v1.10.0	278c7e2897b6	golang.org/x/net@v0.52.0 stdlib@go1.26.1	0.55.0 1.25.13

Open the chart page →

4,440

dv-podcharon

0.19.1

2 of 5 See more

dv-pod charon 0.19.1

2 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
obolnetwork/charon :v1.10.0	278c7e2897b6	golang.org/x/net@v0.52.0 stdlib@go1.26.1	0.55.0 1.25.13
obolnetwork/charon-dkg-sidecar :main	e263be0a7440	golang.org/x/net@v0.44.0 stdlib@go1.25.3	0.55.0 1.25.13

Open the chart page →

7,501

chart-appchart-app

0.3.0

1 of 2 See more

chart-app chart-app 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/mysql :8	b3b90af2a655	stdlib@go1.24.6	1.25.13

Open the chart page →

1,775

chart-dnazarenochart-dnazareno

0.1.0

1 of 3 See more

chart-dnazareno chart-dnazareno 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/mysql :8	b3b90af2a655	stdlib@go1.24.6	1.25.13

Open the chart page →

5,840

ghostchart-ghost

0.1.5

1 of 2 See more

ghost chart-ghost 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/ghost :6.22.0-alpine3.23	ac533a6988ee	stdlib@go1.24.6	1.25.13

Open the chart page →

4,083

calibre-webcharts-derwitt-dev

1.1.2

1 of 1 See more

calibre-web charts-derwitt-dev 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/wittdennis/calibre-web :1.1.1	aa7d5d5dd6be	stdlib@go1.17.8	1.25.13

Open the chart page →

4,930

filebrowsercharts-derwitt-dev

1.1.1

1 of 1 See more

filebrowser charts-derwitt-dev 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
filebrowser/filebrowser :v2.63.23	a469ea076d4a	stdlib@go1.26.5	1.25.13

Open the chart page →

133

home-assistant-otbrcharts-derwitt-dev

2.1.3

1 of 1 See more

home-assistant-otbr charts-derwitt-dev 2.1.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/wittdennis/homeassistant-otbr :4.2.3	1b53b0b3488e	stdlib@go1.26.5	1.25.13

Open the chart page →

2,379

memoscharts-derwitt-dev

1.4.0

1 of 1 See more

memos charts-derwitt-dev 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
neosmemo/memos :0.30.0	71a5b4738d1b	golang.org/x/net@v0.53.0 stdlib@go1.26.2	0.55.0 1.25.13

Open the chart page →

561

paperless-ngxcharts-derwitt-dev

2.1.4

1 of 1 See more

paperless-ngx charts-derwitt-dev 2.1.4

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :3.1.3	aa810a36942c	stdlib@go1.24.4	1.25.13

Open the chart page →

4,651

yas3pcharts-derwitt-dev

0.3.1

1 of 1 See more

yas3p charts-derwitt-dev 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
denniswitt/yas3p :0.2.4	88a235619af6	golang.org/x/net@v0.52.0 stdlib@go1.26.1	0.55.0 1.25.13

Open the chart page →

737

chatgpt-next-webchatgpt-next-web

0.1.1

1 of 1 See more

chatgpt-next-web chatgpt-next-web 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
yidadaa/chatgpt-next-web :latest	eaaa469ddeeb	stdlib@go1.20.12	1.25.13

Open the chart page →

1,977

checker-edgechecker-edge

1.1.11

1 of 1 See more

checker-edge checker-edge 1.1.11

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/imcitius/checker-edge :1.1.11	74426c1fe00f	golang.org/x/net@v0.50.0 stdlib@go1.25.9	0.55.0 1.25.13

Open the chart page →

667

checkin-componentcheckin-component

0.1.0

1 of 4 See more

checkin-component checkin-component 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
conduction/checkin-component-php :dev	3423845692c1	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.55.0 1.25.13

Open the chart page →

8,417

aws-ecr-tokencheveo-charts

0.1.0

1 of 1 See more

aws-ecr-token cheveo-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
huzafach/aws-cli-k8 :1.0.0	6e271d43ea48	golang.org/x/net@v0.23.0 stdlib@go1.22.4	0.55.0 1.25.13

Open the chart page →

1,109

pathling-serverchgl

0.10.11

1 of 3 See more

pathling-server chgl 0.10.11

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
cloudpirates/image-minio :RELEASE.2025-10-15T17-29-55Z-hardened	8dc02a7e5093	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.55.0 1.25.13

Open the chart page →

968

lokichoerodon

0.29.0

1 of 1 See more

loki choerodon 0.29.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
grafana/loki :1.5.0	922b3f412fdd	golang.org/x/net@v0.0.0-20200226121028-0de0cce0169b stdlib@go1.13.11	0.55.0 1.25.13

Open the chart page →

2,876

promtailchoerodon

0.23.0

1 of 1 See more

promtail choerodon 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
grafana/promtail :1.5.0	46e88d390cd6	golang.org/x/net@v0.0.0-20200226121028-0de0cce0169b stdlib@go1.13.11	0.55.0 1.25.13

Open the chart page →

2,828

supersetchoerodon

1.0.0

1 of 3 See more

superset choerodon 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
apache/superset :dockerize	afe59523a6c8	golang.org/x/net@v0.10.0 stdlib@go1.20.4	0.55.0 1.25.13

Open the chart page →

1,439

argocd-metrics-serverchristianhuth

1.1.1

1 of 1 See more

argocd-metrics-server christianhuth 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/argoprojlabs/argocd-extension-metrics :v1.0.3	0d614816c4b7	golang.org/x/net@v0.10.0 stdlib@go1.21.11	0.55.0 1.25.13

Open the chart page →

1,031

cluster-api-visualizerchristianhuth

0.6.0

1 of 1 See more

cluster-api-visualizer christianhuth 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/jont828/cluster-api-visualizer :v1.5.0	678ba6833297	golang.org/x/net@v0.42.0 stdlib@go1.24.11	0.55.0 1.25.13

Open the chart page →

558

countlychristianhuth

5.2.1

3 of 3 See more

countly christianhuth 5.2.1

3 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
bitnami/mongodb :latest	e46cffb66274	stdlib@go1.26.5	1.25.13
countly/api :25.05.4	f4cc7447c4f5	stdlib@go1.19.4	1.25.13
countly/frontend :25.05.4	2acbc11499b6	stdlib@go1.19.4	1.25.13

Open the chart page →

7,296

dnsbl-exporterchristianhuth

1.4.0

1 of 2 See more

dnsbl-exporter christianhuth 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/luzilla/dnsbl_exporter :v0.7.0-rc3	d9767232a55e	golang.org/x/net@v0.20.0 stdlib@go1.20.14	0.55.0 1.25.13

Open the chart page →

1,459

github-exporterchristianhuth

2.6.0

1 of 1 See more

github-exporter christianhuth 2.6.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
githubexporter/github-exporter :v2.3.1	a36fbedeedf8	stdlib@go1.26.4	1.25.13

Open the chart page →

goldpingerchristianhuth

1.4.1

1 of 1 See more

goldpinger christianhuth 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
bloomberg/goldpinger :3.11.3	a8ea8c61ff4c	golang.org/x/net@v0.49.0	0.55.0

Open the chart page →

142

kubedoomchristianhuth

1.1.2

1 of 1 See more

kubedoom christianhuth 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/storax/kubedoom :0.6.0	851ba8c80b93	stdlib@go1.17.6	1.25.13

Open the chart page →

1,021

Container images carrying it

5,324 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
alpine/k8s :1.30.0	bd01dae02676	golang.org/x/net@v0.23.0 stdlib@go1.21.1	0.55.0 1.25.13	1
alpine/k8s :1.30.2	cd560fce90f7	golang.org/x/net@v0.9.0 stdlib@go1.22.3	0.55.0 1.25.13	1
alpine/k8s :1.35.5	d870622d0040	golang.org/x/net@v0.48.0 stdlib@go1.26.0	0.55.0 1.25.13	1
alpine/k8s :1.28.13	e5c0b053fed7	golang.org/x/net@v0.12.0 stdlib@go1.22.5	0.55.0 1.25.13	1
alpine/k8s :1.32.3	eec354133193	golang.org/x/net@v0.37.0 stdlib@go1.23.6	0.55.0 1.25.13	1
alpine/k8s :1.28.2	fc059f056ad0	golang.org/x/net@v0.9.0 stdlib@go1.20.8	0.55.0 1.25.13	1
alpine/kubectl :1.36.0	1ee9df6316d4	golang.org/x/net@v0.49.0 stdlib@go1.26.2	0.55.0 1.25.13	1
alpine/kubectl :1.33.3	2c59a3f0726c	golang.org/x/net@v0.38.0 stdlib@go1.24.4	0.55.0 1.25.13	1
alpine/kubectl :1.35.0	862d86046bbc	golang.org/x/net@v0.47.0 stdlib@go1.25.5	0.55.0 1.25.13	1
alpine/kubectl :1.35.3	c4a11ae9a1cb	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.55.0 1.25.13	1
altinity/clickhouse-operator :0.27.3	0520bfb8015d	stdlib@go1.26.5	1.25.13	1
altinity/clickhouse-operator :0.25.4	1d6f18dbd599	golang.org/x/net@v0.38.0 stdlib@go1.25.1	0.55.0 1.25.13	1
altinity/clickhouse-operator :0.23.3	4baec90b20cd	golang.org/x/net@v0.17.0 stdlib@go1.20.14	0.55.0 1.25.13	1
altinity/clickhouse-operator :0.23.7	74315beb57db	golang.org/x/net@v0.17.0 stdlib@go1.21.13	0.55.0 1.25.13	1
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	golang.org/x/net@v0.0.0-20210525063256-abc453219eb5 stdlib@go1.17.13	0.55.0 1.25.13	1
altinity/clickhouse-operator :0.20.0	8f0f582d41f0	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.17.13	0.55.0 1.25.13	1
altinity/clickhouse-operator :0.27.1	a802b3a19d20	stdlib@go1.26.3	1.25.13	1
altinity/clickhouse-operator :0.16.1	db7dde971407	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.13.15	0.55.0 1.25.13	1
altinity/metrics-exporter :0.20.0	1a46d104406d	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.17.13	0.55.0 1.25.13	1
altinity/metrics-exporter :0.27.3	1e7c1d8167aa	stdlib@go1.26.5	1.25.13	1
altinity/metrics-exporter :0.23.3	2912a6c15b44	golang.org/x/net@v0.17.0 stdlib@go1.20.14	0.55.0 1.25.13	1
altinity/metrics-exporter :0.25.4	6ecf67edfb71	golang.org/x/net@v0.38.0 stdlib@go1.25.1	0.55.0 1.25.13	1
altinity/metrics-exporter :0.16.1	85b4fdbae053	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.13.15	0.55.0 1.25.13	1
altinity/metrics-exporter :latest	8940ecadae65	stdlib@go1.26.5	1.25.13	1
altinity/metrics-exporter :0.23.7	a4d7ff0c727e	golang.org/x/net@v0.17.0 stdlib@go1.21.13	0.55.0 1.25.13	1
amaanx86/oci-native-ingress-controller :master	d7206ac7a319	golang.org/x/net@v0.36.0 stdlib@go1.23.7	0.55.0 1.25.13	1
amazon/aws-efs-csi-driver :v0.3.0	b55277652ea8	golang.org/x/net@v0.0.0-20190812203447-cdfb69ac37fc stdlib@go1.13.4	0.55.0 1.25.13	1
amazon/aws-fsx-csi-driver :latest	c9b14856fd22	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e stdlib@go1.16.8	0.55.0 1.25.13	1
amazon/aws-otel-collector :v0.27.0	d8ab0eef5074	golang.org/x/net@v0.7.0 stdlib@go1.19.6	0.55.0 1.25.13	1
amazon/cloudwatch-agent :1.300032.2b361	73b79b02f03a	golang.org/x/net@v0.17.0 stdlib@go1.21.5	0.55.0 1.25.13	1
amazon/cloudwatch-agent :latest-arm64	9dea6643715a	stdlib@go1.26.5	1.25.13	1
amazon/cloudwatch-agent :1.247350.0b251780	e745d1783c93	golang.org/x/net@v0.0.0-20200301022130-244492dfa37a stdlib@go1.15.15	0.55.0 1.25.13	1
ambassador/aes-authsvc :v4.0.0-preview.1	2a4598b03a6a	golang.org/x/net@v0.11.0 stdlib@go1.20.6	0.55.0 1.25.13	1
ambassador/aes-eg-ext :v4.0.0-preview.1	b7eb1be3345d	golang.org/x/net@v0.11.0 stdlib@go1.20.6	0.55.0 1.25.13	1
ambassador/aes-wafsvc :v4.0.0-preview.1	5fc571509b8c	golang.org/x/net@v0.11.0 stdlib@go1.20.6	0.55.0 1.25.13	1
ambassador/ambassador-agent :1.0.22	7a1ea0d934fb	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.55.0 1.25.13	1
amd64/mysql :5.7	e20a653e0f51	stdlib@go1.18.2	1.25.13	1
anamskenneth/recipe_frontend :2025-06-07	9ecf04f42cc3	stdlib@go1.20.12	1.25.13	1
anchore/anchore-engine :v0.10.0	bde9eedf639d	golang.org/x/net@v0.0.0-20200602114024-627f9648deb9 stdlib@go1.16.3	0.55.0 1.25.13	1
anchore/kai :v0.5.0	8aad6d0912dd	golang.org/x/net@v0.7.0 stdlib@go1.19.7	0.55.0 1.25.13	1
andrcuns/dependabot-gitlab :7.7.0-alpha.1	43060f159f4c	golang.org/x/net@v0.38.0 stdlib@go1.26.5	0.55.0 1.25.13	1
andrcuns/smocker :0.18.5	b4a8eb20581a	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.10	0.55.0 1.25.13	1
andreacioni/kube-workload-restarter :0.0.24	2938b310090a	golang.org/x/net@v0.7.0 stdlib@go1.20.2	0.55.0 1.25.13	1
andrewmackrodt/firefox-x11 :142.0.1-r1	33f9080470c9	stdlib@go1.18.2	1.25.13	1
ankane/pgvector :v0.5.1	d3a9d8ac27bb	stdlib@go1.18.2	1.25.13	1
anonaddy/anonaddy :0.12.3	957a95565166	stdlib@go1.18.3	1.25.13	1
ansgroup/cert-manager-webhook-safedns :v1.0.1	cd6b0ef2b309	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.15	0.55.0 1.25.13	1
ansiblesemaphore/semaphore :v2.8.53	03d1f8684027	stdlib@go1.16.3	1.25.13	1
antrea/antrea-agent-ubuntu :v2.7.0	c10bc45c6272	stdlib@go1.25.7	1.25.13	1
anujarosha/hello-go :v1.0.1	ed60e46870b6	stdlib@go1.18.3	1.25.13	1