CVE-2026-39821

High

Advisory

Published 22 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,518; of 17,792 indexed, latest versions
Container images: 5,259; deployed by those charts
Fix available: 3 of 3; affected packages

Red Hat Security Advisory: git-lfs security update

Carried by container images the latest versions of 4,518 of 17,792 indexed charts deploy, on 5,259 images.

Affected package	Affected versions	Fixed in	Images
git-lfsrpm	2.13.3-3.el8_6	0:3.4.1-11.el8_10	1
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+189 more	1.25.13	5,226
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+220 more	0.55.0	3,669

OSV records: RHSA-2026:30853 GO-2026-5026

Charts affected

4,518 by stars

Chart

Latest

Affected images

Radar Score

artifact-hubsoftonic

1.19.0

6 of 8 See more

artifact-hub softonic 1.19.0

6 of the 8 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
aquasec/trivy :0.43.1	944a04445179	golang.org/x/net@v0.11.0 stdlib@go1.19.10	0.55.0 1.25.13
artifacthub/db-migrator :v1.19.0	2a746b289fcd	stdlib@go1.22.4	1.25.13
artifacthub/hub :v1.19.0	111918d8c399	golang.org/x/net@v0.26.0 stdlib@go1.22.4	0.55.0 1.25.13
artifacthub/postgres :latest	4fd34fa635cc	stdlib@go1.24.6	1.25.13
artifacthub/scanner :v1.19.0	323d026e78c3	golang.org/x/net@v0.21.0 stdlib@go1.21.8	0.55.0 1.25.13
artifacthub/tracker :v1.19.0	6596c8c4d955	golang.org/x/net@v0.26.0 stdlib@go1.22.4	0.55.0 1.25.13

Open the chart page →

14,550

gcp-quota-exportersoftonic

2.0.2

1 of 1 See more

gcp-quota-exporter softonic 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
mintel/gcp-quota-exporter :v0.3.2	0e0707b7732b	golang.org/x/net@v0.0.0-20190311183353-d8887717615a stdlib@go1.13.12	0.55.0 1.25.13

Open the chart page →

2,643

go-ratelimitsoftonic

1.0.7

2 of 3 See more

go-ratelimit softonic 1.0.7

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
envoyproxy/ratelimit :v1.4.0	71081616da3e	golang.org/x/net@v0.0.0-20191209160850-c0dbc17a3553 stdlib@go1.14	0.55.0 1.25.13
oliver006/redis_exporter :v1.9.0	4af75e9f16f6	stdlib@go1.14.4	1.25.13

Open the chart page →

5,105

node-policy-webhooksoftonic

0.1.10

1 of 1 See more

node-policy-webhook softonic 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
softonic/node-policy-webhook :0.1.2	ab6098c04a53	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.14.6	0.55.0 1.25.13

Open the chart page →

2,591

redis-shardedsoftonic

0.5.0

1 of 2 See more

redis-sharded softonic 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
oliver006/redis_exporter :v1.9.0	4af75e9f16f6	stdlib@go1.14.4	1.25.13

Open the chart page →

2,330

sogosogo

0.3.5

1 of 2 See more

sogo sogo 0.3.5

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
sonroyaalmerol/docker-sogo :5.12.4	3f60f3abe990	golang.org/x/net@v0.49.0 stdlib@go1.24.13	0.55.0 1.25.13

Open the chart page →

7,204

postgresql-ha-chartsoldevelo-postgresql-ha-chart

16.3.4

1 of 2 See more

postgresql-ha-chart soldevelo-postgresql-ha-chart 16.3.4

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
soldevelo/pgpool :4.6.3-debian-12-r0	044d16a65129	stdlib@go1.25.4	1.25.13

Open the chart page →

4,604

thanossolidcharts

0.12.2

1 of 1 See more

thanos solidcharts 0.12.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.42.4	b567818fe608	stdlib@go1.26.5	1.25.13

Open the chart page →

203

gloosolo-gloo-edge

0.0.0-fork

4 of 5 See more

gloo solo-gloo-edge 0.0.0-fork

4 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/solo-io/certgen :0.0.0-fork	b17a8c7d1f32	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.1	0.55.0 1.25.13
quay.io/solo-io/discovery :0.0.0-fork	5b62aaade3c9	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.1	0.55.0 1.25.13
quay.io/solo-io/gloo :0.0.0-fork	9a6c84560d44	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.1	0.55.0 1.25.13
quay.io/solo-io/gloo-envoy-wrapper :0.0.0-fork	26ae185e835a	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.1	0.55.0 1.25.13

Open the chart page →

9,256

sp-otel-collectorsp-otel-collector

1.1.6

1 of 1 See more

sp-otel-collector sp-otel-collector 1.1.6

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/geored/spmm-collector-contrib :1.0.0	63baf86a49ac	golang.org/x/net@v0.11.0 stdlib@go1.20.5	0.55.0 1.25.13

Open the chart page →

2,032

sql-operatorsql-operator

0.11.2

1 of 1 See more

sql-operator sql-operator 0.11.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/stenic/sql-operator :1.13.2	f4324baa2aad	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.17.13	0.55.0 1.25.13

Open the chart page →

1,594

stackradar-scannerstackradar

0.3.0

1 of 1 See more

stackradar-scanner stackradar 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/lockdep/stackradar-scanner :0.3.0	dd8a35d50c2d	golang.org/x/net@v0.49.0 stdlib@go1.25.7	0.55.0 1.25.13

Open the chart page →

1,218

gitwebhookproxystakater

0.2.79

1 of 1 See more

gitwebhookproxy stakater 0.2.79

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
stakater/gitwebhookproxy :v0.2.79	c1226e5270cd	stdlib@go1.13.1	1.25.13

Open the chart page →

1,503

splunk-operatorstakater

0.0.6

1 of 2 See more

splunk-operator stakater 0.0.6

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
splunk/splunk-operator :2.0.0	c4e0d3146226	golang.org/x/net@v0.0.0-20211029224645-99673261e6eb stdlib@go1.17.12	0.55.0 1.25.13

Open the chart page →

11,459

gethstakewise

2.5.8

1 of 3 See more

geth stakewise 2.5.8

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ethereum/client-go :v1.15.10	1f36ca5922a5	golang.org/x/net@v0.36.0 stdlib@go1.24.2	0.55.0 1.25.13

Open the chart page →

1,143

graph-nodestakewise

3.1.0

2 of 3 See more

graph-node stakewise 3.1.0

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
graphprotocol/graph-node :v0.37.0	f4452cdedd68	stdlib@go1.24.1	1.25.13
ipfs/kubo :v0.24.0	e3de33bd746b	golang.org/x/net@v0.17.0 stdlib@go1.19.8	0.55.0 1.25.13

Open the chart page →

4,694

mayastorstartechnica

0.2.0

3 of 13 See more

mayastor startechnica 0.2.0

3 of the 13 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-attacher :v4.0.0	9a685020911e	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.18	0.55.0 1.25.13
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.6.0	f1c25991bac2	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.18	0.55.0 1.25.13
registry.k8s.io/sig-storage/livenessprobe :v2.8.0	cacee2b5c36d	golang.org/x/net@v0.0.0-20220921203646-d300de134e69 stdlib@go1.18	0.55.0 1.25.13

Open the chart page →

4,367

multusstartechnica

0.1.2

1 of 1 See more

multus startechnica 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/k8snetworkplumbingwg/multus-cni :stable	ec4e5dfe12b6	golang.org/x/net@v0.48.0 stdlib@go1.25.11	0.55.0 1.25.13

Open the chart page →

512

statpingstatping

0.1.14

1 of 1 See more

statping statping 0.1.14

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
statping/statping :v0.90.74	e874da513a5c	golang.org/x/net@v0.0.0-20200904194848-62affa334b73 stdlib@go1.14.13	0.55.0 1.25.13

Open the chart page →

3,378

thanosstevehipwell-helm-charts-thanos

1.24.1

1 of 1 See more

thanos stevehipwell-helm-charts-thanos 1.24.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.42.4	b567818fe608	stdlib@go1.26.5	1.25.13

Open the chart page →

203

stornxstornx

1.1.1

9 of 9 See more

stornx stornx 1.1.1

9 of the 9 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
alazidis/kube-netlag :1.1.0	0e8c84152201	golang.org/x/net@v0.33.0 stdlib@go1.24.13	0.55.0 1.25.13
alazidis/stornx :1.1.1	602d4f7f090c	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.55.0 1.25.13
istio/pilot :1.29.1	f8b0e412ac4a	golang.org/x/net@v0.48.0 stdlib@go1.25.8	0.55.0 1.25.13
quay.io/kiali/kiali :v2.23.0	7652b1285f50	golang.org/x/net@v0.49.0 stdlib@go1.25.0	0.55.0 1.25.13
quay.io/prometheus-operator/prometheus-config-reloader :v0.90.0	e5aab3be6873	golang.org/x/net@v0.52.0 stdlib@go1.25.8	0.55.0 1.25.13
quay.io/prometheus/node-exporter :v1.10.2	337ff1d356b6	golang.org/x/net@v0.44.0 stdlib@go1.25.3	0.55.0 1.25.13
quay.io/prometheus/prometheus :v3.10.0	7571a304e67f	golang.org/x/net@v0.49.0 stdlib@go1.26.0	0.55.0 1.25.13
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.18.0	1545919b72e3	golang.org/x/net@v0.48.0 stdlib@go1.25.5	0.55.0 1.25.13
registry.k8s.io/metrics-server/metrics-server :v0.8.0	89258156d0e9	golang.org/x/net@v0.40.0 stdlib@go1.24.4	0.55.0 1.25.13

Open the chart page →

11,735

stunner-gateway-operatorstunner

1.1.0

2 of 2 See more

stunner-gateway-operator stunner 1.1.0

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
l7mp/stunner-auth-server :1.1.0	2f8114477ba6	golang.org/x/net@v0.36.0 stdlib@go1.23.8	0.55.0 1.25.13
l7mp/stunner-gateway-operator :1.1.0	c34f7c931491	golang.org/x/net@v0.36.0 stdlib@go1.23.8	0.55.0 1.25.13

Open the chart page →

1,292

hlf-k8ssubstra

10.2.4

4 of 7 See more

hlf-k8s substra 10.2.4

4 of the 7 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
hyperledger/fabric-ca :1.5.0	f270dfeee91d	golang.org/x/net@v0.0.0-20201006153459-a7d1128ccaa0 stdlib@go1.15.7	0.55.0 1.25.13
jwilder/dockerize :latest	f94fb59fb4f6	golang.org/x/net@v0.47.0 stdlib@go1.25.5	0.55.0 1.25.13
ghcr.io/substra/fabric-peer :0.2.4	f681e0343a31	golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110 stdlib@go1.18.10	0.55.0 1.25.13
ghcr.io/substra/fabric-tools :0.2.4	3491a0f31c4a	golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110 stdlib@go1.18.10	0.55.0 1.25.13

Open the chart page →

12,030

supabasesupabse

0.8.0

4 of 11 See more

supabase supabse 0.8.0

4 of the 11 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
darthsim/imgproxy :v3.30.1	3b709e4a0e5e	golang.org/x/net@v0.44.0 stdlib@go1.25.1	0.55.0 1.25.13
library/postgres :17-alpine	18cfe3ef5e68	stdlib@go1.24.6	1.25.13
supabase/gotrue :v2.189.0	385184459f57	golang.org/x/net@v0.52.0 stdlib@go1.25.8	0.55.0 1.25.13
supabase/postgres :17.6.1.136	f371b5f3f2ac	stdlib@go1.26.1	1.25.13

Open the chart page →

18,327

Grafanasurajwarbhe-grafana

0.1.0

1 of 1 See more

Grafana surajwarbhe-grafana 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
surajwarbhe/grafana :v1	85248611e9f1	golang.org/x/net@v0.0.0-20200202094626-16171245cfb2 stdlib@go1.14.3	0.55.0 1.25.13

Open the chart page →

2,604

switchboardswitchboard

0.7.4

1 of 1 See more

switchboard switchboard 0.7.4

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/borchero/switchboard :0.7.4	54a193b757da	golang.org/x/net@v0.51.0 stdlib@go1.26.1	0.55.0 1.25.13

Open the chart page →

844

synology-proxy-operatorsynology-proxy-operator

0.0.8

1 of 1 See more

synology-proxy-operator synology-proxy-operator 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/phoeluga/synology-proxy-operator :0.0.8	b26510b26b31	golang.org/x/net@v0.52.0 stdlib@go1.26.2	0.55.0 1.25.13

Open the chart page →

210

hello-appsysintelligent

2.0.1

1 of 1 See more

hello-app sysintelligent 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
sysintelligent/hello-app :2.0.1	77fb30df847d	golang.org/x/net@v0.19.0 stdlib@go1.19.3	0.55.0 1.25.13

Open the chart page →

1,880

system-upgrade-controllersystem-upgrade

0.2.13

1 of 1 See more

system-upgrade-controller system-upgrade 0.2.13

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
rancher/system-upgrade-controller :v0.20.1	aaf4dbf64057	golang.org/x/net@v0.53.0 stdlib@go1.26.5	0.55.0 1.25.13

Open the chart page →

125

system-upgrade-controllersystem-upgrade-controller

1.12.0

1 of 1 See more

system-upgrade-controller system-upgrade-controller 1.12.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
rancher/system-upgrade-controller :v0.20.1	aaf4dbf64057	golang.org/x/net@v0.53.0 stdlib@go1.26.5	0.55.0 1.25.13

Open the chart page →

125

headscaleszpadel-charts

0.30.2

2 of 3 See more

headscale szpadel-charts 0.30.2

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/juanfont/headscale :0.29.1	8453e47ea6bf	stdlib@go1.26.4	1.25.13
ghcr.io/tale/headplane :0.6.3	9476cc5adb12	golang.org/x/net@v0.42.0 stdlib@go1.25.1	0.55.0 1.25.13

Open the chart page →

1,880

tekton-events-relaytekton-events-relay

0.10.1

1 of 1 See more

tekton-events-relay tekton-events-relay 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/fabioluciano/tekton-events-relay :0.10.1	84cb5a2b8b81	stdlib@go1.26.4	1.25.13

Open the chart page →

174

tenuretenure

1.0.6

2 of 2 See more

tenure tenure 1.0.6

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
mongodb/mongodb-atlas-local :8	925c3d34f0c6	stdlib@go1.26.5	1.25.13
tenureai/tenure :v1.0.28	5f5b222df9a5	stdlib@go1.26.2	1.25.13

Open the chart page →

2,563

terraform-controllerterraform-controller

0.0.20

1 of 1 See more

terraform-controller terraform-controller 0.0.20

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
absaoss/terraform-controller :v0.0.20	ad538a1285a0	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.14.8	0.55.0 1.25.13

Open the chart page →

3,538

jenkinstestchart

0.1.9

1 of 2 See more

jenkins testchart 0.1.9

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
jenkins/jenkins :2.426.1-jdk11	b470bcdc4ecd	golang.org/x/net@v0.7.0 stdlib@go1.20.6	0.55.0 1.25.13

Open the chart page →

9,119

jenkinstest-jenkins

9.1.0

1 of 2 See more

jenkins test-jenkins 9.1.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
jenkins/jenkins :2.426.1-jdk11	b470bcdc4ecd	golang.org/x/net@v0.7.0 stdlib@go1.20.6	0.55.0 1.25.13

Open the chart page →

9,119

base-clusterteuto-net

12.4.0

1 of 1 See more

base-cluster teuto-net 12.4.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
registry.k8s.io/kubectl :1.33.4	261a9ed843eb	golang.org/x/net@v0.38.0 stdlib@go1.24.5	0.55.0 1.25.13

Open the chart page →

436

tocktock

0.6.3

1 of 9 See more

tock tock 0.6.3

1 of the 9 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
bitnamilegacy/mongodb :7.0.5-debian-11-r6	6fe59ed5d79f	golang.org/x/net@v0.19.0 stdlib@go1.20.12	0.55.0 1.25.13

Open the chart page →

13,017

goalerttokens-studio

0.0.5

1 of 2 See more

goalert tokens-studio 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
goalert/goalert :v0.32.0	08d57388b0cb	golang.org/x/net@v0.20.0 stdlib@go1.22.1	0.55.0 1.25.13

Open the chart page →

1,476

tor-snowflake-proxytor-snowflake-proxy

1.2.0

1 of 1 See more

tor-snowflake-proxy tor-snowflake-proxy 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
thetorproject/snowflake-proxy :v2.11.0	1ddc5069d354	golang.org/x/net@v0.35.0 stdlib@go1.23.7	0.55.0 1.25.13

Open the chart page →

740

spa-reloadertoucan

0.1.0

1 of 1 See more

spa-reloader toucan 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
toucansoftware/spa-reloader :latest	c187b1fba501	golang.org/x/net@v0.0.0-20200520004742-59133d7f0dd7 stdlib@go1.13.15	0.55.0 1.25.13

Open the chart page →

2,245

traefik-hubtraefik

4.2.0

1 of 1 See more

traefik-hub traefik 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/traefik/traefik-hub :v2.11.0	322f5f8cc105	golang.org/x/net@v0.17.0 stdlib@go1.21.8	0.55.0 1.25.13

Open the chart page →

3,171

starboard-operatortrivy-operator

0.10.25

1 of 1 See more

starboard-operator trivy-operator 0.10.25

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
aquasec/starboard-operator :0.15.38	e0b1c7ddc843	golang.org/x/net@v0.41.0 stdlib@go1.26.3	0.55.0 1.25.13

Open the chart page →

172

atlantistrozz

3.12.11

1 of 1 See more

atlantis trozz 3.12.11

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
runatlantis/atlantis :v0.16.1	45fbaf7e207c	golang.org/x/net@v0.0.0-20191027093000-83d349e8ac1a stdlib@go1.14.7	0.55.0 1.25.13

Open the chart page →

5,286

guardrails-agent-kubernetesturbot

0.3.0

1 of 1 See more

guardrails-agent-kubernetes turbot 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/turbot/guardrails-agent-kubernetes :0.3.0	9d01bf9c9224	golang.org/x/net@v0.26.0 stdlib@go1.22.8	0.55.0 1.25.13

Open the chart page →

4,075

tyk-operatortyk-helm

1.4.2

1 of 1 See more

tyk-operator tyk-helm 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
tykio/tyk-operator :v1.4.2	e13d37f298b7	stdlib@go1.25.12	1.25.13

Open the chart page →

141

boundaryundergrid

0.1.0

2 of 3 See more

boundary undergrid 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
groundnuty/k8s-wait-for :v1.6	84edcf796267	stdlib@go1.18.1	1.25.13
hashicorp/boundary :0.8.1	fb70bd9210ff	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.17.10	0.55.0 1.25.13

Open the chart page →

4,965

taigaunxwares

2026.3.8

2 of 6 See more

taiga unxwares 2026.3.8

2 of the 6 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
taigaio/taiga-back :latest	4beed8f62c9f	stdlib@go1.24.4	1.25.13
taigaio/taiga-protected :latest	fd4568a97a59	stdlib@go1.24.4	1.25.13

Open the chart page →

9,193

upbot-operatorupbot-operator

0.0.20

2 of 2 See more

upbot-operator upbot-operator 0.0.20

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
alpine/k8s :1.28.13	e5c0b053fed7	golang.org/x/net@v0.12.0 stdlib@go1.22.5	0.55.0 1.25.13
ghcr.io/upbothq/upbot-operator :v0.0.20	e5da24947c91	golang.org/x/net@v0.38.0 stdlib@go1.24.9	0.55.0 1.25.13

Open the chart page →

4,477

user-componentuser-component

1.2.0

1 of 4 See more

user-component user-component 1.2.0

1 of the 4 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/user-component-php :latest	198db44fabb5	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.55.0 1.25.13

Open the chart page →

7,313

Container images carrying it

5,259 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
apache/airflow :2.10.2-python3.9	ce90bdc3d2af	stdlib@go1.22.7	1.25.13	1
apache/airflow :2.8.1	e5560ad0b86e	stdlib@go1.19.8	1.25.13	1
apache/answer :2.0.2	a0d71b0e30a5	stdlib@go1.25.12	1.25.13	1
apache/apisix-dashboard :2.9.0	c010ea7d1694	golang.org/x/net@v0.0.0-20210405180319-a5a99cb37ef4 stdlib@go1.14.15	0.55.0 1.25.13	1
apache/apisix-ingress-controller :1.3.0	412f92cde0b3	golang.org/x/net@v0.0.0-20210510120150-4163338589ed stdlib@go1.13.8	0.55.0 1.25.13	1
apache/camel-k :1.10.4	3bb13d14f64a	golang.org/x/net@v0.0.0-20220520000938-2e3eb7b945c2 stdlib@go1.17.13	0.55.0 1.25.13	1
apache/camel-k :2.11.0	d173e7efe258	stdlib@go1.26.5	1.25.13	1
apache/doris :operator-latest	3a4422656592	golang.org/x/net@v0.33.0 stdlib@go1.23.12	0.55.0 1.25.13	1
apache/shardingsphere-operator :0.3.0	ffe68d6b99c0	golang.org/x/net@v0.10.0 stdlib@go1.19.10	0.55.0 1.25.13	1
apache/skywalking-oap-server :9.2.0	133d35d2c263	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.16.9	0.55.0 1.25.13	1
apache/skywalking-oap-server :8.1.0-es7	641237e0299b	golang.org/x/net@v0.0.0-20200226121028-0de0cce0169b stdlib@go1.13.3	0.55.0 1.25.13	1
apache/skywalking-oap-server :8.9.1	b4ec8c18d079	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.16.9	0.55.0 1.25.13	1
apache/skywalking-ui :8.1.0	67d50e4deff4	golang.org/x/net@v0.0.0-20200226121028-0de0cce0169b stdlib@go1.13.3	0.55.0 1.25.13	1
apache/solr-operator :v0.9.1	4db34508137f	golang.org/x/net@v0.33.0 stdlib@go1.22.12	0.55.0 1.25.13	1
apache/tika :latest-full	80072bb73dd3	stdlib@go1.26.5	1.25.13	1
apache/tika :3.3.1.0	90b7fa1dc018	golang.org/x/net@v0.40.0 stdlib@go1.26.2	0.55.0 1.25.13	1
apache/yunikorn :web-1.9.0	288e9c2db7f7	stdlib@go1.26.4	1.25.13	1
apache/yunikorn :scheduler-1.9.0	96832082e9cf	stdlib@go1.26.4	1.25.13	1
apache/yunikorn :admission-1.9.0	fe8f5ec91f6c	stdlib@go1.26.4	1.25.13	1
apecloud/dt-platform :0.1.1	d48bcbd38066	golang.org/x/net@v0.8.0 stdlib@go1.19.11	0.55.0 1.25.13	1
apecloud/gemini-scheduler :0.1.1	5832d1a9097a	golang.org/x/net@v0.27.0 stdlib@go1.22.7	0.55.0 1.25.13	1
apecloud/kb-cloud-installer :v2.1.42-certified	98abc64aa985	golang.org/x/net@v0.17.0 stdlib@go1.20.11	0.55.0 1.25.13	1
apecloud/kubeblocks-csi-driver :0.1.3	c93655ccb2d7	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.19.13	0.55.0 1.25.13	1
apecloud/kubetran-platform :latest	32bd92c7f7fa	golang.org/x/net@v0.15.0 stdlib@go1.20.8	0.55.0 1.25.13	1
apecloud/pyroscope :0.37.2	dbca95a15bc1	golang.org/x/net@v0.1.0 stdlib@go1.19.6	0.55.0 1.25.13	1
apecloud/smartfs-csi-driver :0.1.1	ff2858eab9cc	golang.org/x/net@v0.5.0 stdlib@go1.19.13	0.55.0 1.25.13	1
appwrite/appwrite :1.9.0	1aaa70127114	golang.org/x/net@v0.40.0 stdlib@go1.25.7	0.55.0 1.25.13	1
appwrite/appwrite :2.2.0	896bdd024de3	golang.org/x/net@v0.51.0	0.55.0	1
aquasec/harbor-scanner-trivy :0.31.2	6e790e233872	golang.org/x/net@v0.25.0 stdlib@go1.22.3	0.55.0 1.25.13	1
aquasec/harbor-scanner-trivy :0.20.0	7ea4aa3d2eb6	golang.org/x/net@v0.0.0-20190613194153-d28f0bde5980 stdlib@go1.16.4	0.55.0 1.25.13	1
aquasec/kube-bench :v0.6.17	6672264accce	stdlib@go1.20.4	1.25.13	1
aquasec/kube-bench :v0.15.0	7a8fa32dce21	golang.org/x/net@v0.49.0 stdlib@go1.26.0	0.55.0 1.25.13	1
aquasec/kube-bench :v0.6.9	c329d73fea58	stdlib@go1.19	1.25.13	1
aquasec/postee :2.12.0-amd64	0795cba777e7	golang.org/x/net@v0.7.0 stdlib@go1.18.10	0.55.0 1.25.13	1
aquasec/postee-ui :2.12.0-amd64	c0467c3941dc	golang.org/x/net@v0.7.0 stdlib@go1.18.10	0.55.0 1.25.13	1
aquasec/starboard-operator :0.15.4	be34f709e1ce	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.17.8	0.55.0 1.25.13	1
aquasec/starboard-operator :0.15.38	e0b1c7ddc843	golang.org/x/net@v0.41.0 stdlib@go1.26.3	0.55.0 1.25.13	1
aquasec/tracee :0.24.1	cfbbfee972e6	golang.org/x/net@v0.42.0 stdlib@go1.24.9	0.55.0 1.25.13	1
aquasec/trivy :0.43.1	944a04445179	golang.org/x/net@v0.11.0 stdlib@go1.19.10	0.55.0 1.25.13	1
aquasec/trivy :0.32.0	973d0df16189	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.19	0.55.0 1.25.13	1
aquasec/trivy :0.69.3	bcc376de8d77	golang.org/x/net@v0.48.0 stdlib@go1.25.7	0.55.0 1.25.13	1
archivebox/archivebox :0.7.4	1a5a37331091	stdlib@go1.24.6	1.25.13	1
arconixforge/mongodb-secure-backup :v1.1	c08d7c438966	golang.org/x/net@v0.34.0 stdlib@go1.22.10	0.55.0 1.25.13	1
aristidetm/basic-notebook :3.6.5	469dbc951224	golang.org/x/net@v0.7.0 stdlib@go1.22.5	0.55.0 1.25.13	1
artifacthub/db-migrator :v1.23.0	28c13565ac5c	stdlib@go1.26.4	1.25.13	1
artifacthub/db-migrator :v1.19.0	2a746b289fcd	stdlib@go1.22.4	1.25.13	1
artifacthub/hub :v1.19.0	111918d8c399	golang.org/x/net@v0.26.0 stdlib@go1.22.4	0.55.0 1.25.13	1
artifacthub/hub :v1.23.0	7d3a91c539dc	stdlib@go1.26.4	1.25.13	1
artifacthub/scanner :v1.23.0	2d8365601f0e	golang.org/x/net@v0.48.0 stdlib@go1.25.7	0.55.0 1.25.13	1
artifacthub/scanner :v1.19.0	323d026e78c3	golang.org/x/net@v0.21.0 stdlib@go1.21.8	0.55.0 1.25.13	1