CVE-2026-39821

High

Advisory

Published 22 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,642; of 17,813 indexed, latest versions
Container images: 5,366; deployed by those charts
Fix available: 3 of 3; affected packages

Red Hat Security Advisory: git-lfs security update

Carried by container images the latest versions of 4,642 of 17,813 indexed charts deploy, on 5,366 images.

Affected package	Affected versions	Fixed in	Images
git-lfsrpm	2.13.3-3.el8_6	0:3.4.1-11.el8_10	1
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+191 more	1.25.13	5,324
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+220 more	0.55.0	3,744

OSV records: RHSA-2026:30853 GO-2026-5026

Charts affected

4,642 by stars

Chart

Latest

Affected images

Radar Score

prometheusleechistest

11.6.0

4 of 6 See more

prometheus leechistest 11.6.0

4 of the 6 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
prom/alertmanager :v0.20.0	7e4e9f7a0954	golang.org/x/net@v0.0.0-20190724013045-ca1201d0de80 stdlib@go1.13.5	0.55.0 1.25.13
prom/prometheus :v2.19.0	bfad037f95e5	golang.org/x/net@v0.0.0-20200602114024-627f9648deb9 stdlib@go1.14.4	0.55.0 1.25.13
prom/pushgateway :v1.2.0	0a9031142481	stdlib@go1.13.8	1.25.13
quay.io/prometheus/node-exporter :v1.0.1	cf66a6bbd573	golang.org/x/net@v0.0.0-20200513185701-a91f0712d120 stdlib@go1.14.4	0.55.0 1.25.13

Open the chart page →

8,495

kube-benchlemontech

0.1.0

1 of 1 See more

kube-bench lemontech 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
aquasec/kube-bench :v0.6.9	c329d73fea58	stdlib@go1.19	1.25.13

Open the chart page →

1,633

trivy-serverlemontech

0.1.0

1 of 1 See more

trivy-server lemontech 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
aquasec/trivy :0.32.0	973d0df16189	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.19	0.55.0 1.25.13

Open the chart page →

4,282

adguard-homelib42

2.0.0

1 of 1 See more

adguard-home lib42 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
adguard/adguardhome :v0.107.65	d765078d2140	golang.org/x/net@v0.43.0 stdlib@go1.24.6	0.55.0 1.25.13

Open the chart page →

1,206

libredb-studiolibredb-studio-oci

0.1.66

1 of 1 See more

libredb-studio libredb-studio-oci 0.1.66

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/libredb/libredb-studio :0.16.1	1d0aa4f090ac	stdlib@go1.24.4	1.25.13

Open the chart page →

1,200

librenmslibrenms

10.1.2

2 of 5 See more

librenms librenms 10.1.2

2 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/mysql :9.7.2	29abb0a17998	stdlib@go1.24.6	1.25.13
librenms/librenms :26.8.2	8194a4a9ff49	stdlib@go1.24.6	1.25.13

Open the chart page →

2,748

kltlifecycle-toolkit

0.2.6

4 of 4 See more

klt lifecycle-toolkit 0.2.6

4 of the 4 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/keptn/certificate-operator :v1.1.0	8fdd311a6d33	golang.org/x/net@v0.14.0 stdlib@go1.20.4	0.55.0 1.25.13
ghcr.io/keptn/lifecycle-operator :v0.8.2	487bfc37c4b4	golang.org/x/net@v0.14.0 stdlib@go1.20.4	0.55.0 1.25.13
ghcr.io/keptn/metrics-operator :v0.8.2	acf22310e9dd	golang.org/x/net@v0.14.0 stdlib@go1.20.4	0.55.0 1.25.13
ghcr.io/keptn/scheduler :v0.8.2	0f7d277bb2b2	golang.org/x/net@v0.14.0 stdlib@go1.20.4	0.55.0 1.25.13

Open the chart page →

4,696

kube-iptables-tailerlifen

0.2.3

1 of 1 See more

kube-iptables-tailer lifen 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
honestica/kube-iptables-tailer :master-91	a393242fb939	golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb stdlib@go1.13.8	0.55.0 1.25.13

Open the chart page →

4,481

op-scim-bridgelifen

1.0.3

1 of 2 See more

op-scim-bridge lifen 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
1password/scim :v2.3.1	29d0c6cb67eb	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.16.8	0.55.0 1.25.13

Open the chart page →

2,788

op-scim-bridgelifen-charts

1.0.3

1 of 2 See more

op-scim-bridge lifen-charts 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
1password/scim :v2.3.1	29d0c6cb67eb	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.16.8	0.55.0 1.25.13

Open the chart page →

2,788

lightsteplightstep-microsat

2.0.21

1 of 1 See more

lightstep lightstep-microsat 2.0.21

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
lightstep/microsatellite :2024-01-22_17-52-59Z	c800e05e1eff	golang.org/x/net@v0.20.0 stdlib@go1.22.1	0.55.0 1.25.13

Open the chart page →

1,135

komgalinkding

0.2.3

1 of 1 See more

komga linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
gotson/komga :1.22.0	ba892ab3e082	stdlib@go1.17.8	1.25.13

Open the chart page →

3,125

linkerd-preview-vizlinkerd-buoyant

25.4.3

4 of 5 See more

linkerd-preview-viz linkerd-buoyant 25.4.3

4 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/buoyantio/metrics-api :preview-25.4.3	2cef2a3f97da	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.55.0 1.25.13
ghcr.io/buoyantio/prometheus :v2.55.1	2659f4c2ebb7	golang.org/x/net@v0.28.0 stdlib@go1.23.2	0.55.0 1.25.13
ghcr.io/buoyantio/tap :preview-25.4.3	e02a8bd9e2c3	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.55.0 1.25.13
ghcr.io/buoyantio/web :preview-25.4.3	3ee1b62aa111	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.55.0 1.25.13

Open the chart page →

3,464

linkerd-dashboardlinkerd-dashboard

0.11.1

2 of 2 See more

linkerd-dashboard linkerd-dashboard 0.11.1

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/buoyantio/linkerd-dashboard-server :0.11.1	dd6a29588242	stdlib@go1.26.5	1.25.13
ghcr.io/buoyantio/prometheus :v3.3.1	e2b8aa62b648	golang.org/x/net@v0.35.0 stdlib@go1.24.2	0.55.0 1.25.13

Open the chart page →

1,060

linode-blockstorage-csi-driverlinode-blockstorage-csi-driver

1.1.4

5 of 5 See more

linode-blockstorage-csi-driver linode-blockstorage-csi-driver 1.1.4

5 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
linode/linode-blockstorage-csi-driver :v1.1.4	09f3282bf53d	stdlib@go1.26.5	1.25.13
registry.k8s.io/sig-storage/csi-attacher :v4.11.0	b74b05b39501	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.55.0 1.25.13
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.16.0	ab482308a492	golang.org/x/net@v0.49.0 stdlib@go1.25.7	0.55.0 1.25.13
registry.k8s.io/sig-storage/csi-provisioner :v6.2.0	6be9f63ca4ca	golang.org/x/net@v0.51.0 stdlib@go1.25.7	0.55.0 1.25.13
registry.k8s.io/sig-storage/csi-resizer :v2.1.0	589e525cddef	golang.org/x/net@v0.48.0 stdlib@go1.25.7	0.55.0 1.25.13

Open the chart page →

2,999

ccm-linodelinode-cloud-controller-manager

0.9.8

1 of 1 See more

ccm-linode linode-cloud-controller-manager 0.9.8

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
linode/linode-cloud-controller-manager :v0.9.8	cd8c17512206	stdlib@go1.26.4	1.25.13

Open the chart page →

167

school-botlinuxoid69

0.1.0

1 of 1 See more

school-bot linuxoid69 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/linuxoid69/school-bot :v0.3.3	c8872438f1e0	stdlib@go1.23.3	1.25.13

Open the chart page →

772

liqo-upgrade-operatorliqo-upgrade-operator

0.1.0

1 of 1 See more

liqo-upgrade-operator liqo-upgrade-operator 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
kazem26/liqo-upgrade-operator :v0.1	268b7c6a59dd	golang.org/x/net@v0.38.0 stdlib@go1.24.13	0.55.0 1.25.13

Open the chart page →

382

listmonklistmonk-chart

2.0.1

2 of 2 See more

listmonk listmonk-chart 2.0.1

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :15	9b1d34adbce1	stdlib@go1.24.6	1.25.13
listmonk/listmonk :v6.0.0	bf3903d54a46	golang.org/x/net@v0.47.0 stdlib@go1.24.1	0.55.0 1.25.13

Open the chart page →

3,143

pocketbase-halitesql

0.0.3

1 of 1 See more

pocketbase-ha litesql 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/litesql/pocketbase-ha :latest	c5b28608958b	stdlib@go1.26.5	1.25.13

Open the chart page →

1,170

ingresslivekit-server

1.2.2

1 of 1 See more

ingress livekit-server 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
livekit/ingress :v1.2.2	1ab01641b366	golang.org/x/net@v0.18.0 stdlib@go1.20.7	0.55.0 1.25.13

Open the chart page →

10,844

livekit-recorderlivekit-server

0.3.13

1 of 1 See more

livekit-recorder livekit-server 0.3.13

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
livekit/livekit-recorder :v0.3.13	ecf1409c75e0	golang.org/x/net@v0.0.0-20211004195052-b30845b58a23 stdlib@go1.16.2	0.55.0 1.25.13

Open the chart page →

2,136

livekit-serverlivekit-server

1.9.0

1 of 1 See more

livekit-server livekit-server 1.9.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
livekit/livekit-server :v1.9.0	3602a85840d5	golang.org/x/net@v0.40.0 stdlib@go1.24.3	0.55.0 1.25.13

Open the chart page →

1,562

pagesliviu884422-pages

1.0.0

1 of 3 See more

pages liviu884422-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.13

Open the chart page →

20,285

llmarinerllmariner

1.53.1

15 of 21 See more

llmariner llmariner 1.53.1

15 of the 21 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
public.ecr.aws/cloudnatix/llmariner/api-usage-cleaner :1.16.0	d47f43484055	stdlib@go1.23.12	1.25.13
public.ecr.aws/cloudnatix/llmariner/api-usage-server :1.16.0	8f9c32b866b0	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/cluster-manager-server :1.8.0	364b3ff0fcb7	golang.org/x/net@v0.38.0 stdlib@go1.24.5	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/cluster-monitor-server :0.10.2	2d28f9e3eab4	golang.org/x/net@v0.38.0 stdlib@go1.23.11	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/database-creator :1.17.0	97065ced2942	stdlib@go1.23.11	1.25.13
public.ecr.aws/cloudnatix/llmariner/file-manager-server :1.11.0	301216788e93	golang.org/x/net@v0.38.0 stdlib@go1.23.11	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/inference-manager-engine :1.46.0	c46f109c3d0b	golang.org/x/net@v0.48.0 stdlib@go1.25.9	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/inference-manager-server :1.45.0	90b890f800ab	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/job-manager-dispatcher :1.27.0	582508903cb0	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/job-manager-server :1.27.0	fe9de719f91e	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/model-manager-loader :1.27.0	26ac7263a823	golang.org/x/net@v0.38.0 stdlib@go1.24.0	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/model-manager-server :1.27.0	c057dcdd9ef3	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/rbac-server :1.19.1	df1adeb86679	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/session-manager-server :1.9.0	f24ecd37fbaa	golang.org/x/net@v0.38.0 stdlib@go1.23.11	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/user-manager-server :1.27.1	628a14449241	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13

Open the chart page →

12,185

llm-dllm-d

1.0.23

1 of 2 See more

llm-d llm-d 1.0.23

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/llm-d/llm-d-model-service :v0.0.15	8b99a8104a2f	golang.org/x/net@v0.40.0 stdlib@go1.24.3	0.55.0 1.25.13

Open the chart page →

2,564

home-assistantlmatfy

0.1.38

1 of 1 See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
homeassistant/home-assistant :2026.7	5a531753cea9	golang.org/x/net@v0.49.0 stdlib@go1.25.6	0.55.0 1.25.13

Open the chart page →

2,488

go-ocpp-serverloafoe

0.2.1

1 of 1 See more

go-ocpp-server loafoe 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/go-ocpp-server :v0.2.1	45bb960674ab	stdlib@go1.21.13	1.25.13

Open the chart page →

399

mcp-notifierloafoe

0.2.0

1 of 1 See more

mcp-notifier loafoe 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/mcp-notifier :v0.2.0	ea958b832415	stdlib@go1.26.4	1.25.13

Open the chart page →

mt-mcp-grafanaloafoe

0.10.0

2 of 2 See more

mt-mcp-grafana loafoe 0.10.0

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
grafana/mcp-grafana :0.14.0	42f541f22063	golang.org/x/net@v0.53.0 stdlib@go1.26.3	0.55.0 1.25.13
ghcr.io/loafoe/mt-mcp-grafana :v0.1.1	2332d9b47475	stdlib@go1.26.2	1.25.13

Open the chart page →

1,988

mt-mcp-proxyloafoe

0.3.0

1 of 2 See more

mt-mcp-proxy loafoe 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/mt-mcp-proxy :v0.1.0	221835f9340f	stdlib@go1.26.4	1.25.13

Open the chart page →

505

otlp-gatewayloafoe

0.0.2

2 of 2 See more

otlp-gateway loafoe 0.0.2

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/jimmidyson/configmap-reload :v0.13.1	ca0c14eef541	stdlib@go1.22.4	1.25.13
ghcr.io/loafoe/caddy-token :v0.3.0	528f2174fa2f	golang.org/x/net@v0.27.0 stdlib@go1.22.5	0.55.0 1.25.13

Open the chart page →

2,180

patch-operatorloafoe

0.11.3

1 of 2 See more

patch-operator loafoe 0.11.3

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/redhat-cop/kube-rbac-proxy :v0.11.0	c68135620167	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.15.15	0.55.0 1.25.13

Open the chart page →

4,912

picoclawloafoe

0.1.1

1 of 2 See more

picoclaw loafoe 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/picoclaw :v0.0.19	42e1b6862913	golang.org/x/net@v0.53.0 stdlib@go1.26.2	0.55.0 1.25.13

Open the chart page →

479

solgateloafoe

0.0.12

1 of 1 See more

solgate loafoe 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/solgate :v0.0.12	b3256cbc7b68	golang.org/x/net@v0.14.0 stdlib@go1.21.0	0.55.0 1.25.13

Open the chart page →

2,126

tempo-distributedloafoe

1.20.1

1 of 2 See more

tempo-distributed loafoe 1.20.1

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
grafana/tempo :2.6.0	f55a8a1937ff	golang.org/x/net@v0.27.0 stdlib@go1.22.6	0.55.0 1.25.13

Open the chart page →

2,038

local-path-exporterlocal-path-exporter

0.2.3

1 of 1 See more

local-path-exporter local-path-exporter 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/tmusial99/local-path-exporter :1.1.0	82476692c680	stdlib@go1.26.4	1.25.13

Open the chart page →

weather-app-chartlocal-weatherapp

0.1.0

2 of 4 See more

weather-app-chart local-weatherapp 0.1.0

2 of the 4 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
bitnamilegacy/mysql :8.0.36-debian-11-r3	8aad73aa0c6d	stdlib@go1.21.6	1.25.13
youssef11gaber10/deployment-auth-go :latest	6597b26959d2	golang.org/x/net@v0.10.0 stdlib@go1.26.1	0.55.0 1.25.13

Open the chart page →

5,915

ocatiecataloguslocatiecatalogus

1.0.0

1 of 3 See more

ocatiecatalogus locatiecatalogus 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/ocatiecatalogus-php :latest	c22764cbfa97	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.55.0 1.25.13

Open the chart page →

7,521

locust-pluginslocust-plugins

0.0.4

2 of 3 See more

locust-plugins locust-plugins 0.0.4

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
sky5367/locust-plugins-grafana :latest	d51bf68d4b26	golang.org/x/net@v0.22.0 stdlib@go1.21.8	0.55.0 1.25.13
sky5367/locust-plugins-timescale :latest	d3150f201471	stdlib@go1.18.7	1.25.13

Open the chart page →

7,581

uptime-kumaloeken-at-home

2.3.2

1 of 1 See more

uptime-kuma loeken-at-home 2.3.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :2.3.2	9aeb4e51d038	golang.org/x/net@v0.40.0 stdlib@go1.20.5	0.55.0 1.25.13

Open the chart page →

33,925

central-hostpath-mapperloft

0.2.9

1 of 1 See more

central-hostpath-mapper loft 0.2.9

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/central-hostpath-mapper :0.2.9	fa6dba122171	golang.org/x/net@v0.26.0 stdlib@go1.23.2	0.55.0 1.25.13

Open the chart page →

931

devpod-proloft

0.0.0-ci.4-do-not-use

1 of 1 See more

devpod-pro loft 0.0.0-ci.4-do-not-use

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/devpod-pro :0.0.0-ci.4-do-not-use	5dfa86b6451f	golang.org/x/net@v0.21.0 stdlib@go1.20.10	0.55.0 1.25.13

Open the chart page →

3,242

devspace-cloudloft

0.3.3

2 of 8 See more

devspace-cloud loft 0.3.3

2 of the 8 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
devspacecloud/manager :0.3.3	49c397413f7b	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.8	0.55.0 1.25.13
library/postgres :11	5d2aa4a7b5f9	stdlib@go1.16.7	1.25.13

Open the chart page →

9,893

kioskloft

0.2.11

1 of 1 See more

kiosk loft 0.2.11

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
kiosksh/kiosk :0.2.11	501725ba2025	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.15.7	0.55.0 1.25.13

Open the chart page →

3,096

license-serverloft

0.6.0

1 of 1 See more

license-server loft 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/license-server :0.6.0	69ce001bb4b0	golang.org/x/net@v0.53.0 stdlib@go1.24.3	0.55.0 1.25.13

Open the chart page →

804

loft-agentloft

3.2.4

1 of 1 See more

loft-agent loft 3.2.4

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/agent :3.2.4	5c109914ff73	golang.org/x/net@v0.6.0 stdlib@go1.18.10	0.55.0 1.25.13

Open the chart page →

2,460

loft-direct-cluster-endpointloft

1.14.0

1 of 1 See more

loft-direct-cluster-endpoint loft 1.14.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
loftsh/directclusterendpoint :1.14.0	310cc7d690f5	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.16.6	0.55.0 1.25.13

Open the chart page →

3,120

vcluster-control-planeloft

0.0.0-ci.4-do-not-use

1 of 1 See more

vcluster-control-plane loft 0.0.0-ci.4-do-not-use

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/vcluster-control-plane :0.0.0-ci.4-do-not-use	45e744fc623f	golang.org/x/net@v0.21.0 stdlib@go1.22.0	0.55.0 1.25.13

Open the chart page →

3,242

vcluster-headloft

0.0.0-035ec6e

1 of 2 See more

vcluster-head loft 0.0.0-035ec6e

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/kubernetes :v1.35.0	90097a08b87c	golang.org/x/net@v0.42.0 stdlib@go1.24.11	0.55.0 1.25.13

Open the chart page →

1,309

Container images carrying it

5,366 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
circleci/container-agent :3	4d8d0ae5efc3	golang.org/x/net@v0.8.0 stdlib@go1.19.7	0.55.0 1.25.13	1
circleci/runner :launch-agent	9bdc62f02162	stdlib@go1.21.5	1.25.13	1
ciscolabs/msm-nc :07102023	36d02faad958	golang.org/x/net@v0.10.0 stdlib@go1.20.5	0.55.0 1.25.13	1
ckan/ckan-solr :2.11-solr9	ef8e5d3e6be1	stdlib@go1.18.1	1.25.13	1
clastix/capsule-rancher-addon :v0.1.1	43d301afbca8	golang.org/x/net@v0.4.0 stdlib@go1.19.2	0.55.0 1.25.13	1
clastix/kamaji :latest	a7c5d108810b	stdlib@go1.26.5	1.25.13	1
cleanstart/minio :latest	544bdb8811e1	stdlib@go1.26.4	1.25.13	1
clickhouse/clickhouse-server :23.8	512bb8a21483	stdlib@go1.19.10	1.25.13	1
clickhouse/clickhouse-server :23.4.2.11	dc5658853ce1	stdlib@go1.19.5	1.25.13	1
cloud37io/s3-encryption-gateway :0.11.10	f8ff2092b8af	stdlib@go1.26.5	1.25.13	1
cloudbees/cert-requester :2.3.3	1d44fb4f799b	golang.org/x/net@v0.0.0-20200927032502-5d4f70055728 stdlib@go1.20.1	0.55.0 1.25.13	1
cloudbees/sidecar-injector :2.3.3	8f102ef0383a	golang.org/x/net@v0.0.0-20200927032502-5d4f70055728 stdlib@go1.20.1	0.55.0 1.25.13	1
cloudecho/hello :0.1.0	f76ede067ab9	stdlib@go1.16.6	1.25.13	1
cloudentity/openbanking-quickstart-bank :1.11.1	9402ec4b5016	golang.org/x/net@v0.0.0-20201207224615-747e23833adb stdlib@go1.15.14	0.55.0 1.25.13	1
cloudentity/openbanking-quickstart-configuration :1.11.1	8a1890eb8265	golang.org/x/net@v0.0.0-20201207224615-747e23833adb stdlib@go1.15.14	0.55.0 1.25.13	1
cloudentity/openbanking-quickstart-consent-admin-portal :1.11.1	ee83cdd45b7b	golang.org/x/net@v0.0.0-20201207224615-747e23833adb stdlib@go1.15.2	0.55.0 1.25.13	1
cloudentity/openbanking-quickstart-consent-page :1.11.1	5728654cecb7	golang.org/x/net@v0.0.0-20201207224615-747e23833adb stdlib@go1.16.6	0.55.0 1.25.13	1
cloudentity/openbanking-quickstart-consent-self-service-portal :1.11.1	8ca94ae6acf4	golang.org/x/net@v0.0.0-20201207224615-747e23833adb stdlib@go1.15.2	0.55.0 1.25.13	1
cloudentity/openbanking-quickstart-financroo-tpp :1.11.1	c04eb10c77b7	golang.org/x/net@v0.0.0-20201207224615-747e23833adb stdlib@go1.15.2	0.55.0 1.25.13	1
cloudflare/cloudflared :2024.8.3	14d9c6b01b29	golang.org/x/net@v0.25.0 stdlib@go1.22.2-devel-cf	0.55.0 1.25.13	1
cloudflare/cloudflared :2024.5.0	5d5f70a59d5e	golang.org/x/net@v0.25.0 stdlib@go1.22.2-devel-cf	0.55.0 1.25.13	1
cloudflare/cloudflared :2023.10.0	c18744ae1767	golang.org/x/net@v0.12.0 stdlib@go1.20.6	0.55.0 1.25.13	1
cloudflare/cloudflared :2025.8.0	eb5c9324efe3	golang.org/x/net@v0.40.0 stdlib@go1.24.4	0.55.0 1.25.13	1
cloudflare/origin-ca-issuer :v0.14.4	c92ef5ac7e4b	stdlib@go1.26.4	1.25.13	1
cloudnativelabs/kube-router :v1.6.0	0ec7cd73f43f	golang.org/x/net@v0.4.0 stdlib@go1.19.5	0.55.0 1.25.13	1
cloudposse/bastion :latest	0d9507e8a760	stdlib@go1.13.3	1.25.13	1
cloudreve/cloudreve :4.18.0	f7a464100bf6	stdlib@go1.25.5	1.25.13	1
cloudtooling/moodle :5.2.3	f4f04e0fc401	stdlib@go1.26.4	1.25.13	1
cloudtooling/wordpress :7.1.1	db89d95f1d14	stdlib@go1.26.4	1.25.13	1
cmacrae/d2-prometheus-exporter :v0.1.0	fc5fecba436e	stdlib@go1.15	1.25.13	1
cmacrae/lgtm :0.1.0	dec8d490fe40	golang.org/x/net@v0.0.0-20181108082009-03003ca0c849 stdlib@go1.14.1	0.55.0 1.25.13	1
cockroachdb/cockroach-operator :v2.1.0	983312754620	golang.org/x/net@v0.0.0-20200602114024-627f9648deb9 stdlib@go1.13.14	0.55.0 1.25.13	1
codecov/self-hosted-gateway :24.4.1	de483faad6e5	golang.org/x/net@v0.21.0 stdlib@go1.22.0	0.55.0 1.25.13	1
codenotary/immudb :1.9.7	7c85d7cc4f22	golang.org/x/net@v0.17.0 stdlib@go1.18.10	0.55.0 1.25.13	1
codercom/code-server :4.11.0-debian	1e2cc688008e	stdlib@go1.14.4	1.25.13	1
codercom/code-server :3.10.2	47605610ad8d	stdlib@go1.14.4	1.25.13	1
coderenvs/coder-service :1.44.6	1deffc4670e6	golang.org/x/net@v0.24.0 stdlib@go1.21.9	0.55.0 1.25.13	1
codeskyblue/gohttpserver :latest	caa862590e34	golang.org/x/net@v0.0.0-20201021035429-f5854403a974 stdlib@go1.16.3	0.55.0 1.25.13	1
cometbft/cometbft :v0.38.17	22c2ac018f40	golang.org/x/net@v0.34.0 stdlib@go1.22.11	0.55.0 1.25.13	1
concourse/concourse :8.3.0	40a143ce5873	golang.org/x/net@v0.50.0 stdlib@go1.26.5	0.55.0 1.25.13	1
conduction/agendaservice-php :latest	9cfeeb6c7c20	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.55.0 1.25.13	1
conduction/balance-registration-php :dev	c36094a41369	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.55.0 1.25.13	1
conduction/betaalservice-php :latest	ece1ab544c57	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.55.0 1.25.13	1
conduction/cgrc-php :dev	25415534d245	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.55.0 1.25.13	1
conduction/checkin-component-php :dev	3423845692c1	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.55.0 1.25.13	1
conduction/conduction-ui-php :dev	2744565516e8	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.55.0 1.25.13	1
conduction/contactmoment-component-php :dev	e1d4ad1e22a8	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.55.0 1.25.13	1
conduction/docparser-php :dev	b6f95c8ead7d	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.55.0 1.25.13	1
conduction/kvk-php :dev	8f177f9f8a7b	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.55.0 1.25.13	1
conduction/pan-php :dev	24f03c57568f	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.55.0 1.25.13	1