CVE-2026-39821

High

Advisory

Published 22 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,556; of 17,790 indexed, latest versions
Container images: 5,324; deployed by those charts
Fix available: 3 of 3; affected packages

Red Hat Security Advisory: git-lfs security update

Carried by container images the latest versions of 4,556 of 17,790 indexed charts deploy, on 5,324 images.

Affected package	Affected versions	Fixed in	Images
git-lfsrpm	2.13.3-3.el8_6	0:3.4.1-11.el8_10	1
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+189 more	1.25.13	5,288
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+220 more	0.55.0	3,695

OSV records: RHSA-2026:30853 GO-2026-5026

Charts affected

4,556 by stars

Chart

Latest

Affected images

Radar Score

scaffoldsigstore

0.6.115

11 of 15 See more

scaffold sigstore 0.6.115

11 of the 15 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/redisdigest-pinned	148bb5411c18	stdlib@go1.18.2	1.25.13
gcr.io/trillian-opensource-ci/db_serverdigest-pinned	2a685a38dd01	stdlib@go1.18.2	1.25.13
ghcr.io/sigstore/fulcio :v1.8.8	ef72cf56c64b	stdlib@go1.26.4	1.25.13
ghcr.io/sigstore/rekor/rekor-server :v1.5.4	100d793d68d0	stdlib@go1.26.4	1.25.13
ghcr.io/sigstore/scaffolding/createcertsdigest-pinned	7f59f7c08d1a	golang.org/x/net@v0.46.0 stdlib@go1.25.0	0.55.0 1.25.13
ghcr.io/sigstore/scaffolding/createctconfig :v0.7.31	3a061734c5be	golang.org/x/net@v0.46.0 stdlib@go1.25.0	0.55.0 1.25.13
ghcr.io/sigstore/scaffolding/createdbdigest-pinned	3cee6c78973b	golang.org/x/net@v0.46.0 stdlib@go1.25.0	0.55.0 1.25.13
ghcr.io/sigstore/scaffolding/createtreedigest-pinned:v0.7.31	e5232e8c9122	golang.org/x/net@v0.46.0 stdlib@go1.25.0	0.55.0 1.25.13
ghcr.io/sigstore/scaffolding/ct_server :v0.7.31	66664ba563e7	golang.org/x/net@v0.46.0 stdlib@go1.25.0	0.55.0 1.25.13
ghcr.io/sigstore/scaffolding/trillian_log_serverdigest-pinned	5a878e4e4f03	stdlib@go1.26.0	1.25.13
ghcr.io/sigstore/scaffolding/trillian_log_signerdigest-pinned	28c5ff40963f	stdlib@go1.26.0	1.25.13

Open the chart page →

7,686

simply-dns-webhooksimply-dns-webhook

1.10.0

1 of 1 See more

simply-dns-webhook simply-dns-webhook 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/runnerm/simply-dns-webhook :v1.10.0	fdfffa3984a5	golang.org/x/net@v0.52.0 stdlib@go1.26.4	0.55.0 1.25.13

Open the chart page →

422

mongodb-backupsinextra

1.1.0

1 of 1 See more

mongodb-backup sinextra 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/sergelogvinov/mongodb :8.0.10	1eee8e20a87f	golang.org/x/net@v0.40.0 stdlib@go1.23.8	0.55.0 1.25.13

Open the chart page →

4,277

postgresql-singlesinextra

1.15.1

1 of 1 See more

postgresql-single sinextra 1.15.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/sergelogvinov/postgresql :16.15	fafb72e98f22	golang.org/x/net@v0.47.0 stdlib@go1.24.6	0.55.0 1.25.13

Open the chart page →

4,937

altinity-clickhouse-operatorslamdev

0.1.2

2 of 2 See more

altinity-clickhouse-operator slamdev 0.1.2

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.20.0	8f0f582d41f0	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.17.13	0.55.0 1.25.13
altinity/metrics-exporter :0.20.0	1a46d104406d	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.17.13	0.55.0 1.25.13

Open the chart page →

6,420

docker-registry-uislamdev

0.0.1

1 of 1 See more

docker-registry-ui slamdev 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quiq/docker-registry-ui :0.9.4	91281da47036	golang.org/x/net@v0.0.0-20211015210444-4f30a5c0130f stdlib@go1.18	0.55.0 1.25.13

Open the chart page →

2,200

external-secrets-operatorslamdev

0.0.15

1 of 1 See more

external-secrets-operator slamdev 0.0.15

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
slamdev/external-secrets-operator :0.0.8	855f6625dda4	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.15	0.55.0 1.25.13

Open the chart page →

2,301

wg-easyslybase-wg-easy

1.2.0

1 of 1 See more

wg-easy slybase-wg-easy 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/wg-easy/wg-easy :15.4.0	0e7bc9d34e86	golang.org/x/net@v0.44.0 stdlib@go1.26.3	0.55.0 1.25.13

Open the chart page →

725

wireguardslybase-wireguard

2.0.6

1 of 1 See more

wireguard slybase-wireguard 2.0.6

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
linuxserver/wireguard :1.0.20260223-r0-ls122	dca67384e3e9	golang.org/x/net@v0.47.0	0.55.0

Open the chart page →

443

smallest-self-hostsmallest-self-host

0.2.2

6 of 12 See more

smallest-self-host smallest-self-host 0.2.2

6 of the 12 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
grafana/grafana :11.0.0	0dc5a246ab16	golang.org/x/net@v0.23.0 stdlib@go1.21.10	0.55.0 1.25.13
quay.io/prometheus-operator/prometheus-operator :v0.74.0	6b3f6d8b4c0a	golang.org/x/net@v0.25.0 stdlib@go1.22.3	0.55.0 1.25.13
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v20221220-controller-v1.5.1-58-g787ea74b6	4d99688e5573	golang.org/x/net@v0.1.0 stdlib@go1.19.4	0.55.0 1.25.13
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.12.0	b401fae262a5	golang.org/x/net@v0.22.0 stdlib@go1.21.8	0.55.0 1.25.13
registry.k8s.io/nfd/node-feature-discovery :v0.16.6	19ebca8b3804	golang.org/x/net@v0.25.0 stdlib@go1.22.8	0.55.0 1.25.13
registry.k8s.io/prometheus-adapter/prometheus-adapter :v0.12.0	932eae60e2bc	golang.org/x/net@v0.24.0 stdlib@go1.22.2	0.55.0 1.25.13

Open the chart page →

7,705

smarter-edgesmarter

0.0.15

1 of 1 See more

smarter-edge smarter 0.0.15

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/smarter-project/smarter-device-manager :v1.20.12	228f7f44594a	golang.org/x/net@v0.2.0 stdlib@go1.19.3	0.55.0 1.25.13

Open the chart page →

1,151

aws-otel-collectorsnowplow-devops

0.16.0

1 of 1 See more

aws-otel-collector snowplow-devops 0.16.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-observability/aws-otel-collector :v0.49.0	d2bdfff2c377	stdlib@go1.26.5	1.25.13

Open the chart page →

160

yopasssoftizy

1.0.1

1 of 2 See more

yopass softizy 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
jhaals/yopass :11.4.6	9516e3b3e88c	stdlib@go1.19.1	1.25.13

Open the chart page →

1,461

artifact-hubsoftonic

1.19.0

6 of 8 See more

artifact-hub softonic 1.19.0

6 of the 8 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
aquasec/trivy :0.43.1	944a04445179	golang.org/x/net@v0.11.0 stdlib@go1.19.10	0.55.0 1.25.13
artifacthub/db-migrator :v1.19.0	2a746b289fcd	stdlib@go1.22.4	1.25.13
artifacthub/hub :v1.19.0	111918d8c399	golang.org/x/net@v0.26.0 stdlib@go1.22.4	0.55.0 1.25.13
artifacthub/postgres :latest	4fd34fa635cc	stdlib@go1.24.6	1.25.13
artifacthub/scanner :v1.19.0	323d026e78c3	golang.org/x/net@v0.21.0 stdlib@go1.21.8	0.55.0 1.25.13
artifacthub/tracker :v1.19.0	6596c8c4d955	golang.org/x/net@v0.26.0 stdlib@go1.22.4	0.55.0 1.25.13

Open the chart page →

14,550

gcp-quota-exportersoftonic

2.0.2

1 of 1 See more

gcp-quota-exporter softonic 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
mintel/gcp-quota-exporter :v0.3.2	0e0707b7732b	golang.org/x/net@v0.0.0-20190311183353-d8887717615a stdlib@go1.13.12	0.55.0 1.25.13

Open the chart page →

2,643

go-ratelimitsoftonic

1.0.7

2 of 3 See more

go-ratelimit softonic 1.0.7

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
envoyproxy/ratelimit :v1.4.0	71081616da3e	golang.org/x/net@v0.0.0-20191209160850-c0dbc17a3553 stdlib@go1.14	0.55.0 1.25.13
oliver006/redis_exporter :v1.9.0	4af75e9f16f6	stdlib@go1.14.4	1.25.13

Open the chart page →

5,105

node-policy-webhooksoftonic

0.1.10

1 of 1 See more

node-policy-webhook softonic 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
softonic/node-policy-webhook :0.1.2	ab6098c04a53	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.14.6	0.55.0 1.25.13

Open the chart page →

2,591

redis-shardedsoftonic

0.5.0

1 of 2 See more

redis-sharded softonic 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
oliver006/redis_exporter :v1.9.0	4af75e9f16f6	stdlib@go1.14.4	1.25.13

Open the chart page →

2,330

sogosogo

0.3.5

1 of 2 See more

sogo sogo 0.3.5

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
sonroyaalmerol/docker-sogo :5.12.4	3f60f3abe990	golang.org/x/net@v0.49.0 stdlib@go1.24.13	0.55.0 1.25.13

Open the chart page →

7,204

postgresql-ha-chartsoldevelo-postgresql-ha-chart

16.3.4

1 of 2 See more

postgresql-ha-chart soldevelo-postgresql-ha-chart 16.3.4

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
soldevelo/pgpool :4.6.3-debian-12-r0	044d16a65129	stdlib@go1.25.4	1.25.13

Open the chart page →

4,604

rabbitmqsolidcharts

0.7.5

1 of 2 See more

rabbitmq solidcharts 0.7.5

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/rabbitmq :4.3.5-management	ffd1b50c522a	stdlib@go1.22.2	1.25.13

Open the chart page →

1,045

thanossolidcharts

0.12.2

1 of 1 See more

thanos solidcharts 0.12.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.42.4	b567818fe608	stdlib@go1.26.5	1.25.13

Open the chart page →

203

gloosolo-gloo-edge

0.0.0-fork

4 of 5 See more

gloo solo-gloo-edge 0.0.0-fork

4 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/solo-io/certgen :0.0.0-fork	b17a8c7d1f32	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.1	0.55.0 1.25.13
quay.io/solo-io/discovery :0.0.0-fork	5b62aaade3c9	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.1	0.55.0 1.25.13
quay.io/solo-io/gloo :0.0.0-fork	9a6c84560d44	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.1	0.55.0 1.25.13
quay.io/solo-io/gloo-envoy-wrapper :0.0.0-fork	26ae185e835a	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.1	0.55.0 1.25.13

Open the chart page →

9,256

sp-otel-collectorsp-otel-collector

1.1.6

1 of 1 See more

sp-otel-collector sp-otel-collector 1.1.6

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/geored/spmm-collector-contrib :1.0.0	63baf86a49ac	golang.org/x/net@v0.11.0 stdlib@go1.20.5	0.55.0 1.25.13

Open the chart page →

2,032

sql-operatorsql-operator

0.11.2

1 of 1 See more

sql-operator sql-operator 0.11.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/stenic/sql-operator :1.13.2	f4324baa2aad	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.17.13	0.55.0 1.25.13

Open the chart page →

1,594

stackradar-scannerstackradar

0.3.0

1 of 1 See more

stackradar-scanner stackradar 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/lockdep/stackradar-scanner :0.3.0	dd8a35d50c2d	golang.org/x/net@v0.49.0 stdlib@go1.25.7	0.55.0 1.25.13

Open the chart page →

1,218

gitwebhookproxystakater

0.2.79

1 of 1 See more

gitwebhookproxy stakater 0.2.79

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
stakater/gitwebhookproxy :v0.2.79	c1226e5270cd	stdlib@go1.13.1	1.25.13

Open the chart page →

1,503

splunk-operatorstakater

0.0.6

1 of 2 See more

splunk-operator stakater 0.0.6

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
splunk/splunk-operator :2.0.0	c4e0d3146226	golang.org/x/net@v0.0.0-20211029224645-99673261e6eb stdlib@go1.17.12	0.55.0 1.25.13

Open the chart page →

11,459

gethstakewise

2.5.8

1 of 3 See more

geth stakewise 2.5.8

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ethereum/client-go :v1.15.10	1f36ca5922a5	golang.org/x/net@v0.36.0 stdlib@go1.24.2	0.55.0 1.25.13

Open the chart page →

1,143

graph-nodestakewise

3.1.0

2 of 3 See more

graph-node stakewise 3.1.0

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
graphprotocol/graph-node :v0.37.0	f4452cdedd68	stdlib@go1.24.1	1.25.13
ipfs/kubo :v0.24.0	e3de33bd746b	golang.org/x/net@v0.17.0 stdlib@go1.19.8	0.55.0 1.25.13

Open the chart page →

4,694

mayastorstartechnica

0.2.0

3 of 13 See more

mayastor startechnica 0.2.0

3 of the 13 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-attacher :v4.0.0	9a685020911e	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.18	0.55.0 1.25.13
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.6.0	f1c25991bac2	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.18	0.55.0 1.25.13
registry.k8s.io/sig-storage/livenessprobe :v2.8.0	cacee2b5c36d	golang.org/x/net@v0.0.0-20220921203646-d300de134e69 stdlib@go1.18	0.55.0 1.25.13

Open the chart page →

4,367

multusstartechnica

0.1.2

1 of 1 See more

multus startechnica 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/k8snetworkplumbingwg/multus-cni :stable	ec4e5dfe12b6	golang.org/x/net@v0.48.0 stdlib@go1.25.11	0.55.0 1.25.13

Open the chart page →

512

statpingstatping

0.1.14

1 of 1 See more

statping statping 0.1.14

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
statping/statping :v0.90.74	e874da513a5c	golang.org/x/net@v0.0.0-20200904194848-62affa334b73 stdlib@go1.14.13	0.55.0 1.25.13

Open the chart page →

3,378

thanosstevehipwell-helm-charts-thanos

1.24.1

1 of 1 See more

thanos stevehipwell-helm-charts-thanos 1.24.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.42.4	b567818fe608	stdlib@go1.26.5	1.25.13

Open the chart page →

203

stornxstornx

1.1.1

9 of 9 See more

stornx stornx 1.1.1

9 of the 9 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
alazidis/kube-netlag :1.1.0	0e8c84152201	golang.org/x/net@v0.33.0 stdlib@go1.24.13	0.55.0 1.25.13
alazidis/stornx :1.1.1	602d4f7f090c	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.55.0 1.25.13
istio/pilot :1.29.1	f8b0e412ac4a	golang.org/x/net@v0.48.0 stdlib@go1.25.8	0.55.0 1.25.13
quay.io/kiali/kiali :v2.23.0	7652b1285f50	golang.org/x/net@v0.49.0 stdlib@go1.25.0	0.55.0 1.25.13
quay.io/prometheus-operator/prometheus-config-reloader :v0.90.0	e5aab3be6873	golang.org/x/net@v0.52.0 stdlib@go1.25.8	0.55.0 1.25.13
quay.io/prometheus/node-exporter :v1.10.2	337ff1d356b6	golang.org/x/net@v0.44.0 stdlib@go1.25.3	0.55.0 1.25.13
quay.io/prometheus/prometheus :v3.10.0	7571a304e67f	golang.org/x/net@v0.49.0 stdlib@go1.26.0	0.55.0 1.25.13
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.18.0	1545919b72e3	golang.org/x/net@v0.48.0 stdlib@go1.25.5	0.55.0 1.25.13
registry.k8s.io/metrics-server/metrics-server :v0.8.0	89258156d0e9	golang.org/x/net@v0.40.0 stdlib@go1.24.4	0.55.0 1.25.13

Open the chart page →

11,735

stunner-gateway-operatorstunner

1.1.0

2 of 2 See more

stunner-gateway-operator stunner 1.1.0

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
l7mp/stunner-auth-server :1.1.0	2f8114477ba6	golang.org/x/net@v0.36.0 stdlib@go1.23.8	0.55.0 1.25.13
l7mp/stunner-gateway-operator :1.1.0	c34f7c931491	golang.org/x/net@v0.36.0 stdlib@go1.23.8	0.55.0 1.25.13

Open the chart page →

1,292

hlf-k8ssubstra

10.2.4

4 of 7 See more

hlf-k8s substra 10.2.4

4 of the 7 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
hyperledger/fabric-ca :1.5.0	f270dfeee91d	golang.org/x/net@v0.0.0-20201006153459-a7d1128ccaa0 stdlib@go1.15.7	0.55.0 1.25.13
jwilder/dockerize :latest	f94fb59fb4f6	golang.org/x/net@v0.47.0 stdlib@go1.25.5	0.55.0 1.25.13
ghcr.io/substra/fabric-peer :0.2.4	f681e0343a31	golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110 stdlib@go1.18.10	0.55.0 1.25.13
ghcr.io/substra/fabric-tools :0.2.4	3491a0f31c4a	golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110 stdlib@go1.18.10	0.55.0 1.25.13

Open the chart page →

12,030

supabasesupabse

0.8.0

4 of 11 See more

supabase supabse 0.8.0

4 of the 11 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
darthsim/imgproxy :v3.30.1	3b709e4a0e5e	golang.org/x/net@v0.44.0 stdlib@go1.25.1	0.55.0 1.25.13
library/postgres :17-alpine	18cfe3ef5e68	stdlib@go1.24.6	1.25.13
supabase/gotrue :v2.189.0	385184459f57	golang.org/x/net@v0.52.0 stdlib@go1.25.8	0.55.0 1.25.13
supabase/postgres :17.6.1.136	f371b5f3f2ac	stdlib@go1.26.1	1.25.13

Open the chart page →

18,327

Grafanasurajwarbhe-grafana

0.1.0

1 of 1 See more

Grafana surajwarbhe-grafana 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
surajwarbhe/grafana :v1	85248611e9f1	golang.org/x/net@v0.0.0-20200202094626-16171245cfb2 stdlib@go1.14.3	0.55.0 1.25.13

Open the chart page →

2,604

switchboardswitchboard

0.7.4

1 of 1 See more

switchboard switchboard 0.7.4

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/borchero/switchboard :0.7.4	54a193b757da	golang.org/x/net@v0.51.0 stdlib@go1.26.1	0.55.0 1.25.13

Open the chart page →

844

synology-proxy-operatorsynology-proxy-operator

0.0.8

1 of 1 See more

synology-proxy-operator synology-proxy-operator 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/phoeluga/synology-proxy-operator :0.0.8	b26510b26b31	golang.org/x/net@v0.52.0 stdlib@go1.26.2	0.55.0 1.25.13

Open the chart page →

210

hello-appsysintelligent

2.0.1

1 of 1 See more

hello-app sysintelligent 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
sysintelligent/hello-app :2.0.1	77fb30df847d	golang.org/x/net@v0.19.0 stdlib@go1.19.3	0.55.0 1.25.13

Open the chart page →

1,880

system-upgrade-controllersystem-upgrade

0.2.13

1 of 1 See more

system-upgrade-controller system-upgrade 0.2.13

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
rancher/system-upgrade-controller :v0.20.1	aaf4dbf64057	golang.org/x/net@v0.53.0 stdlib@go1.26.5	0.55.0 1.25.13

Open the chart page →

125

system-upgrade-controllersystem-upgrade-controller

1.12.0

1 of 1 See more

system-upgrade-controller system-upgrade-controller 1.12.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
rancher/system-upgrade-controller :v0.20.1	aaf4dbf64057	golang.org/x/net@v0.53.0 stdlib@go1.26.5	0.55.0 1.25.13

Open the chart page →

125

headscaleszpadel-charts

0.30.2

2 of 3 See more

headscale szpadel-charts 0.30.2

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/juanfont/headscale :0.29.1	8453e47ea6bf	stdlib@go1.26.4	1.25.13
ghcr.io/tale/headplane :0.6.3	9476cc5adb12	golang.org/x/net@v0.42.0 stdlib@go1.25.1	0.55.0 1.25.13

Open the chart page →

1,880

tekton-events-relaytekton-events-relay

0.10.1

1 of 1 See more

tekton-events-relay tekton-events-relay 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/fabioluciano/tekton-events-relay :0.10.1	84cb5a2b8b81	stdlib@go1.26.4	1.25.13

Open the chart page →

174

tbotteleport-agent-kube

18.11.0

1 of 1 See more

tbot teleport-agent-kube 18.11.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
public.ecr.aws/gravitational/tbot-distroless :18.11.0	4ba5ace31fea	stdlib@go1.25.12	1.25.13

Open the chart page →

472

tenuretenure

1.0.6

2 of 2 See more

tenure tenure 1.0.6

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
mongodb/mongodb-atlas-local :8	925c3d34f0c6	stdlib@go1.26.5	1.25.13
tenureai/tenure :v1.0.28	5f5b222df9a5	stdlib@go1.26.2	1.25.13

Open the chart page →

2,563

terraform-controllerterraform-controller

0.0.20

1 of 1 See more

terraform-controller terraform-controller 0.0.20

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
absaoss/terraform-controller :v0.0.20	ad538a1285a0	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.14.8	0.55.0 1.25.13

Open the chart page →

3,538

jenkinstestchart

0.1.9

1 of 2 See more

jenkins testchart 0.1.9

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
jenkins/jenkins :2.426.1-jdk11	b470bcdc4ecd	golang.org/x/net@v0.7.0 stdlib@go1.20.6	0.55.0 1.25.13

Open the chart page →

9,119

Container images carrying it

5,324 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
daprio/dashboard :0.14.0	7ba5d51e5b97	golang.org/x/net@v0.6.0 stdlib@go1.19.13	0.55.0 1.25.13	1
daprio/injector :1.11.2	763b9b70b0c8	golang.org/x/net@v0.12.0 stdlib@go1.20.6	0.55.0 1.25.13	1
daprio/operator :1.11.2	c584428aa12d	golang.org/x/net@v0.12.0 stdlib@go1.20.6	0.55.0 1.25.13	1
daprio/placement :1.11.2	d8e1446da996	golang.org/x/net@v0.12.0 stdlib@go1.20.6	0.55.0 1.25.13	1
daprio/sentry :1.11.2	1f507c1a181b	golang.org/x/net@v0.12.0 stdlib@go1.20.6	0.55.0 1.25.13	1
darioackermann/cert-manager-webhook-regery :latest	0d450bc4acc4	golang.org/x/net@v0.26.0 stdlib@go1.22.10	0.55.0 1.25.13	1
darkobas/ethexporter :latest	62e6464491ba	stdlib@go1.19.1	1.25.13	1
darkobas/tokenexporter :latest	a0349a0eedf0	stdlib@go1.19.1	1.25.13	1
darthsim/imgproxy :v3.30.1	3b709e4a0e5e	golang.org/x/net@v0.44.0 stdlib@go1.25.1	0.55.0 1.25.13	1
darthsim/imgproxy :v3.15.0	40f6eb807444	golang.org/x/net@v0.7.0 stdlib@go1.20	0.55.0 1.25.13	1
darthsim/imgproxy :v3.26	476cb08c816a	golang.org/x/net@v0.30.0 stdlib@go1.23.2	0.55.0 1.25.13	1
darthsim/imgproxy :v3.29.1	7d12c7c8fc66	golang.org/x/net@v0.41.0 stdlib@go1.24.3	0.55.0 1.25.13	1
dashops/dash-ops :latest	23537693ff05	golang.org/x/net@v0.46.0 stdlib@go1.25.10	0.55.0 1.25.13	1
dasmeta/mongodb-bi-connector :1.0.3	fa657960dfec	stdlib@go1.16.9	1.25.13	1
datadog/agent :7.22.0	8f20e56b5311	golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e stdlib@go1.13.11	0.55.0 1.25.13	1
datadog/agent :6	aad9994de6a7	golang.org/x/net@v0.33.0 stdlib@go1.21.11	0.55.0 1.25.13	1
datadog/extendeddaemonset :v0.8.0	513a4377aed5	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.15.15	0.55.0 1.25.13	1
datadog/operator :0.3.1	17f08a860090	golang.org/x/net@v0.0.0-20200301022130-244492dfa37a stdlib@go1.15.2	0.55.0 1.25.13	1
datamate/seafile-professional :11.0.20	2dd66b722464	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.21.4	0.55.0 1.25.13	1
datappeal/hive-metastore :latest	e38c085a3567	golang.org/x/net@v0.0.0-20191112182307-2180aed22343 stdlib@go1.13.4	0.55.0 1.25.13	1
datappeal/trino-exporter :latest	325b91c2b09e	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.16.15	0.55.0 1.25.13	1
datappeal/trino-loadbalancer :sha-950abbae	6b5b9fdb2e6d	golang.org/x/net@v0.0.0-20220617184016-355a448f1bc9 stdlib@go1.17.13	0.55.0 1.25.13	1
datasaker/dsk-container-agent :latest	08b52999f67b	golang.org/x/net@v0.17.0 stdlib@go1.21.0	0.55.0 1.25.13	1
datasaker/dsk-k8s-agent :latest	2542ee73be51	golang.org/x/net@v0.17.0 stdlib@go1.19.1	0.55.0 1.25.13	1
datasaker/dsk-kube-state-agent :latest	d6d2eb48589d	golang.org/x/net@v0.17.0 stdlib@go1.21.0	0.55.0 1.25.13	1
datasaker/dsk-node-agent :latest	1b95913b6729	golang.org/x/net@v0.17.0 stdlib@go1.21.4	0.55.0 1.25.13	1
datasaker/dsk-process-agent :latest	2f38720a637d	golang.org/x/net@v0.15.0 stdlib@go1.21.0	0.55.0 1.25.13	1
datawire/aes :2.0.3-ea	07f8fe4f4f8e	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777 stdlib@go1.15	0.55.0 1.25.13	1
datawire/aes :1.13.6	2beb65062c8b	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777 stdlib@go1.15	0.55.0 1.25.13	1
datawire/aes :3.11.1	95ec30b3c732	golang.org/x/net@v0.23.0 stdlib@go1.22.4	0.55.0 1.25.13	1
datawire/ambassador-operator :v1.3.0	f95ae710d75c	golang.org/x/net@v0.0.0-20200202094626-16171245cfb2 stdlib@go1.16.5	0.55.0 1.25.13	1
datawire/emissary :3.12.2	1f67a1292d2a	golang.org/x/net@v0.28.0 stdlib@go1.22.4	0.55.0 1.25.13	1
datawire/emissary :2.0.2-ea	9716efbdd24b	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777 stdlib@go1.15	0.55.0 1.25.13	1
ddefrancesco/scoperunner-server :0.2.1	daaac6657600	stdlib@go1.21.10	1.25.13	1
ddosify/alaz :v0.12.0	ea602056d9ce	golang.org/x/net@v0.20.0 stdlib@go1.22.5	0.55.0 1.25.13	1
ddosify/selfhosted_hammer :2.0.0	181965edb12e	golang.org/x/net@v0.8.0 stdlib@go1.18.1	0.55.0 1.25.13	1
ddosify/selfhosted_hammer :1.4.2	a97a1b8a66af	golang.org/x/net@v0.8.0 stdlib@go1.18.1	0.55.0 1.25.13	1
ddvk/rmfakecloud :latest	2f5c45cbf0c5	golang.org/x/net@v0.38.0 stdlib@go1.26.3	0.55.0 1.25.13	1
deconzcommunity/deconz :2.29.2	062de2362641	stdlib@go1.19.8	1.25.13	1
deepflowce/clickhouse-server :22.8.6.71	bc1882f75c18	stdlib@go1.18.3	1.25.13	1
deepflowce/deepflowio-init-grafana :v6.2.6.5	6b51a0206b04	golang.org/x/net@v0.8.0 stdlib@go1.19.1	0.55.0 1.25.13	1
deepflowce/deepflow-server :v6.2.6.5	34fcc526dd59	golang.org/x/net@v0.7.0 stdlib@go1.18.10	0.55.0 1.25.13	1
deepflowce/mysql :8.0.31	3d7ae561cf60	stdlib@go1.16.7	1.25.13	1
defactops/defactops-ui :1.0.16	825cdf9ba706	golang.org/x/net@v0.25.0 stdlib@go1.21.10	0.55.0 1.25.13	1
deimosfr/dnsmasq-k8s :1.4.1	284c4040fc6d	golang.org/x/net@v0.47.0 stdlib@go1.25.5	0.55.0 1.25.13	1
dellemc/csm-application-mobility-controller :v0.1.0	148ada9060a9	golang.org/x/net@v0.0.0-20220822230855-b0a4917ee28c stdlib@go1.18.5	0.55.0 1.25.13	1
dellemc/csm-application-mobility-velero-plugin :v0.1.0	660cabd6d929	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.5	0.55.0 1.25.13	1
deluan/navidrome :0.49.3	11a24da08977	golang.org/x/net@v0.5.0 stdlib@go1.19.5	0.55.0 1.25.13	1
deluan/navidrome :0.50.0	2cf4442b0099	golang.org/x/net@v0.18.0 stdlib@go1.21.0	0.55.0 1.25.13	1
deluan/navidrome :0.43.0	4e9ae3bff6aa	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.16.4	0.55.0 1.25.13	1