CVE-2026-39821

High

Advisory

Published 22 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,642; of 17,813 indexed, latest versions
Container images: 5,366; deployed by those charts
Fix available: 3 of 3; affected packages

Red Hat Security Advisory: git-lfs security update

Carried by container images the latest versions of 4,642 of 17,813 indexed charts deploy, on 5,366 images.

Affected package	Affected versions	Fixed in	Images
git-lfsrpm	2.13.3-3.el8_6	0:3.4.1-11.el8_10	1
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+191 more	1.25.13	5,324
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+220 more	0.55.0	3,744

OSV records: RHSA-2026:30853 GO-2026-5026

Charts affected

4,642 by stars

Chart

Latest

Affected images

Radar Score

prometheusleechistest

11.6.0

4 of 6 See more

prometheus leechistest 11.6.0

4 of the 6 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
prom/alertmanager :v0.20.0	7e4e9f7a0954	golang.org/x/net@v0.0.0-20190724013045-ca1201d0de80 stdlib@go1.13.5	0.55.0 1.25.13
prom/prometheus :v2.19.0	bfad037f95e5	golang.org/x/net@v0.0.0-20200602114024-627f9648deb9 stdlib@go1.14.4	0.55.0 1.25.13
prom/pushgateway :v1.2.0	0a9031142481	stdlib@go1.13.8	1.25.13
quay.io/prometheus/node-exporter :v1.0.1	cf66a6bbd573	golang.org/x/net@v0.0.0-20200513185701-a91f0712d120 stdlib@go1.14.4	0.55.0 1.25.13

Open the chart page →

8,495

kube-benchlemontech

0.1.0

1 of 1 See more

kube-bench lemontech 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
aquasec/kube-bench :v0.6.9	c329d73fea58	stdlib@go1.19	1.25.13

Open the chart page →

1,633

trivy-serverlemontech

0.1.0

1 of 1 See more

trivy-server lemontech 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
aquasec/trivy :0.32.0	973d0df16189	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.19	0.55.0 1.25.13

Open the chart page →

4,282

adguard-homelib42

2.0.0

1 of 1 See more

adguard-home lib42 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
adguard/adguardhome :v0.107.65	d765078d2140	golang.org/x/net@v0.43.0 stdlib@go1.24.6	0.55.0 1.25.13

Open the chart page →

1,206

libredb-studiolibredb-studio-oci

0.1.66

1 of 1 See more

libredb-studio libredb-studio-oci 0.1.66

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/libredb/libredb-studio :0.16.1	1d0aa4f090ac	stdlib@go1.24.4	1.25.13

Open the chart page →

1,200

librenmslibrenms

10.1.2

2 of 5 See more

librenms librenms 10.1.2

2 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/mysql :9.7.2	29abb0a17998	stdlib@go1.24.6	1.25.13
librenms/librenms :26.8.2	8194a4a9ff49	stdlib@go1.24.6	1.25.13

Open the chart page →

2,748

kltlifecycle-toolkit

0.2.6

4 of 4 See more

klt lifecycle-toolkit 0.2.6

4 of the 4 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/keptn/certificate-operator :v1.1.0	8fdd311a6d33	golang.org/x/net@v0.14.0 stdlib@go1.20.4	0.55.0 1.25.13
ghcr.io/keptn/lifecycle-operator :v0.8.2	487bfc37c4b4	golang.org/x/net@v0.14.0 stdlib@go1.20.4	0.55.0 1.25.13
ghcr.io/keptn/metrics-operator :v0.8.2	acf22310e9dd	golang.org/x/net@v0.14.0 stdlib@go1.20.4	0.55.0 1.25.13
ghcr.io/keptn/scheduler :v0.8.2	0f7d277bb2b2	golang.org/x/net@v0.14.0 stdlib@go1.20.4	0.55.0 1.25.13

Open the chart page →

4,696

kube-iptables-tailerlifen

0.2.3

1 of 1 See more

kube-iptables-tailer lifen 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
honestica/kube-iptables-tailer :master-91	a393242fb939	golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb stdlib@go1.13.8	0.55.0 1.25.13

Open the chart page →

4,481

op-scim-bridgelifen

1.0.3

1 of 2 See more

op-scim-bridge lifen 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
1password/scim :v2.3.1	29d0c6cb67eb	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.16.8	0.55.0 1.25.13

Open the chart page →

2,788

op-scim-bridgelifen-charts

1.0.3

1 of 2 See more

op-scim-bridge lifen-charts 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
1password/scim :v2.3.1	29d0c6cb67eb	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.16.8	0.55.0 1.25.13

Open the chart page →

2,788

lightsteplightstep-microsat

2.0.21

1 of 1 See more

lightstep lightstep-microsat 2.0.21

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
lightstep/microsatellite :2024-01-22_17-52-59Z	c800e05e1eff	golang.org/x/net@v0.20.0 stdlib@go1.22.1	0.55.0 1.25.13

Open the chart page →

1,135

komgalinkding

0.2.3

1 of 1 See more

komga linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
gotson/komga :1.22.0	ba892ab3e082	stdlib@go1.17.8	1.25.13

Open the chart page →

3,125

linkerd-preview-vizlinkerd-buoyant

25.4.3

4 of 5 See more

linkerd-preview-viz linkerd-buoyant 25.4.3

4 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/buoyantio/metrics-api :preview-25.4.3	2cef2a3f97da	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.55.0 1.25.13
ghcr.io/buoyantio/prometheus :v2.55.1	2659f4c2ebb7	golang.org/x/net@v0.28.0 stdlib@go1.23.2	0.55.0 1.25.13
ghcr.io/buoyantio/tap :preview-25.4.3	e02a8bd9e2c3	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.55.0 1.25.13
ghcr.io/buoyantio/web :preview-25.4.3	3ee1b62aa111	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.55.0 1.25.13

Open the chart page →

3,464

linkerd-dashboardlinkerd-dashboard

0.11.1

2 of 2 See more

linkerd-dashboard linkerd-dashboard 0.11.1

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/buoyantio/linkerd-dashboard-server :0.11.1	dd6a29588242	stdlib@go1.26.5	1.25.13
ghcr.io/buoyantio/prometheus :v3.3.1	e2b8aa62b648	golang.org/x/net@v0.35.0 stdlib@go1.24.2	0.55.0 1.25.13

Open the chart page →

1,060

linode-blockstorage-csi-driverlinode-blockstorage-csi-driver

1.1.4

5 of 5 See more

linode-blockstorage-csi-driver linode-blockstorage-csi-driver 1.1.4

5 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
linode/linode-blockstorage-csi-driver :v1.1.4	09f3282bf53d	stdlib@go1.26.5	1.25.13
registry.k8s.io/sig-storage/csi-attacher :v4.11.0	b74b05b39501	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.55.0 1.25.13
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.16.0	ab482308a492	golang.org/x/net@v0.49.0 stdlib@go1.25.7	0.55.0 1.25.13
registry.k8s.io/sig-storage/csi-provisioner :v6.2.0	6be9f63ca4ca	golang.org/x/net@v0.51.0 stdlib@go1.25.7	0.55.0 1.25.13
registry.k8s.io/sig-storage/csi-resizer :v2.1.0	589e525cddef	golang.org/x/net@v0.48.0 stdlib@go1.25.7	0.55.0 1.25.13

Open the chart page →

2,999

ccm-linodelinode-cloud-controller-manager

0.9.8

1 of 1 See more

ccm-linode linode-cloud-controller-manager 0.9.8

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
linode/linode-cloud-controller-manager :v0.9.8	cd8c17512206	stdlib@go1.26.4	1.25.13

Open the chart page →

167

school-botlinuxoid69

0.1.0

1 of 1 See more

school-bot linuxoid69 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/linuxoid69/school-bot :v0.3.3	c8872438f1e0	stdlib@go1.23.3	1.25.13

Open the chart page →

772

liqo-upgrade-operatorliqo-upgrade-operator

0.1.0

1 of 1 See more

liqo-upgrade-operator liqo-upgrade-operator 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
kazem26/liqo-upgrade-operator :v0.1	268b7c6a59dd	golang.org/x/net@v0.38.0 stdlib@go1.24.13	0.55.0 1.25.13

Open the chart page →

382

listmonklistmonk-chart

2.0.1

2 of 2 See more

listmonk listmonk-chart 2.0.1

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :15	9b1d34adbce1	stdlib@go1.24.6	1.25.13
listmonk/listmonk :v6.0.0	bf3903d54a46	golang.org/x/net@v0.47.0 stdlib@go1.24.1	0.55.0 1.25.13

Open the chart page →

3,143

pocketbase-halitesql

0.0.3

1 of 1 See more

pocketbase-ha litesql 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/litesql/pocketbase-ha :latest	c5b28608958b	stdlib@go1.26.5	1.25.13

Open the chart page →

1,170

ingresslivekit-server

1.2.2

1 of 1 See more

ingress livekit-server 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
livekit/ingress :v1.2.2	1ab01641b366	golang.org/x/net@v0.18.0 stdlib@go1.20.7	0.55.0 1.25.13

Open the chart page →

10,844

livekit-recorderlivekit-server

0.3.13

1 of 1 See more

livekit-recorder livekit-server 0.3.13

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
livekit/livekit-recorder :v0.3.13	ecf1409c75e0	golang.org/x/net@v0.0.0-20211004195052-b30845b58a23 stdlib@go1.16.2	0.55.0 1.25.13

Open the chart page →

2,136

livekit-serverlivekit-server

1.9.0

1 of 1 See more

livekit-server livekit-server 1.9.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
livekit/livekit-server :v1.9.0	3602a85840d5	golang.org/x/net@v0.40.0 stdlib@go1.24.3	0.55.0 1.25.13

Open the chart page →

1,562

pagesliviu884422-pages

1.0.0

1 of 3 See more

pages liviu884422-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.25.13

Open the chart page →

20,285

llmarinerllmariner

1.53.1

15 of 21 See more

llmariner llmariner 1.53.1

15 of the 21 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
public.ecr.aws/cloudnatix/llmariner/api-usage-cleaner :1.16.0	d47f43484055	stdlib@go1.23.12	1.25.13
public.ecr.aws/cloudnatix/llmariner/api-usage-server :1.16.0	8f9c32b866b0	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/cluster-manager-server :1.8.0	364b3ff0fcb7	golang.org/x/net@v0.38.0 stdlib@go1.24.5	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/cluster-monitor-server :0.10.2	2d28f9e3eab4	golang.org/x/net@v0.38.0 stdlib@go1.23.11	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/database-creator :1.17.0	97065ced2942	stdlib@go1.23.11	1.25.13
public.ecr.aws/cloudnatix/llmariner/file-manager-server :1.11.0	301216788e93	golang.org/x/net@v0.38.0 stdlib@go1.23.11	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/inference-manager-engine :1.46.0	c46f109c3d0b	golang.org/x/net@v0.48.0 stdlib@go1.25.9	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/inference-manager-server :1.45.0	90b890f800ab	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/job-manager-dispatcher :1.27.0	582508903cb0	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/job-manager-server :1.27.0	fe9de719f91e	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/model-manager-loader :1.27.0	26ac7263a823	golang.org/x/net@v0.38.0 stdlib@go1.24.0	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/model-manager-server :1.27.0	c057dcdd9ef3	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/rbac-server :1.19.1	df1adeb86679	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/session-manager-server :1.9.0	f24ecd37fbaa	golang.org/x/net@v0.38.0 stdlib@go1.23.11	0.55.0 1.25.13
public.ecr.aws/cloudnatix/llmariner/user-manager-server :1.27.1	628a14449241	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13

Open the chart page →

12,185

llm-dllm-d

1.0.23

1 of 2 See more

llm-d llm-d 1.0.23

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/llm-d/llm-d-model-service :v0.0.15	8b99a8104a2f	golang.org/x/net@v0.40.0 stdlib@go1.24.3	0.55.0 1.25.13

Open the chart page →

2,564

home-assistantlmatfy

0.1.38

1 of 1 See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
homeassistant/home-assistant :2026.7	5a531753cea9	golang.org/x/net@v0.49.0 stdlib@go1.25.6	0.55.0 1.25.13

Open the chart page →

2,488

go-ocpp-serverloafoe

0.2.1

1 of 1 See more

go-ocpp-server loafoe 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/go-ocpp-server :v0.2.1	45bb960674ab	stdlib@go1.21.13	1.25.13

Open the chart page →

399

mcp-notifierloafoe

0.2.0

1 of 1 See more

mcp-notifier loafoe 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/mcp-notifier :v0.2.0	ea958b832415	stdlib@go1.26.4	1.25.13

Open the chart page →

mt-mcp-grafanaloafoe

0.10.0

2 of 2 See more

mt-mcp-grafana loafoe 0.10.0

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
grafana/mcp-grafana :0.14.0	42f541f22063	golang.org/x/net@v0.53.0 stdlib@go1.26.3	0.55.0 1.25.13
ghcr.io/loafoe/mt-mcp-grafana :v0.1.1	2332d9b47475	stdlib@go1.26.2	1.25.13

Open the chart page →

1,988

mt-mcp-proxyloafoe

0.3.0

1 of 2 See more

mt-mcp-proxy loafoe 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/mt-mcp-proxy :v0.1.0	221835f9340f	stdlib@go1.26.4	1.25.13

Open the chart page →

505

otlp-gatewayloafoe

0.0.2

2 of 2 See more

otlp-gateway loafoe 0.0.2

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/jimmidyson/configmap-reload :v0.13.1	ca0c14eef541	stdlib@go1.22.4	1.25.13
ghcr.io/loafoe/caddy-token :v0.3.0	528f2174fa2f	golang.org/x/net@v0.27.0 stdlib@go1.22.5	0.55.0 1.25.13

Open the chart page →

2,180

patch-operatorloafoe

0.11.3

1 of 2 See more

patch-operator loafoe 0.11.3

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/redhat-cop/kube-rbac-proxy :v0.11.0	c68135620167	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.15.15	0.55.0 1.25.13

Open the chart page →

4,912

picoclawloafoe

0.1.1

1 of 2 See more

picoclaw loafoe 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/picoclaw :v0.0.19	42e1b6862913	golang.org/x/net@v0.53.0 stdlib@go1.26.2	0.55.0 1.25.13

Open the chart page →

479

solgateloafoe

0.0.12

1 of 1 See more

solgate loafoe 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/solgate :v0.0.12	b3256cbc7b68	golang.org/x/net@v0.14.0 stdlib@go1.21.0	0.55.0 1.25.13

Open the chart page →

2,126

tempo-distributedloafoe

1.20.1

1 of 2 See more

tempo-distributed loafoe 1.20.1

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
grafana/tempo :2.6.0	f55a8a1937ff	golang.org/x/net@v0.27.0 stdlib@go1.22.6	0.55.0 1.25.13

Open the chart page →

2,038

local-path-exporterlocal-path-exporter

0.2.3

1 of 1 See more

local-path-exporter local-path-exporter 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/tmusial99/local-path-exporter :1.1.0	82476692c680	stdlib@go1.26.4	1.25.13

Open the chart page →

weather-app-chartlocal-weatherapp

0.1.0

2 of 4 See more

weather-app-chart local-weatherapp 0.1.0

2 of the 4 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
bitnamilegacy/mysql :8.0.36-debian-11-r3	8aad73aa0c6d	stdlib@go1.21.6	1.25.13
youssef11gaber10/deployment-auth-go :latest	6597b26959d2	golang.org/x/net@v0.10.0 stdlib@go1.26.1	0.55.0 1.25.13

Open the chart page →

5,915

ocatiecataloguslocatiecatalogus

1.0.0

1 of 3 See more

ocatiecatalogus locatiecatalogus 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/ocatiecatalogus-php :latest	c22764cbfa97	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.55.0 1.25.13

Open the chart page →

7,521

locust-pluginslocust-plugins

0.0.4

2 of 3 See more

locust-plugins locust-plugins 0.0.4

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
sky5367/locust-plugins-grafana :latest	d51bf68d4b26	golang.org/x/net@v0.22.0 stdlib@go1.21.8	0.55.0 1.25.13
sky5367/locust-plugins-timescale :latest	d3150f201471	stdlib@go1.18.7	1.25.13

Open the chart page →

7,581

uptime-kumaloeken-at-home

2.3.2

1 of 1 See more

uptime-kuma loeken-at-home 2.3.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :2.3.2	9aeb4e51d038	golang.org/x/net@v0.40.0 stdlib@go1.20.5	0.55.0 1.25.13

Open the chart page →

33,925

central-hostpath-mapperloft

0.2.9

1 of 1 See more

central-hostpath-mapper loft 0.2.9

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/central-hostpath-mapper :0.2.9	fa6dba122171	golang.org/x/net@v0.26.0 stdlib@go1.23.2	0.55.0 1.25.13

Open the chart page →

931

devpod-proloft

0.0.0-ci.4-do-not-use

1 of 1 See more

devpod-pro loft 0.0.0-ci.4-do-not-use

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/devpod-pro :0.0.0-ci.4-do-not-use	5dfa86b6451f	golang.org/x/net@v0.21.0 stdlib@go1.20.10	0.55.0 1.25.13

Open the chart page →

3,242

devspace-cloudloft

0.3.3

2 of 8 See more

devspace-cloud loft 0.3.3

2 of the 8 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
devspacecloud/manager :0.3.3	49c397413f7b	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.8	0.55.0 1.25.13
library/postgres :11	5d2aa4a7b5f9	stdlib@go1.16.7	1.25.13

Open the chart page →

9,893

kioskloft

0.2.11

1 of 1 See more

kiosk loft 0.2.11

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
kiosksh/kiosk :0.2.11	501725ba2025	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.15.7	0.55.0 1.25.13

Open the chart page →

3,096

license-serverloft

0.6.0

1 of 1 See more

license-server loft 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/license-server :0.6.0	69ce001bb4b0	golang.org/x/net@v0.53.0 stdlib@go1.24.3	0.55.0 1.25.13

Open the chart page →

804

loft-agentloft

3.2.4

1 of 1 See more

loft-agent loft 3.2.4

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/agent :3.2.4	5c109914ff73	golang.org/x/net@v0.6.0 stdlib@go1.18.10	0.55.0 1.25.13

Open the chart page →

2,460

loft-direct-cluster-endpointloft

1.14.0

1 of 1 See more

loft-direct-cluster-endpoint loft 1.14.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
loftsh/directclusterendpoint :1.14.0	310cc7d690f5	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.16.6	0.55.0 1.25.13

Open the chart page →

3,120

vcluster-control-planeloft

0.0.0-ci.4-do-not-use

1 of 1 See more

vcluster-control-plane loft 0.0.0-ci.4-do-not-use

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/vcluster-control-plane :0.0.0-ci.4-do-not-use	45e744fc623f	golang.org/x/net@v0.21.0 stdlib@go1.22.0	0.55.0 1.25.13

Open the chart page →

3,242

vcluster-headloft

0.0.0-035ec6e

1 of 2 See more

vcluster-head loft 0.0.0-035ec6e

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/kubernetes :v1.35.0	90097a08b87c	golang.org/x/net@v0.42.0 stdlib@go1.24.11	0.55.0 1.25.13

Open the chart page →

1,309

Container images carrying it

5,366 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
gocrane/crane-scheduler-controller :0.1.23	a2d7e60576f9	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.17.2	0.55.0 1.25.13	1
gogs/gogs :0.12.3	0195b095d0b2	golang.org/x/net@v0.0.0-20191014212845-da9a3fd4c582 stdlib@go1.14.7	0.55.0 1.25.13	1
gogs/gogs :0.12.1	420d53bb7277	golang.org/x/net@v0.0.0-20191014212845-da9a3fd4c582 stdlib@go1.14.7	0.55.0 1.25.13	1
goharbor/chartmuseum-photon :v2.5.3	6ab3ca28e9e5	golang.org/x/net@v0.0.0-20220121210141-e204ce36a2ba stdlib@go1.17.7	0.55.0 1.25.13	1
goharbor/harbor-acceld :0.2.13	451103a6c8d8	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.55.0 1.25.13	1
goharbor/harbor-core :v2.9.0	6412d679fdc3	golang.org/x/net@v0.10.0 stdlib@go1.20.7	0.55.0 1.25.13	1
goharbor/harbor-core :v2.5.3	86bf3031f4a7	golang.org/x/net@v0.0.0-20211013171255-e13a2654a71e stdlib@go1.17.7	0.55.0 1.25.13	1
goharbor/harbor-core :v2.14.3	a30e5a8be3d9	golang.org/x/net@v0.47.0 stdlib@go1.24.13	0.55.0 1.25.13	1
goharbor/harbor-core :v2.11.1	c017dd84ee96	golang.org/x/net@v0.24.0 stdlib@go1.22.6	0.55.0 1.25.13	1
goharbor/harbor-jobservice :v2.9.0	39435daedd0c	golang.org/x/net@v0.10.0 stdlib@go1.20.7	0.55.0 1.25.13	1
goharbor/harbor-jobservice :v2.5.3	8d5339ff2d74	golang.org/x/net@v0.0.0-20211013171255-e13a2654a71e stdlib@go1.17.7	0.55.0 1.25.13	1
goharbor/harbor-jobservice :v2.14.3	e2b0298e894d	golang.org/x/net@v0.47.0 stdlib@go1.24.13	0.55.0 1.25.13	1
goharbor/harbor-registryctl :v2.5.3	7f82ed1e2635	golang.org/x/net@v0.0.0-20211013171255-e13a2654a71e stdlib@go1.17.7	0.55.0 1.25.13	1
goharbor/harbor-registryctl :v2.9.0	cce272836449	golang.org/x/net@v0.10.0 stdlib@go1.20.7	0.55.0 1.25.13	1
goharbor/harbor-registryctl :v2.14.3	ddf6bb429eb6	golang.org/x/net@v0.47.0 stdlib@go1.24.13	0.55.0 1.25.13	1
goharbor/notary-server-photon :v2.5.3	fd91a4a1273f	golang.org/x/net@v0.0.0-20200202094626-16171245cfb2 stdlib@go1.14.15	0.55.0 1.25.13	1
goharbor/notary-signer-photon :v2.5.3	a92b51aa7d6e	golang.org/x/net@v0.0.0-20200202094626-16171245cfb2 stdlib@go1.14.15	0.55.0 1.25.13	1
goharbor/registry-photon :v2.11.1	5645d459af2b	stdlib@go1.22.6	1.25.13	1
goharbor/registry-photon :v2.14.3	6533fc396cbc	stdlib@go1.24.13	1.25.13	1
goharbor/registry-photon :v2.9.0	8a26e8cb7862	stdlib@go1.20.7	1.25.13	1
goharbor/trivy-adapter-photon :v2.14.3	5c6f7162804c	golang.org/x/net@v0.28.0 stdlib@go1.25.7	0.55.0 1.25.13	1
goharbor/trivy-adapter-photon :v2.5.3	b9522c3f5056	golang.org/x/net@v0.0.0-20211108170745-6635138e15ea stdlib@go1.18.3	0.55.0 1.25.13	1
goharbor/trivy-adapter-photon :v2.9.0	dc5b882a7db4	golang.org/x/net@v0.12.0 stdlib@go1.20.7	0.55.0 1.25.13	1
golift/unifi-poller :v2.9.5	486a63339969	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.55.0 1.25.13	1
golift/unifi-poller :v2.9.2	585a29a06d05	golang.org/x/net@v0.15.0 stdlib@go1.21.0	0.55.0 1.25.13	1
golift/unifi-poller :2.0.0	cafac968b540	golang.org/x/net@v0.0.0-20200202094626-16171245cfb2 stdlib@go1.13.7	0.55.0 1.25.13	1
gomods/athens :v0.17.1	0f61d1e62359	golang.org/x/net@v0.52.0 stdlib@go1.25.9	0.55.0 1.25.13	1
gomods/athens :v0.18.1	97cc113b34b0	stdlib@go1.24.1	1.25.13	1
gomods/athens :v0.8.1	d714c7ff0231	golang.org/x/net@v0.0.0-20191027093000-83d349e8ac1a stdlib@go1.13.4	0.55.0 1.25.13	1
goofball222/pritunl :1.32.3602.80	7bf26032dfce	golang.org/x/net@v0.7.0 stdlib@go1.18.7	0.55.0 1.25.13	1
gophish/gophish :0.12.1	8a57cd171999	golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3 stdlib@go1.15.2	0.55.0 1.25.13	1
gotenberg/gotenberg :8.30	206a6c708fc6	golang.org/x/net@v0.52.0 stdlib@go1.26.0	0.55.0 1.25.13	1
gotenberg/gotenberg :8.34	67097317623a	stdlib@go1.26.2	1.25.13	1
gotenberg/gotenberg :8-chromium	a40f92d7419a	stdlib@go1.26.5	1.25.13	1
gotenberg/gotenberg :8.0.1	cf0b9a7ca3cf	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.55.0 1.25.13	1
gotify/server :2.1.4	09c79bc1e403	golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110 stdlib@go1.16	0.55.0 1.25.13	1
gotify/server :2.9.1	a3af47067ce6	golang.org/x/net@v0.48.0 stdlib@go1.26.0	0.55.0 1.25.13	1
gotify/server-arm7 :2.0.23	d91e302ad1d0	golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110 stdlib@go1.16	0.55.0 1.25.13	1
gotson/komga :1.22.0	ba892ab3e082	stdlib@go1.17.8	1.25.13	1
gradiant/open5gs-dbctl :0.10.3	332031245fce	golang.org/x/net@v0.34.0 stdlib@go1.22.11	0.55.0 1.25.13	1
grafana/agent :v0.44.2	3364714a2f64	golang.org/x/net@v0.33.0 stdlib@go1.22.11	0.55.0 1.25.13	1
grafana/agent :v0.20.0	825c09373d27	golang.org/x/net@v0.0.0-20210917221730-978cfadd31cf stdlib@go1.16	0.55.0 1.25.13	1
grafana/agent :v0.40.3	f6cbec9409be	golang.org/x/net@v0.20.0 stdlib@go1.22.1	0.55.0 1.25.13	1
grafana/agent-operator :v0.34.1	045c9125634c	golang.org/x/net@v0.10.0 stdlib@go1.20.4	0.55.0 1.25.13	1
grafana/alloy :v1.5.1	01a63f4e032c	golang.org/x/net@v0.31.0 stdlib@go1.22.7	0.55.0 1.25.13	1
grafana/alloy :v1.4.3	06bdcbb51fc2	golang.org/x/net@v0.29.0 stdlib@go1.22.7	0.55.0 1.25.13	1
grafana/alloy :v1.18.1	0f4434c92b3e	stdlib@go1.26.5	1.25.13	1
grafana/alloy :v1.18.0	491b0578c049	stdlib@go1.26.5	1.25.13	1
grafana/alloy :v1.16.3	84b76d56c594	stdlib@go1.26.3	1.25.13	1
grafana/alloy :v1.11.3	8c7256f412fe	golang.org/x/net@v0.43.0 stdlib@go1.24.6	0.55.0 1.25.13	1