CVE-2026-39821

High

Advisory

Published 22 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,535; of 17,792 indexed, latest versions
Container images: 5,293; deployed by those charts
Fix available: 3 of 3; affected packages

Red Hat Security Advisory: git-lfs security update

Carried by container images the latest versions of 4,535 of 17,792 indexed charts deploy, on 5,293 images.

Affected package	Affected versions	Fixed in	Images
git-lfsrpm	2.13.3-3.el8_6	0:3.4.1-11.el8_10	1
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+189 more	1.25.13	5,256
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+220 more	0.55.0	3,684

OSV records: RHSA-2026:30853 GO-2026-5026

Charts affected

4,535 by stars

Chart

Latest

Affected images

Radar Score

multicaicoretech

0.4.43

2 of 5 See more

multica icoretech 0.4.43

2 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :18-alpine	d3e1620b530c	stdlib@go1.24.6	1.25.13
pgvector/pgvector :pg17	cf134a767f47	stdlib@go1.24.6	1.25.13

Open the chart page →

2,612

tolgeeicoretech

0.49.0

2 of 3 See more

tolgee icoretech 0.49.0

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :18.3	69e8582b781c	stdlib@go1.24.6	1.25.13
tolgee/tolgee :v3.224.0	60392077cbda	stdlib@go1.24.6	1.25.13

Open the chart page →

2,769

monitoring-stackict-platform

0.4.0

10 of 13 See more

monitoring-stack ict-platform 0.4.0

10 of the 13 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
grafana/loki :3.6.7	3c8fd3570dd9	golang.org/x/net@v0.47.0 stdlib@go1.24.13	0.55.0 1.25.13
prom/memcached-exporter :v0.15.4	b6763ecb3c47	golang.org/x/net@v0.44.0 stdlib@go1.25.3	0.55.0 1.25.13
ghcr.io/grafana/alloy-operator :1.7.0	2ce23f948e02	golang.org/x/net@v0.46.0 stdlib@go1.24.10	0.55.0 1.25.13
ghcr.io/grafana/grafana-operator :v5.22.2	d45fc24e8f43	golang.org/x/net@v0.51.0 stdlib@go1.26.1	0.55.0 1.25.13
ghcr.io/grafana/helm-chart-toolbox-kubectl :0.1.2	c7adcc4db378	golang.org/x/net@v0.30.0 stdlib@go1.24.9	0.55.0 1.25.13
ghcr.io/jkroepke/kube-webhook-certgen :1.8.0	43401e216e89	golang.org/x/net@v0.52.0 stdlib@go1.26.1	0.55.0 1.25.13
quay.io/prometheus-operator/prometheus-operator :v0.90.1	52a6a92d915e	golang.org/x/net@v0.52.0 stdlib@go1.25.8	0.55.0 1.25.13
quay.io/prometheus/node-exporter :v1.11.1	0f422f62c15f	golang.org/x/net@v0.52.0 stdlib@go1.26.1	0.55.0 1.25.13
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.18.0	1545919b72e3	golang.org/x/net@v0.48.0 stdlib@go1.25.5	0.55.0 1.25.13
registry.k8s.io/kubectl :v1.31.0	99b37df34bc4	golang.org/x/net@v0.26.0 stdlib@go1.22.5	0.55.0 1.25.13

Open the chart page →

9,629

ingress-nginxifmethod-helm-charts

4.12.1

2 of 2 See more

ingress-nginx ifmethod-helm-charts 4.12.1

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
registry.k8s.io/ingress-nginx/controller :v1.12.1	d2fbc4ec70d8	golang.org/x/net@v0.37.0 stdlib@go1.24.1	0.55.0 1.25.13
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.5.2	e8825994b7a2	golang.org/x/net@v0.37.0 stdlib@go1.24.1	0.55.0 1.25.13

Open the chart page →

1,477

eoloserverihuertas2021-vmartinp2021-helm

0.1.0

3 of 7 See more

eoloserver ihuertas2021-vmartinp2021-helm 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
codeurjc/toposervice :v1.0	9fb4c11e6a49	golang.org/x/net@v0.7.0 stdlib@go1.18.10	0.55.0 1.25.13
library/mongo :5.0.6-focal	8e70544b6c76	stdlib@go1.16.7	1.25.13
library/mysql :8.0.28	fc77d54cacef	stdlib@go1.16.7	1.25.13

Open the chart page →

27,861

bluesky-pdsijmacd

1.0.0

2 of 2 See more

bluesky-pds ijmacd 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
arunvelsriram/utils :latest	655ad18fd8d6	golang.org/x/net@v0.24.0 stdlib@go1.23.8	0.55.0 1.25.13
ghcr.io/bluesky-social/pds :0.4	d95725b24dbe	stdlib@go1.25.10	1.25.13

Open the chart page →

9,062

ikigaiikigai-chart

0.0.9

3 of 58 See more

ikigai ikigai-chart 0.0.9

3 of the 58 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
kuberay/operator :v1.0.0	4e6ac8a3a2c4	golang.org/x/net@v0.17.0 stdlib@go1.19.13	0.55.0 1.25.13
rabbitmqoperator/cluster-operator :2.6.0	8651dd3cec51	golang.org/x/net@v0.18.0 stdlib@go1.20.11	0.55.0 1.25.13
mcr.microsoft.com/azure-application-gateway/kubernetes-ingress :1.6.0	bccaa701e2df	golang.org/x/net@v0.0.0-20220802222814-0bcc04d9c69b stdlib@go1.17.3	0.55.0 1.25.13

Open the chart page →

37,983

ilum-apiilum

6.7.3

1 of 1 See more

ilum-api ilum 6.7.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ilum/api :6.7.3	624fd09528c8	golang.org/x/net@v0.37.0 stdlib@go1.23.7	0.55.0 1.25.13

Open the chart page →

2,203

ilum-jupyterhubilum

4.3.1

1 of 6 See more

ilum-jupyterhub ilum 4.3.1

1 of the 6 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
registry.k8s.io/kube-scheduler :v1.30.14	74a5cf9cfa9f	golang.org/x/net@v0.23.0 stdlib@go1.23.10	0.55.0 1.25.13

Open the chart page →

1,843

ilum-otel-collectorilum

0.1.0

1 of 1 See more

ilum-otel-collector ilum 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
otel/opentelemetry-collector-contrib :0.113.0	5ac3e0ba2b0b	golang.org/x/net@v0.30.0 stdlib@go1.23.2	0.55.0 1.25.13

Open the chart page →

1,400

plausible-analyticsimio

0.4.2

1 of 5 See more

plausible-analytics imio 0.4.2

1 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :17.6-alpine	ef257d85f76e	stdlib@go1.24.6	1.25.13

Open the chart page →

10,558

apexkube-agentimprowised

1.4.0

1 of 2 See more

apexkube-agent improwised 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
masipcat/wireguard-go :0.0.20230223	769f7bb64694	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.20.14	0.55.0 1.25.13

Open the chart page →

3,360

frigateimprowised

1.1.0

1 of 1 See more

frigate improwised 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/blakeblackshear/frigate :0.13.0	7a5244e4c8dc	golang.org/x/net@v0.8.0 stdlib@go1.20.3	0.55.0 1.25.13

Open the chart page →

2,160

kore-boardimprowised

0.5.8

3 of 4 See more

kore-board improwised 0.5.8

3 of the 4 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/kore3lab/kore-board.backend :v0.5.5	455f6e7a26fd	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.19.4	0.55.0 1.25.13
ghcr.io/kore3lab/kore-board.metrics-scraper :v0.5.5	47f88b18fb7c	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.19.4	0.55.0 1.25.13
ghcr.io/kore3lab/kore-board.terminal :v0.5.5	f52e66eff50b	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.18.9	0.55.0 1.25.13

Open the chart page →

16,253

fpga-cloudinaccel

1.2.2

3 of 3 See more

fpga-cloud inaccel 1.2.2

3 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
inaccel/cloud-init :latest	a5d3d0af05c1	golang.org/x/net@v0.19.0 stdlib@go1.21.6	0.55.0 1.25.13
inaccel/device-selector :latest	44b4f274f40b	golang.org/x/net@v0.21.0 stdlib@go1.21.9	0.55.0 1.25.13
inaccel/kubevirt-hack :latest	bdfd61803a70	golang.org/x/net@v0.19.0 stdlib@go1.21.7	0.55.0 1.25.13

Open the chart page →

3,166

fpga-operatorinaccel

2.8.2

3 of 7 See more

fpga-operator inaccel 2.8.2

3 of the 7 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
inaccel/daemon :latest	093e1ea90ab8	golang.org/x/net@v0.19.0 stdlib@go1.21.6	0.55.0 1.25.13
inaccel/mkrt :latest	187fd448b6f2	stdlib@go1.21.5	1.25.13
inaccel/reef :latest	c967218739f3	golang.org/x/net@v0.19.0 stdlib@go1.21.6	0.55.0 1.25.13

Open the chart page →

5,771

infisicalinfisical-charts

0.4.2

1 of 3 See more

infisical infisical-charts 0.4.2

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
infisical/infisical :latest	02082bf13163	stdlib@go1.25.12	1.25.13

Open the chart page →

3,055

infisical-agent-injectorinfisical-charts

0.1.12

1 of 1 See more

infisical-agent-injector infisical-charts 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
infisical/infisical-agent-injector :v0.1.12	718dd5bee7cb	golang.org/x/net@v0.38.0 stdlib@go1.24.13	0.55.0 1.25.13

Open the chart page →

761

infisical-csi-providerinfisical-charts

0.2.3

1 of 1 See more

infisical-csi-provider infisical-charts 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
infisical/infisical-csi-provider :v0.0.9	e3390e677db6	golang.org/x/net@v0.33.0 stdlib@go1.24.13	0.55.0 1.25.13

Open the chart page →

636

infisical-gatewayinfisical-charts

1.4.0

1 of 1 See more

infisical-gateway infisical-charts 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
infisical/cli :0.43.123	0941c1293b77	stdlib@go1.25.12	1.25.13

Open the chart page →

293

infisical-pki-issuerinfisical-charts

1.0.0

1 of 1 See more

infisical-pki-issuer infisical-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
infisical/pki-issuer :latest	ff38294270e3	golang.org/x/net@v0.49.0 stdlib@go1.24.13	0.55.0 1.25.13

Open the chart page →

573

chronografinfluxdata

1.2.6

1 of 1 See more

chronograf influxdata 1.2.6

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/chronograf :1.9.4	96d8a3f65a4f	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e stdlib@go1.16.4	0.55.0 1.25.13

Open the chart page →

2,205

influxdb-enterpriseinfluxdata

0.2.1

2 of 2 See more

influxdb-enterprise influxdata 0.2.1

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/influxdb :1.12.3-meta	8812029260b5	stdlib@go1.24.13	1.25.13
library/influxdb :1.12.3-data	b0f9fc41ed79	golang.org/x/net@v0.47.0 stdlib@go1.24.13	0.55.0 1.25.13

Open the chart page →

5,988

influxdbinfluxdb2

0.1.0

1 of 1 See more

influxdb influxdb2 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/influxdb :latest	f75e48af0598	golang.org/x/net@v0.51.0 stdlib@go1.25.8	0.55.0 1.25.13

Open the chart page →

2,362

dtlinfradao

0.0.1

1 of 1 See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ethereumoptimism/data-transport-layer :0.5.56	e07968a0e686	stdlib@go1.19.3	1.25.13

Open the chart page →

4,945

erigoninfradao

0.0.5

1 of 2 See more

erigon infradao 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
testinprod/op-erigon :latest	0a125bd77a2d	golang.org/x/net@v0.33.0 stdlib@go1.22.12	0.55.0 1.25.13

Open the chart page →

2,905

l2gethinfradao

0.0.1

1 of 1 See more

l2geth infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ethereumoptimism/l2geth :0.5.31	5577036dc36d	golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2 stdlib@go1.18	0.55.0 1.25.13

Open the chart page →

2,659

infrafence-agentinfrafence-agent

0.6.0

1 of 1 See more

infrafence-agent infrafence-agent 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/infrafence/infrafence-agent :1.0.0	d22095ee8a1a	golang.org/x/net@v0.47.0	0.55.0

Open the chart page →

registry-container-webhookinnago

2.0.2

1 of 1 See more

registry-container-webhook innago 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/indeedeng/harbor-container-webhook :main	45ca15fc294f	golang.org/x/net@v0.37.0 stdlib@go1.24.1	0.55.0 1.25.13

Open the chart page →

600

cloudshellinseefrlab

4.3.0

1 of 2 See more

cloudshell inseefrlab 4.3.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
inseefrlab/shelly :cloudshell	31f04ca7436b	golang.org/x/net@v0.13.0 stdlib@go1.15.7	0.55.0 1.25.13

Open the chart page →

10,575

lakefsinseefrlab

0.0.6

1 of 2 See more

lakefs inseefrlab 0.0.6

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
treeverse/lakefs :0.69.0	478f37a6cffc	golang.org/x/net@v0.0.0-20220412020605-290c469a71a5 stdlib@go1.17.8	0.55.0 1.25.13

Open the chart page →

2,652

instemmingserviceinstemmingservice

1.0.0

1 of 3 See more

instemmingservice instemmingservice 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/instemmingservice-php :latest	4ffe222b3e3a	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.55.0 1.25.13

Open the chart page →

7,519

consulintel

0.8.1

2 of 2 See more

consul intel 0.8.1

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.14.2	e38576edcdfd	golang.org/x/net@v0.0.0-20220909164309-bea034e7d591 stdlib@go1.19.2	0.55.0 1.25.13
hashicorp/consul-k8s-control-plane :1.0.2	538a3436398d	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.19.2	0.55.0 1.25.13

Open the chart page →

5,403

evi-consulintel

3.0.3

2 of 2 See more

evi-consul intel 3.0.3

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.14.2	e38576edcdfd	golang.org/x/net@v0.0.0-20220909164309-bea034e7d591 stdlib@go1.19.2	0.55.0 1.25.13
hashicorp/consul-k8s-control-plane :1.0.2	538a3436398d	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.19.2	0.55.0 1.25.13

Open the chart page →

5,403

evi-kesintel

3.0.3

1 of 1 See more

evi-kes intel 3.0.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
minio/kes :2023-04-03T16-41-28Z	f93c2d9088df	golang.org/x/net@v0.7.0 stdlib@go1.20.2	0.55.0 1.25.13

Open the chart page →

1,765

evi-miniointel

3.0.3

2 of 2 See more

evi-minio intel 3.0.3

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/minio/mc :RELEASE.2023-01-28T20-29-38Z	ad34abeba912	golang.org/x/net@v0.4.0 stdlib@go1.19.4	0.55.0 1.25.13
quay.io/minio/minio :RELEASE.2023-02-10T18-48-39Z	a0a002cb113c	golang.org/x/net@v0.5.0 stdlib@go1.19.4	0.55.0 1.25.13

Open the chart page →

7,472

evi-vaultintel

3.0.3

2 of 2 See more

evi-vault intel 3.0.3

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
hashicorp/vault :1.12.1	8de4d5f31b38	golang.org/x/net@v0.0.0-20220909164309-bea034e7d591 stdlib@go1.19.2	0.55.0 1.25.13
hashicorp/vault-k8s :1.1.0	844337076b72	golang.org/x/net@v0.0.0-20221004154528-8021a29435af stdlib@go1.19.3	0.55.0 1.25.13

Open the chart page →

4,487

intel-gaudi-resource-driverintel

0.3.0

1 of 1 See more

intel-gaudi-resource-driver intel 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
intel/intel-gaudi-resource-driver :v0.3.0	ac758c14c2de	golang.org/x/net@v0.33.0 stdlib@go1.23.4	0.55.0 1.25.13

Open the chart page →

565

intel-qat-resource-driverintel

0.1.0

1 of 1 See more

intel-qat-resource-driver intel 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
intel/intel-qat-resource-driver :v0.1.0	ac7616986a2b	golang.org/x/net@v0.26.0 stdlib@go1.22.4	0.55.0 1.25.13

Open the chart page →

609

kesintel

0.8.3

1 of 1 See more

kes intel 0.8.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
minio/kes :v0.22.2	55f3aef5803e	golang.org/x/net@v0.0.0-20221014081412-f15817d10f9b stdlib@go1.19.3	0.55.0 1.25.13

Open the chart page →

3,577

multimodal-data-visualizationintel

3.0.0

1 of 2 See more

multimodal-data-visualization intel 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
intel/multimodal-data-visualization :3.0	3426deb77337	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4 stdlib@go1.17.11	0.55.0 1.25.13

Open the chart page →

11,148

tcs-issuerintel

0.5.0

1 of 2 See more

tcs-issuer intel 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
intel/trusted-certificate-issuer :0.5.0	591a9db4a427	golang.org/x/net@v0.7.0 stdlib@go1.19.3	0.55.0 1.25.13

Open the chart page →

6,005

vaultintel

0.8.1

2 of 2 See more

vault intel 0.8.1

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
hashicorp/vault :1.12.1	8de4d5f31b38	golang.org/x/net@v0.0.0-20220909164309-bea034e7d591 stdlib@go1.19.2	0.55.0 1.25.13
hashicorp/vault-k8s :1.1.0	844337076b72	golang.org/x/net@v0.0.0-20221004154528-8021a29435af stdlib@go1.19.3	0.55.0 1.25.13

Open the chart page →

4,487

gravity-initinvisibl

1.0.9

1 of 1 See more

gravity-init invisibl 1.0.9

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
invisibl/gravity-init :v1.0.9	1a970f84178b	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4 stdlib@go1.17.12	0.55.0 1.25.13

Open the chart page →

2,006

identity-managerinvisibl

1.0.0

1 of 1 See more

identity-manager invisibl 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
invisibl/identity-manager :1.0.0	1029f4fe20eb	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.17.11	0.55.0 1.25.13

Open the chart page →

2,162

identity-manager-demoinvisibl

0.1.1

1 of 1 See more

identity-manager-demo invisibl 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
invisibl/identity-manager-demo :v1.0.0	cf5400cb935a	stdlib@go1.19.2	1.25.13

Open the chart page →

1,006

karpenteriomete

0.19.3

1 of 1 See more

karpenter iomete 0.19.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
public.ecr.aws/karpenter/controller :v0.19.3	f0e5ab60b2df	golang.org/x/net@v0.1.0 stdlib@go1.19.3	0.55.0 1.25.13

Open the chart page →

1,555

server-monitoringiserversupport-helm--charts

1.0.0

2 of 2 See more

server-monitoring iserversupport-helm--charts 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
prom/node-exporter :v1.10.2	3ac34ce007ac	golang.org/x/net@v0.44.0 stdlib@go1.25.3	0.55.0 1.25.13
prom/prometheus :v3.8.0	d936808bdea5	golang.org/x/net@v0.46.0 stdlib@go1.25.4	0.55.0 1.25.13

Open the chart page →

1,321

istio-aws-private-ingress-customizedistio-aws-private-ingress-customized

1.0.0

1 of 1 See more

istio-aws-private-ingress-customized istio-aws-private-ingress-customized 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
istio/proxyv2 :1.18.0	757d28c24100	golang.org/x/net@v0.9.0 stdlib@go1.20.4	0.55.0 1.25.13

Open the chart page →

5,586

istio-azure-private-ingress-customizedistio-azure-private-ingress-customized

1.0.0

1 of 1 See more

istio-azure-private-ingress-customized istio-azure-private-ingress-customized 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
istio/proxyv2 :1.18.0	757d28c24100	golang.org/x/net@v0.9.0 stdlib@go1.20.4	0.55.0 1.25.13

Open the chart page →

5,586

Container images carrying it

5,293 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/kubedb/kubedb-ops-manager :v0.53.0	6d4c9fe66e4f	stdlib@go1.25.12	1.25.13	4
ghcr.io/kubedb/kubedb-webhook-server :v0.42.0	f7dcade6523b	stdlib@go1.25.12	1.25.13	4
ghcr.io/kubestash/kubestash :v0.29.0	43e01ed32486	golang.org/x/net@v0.47.0 stdlib@go1.25.5	0.55.0 1.25.13	4
ghcr.io/linuxserver/plex :latest	7f9a1d574958	stdlib@go1.26.5	1.25.13	4
ghcr.io/loft-sh/vcluster-pro :0.0.0-ci-run.10	ab2e1fa19dd4	golang.org/x/net@v0.5.0 stdlib@go1.18.10	0.55.0 1.25.13	4
ghcr.io/sigstore/scaffolding/createtree :v0.7.31	e5232e8c9122	golang.org/x/net@v0.46.0 stdlib@go1.25.0	0.55.0 1.25.13	4
ghcr.io/synapsecns/sanguine/omnirpc :latest	5217e3d1fc70	golang.org/x/net@v0.35.0 stdlib@go1.22.4	0.55.0 1.25.13	4
quay.io/jetstack/cert-manager-cainjector :v1.13.1	72072d492b43	golang.org/x/net@v0.15.0 stdlib@go1.20.8	0.55.0 1.25.13	4
quay.io/jetstack/cert-manager-controller :v1.13.1	6b83f55bd99e	golang.org/x/net@v0.15.0 stdlib@go1.20.8	0.55.0 1.25.13	4
quay.io/jetstack/cert-manager-ctl :v1.13.1	c10bde7ff9ad	golang.org/x/net@v0.15.0 stdlib@go1.20.8	0.55.0 1.25.13	4
quay.io/jetstack/cert-manager-webhook :v1.13.1	48ea4a77dfa7	golang.org/x/net@v0.15.0 stdlib@go1.20.8	0.55.0 1.25.13	4
quay.io/prometheus/alertmanager :v0.25.0	fd4d9a3dd1fd	golang.org/x/net@v0.4.0 stdlib@go1.19.4	0.55.0 1.25.13	4
quay.io/prometheus/mysqld-exporter :latest :v0.20.0	abed8dac117b	stdlib@go1.26.5	1.25.13	4
quay.io/prometheus/node-exporter :v1.5.0	39c642b2b337	golang.org/x/net@v0.2.0 stdlib@go1.19.3	0.55.0 1.25.13	4
quay.io/prometheus/node-exporter :v1.9.1	d00a542e409e	golang.org/x/net@v0.37.0 stdlib@go1.23.7	0.55.0 1.25.13	4
quay.io/thanos/thanos :v0.42.4	b567818fe608	stdlib@go1.26.5	1.25.13	4
registry.k8s.io/autoscaling/vpa-admission-controller :1.7.1	be29624f7f12	stdlib@go1.26.5	1.25.13	4
registry.k8s.io/autoscaling/vpa-recommender :1.7.1	89cea705535f	stdlib@go1.26.5	1.25.13	4
registry.k8s.io/autoscaling/vpa-updater :1.7.1	feb42a526970	stdlib@go1.26.5	1.25.13	4
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v20220916-gd32f8c343	39c5b2e3310d	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.19.1	0.55.0 1.25.13	4
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v20221220-controller-v1.5.1-58-g787ea74b6	4d99688e5573	golang.org/x/net@v0.1.0 stdlib@go1.19.4	0.55.0 1.25.13	4
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.1.1	64d8c73dca98	golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023 stdlib@go1.16.9	0.55.0 1.25.13	4
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.6.0	c9f76a75fd00	golang.org/x/net@v0.41.0 stdlib@go1.24.4	0.55.0 1.25.13	4
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.16.0	e750cd4b43f7	golang.org/x/net@v0.40.0 stdlib@go1.24.4	0.55.0 1.25.13	4
registry.k8s.io/metrics-server/metrics-server :v0.9.0	d9862115e7c7	stdlib@go1.26.4	1.25.13	4
registry.k8s.io/prometheus-adapter/prometheus-adapter :v0.12.0	932eae60e2bc	golang.org/x/net@v0.24.0 stdlib@go1.22.2	0.55.0 1.25.13	4
registry.k8s.io/sig-storage/csi-attacher :v4.8.1	69888dba5815	golang.org/x/net@v0.34.0 stdlib@go1.23.1	0.55.0 1.25.13	4
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.13.0	d7138bcc3aa5	golang.org/x/net@v0.32.0 stdlib@go1.23.1	0.55.0 1.25.13	4
registry.k8s.io/sig-storage/csi-provisioner :v4.0.1	bf5a235b67d8	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.55.0 1.25.13	4
registry.k8s.io/sig-storage/livenessprobe :v2.16.0	88092d100909	golang.org/x/net@v0.40.0 stdlib@go1.24.2	0.55.0 1.25.13	4
registry.k8s.io/sig-storage/livenessprobe :v2.18.0	c4cc074199c0	golang.org/x/net@v0.49.0 stdlib@go1.25.7	0.55.0 1.25.13	4
registry.k8s.io/sig-storage/snapshot-controller :v8.6.0	81e79f205083	golang.org/x/net@v0.54.0 stdlib@go1.26.3	0.55.0 1.25.13	4
registry.k8s.io/sig-storage/snapshot-controller :v8.2.0	9dade8f2f3ab	golang.org/x/net@v0.31.0 stdlib@go1.23.1	0.55.0 1.25.13	4
alfhou/hammond :v0.0.24	c85dc0293aa1	golang.org/x/net@v0.0.0-20210410081132-afb366fc7cd1 stdlib@go1.20.6	0.55.0 1.25.13	3
alpine/git :latest :v2.54.0	6f3b5029566d	golang.org/x/net@v0.54.0 stdlib@go1.26.3	0.55.0 1.25.13	3
argoproj/argocd :v1.8.1	830e86cacefd	golang.org/x/net@v0.0.0-20201024042810-be3efd7ff127 stdlib@go1.14.12	0.55.0 1.25.13	3
bitnamilegacy/kubectl :latest	cd354d5b2556	golang.org/x/net@v0.41.0 stdlib@go1.24.5	0.55.0 1.25.13	3
bitnamilegacy/mongodb :6.0.4-debian-11-r10	016dce036593	golang.org/x/net@v0.0.0-20220906165146-f3363e06e74c stdlib@go1.17.10	0.55.0 1.25.13	3
bitnamilegacy/os-shell :12-debian-12-r51	77e65e9d633e	golang.org/x/net@v0.42.0 stdlib@go1.25.0	0.55.0 1.25.13	3
bitnami/mongodb :latest	9aa916500f02	stdlib@go1.26.5	1.25.13	3
caddy/ingress :v0.2.1	18d1366fc0e9	golang.org/x/net@v0.17.0 stdlib@go1.21.4	0.55.0 1.25.13	3
ciscolabs/rtsp-server :latest	b59fc10bb821	golang.org/x/net@v0.0.0-20220526153639-5463443f8c37 stdlib@go1.19.2	0.55.0 1.25.13	3
cloudflare/cloudflared :2026.8.3 :latest	51c9cefcb456	stdlib@go1.26.4	1.25.13	3
cloudpirates/image-minio :RELEASE.2025-10-15T17-29-55Z-hardened	8dc02a7e5093	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.55.0 1.25.13	3
cockroachdb/cockroach-self-signer-cert :1.10	07a49acec18d	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.55.0 1.25.13	3
csiplugin/csi-resizer :v1.2.0	36c31f7e1f43	golang.org/x/net@v0.0.0-20210316092652-d523dce5a7f4 stdlib@go1.16	0.55.0 1.25.13	3
csiplugin/csi-snapshotter :v4.0.0	51f2dfde5bcc	golang.org/x/net@v0.0.0-20201209123823-ac852fbbde11 stdlib@go1.15	0.55.0 1.25.13	3
derailed/popeye :v0.22.1	8e68e22c7663	golang.org/x/net@v0.34.0 stdlib@go1.23.5	0.55.0 1.25.13	3
dgraph/dgraph :v21.12.0	3b55ea83fffe	golang.org/x/net@v0.0.0-20201021035429-f5854403a974 stdlib@go1.17.3	0.55.0 1.25.13	3
dnationcloud/kubernetes-jsonnet-translator :2.0.1	78fed4f3c130	stdlib@go1.26.5	1.25.13	3