CVE-2026-39821

High

Advisory

Published 22 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,549; of 17,805 indexed, latest versions
Container images: 5,253; deployed by those charts
Fix available: 3 of 3; affected packages

Red Hat Security Advisory: git-lfs security update

Carried by container images the latest versions of 4,549 of 17,805 indexed charts deploy, on 5,253 images.

Affected package	Affected versions	Fixed in	Images
git-lfsrpm	2.13.3-3.el8_6	0:3.4.1-11.el8_10	1
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+190 more	1.25.13	5,215
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+220 more	0.55.0	3,675

OSV records: RHSA-2026:30853 GO-2026-5026

Charts affected

4,549 by stars

Chart

Latest

Affected images

Radar Score

sn-platformstreamnative

1.11.44

6 of 9 See more

sn-platform streamnative 1.11.44

6 of the 9 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
jimmidyson/configmap-reload :v0.8.0	5af9d3041d12	stdlib@go1.19.2	1.25.13
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	golang.org/x/net@v0.8.0 stdlib@go1.20.4	0.55.0 1.25.13
streamnative/pulsar_vault_init :v1.0.7	31533fa9fab7	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.17.11	0.55.0 1.25.13
quay.io/prometheus/alertmanager :v0.25.0	fd4d9a3dd1fd	golang.org/x/net@v0.4.0 stdlib@go1.19.4	0.55.0 1.25.13
quay.io/prometheus/node-exporter :v1.5.0	39c642b2b337	golang.org/x/net@v0.2.0 stdlib@go1.19.3	0.55.0 1.25.13
quay.io/prometheus/prometheus :v2.43.0	f5c29683a301	golang.org/x/net@v0.8.0 stdlib@go1.19.7	0.55.0 1.25.13

Open the chart page →

67,666

stunnerstunner

1.2.1

2 of 2 See more

stunner stunner 1.2.1

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
l7mp/stunner-auth-server :1.2.1	0d2094060b72	stdlib@go1.26.4	1.25.13
l7mp/stunner-gateway-operator :1.2.1	0ea40a1d42d5	stdlib@go1.26.4	1.25.13

Open the chart page →

267

pocketbasetechwolf12

0.29.3

1 of 1 See more

pocketbase techwolf12 0.29.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/techwolf12/pocketbase :0.29.3	106099641679	golang.org/x/net@v0.43.0 stdlib@go1.24.6	0.55.0 1.25.13

Open the chart page →

1,463

pretixtechwolf12

2026.7.0

1 of 3 See more

pretix techwolf12 2026.7.0

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :18.4	a02db8cac496	stdlib@go1.24.6	1.25.13

Open the chart page →

10,105

mealieth-charts

0.5.1

1 of 1 See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/mealie-recipes/mealie :v3.7.0	bb2939094eed	stdlib@go1.24.4	1.25.13

Open the chart page →

3,864

thingsboard-clusterthingsboard-cluster-betta

0.2.26

3 of 6 See more

thingsboard-cluster thingsboard-cluster-betta 0.2.26

3 of the 6 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
bitnamilegacy/kafka :3.5.0-debian-11-r0	8657bb93a581	stdlib@go1.20.5	1.25.13
bitnamilegacy/redis :7.2.1-debian-11-r0	fa288394f402	stdlib@go1.19.12	1.25.13
bitnamilegacy/zookeeper :3.9.0-debian-11-r11	10ed1ea3c8d1	stdlib@go1.19.12	1.25.13

Open the chart page →

14,599

feedbacksystemthm-mni-ii

0.47.1

6 of 10 See more

feedbacksystem thm-mni-ii 0.47.1

6 of the 10 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
bitnamilegacy/minio :2023.12.23-debian-11-r2	5bb0aa825d16	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.55.0 1.25.13
bitnamilegacy/mongodb :6.0.10-debian-11-r8	42319decb591	golang.org/x/net@v0.14.0 stdlib@go1.19.12	0.55.0 1.25.13
bitnamilegacy/mysql :8.0.35-debian-11-r2	be03e8ea6129	stdlib@go1.21.5	1.25.13
library/docker :20.10.21-dind	3153fa63f546	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.18.7	0.55.0 1.25.13
thmmniii/fbs-qcm-frontend :v1.27.1	a347f7f4d144	stdlib@go1.20.12	1.25.13
thmmniii/fbs-runner :v1.27.1	86105349c1a3	golang.org/x/net@v0.17.0 stdlib@go1.20.11	0.55.0 1.25.13

Open the chart page →

28,836

topaztopaz

0.2.5

1 of 1 See more

topaz topaz 0.2.5

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/aserto-dev/topaz :0.32.59	4c708ecf7dc4	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.55.0 1.25.13

Open the chart page →

1,674

maeshtraefik

2.1.2

1 of 7 See more

maesh traefik 2.1.2

1 of the 7 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
containous/maesh :v1.3.2	587162516502	golang.org/x/net@v0.0.0-20200301022130-244492dfa37a stdlib@go1.14.4	0.55.0 1.25.13

Open the chart page →

4,145

traefik-meshtraefik

4.1.1

3 of 7 See more

traefik-mesh traefik 4.1.1

3 of the 7 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
jaegertracing/all-in-one :1.18	db45c07f2e1b	golang.org/x/net@v0.0.0-20200202094626-16171245cfb2 stdlib@go1.14.4	0.55.0 1.25.13
library/traefik :v2.5	7d5a6ae66572	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.17.6	0.55.0 1.25.13
traefik/mesh :v1.4.8	cf071f3e165c	golang.org/x/net@v0.0.0-20220624214902-1bab6f366d9e stdlib@go1.19	0.55.0 1.25.13

Open the chart page →

9,289

k8s-ttl-controllertwin

0.4.0

1 of 1 See more

k8s-ttl-controller twin 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/twin/k8s-ttl-controller :v1.4.0	0525a7def93d	golang.org/x/net@v0.26.0 stdlib@go1.24.1	0.55.0 1.25.13

Open the chart page →

471

argocdtwomartens

0.1.1

2 of 3 See more

argocd twomartens 0.1.1

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/dexidp/dex :v2.37.0	f579d00721b0	golang.org/x/net@v0.11.0 stdlib@go1.19.6	0.55.0 1.25.13
quay.io/argoproj/argocd :v2.8.6	acaf37352569	golang.org/x/net@v0.17.0 stdlib@go1.20.4	0.55.0 1.25.13

Open the chart page →

10,418

crossplaneupbound-stable

2.4.1-up.1

1 of 5 See more

crossplane upbound-stable 2.4.1-up.1

1 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :14	156f0b253fd6	stdlib@go1.24.6	1.25.13

Open the chart page →

1,686

uptraceuptrace

2.0.2

1 of 2 See more

uptrace uptrace 2.0.2

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
uptrace/uptrace :2.0.2	34a02c3b2d12	golang.org/x/net@v0.42.0 stdlib@go1.24.10	0.55.0 1.25.13

Open the chart page →

1,749

valkey-operatorvalkey

0.6.0

1 of 1 See more

valkey-operator valkey 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/valkey-io/valkey-operator :v0.6.0	52a0f1ed0c03	golang.org/x/net@v0.49.0	0.55.0

Open the chart page →

148

vaultvault

1.22.0

4 of 4 See more

vault vault 1.22.0

4 of the 4 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
alpine/k8s :1.35.5	d870622d0040	golang.org/x/net@v0.48.0 stdlib@go1.26.0	0.55.0 1.25.13
hashicorp/vault :2.0.1	755355002715	golang.org/x/net@v0.54.0 stdlib@go1.26.3	0.55.0 1.25.13
prom/statsd-exporter :v0.29.0	632f70580492	golang.org/x/net@v0.48.0 stdlib@go1.26.0	0.55.0 1.25.13
ghcr.io/bank-vaults/bank-vaults :v1.33.1	98b6ea2ed319	stdlib@go1.26.3	1.25.13

Open the chart page →

4,293

vouchvouch

3.2.0

1 of 1 See more

vouch vouch 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/vouch/vouch-proxy :0.39	d34e220de3cf	golang.org/x/net@v0.5.0 stdlib@go1.18.10	0.55.0 1.25.13

Open the chart page →

1,035

vsphere-cpivsphere-tmm

1.6.0

1 of 1 See more

vsphere-cpi vsphere-tmm 1.6.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere :v1.28.0	026f63d9ed42	golang.org/x/net@v0.13.0 stdlib@go1.20.7	0.55.0 1.25.13

Open the chart page →

1,358

gethvulcanlink

1.10.23

1 of 1 See more

geth vulcanlink 1.10.23

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ethereum/client-go :v1.10.23	cce21b423165	golang.org/x/net@v0.0.0-20220607020251-c690dde0001d stdlib@go1.18.5	0.55.0 1.25.13

Open the chart page →

2,246

api-firewallwallarm

0.9.6

1 of 1 See more

api-firewall wallarm 0.9.6

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
wallarm/api-firewall :v0.9.6	4d45db0ff240	golang.org/x/net@v0.52.0 stdlib@go1.25.8	0.55.0 1.25.13

Open the chart page →

1,000

wallarm-ingresswallarm

5.3.10-1

2 of 2 See more

wallarm-ingress wallarm 5.3.10-1

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
wallarm/ingress-controller :5.3.10.1	a1fecfdf987e	golang.org/x/net@v0.34.0 stdlib@go1.23.1	0.55.0 1.25.13
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.4.4	a9f03b34a3cb	golang.org/x/net@v0.28.0 stdlib@go1.22.8	0.55.0 1.25.13

Open the chart page →

1,302

wallarm-sidecarwallarm

6.13.1

1 of 3 See more

wallarm-sidecar wallarm 6.13.1

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.4.1	36d05b4077fb	golang.org/x/net@v0.22.0 stdlib@go1.22.2	0.55.0 1.25.13

Open the chart page →

966

wasmcloud-chartwasmcloud-chart

0.7.2

1 of 2 See more

wasmcloud-chart wasmcloud-chart 0.7.2

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/nats :2.10.7-alpine	1bcddab51b80	stdlib@go1.21.5	1.25.13

Open the chart page →

3,503

prometheuswener

29.31.1

2 See more

prometheus wener 29.31.1

2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/prometheus/node-exporter :v1.12.1	1b4e4438faca	stdlib@go1.26.5	1.25.13
quay.io/prometheus/pushgateway :v1.11.3	74fa117cef2d	stdlib@go1.26.3	1.25.13

Open the chart page →

—

argo-cdwenerme

10.9.2

2 of 3 See more

argo-cd wenerme 10.9.2

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/dexidp/dex :v2.45.1	8499afd690c4	golang.org/x/net@v0.50.0 stdlib@go1.25.6	0.55.0 1.25.13
quay.io/argoproj/argocd :v3.5.3	dd3f47d5a5e4	golang.org/x/net@v0.40.0 stdlib@go1.26.4	0.55.0 1.25.13

Open the chart page →

3,032

minio-operatorwenerme

4.3.7

1 of 2 See more

minio-operator wenerme 4.3.7

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
minio/operator :v4.3.7	54393e03f3b2	golang.org/x/net@v0.0.0-20210421230115-4e50805a0758 stdlib@go1.17.4	0.55.0 1.25.13

Open the chart page →

6,087

wgerwger

1.0.0

1 of 8 See more

wger wger 1.0.0

1 of the 8 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :15.18	6eb0add3b77c	stdlib@go1.24.6	1.25.13

Open the chart page →

8,799

wharf-helmwharf-helm

3.2.6

4 of 5 See more

wharf-helm wharf-helm 3.2.6

4 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/iver-wharf/wharf-api :v5.2.0	b736b345437d	golang.org/x/net@v0.0.0-20220325170049-de3da57026de stdlib@go1.18.1	0.55.0 1.25.13
quay.io/iver-wharf/wharf-provider-azuredevops :v3.0.1	2fe7e4dcffdf	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4 stdlib@go1.18.2	0.55.0 1.25.13
quay.io/iver-wharf/wharf-provider-github :v3.0.1	77a22cb45c2a	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4 stdlib@go1.18.2	0.55.0 1.25.13
quay.io/iver-wharf/wharf-provider-gitlab :v2.0.1	d7079e0890da	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4 stdlib@go1.18.2	0.55.0 1.25.13

Open the chart page →

10,048

buildkitdwiremind

0.33.0

1 of 1 See more

buildkitd wiremind 0.33.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
moby/buildkit :v0.32.2-rootless	504731e577c2	golang.org/x/net@v0.43.0 stdlib@go1.25.7	0.55.0 1.25.13

Open the chart page →

1,164

keycloak-operatorwiremind

0.0.14

1 of 1 See more

keycloak-operator wiremind 0.0.14

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak-operator :18.0.0-legacy	36ce77526145	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.13.8	0.55.0 1.25.13

Open the chart page →

4,715

yataiyatai

0.4.6

1 of 2 See more

yatai yatai 0.4.6

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/bentoml/yatai :0.4.6	14b482c1f1b8	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4 stdlib@go1.18.4	0.55.0 1.25.13

Open the chart page →

4,050

yet-another-cloudwatch-exporteryet-another-cloudwatch-exporter

0.38.0

1 of 1 See more

yet-another-cloudwatch-exporter yet-another-cloudwatch-exporter 0.38.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/nerdswords/yet-another-cloudwatch-exporter :v0.61.2	f04925fe1fa6	stdlib@go1.22.4	1.25.13

Open the chart page →

923

nocodbzekker6

1.10.0

1 of 1 See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
nocodb/nocodb :0.301.5	d9516f0bf546	stdlib@go1.23.12	1.25.13

Open the chart page →

4,175

paperlesszekker6

11.8.0

1 of 1 See more

paperless zekker6 11.8.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :3.1.3	aa810a36942c	stdlib@go1.24.4	1.25.13

Open the chart page →

4,679

adcs-issueradcs-issuer

3.0.2

1 of 1 See more

adcs-issuer adcs-issuer 3.0.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
djkormo/adcs-issuer :2.1.2	9f34e87e7586	golang.org/x/net@v0.26.0 stdlib@go1.22.6	0.55.0 1.25.13

Open the chart page →

829

kubernetes-etcd-backupadfinis

1.6.2

1 of 1 See more

kubernetes-etcd-backup adfinis 1.6.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/adfinis/kubernetes-etcd-backup :v1.4.6	8ec6c4812a7e	golang.org/x/net@v0.38.0 stdlib@go1.23.7	0.55.0 1.25.13

Open the chart page →

1,875

no-latest-tag-webhookadmission-webhook-no-latest

1.0.14

1 of 1 See more

no-latest-tag-webhook admission-webhook-no-latest 1.0.14

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/omkar-shelke25/admission-webhook-no-latest :sha-3316545	5976a1d3236a	golang.org/x/net@v0.38.0 stdlib@go1.26.3	0.55.0 1.25.13

Open the chart page →

162

paperless-ngxadnoctem

0.4.2

2 of 5 See more

paperless-ngx adnoctem 0.4.2

2 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
gotenberg/gotenberg :8.36.0	87c16b9f3642	stdlib@go1.26.5	1.25.13
ghcr.io/paperless-ngx/paperless-ngx :3.1.3	aa810a36942c	stdlib@go1.24.4	1.25.13

Open the chart page →

20,339

agentareaagentarea

0.0.18

9 of 16 See more

agentarea agentarea 0.0.18

9 of the 16 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
agentarea/agentarea-events :latest	641532dca757	stdlib@go1.25.12	1.25.13
agentarea/agentarea-mcp-manager :latest	efe23cef3727	stdlib@go1.22.5	1.25.13
agentarea/agentarea-mcp-runner :latest	d3c209a5d531	stdlib@go1.19.8	1.25.13
library/postgres :16-alpine	cf78e76683b9	stdlib@go1.24.6	1.25.13
library/postgres :alpine	d3e1620b530c	stdlib@go1.24.6	1.25.13
openfga/openfga :v1.18.0	36097b960f66	stdlib@go1.26.4	1.25.13
oryd/kratos :v1.3.1	fe2428f103a6	golang.org/x/net@v0.27.0 stdlib@go1.23.2	0.55.0 1.25.13
temporalio/auto-setup :1.29.1	5b3502a3b685	golang.org/x/net@v0.35.0 stdlib@go1.25.0	0.55.0 1.25.13
temporalio/ui :2.39.0	b768f87f18b5	golang.org/x/net@v0.40.0 stdlib@go1.23.4	0.55.0 1.25.13

Open the chart page →

15,295

akeyless-api-gatewayakeyless-services-helm

1.62.26

1 of 1 See more

akeyless-api-gateway akeyless-services-helm 1.62.26

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
akeyless/base :latest	759e4289fae8	stdlib@go1.26.3	1.25.13

Open the chart page →

2,437

alertmanager-discordalertmanagerdiscord

0.3.2

1 of 1 See more

alertmanager-discord alertmanagerdiscord 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
speckle/alertmanager-discord :latest	f6221ff308e9	stdlib@go1.22.4	1.25.13

Open the chart page →

420

alertmanager-matrixalertmanager-matrix

0.1.16

1 of 1 See more

alertmanager-matrix alertmanager-matrix 0.1.16

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
silkeh/alertmanager_matrix :0.6.1	900010497f8c	golang.org/x/net@v0.54.0 stdlib@go1.26.3	0.55.0 1.25.13

Open the chart page →

471

paperless-ngxalexmorbo-paperless-ngx

0.2.0

1 of 2 See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :2.20.5	665f2f5cc548	stdlib@go1.24.4	1.25.13

Open the chart page →

12,161

clearml-agentallegroai

5.3.3

1 of 1 See more

clearml-agent allegroai 5.3.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
allegroai/clearml-agent-k8s-base :1.24-21	772827a01bb5	stdlib@go1.18.1	1.25.13

Open the chart page →

67,934

clearml-servingallegroai

1.6.2

6 of 9 See more

clearml-serving allegroai 1.6.2

6 of the 9 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
bitnamilegacy/kafka :3.4.0-debian-11-r6	ac64829e45b3	stdlib@go1.19.6	1.25.13
bitnamilegacy/zookeeper :3.8.1-debian-11-r6	dba59d740e13	stdlib@go1.18.2	1.25.13
grafana/grafana :9.4.3	76dcf36e7d2a	golang.org/x/net@v0.4.0 stdlib@go1.19.4	0.55.0 1.25.13
jimmidyson/configmap-reload :v0.8.0	5af9d3041d12	stdlib@go1.19.2	1.25.13
quay.io/prometheus/alertmanager :v0.25.0	fd4d9a3dd1fd	golang.org/x/net@v0.4.0 stdlib@go1.19.4	0.55.0 1.25.13
quay.io/prometheus/prometheus :v2.41.0	1a3e9a878e50	golang.org/x/net@v0.4.0 stdlib@go1.19.4	0.55.0 1.25.13

Open the chart page →

17,923

pact-brokeralmorgv

0.1.0

1 of 1 See more

pact-broker almorgv 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
pactfoundation/pact-broker :2.79.1.1	12861b0bd4d9	stdlib@go1.14.4	1.25.13

Open the chart page →

5,000

mariadbalphani-helm-charts

10.10.3

1 of 1 See more

mariadb alphani-helm-charts 10.10.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/mariadb :10.10.2	bfc25a68e113	stdlib@go1.16.7	1.25.13

Open the chart page →

8,401

soft-servealphani-helm-charts

0.4.0

1 of 1 See more

soft-serve alphani-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
charmcli/soft-serve :v0.4.0	39523c1a6ba8	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.18.5	0.55.0 1.25.13

Open the chart page →

3,120

smockerandrcuns

0.0.4

1 of 1 See more

smocker andrcuns 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
andrcuns/smocker :0.18.5	b4a8eb20581a	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.10	0.55.0 1.25.13

Open the chart page →

2,173

cloudflare-operatorankra-charts

0.2.0

1 of 1 See more

cloudflare-operator ankra-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
adyanth/cloudflare-operatordigest-pinned	6b168dc237d5	golang.org/x/net@v0.39.0 stdlib@go1.24.4	0.55.0 1.25.13

Open the chart page →

507

Container images carrying it

5,253 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
netrisai/controller-telescope :4.6.0.004	14d82948a8b2	stdlib@go1.25.6	1.25.13	1
netrisai/controller-web-session-generator :0.2.0	a030a31289f4	stdlib@go1.14.15	1.25.13	1
netrisai/mariadb :10.11.4-debian-11-r46	0aa742a0b906	stdlib@go1.19.11	1.25.13	1
netrisai/mongodb :4.4.4-debian-10-r0	95abfb776bb4	stdlib@go1.15.1	1.25.13	1
netrisai/netris-operator :v4.0.2	44f60aa0d898	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.10	0.55.0 1.25.13	1
netskopeprivateaccess/publisher_u22 :latest	93e2fd164a93	stdlib@go1.25.10	1.25.13	1
newrelic/newrelic-agent-control-cli :0.48.0	1a448492b55a	golang.org/x/net@v0.38.0 stdlib@go1.24.6	0.55.0 1.25.13	1
newrelic/newrelic-agent-control-cli :1.24.0	47520b65d6b2	stdlib@go1.26.5	1.25.13	1
nginx/nginx-ingress :1.11.1	eb5b4fd73325	golang.org/x/net@v0.0.0-20201216054612-986b41b23924 stdlib@go1.15.11	0.55.0 1.25.13	1
ngosang/restic-exporter :2.1.2	a8f9cfa30162	stdlib@go1.26.4	1.25.13	1
ngrok/ngrok-operator :0.22.0	db8e6fecc52c	stdlib@go1.26.5	1.25.13	1
nineinfra/hdfs-operator :v0.7.0	debb1e3410e2	golang.org/x/net@v0.17.0 stdlib@go1.21.3	0.55.0 1.25.13	1
nineinfra/kyuubi-operator :v0.7.0	8d8ed87ef77c	golang.org/x/net@v0.13.0 stdlib@go1.20.8	0.55.0 1.25.13	1
nineinfra/metastore-operator :v0.7.0	11259032fb04	golang.org/x/net@v0.13.0 stdlib@go1.20.8	0.55.0 1.25.13	1
nineinfra/nineinfra :v0.7.0	d4aad414eccd	golang.org/x/net@v0.17.0 stdlib@go1.21.3	0.55.0 1.25.13	1
nineinfra/zookeeper-operator :v0.7.0	af6eb2f37bfc	golang.org/x/net@v0.17.0 stdlib@go1.21.3	0.55.0 1.25.13	1
nmalhotr/webserver :v1.0.0	3419361fb0dd	stdlib@go1.13.10	1.25.13	1
nocodb/nocodb :0.258.0	6779a4ddedf2	golang.org/x/net@v0.19.0 stdlib@go1.21.10	0.55.0 1.25.13	1
nocodb/nocodb :0.100.2	b0b91ec2a2dd	golang.org/x/net@v0.0.0-20220805013720-a33c5aa5df48 stdlib@go1.18.2	0.55.0 1.25.13	1
nocodb/nocodb :0.301.5	d9516f0bf546	stdlib@go1.23.12	1.25.13	1
nocodb/nocodb :0.84.15	f9b799933aa8	golang.org/x/net@v0.0.0-20211216030914-fe4d6282115f stdlib@go1.17.8	0.55.0 1.25.13	1
noooste/garage-ui :v0.12.1	0b68a9237da6	stdlib@go1.26.0	1.25.13	1
nousresearch/hermes-agent :v2026.8.27	e0df6adebddf	stdlib@go1.24.4	1.25.13	1
novosga/novosga :latest	34b9acbe6e51	golang.org/x/net@v0.53.0 stdlib@go1.26.2	0.55.0 1.25.13	1
nsqio/nsq :v1.3.0	1a369c146af7	stdlib@go1.21.5	1.25.13	1
ntakashi/cole :1.2.3	f7b68bee2a68	golang.org/x/net@v0.10.0 stdlib@go1.20.11	0.55.0 1.25.13	1
ntakashi/gitana :1.4.0	4171ec641120	golang.org/x/net@v0.0.0-20210929161516-d455829e376d stdlib@go1.17.7	0.55.0 1.25.13	1
nutanix/cn-rwx-operator :1.1.0	0082e0cebd42	stdlib@go1.25.12	1.25.13	1
nvidia/dcgm-exporter :2.2.9-2.4.1-ubuntu20.04	91b20b66d1cd	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.14.2	0.55.0 1.25.13	1
oamdev/cluster-gateway-addon-manager :v1.4.0	1bcae00bd7b0	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.17.10	0.55.0 1.25.13	1
obolnetwork/charon-dkg-sidecar :main	e263be0a7440	golang.org/x/net@v0.44.0 stdlib@go1.25.3	0.55.0 1.25.13	1
odavid/my-bloody-jenkins :2.462.3-306	e7ab3bbc948e	golang.org/x/net@v0.21.0 stdlib@go1.22.5	0.55.0 1.25.13	1
ofekmeister/csi-gcs :v0.9.0	30d70fa9211b	golang.org/x/net@v0.0.0-20220513224357-95641704303c stdlib@go1.18.2	0.55.0 1.25.13	1
offchainlabs/nitro-node :v3.7.6-c0fe95e	9f779fa84b7b	golang.org/x/net@v0.38.0 stdlib@go1.24.5	0.55.0 1.25.13	1
offchainlabs/nitro-node :v3.1.0-7d1d84c	e95865866129	golang.org/x/net@v0.21.0 stdlib@go1.21.10	0.55.0 1.25.13	1
okgolove/asprom :1.10.1	974d2e5eb150	stdlib@go1.14.11	1.25.13	1
okteto/civo-webhook :0.5.3	57cd51176538	golang.org/x/net@v0.15.0 stdlib@go1.21.3	0.55.0 1.25.13	1
oliver006/redis_exporter :v1.11.1	04d958d209ab	stdlib@go1.15	1.25.13	1
oliver006/redis_exporter :v1.67.0	120f7ec77293	stdlib@go1.23.4	1.25.13	1
oliver006/redis_exporter :v1.14.0	d55e056987af	stdlib@go1.15.6	1.25.13	1
oliver006/redis_exporter :v1.66.0	d98e6db8094f	stdlib@go1.23.2	1.25.13	1
oliver006/redis_exporter :v1.82.0-alpine	da9e89ee4e75	stdlib@go1.26.1	1.25.13	1
olliai/exposecontroller :1.0.5	a470d96525e4	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.16.3	0.55.0 1.25.13	1
olliai/k8s-replicator :1.3.0	5716f2a8bd4c	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.17.2	0.55.0 1.25.13	1
ondrejsika/counter :latest	d95eaeee2172	golang.org/x/net@v0.46.0 stdlib@go1.26.2	0.55.0 1.25.13	1
opea/codegen-ui :1.0	2bee4eb66f3e	stdlib@go1.20.7	1.25.13	1
opea/codetrans-ui :1.0	3ef121f34610	stdlib@go1.20.12	1.25.13	1
opea/docsum-ui :1.0	7f854e9bffaf	stdlib@go1.20.12	1.25.13	1
opea/gmcmanager :1.0	514af17c495c	golang.org/x/net@v0.25.0 stdlib@go1.21.13	0.55.0 1.25.13	1
openbas/caldera-server :5.1.0	a277796d9724	golang.org/x/net@v0.14.0 stdlib@go1.19.8	0.55.0 1.25.13	1