CVE-2026-39821

High

Advisory

Published 22 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,687; of 17,832 indexed, latest versions
Container images: 5,405; deployed by those charts
Fix available: 3 of 3; affected packages

Red Hat Security Advisory: git-lfs security update

Carried by container images the latest versions of 4,687 of 17,832 indexed charts deploy, on 5,405 images.

Affected package	Affected versions	Fixed in	Images
git-lfsrpm	2.13.3-3.el8_6	0:3.4.1-11.el8_10	1
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+193 more	1.25.13	5,361
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+223 more	0.55.0	3,797

OSV records: RHSA-2026:30853 GO-2026-5026

Charts affected

4,687 by stars

Chart

Latest

Affected images

Radar Score

kommandermesosphere-stable

0.39.2

19 of 29 See more

kommander mesosphere-stable 0.39.2

19 of the 29 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
grafana/grafana :6.6.0	052147d7e0ec	golang.org/x/net@v0.0.0-20190923162816-aa69164e4478 stdlib@go1.13.4	0.55.0 1.25.13
jimmidyson/configmap-reload :v0.5.0	904d08e9f701	stdlib@go1.15.7	1.25.13
mesosphere/karma :v0.55-d2iq-proxy	4693bb4e0814	golang.org/x/net@v0.0.0-20190923162816-aa69164e4478 stdlib@go1.13.7	0.55.0 1.25.13
mesosphere/kommander-federation-authorizedlister :v0.21.2	63bc411b930b	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777 stdlib@go1.14.5	0.55.0 1.25.13
mesosphere/kommander-federation-controller-manager :v0.21.2	b036785a8862	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777 stdlib@go1.14.5	0.55.0 1.25.13
mesosphere/kommander-federation-utility-apiserver :v0.21.2	f9b769c65e24	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777 stdlib@go1.14.5	0.55.0 1.25.13
mesosphere/kommander-federation-webhook :v0.21.2	94af41b6dd9a	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777 stdlib@go1.14.5	0.55.0 1.25.13
mesosphere/kommander-licensing-controller-manager :v0.21.2	8e18bbe407f7	golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb stdlib@go1.14.5	0.55.0 1.25.13
mesosphere/kommander-licensing-webhook :v0.21.2	265edcd2a1ca	golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb stdlib@go1.14.5	0.55.0 1.25.13
mesosphere/kubeaddons-addon-initializer :v0.2.8	c10011f866f2	golang.org/x/net@v0.0.0-20191209160850-c0dbc17a3553 stdlib@go1.13.8	0.55.0 1.25.13
mesosphere/kubeaddons-catalog :v0.11.4	073db43d0b8b	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.15.2	0.55.0 1.25.13
prom/prometheus :v2.19.2	cd134bd4fca0	golang.org/x/net@v0.0.0-20200602114024-627f9648deb9 stdlib@go1.14.4	0.55.0 1.25.13
thanosio/thanos :v0.19.0	88276fcd1491	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777 stdlib@go1.15.10	0.55.0 1.25.13
thanosio/thanos :v0.15.0	b12d5c31bf5a	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.14.2	0.55.0 1.25.13
gcr.io/kubecost1/cost-model :prod-1.81.0	67f4f162da8d	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.16.4	0.55.0 1.25.13
gcr.io/kubecost1/server :prod-1.81.0	a348db3e4d74	golang.org/x/net@v0.0.0-20190311183353-d8887717615a stdlib@go1.16.4	0.55.0 1.25.13
quay.io/kubernetes-multicluster/kubefed :v0.7.0	6d56f69b15a3	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.15.3	0.55.0 1.25.13
quay.io/prometheus/alertmanager :v0.21.0	24a5204b418e	golang.org/x/net@v0.0.0-20200513185701-a91f0712d120 stdlib@go1.14.4	0.55.0 1.25.13
quay.io/thanos/thanos :v0.17.1	e362f02ed304	golang.org/x/net@v0.0.0-20201006153459-a7d1128ccaa0 stdlib@go1.15	0.55.0 1.25.13

Open the chart page →

68,529

kube-prometheus-stackmesosphere-stable

75.9.1

6 of 7 See more

kube-prometheus-stack mesosphere-stable 75.9.1

6 of the 7 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
bitnamilegacy/kubectl :1.29.2	c74b703deed2	golang.org/x/net@v0.19.0 stdlib@go1.21.7	0.55.0 1.25.13
grafana/grafana :12.0.2	b5b59bfc7561	golang.org/x/net@v0.40.0 stdlib@go1.24.4	0.55.0 1.25.13
quay.io/prometheus-operator/prometheus-operator :v0.83.0	b6a89b8ec08f	golang.org/x/net@v0.40.0 stdlib@go1.24.3	0.55.0 1.25.13
quay.io/prometheus/node-exporter :v1.9.1	d00a542e409e	golang.org/x/net@v0.37.0 stdlib@go1.23.7	0.55.0 1.25.13
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.6.0	c9f76a75fd00	golang.org/x/net@v0.41.0 stdlib@go1.24.4	0.55.0 1.25.13
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.16.0	e750cd4b43f7	golang.org/x/net@v0.40.0 stdlib@go1.24.4	0.55.0 1.25.13

Open the chart page →

10,616

logging-operatormesosphere-stable

6.7.0

1 of 1 See more

logging-operator mesosphere-stable 6.7.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/kube-logging/logging-operator :6.7.0	df10e783095e	stdlib@go1.26.3	1.25.13

Open the chart page →

108

multusmesosphere-stable

0.1.1

1 of 1 See more

multus mesosphere-stable 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/k8snetworkplumbingwg/multus-cni :v4.2.4-thick	3c20900b5381	golang.org/x/net@v0.43.0 stdlib@go1.24.13	0.55.0 1.25.13

Open the chart page →

1,854

opsportalmesosphere-stable

0.9.5

1 of 3 See more

opsportal mesosphere-stable 0.9.5

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
mesosphere/kubeaddons-addon-initializer :v0.2.0	9f863160127b	golang.org/x/net@v0.0.0-20190613194153-d28f0bde5980 stdlib@go1.13.7	0.55.0 1.25.13

Open the chart page →

7,034

valkeymesosphere-stable

3.0.22

1 of 1 See more

valkey mesosphere-stable 3.0.22

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
bitnamilegacy/valkey :8.1.3-debian-12-r1	a185655855b3	stdlib@go1.24.4	1.25.13

Open the chart page →

2,701

veleromesosphere-stable

3.2.5

1 of 1 See more

velero mesosphere-stable 3.2.5

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
bitnamilegacy/kubectl :1.26.4	a0a972324d93	golang.org/x/net@v0.7.0 stdlib@go1.19.8	0.55.0 1.25.13

Open the chart page →

1,871

metacontroller-helmmetacontroller

4.17.2

1 of 1 See more

metacontroller-helm metacontroller 4.17.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/metacontroller/metacontroller :v4.17.2	d7a55ebc70b4	stdlib@go1.26.5	1.25.13

Open the chart page →

205

cortexmetakube

0.6.0

1 of 2 See more

cortex metakube 0.6.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/cortexproject/cortex :v1.9.0	5d1c2cf4c538	golang.org/x/net@v0.0.0-20210324051636-2c4c8ecb7826 stdlib@go1.16.3	0.55.0 1.25.13

Open the chart page →

4,117

istio-operatormetakube

1.12.0

1 of 1 See more

istio-operator metakube 1.12.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
istio/operator :1.12.0	6cfce8a071b9	golang.org/x/net@v0.0.0-20211020060615-d418f374d309 stdlib@go1.17.3	0.55.0 1.25.13

Open the chart page →

8,995

wg-access-servermglants

0.4.7

1 of 1 See more

wg-access-server mglants 0.4.7

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
place1/wg-access-server :v0.4.6	2b2f3ea80ed6	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.13.8	0.55.0 1.25.13

Open the chart page →

2,753

activityrelaymhamzahkhan

1.0.66

1 of 2 See more

activityrelay mhamzahkhan 1.0.66

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
yukimochi/activity-relay :v2.0.11	5798afb69216	stdlib@go1.25.12	1.25.13

Open the chart page →

220

gogsmhio

0.9.2

1 of 2 See more

gogs mhio 0.9.2

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
gogs/gogs :0.12.1	420d53bb7277	golang.org/x/net@v0.0.0-20191014212845-da9a3fd4c582 stdlib@go1.14.7	0.55.0 1.25.13

Open the chart page →

3,232

postgresmicroboxlabs

0.3.0

1 of 1 See more

postgres microboxlabs 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :16.6	557fea37a744	stdlib@go1.18.2	1.25.13

Open the chart page →

3,982

resource-servicemicroservices-learning

1.5.0

1 of 2 See more

resource-service microservices-learning 1.5.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :latest	86c951e05bf5	stdlib@go1.24.6	1.25.13

Open the chart page →

4,815

song-servicemicroservices-learning

1.2.0

1 of 2 See more

song-service microservices-learning 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :latest	86c951e05bf5	stdlib@go1.24.6	1.25.13

Open the chart page →

4,283

apimicroslac

0.1.0

1 of 2 See more

api microslac 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
kong/kubernetes-ingress-controller :3.1	999213b98257	golang.org/x/net@v0.23.0 stdlib@go1.21.9	0.55.0 1.25.13

Open the chart page →

3,435

argomicroslac

0.1.0

3 of 4 See more

argo microslac 0.1.0

3 of the 4 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/redis :7.2.4-alpine	c8bb255c3559	stdlib@go1.18.2	1.25.13
ghcr.io/dexidp/dex :v2.38.0	b1d793440a98	golang.org/x/net@v0.20.0 stdlib@go1.21.6	0.55.0 1.25.13
quay.io/argoproj/argocd :v2.10.7	83c86003b781	golang.org/x/net@v0.17.0 stdlib@go1.20.10	0.55.0 1.25.13

Open the chart page →

10,029

streamsmicroslac

0.1.0

1 of 6 See more

streams microslac 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
microslac/kafka-connect :latest	a90091a1f524	golang.org/x/net@v0.10.0 stdlib@go1.20.4	0.55.0 1.25.13

Open the chart page →

19,907

kube-agent-chartmiddleware-labs

0.1.2

1 of 1 See more

kube-agent-chart middleware-labs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/middleware-labs/agent-kube-go :dev	17369c4cd390	golang.org/x/net@v0.4.0 stdlib@go1.18.9	0.55.0 1.25.13

Open the chart page →

1,809

middleware-odigosmiddleware-labs

0.2.41

4 of 6 See more

middleware-odigos middleware-labs 0.2.41

4 of the 6 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/middleware-labs/odigos-autoscaler :middleware-test-0.0.14	aac0389614e4	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.10	0.55.0 1.25.13
ghcr.io/middleware-labs/odigos-instrumentor :middleware-test-0.0.1	04ae1fc698a5	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.10	0.55.0 1.25.13
ghcr.io/middleware-labs/odigos-odiglet :middleware-test-0.0.1	03c8c835ecee	golang.org/x/net@v0.3.1-0.20221206200815-1e63c2f08a10 stdlib@go1.19.6	0.55.0 1.25.13
ghcr.io/middleware-labs/odigos-scheduler :middleware-test-0.0.1	09741c86aee7	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.10	0.55.0 1.25.13

Open the chart page →

8,386

middleware-visionmiddleware-labs

0.2.65

4 of 6 See more

middleware-vision middleware-labs 0.2.65

4 of the 6 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/middleware-labs/vision-autoscaler :middleware-test-0.0.23	1f7f89bc6585	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.10	0.55.0 1.25.13
ghcr.io/middleware-labs/vision-instrumentor :middleware-test-0.0.4	dfa5907170c4	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.10	0.55.0 1.25.13
ghcr.io/middleware-labs/vision-odiglet :middleware-test-0.0.3	bce34c98668e	golang.org/x/net@v0.3.1-0.20221206200815-1e63c2f08a10 stdlib@go1.19.7	0.55.0 1.25.13
ghcr.io/middleware-labs/vision-scheduler :middleware-test-0.0.3	3609a075c825	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.10	0.55.0 1.25.13

Open the chart page →

8,378

mw-autoinstrumentationmiddleware-labs

1.2.6

5 of 6 See more

mw-autoinstrumentation middleware-labs 1.2.6

5 of the 6 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/middleware-labs/mw-auto-injector :0.1.1	8512248e17e8	golang.org/x/net@v0.26.0 stdlib@go1.23.12	0.55.0 1.25.13
ghcr.io/middleware-labs/mw-lang-aggregator :0.1.0	ae6e13970ec2	golang.org/x/net@v0.26.0 stdlib@go1.24.0	0.55.0 1.25.13
ghcr.io/middleware-labs/mw-lang-detector :0.1.2	a4776aa2a56b	golang.org/x/net@v0.26.0 stdlib@go1.23.12	0.55.0 1.25.13
ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator :0.132.0	5e331c925091	golang.org/x/net@v0.41.0 stdlib@go1.24.6	0.55.0 1.25.13
quay.io/brancz/kube-rbac-proxy :v0.19.1	9f21034731c7	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.55.0 1.25.13

Open the chart page →

3,756

mw-kube-agentmiddleware-labs

0.1.2

1 of 1 See more

mw-kube-agent middleware-labs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/middleware-labs/mw-kube-agent :master	056f0953763d	golang.org/x/net@v0.14.0 stdlib@go1.20.14	0.55.0 1.25.13

Open the chart page →

1,612

mw-kube-agent-v3middleware-labs

1.8.5

2 of 2 See more

mw-kube-agent-v3 middleware-labs 1.8.5

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/middleware-labs/mw-kube-agent :1.21.0	ff23f452813a	golang.org/x/net@v0.53.0 stdlib@go1.25.6	0.55.0 1.25.13
ghcr.io/middleware-labs/mw-kube-agent-config-updater :1.21.0	d4edc3f244f4	golang.org/x/net@v0.53.0 stdlib@go1.25.6	0.55.0 1.25.13

Open the chart page →

2,131

sshportalmidokura-community

0.1.4

1 of 2 See more

sshportal midokura-community 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
moul/sshportal :v1.19.3	332b603727c3	stdlib@go1.17.6	1.25.13

Open the chart page →

2,339

argocd-extra-app-info-exportermikejoh

0.1.12

1 of 1 See more

argocd-extra-app-info-exporter mikejoh 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
mikejoh/argocd-extra-app-info-exporter :0.2.0	5c5a3b734271	golang.org/x/net@v0.30.0 stdlib@go1.23.4	0.55.0 1.25.13

Open the chart page →

1,365

imaginemikejoh

0.2.0

1 of 1 See more

imagine mikejoh 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
mikejoh/imagine :0.1.0	78737d7345f9	golang.org/x/net@v0.26.0 stdlib@go1.23.3	0.55.0 1.25.13

Open the chart page →

559

local-path-provisionermikejoh

0.0.29

1 of 1 See more

local-path-provisioner mikejoh 0.0.29

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
rancher/local-path-provisioner :v0.0.29	9bebefa0b908	golang.org/x/net@v0.27.0 stdlib@go1.22.5	0.55.0 1.25.13

Open the chart page →

1,301

miniomilvus-helm

8.0.20

1 of 1 See more

minio milvus-helm 8.0.20

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2024-05-28T17-19-04Z	391d1d45fdbe	golang.org/x/net@v0.25.0 stdlib@go1.22.3	0.55.0 1.25.13

Open the chart page →

1,685

pulsarv2milvus-helm

2.7.8

2 of 4 See more

pulsarv2 milvus-helm 2.7.8

2 of the 4 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
prom/prometheus :v2.17.2	42d2395cd719	golang.org/x/net@v0.0.0-20200301022130-244492dfa37a stdlib@go1.13.10	0.55.0 1.25.13
streamnative/apache-pulsar-grafana-dashboard-k8s :0.0.10	ebcf7f033b54	golang.org/x/net@v0.0.0-20190923162816-aa69164e4478 stdlib@go1.13.4	0.55.0 1.25.13

Open the chart page →

15,889

mimirmimir

0.1.10

1 of 1 See more

mimir mimir 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/heimops/mimir-operator :latest	4e1a3ef1fe82	golang.org/x/net@v0.17.0 stdlib@go1.24.13	0.55.0 1.25.13

Open the chart page →

382

zkapps-dashboardmina

0.1.2

1 of 2 See more

zkapps-dashboard mina 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :12-alpine	7c8f48705831	stdlib@go1.18.2	1.25.13

Open the chart page →

1,672

mini-blogmini-blog-helm

0.1.0

1 of 3 See more

mini-blog mini-blog-helm 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :15	dfbbb0ad8cab	stdlib@go1.24.6	1.25.13

Open the chart page →

12,948

minio-operatorminio-operator

4.3.7

1 of 2 See more

minio-operator minio-operator 4.3.7

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
minio/operator :v4.3.7	54393e03f3b2	golang.org/x/net@v0.0.0-20210421230115-4e50805a0758 stdlib@go1.17.4	0.55.0 1.25.13

Open the chart page →

6,101

MINTmint

8.0.2

1 of 15 See more

MINT mint 8.0.2

1 of the 15 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :13-alpine	fb9065b6e3e2	stdlib@go1.24.6	1.25.13

Open the chart page →

112,683

aws-api-gateway-operatormintel

0.1.2

1 of 11 See more

aws-api-gateway-operator mintel 0.1.2

1 of the 11 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/docker :20.10-dind	af96c680a7e1	golang.org/x/net@v0.4.0 stdlib@go1.19.7	0.55.0 1.25.13

Open the chart page →

10,727

standard-application-stackmintel

11.5.0

1 of 12 See more

standard-application-stack mintel 11.5.0

1 of the 12 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/docker :20.10-dind	af96c680a7e1	golang.org/x/net@v0.4.0 stdlib@go1.19.7	0.55.0 1.25.13

Open the chart page →

10,727

helmmirasys-chart

0.1.0

1 of 4 See more

helm mirasys-chart 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/mongo :latest	5d7043a4ffe0	stdlib@go1.26.5	1.25.13

Open the chart page →

3,715

mitosmitos

1.6.0

5 of 7 See more

mitos mitos 1.6.0

5 of the 7 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/mitos-run/mitos-console :v1.6.0	209e966322ab	stdlib@go1.26.4	1.25.13
ghcr.io/mitos-run/mitos-controller :v1.6.0	b547c38dcc9d	stdlib@go1.26.4	1.25.13
ghcr.io/mitos-run/mitos-forkd :v1.6.0	979b462ab7d6	stdlib@go1.26.4	1.25.13
ghcr.io/mitos-run/mitos-gateway :v1.6.0	017274a28204	stdlib@go1.26.4	1.25.13
ghcr.io/mitos-run/mitos-kvm-device-plugin :v1.6.0	63e2b78d03c4	stdlib@go1.26.4	1.25.13

Open the chart page →

3,097

jupyterhubmizzoukube

0.0.1-set.by.chartpress

1 of 7 See more

jupyterhub mizzoukube 0.0.1-set.by.chartpress

1 of the 7 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
registry.k8s.io/kube-scheduler :v1.28.7	3ae5620a33bb	golang.org/x/net@v0.19.0 stdlib@go1.21.7	0.55.0 1.25.13

Open the chart page →

1,897

cert-manager-webhook-duckdnsmmontes

1.2.3

1 of 1 See more

cert-manager-webhook-duckdns mmontes 1.2.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ebrianne/cert-manager-webhook-duckdns :v1.2.3	9cd17700c9ec	golang.org/x/net@v0.0.0-20200822124328-c89045814202 stdlib@go1.15.13	0.55.0 1.25.13

Open the chart page →

2,856

cockroachdb-operatormmontes

0.1.0

1 of 1 See more

cockroachdb-operator mmontes 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
cockroachdb/cockroach-operator :v2.1.0	983312754620	golang.org/x/net@v0.0.0-20200602114024-627f9648deb9 stdlib@go1.13.14	0.55.0 1.25.13

Open the chart page →

7,821

echoperatormmontes

0.0.2

1 of 1 See more

echoperator mmontes 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/mmontes11/echoperator :v0.0.4	a544a71c6e3b	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.18.3	0.55.0 1.25.13

Open the chart page →

1,828

mariadbmmontes

0.3.0

1 of 1 See more

mariadb mmontes 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/mariadb :10.7.3	07e06f2e7ae9	stdlib@go1.16.7	1.25.13

Open the chart page →

10,183

mongodbmmontes

0.5.0

1 of 1 See more

mongodb mmontes 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/mongo :4.4.13	05678ae4e5e1	stdlib@go1.16.7	1.25.13

Open the chart page →

7,204

basic-git-servermoikot

0.0.2

1 of 1 See more

basic-git-server moikot 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
moikot/basic-git-server :0.0.2	0d941bd30ffa	stdlib@go1.14.9	1.25.13

Open the chart page →

2,955

corednsmoikot

1.13.3

1 of 1 See more

coredns moikot 1.13.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
coredns/coredns :1.7.0	73ca82b4ce82	golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e stdlib@go1.14.4	0.55.0 1.25.13

Open the chart page →

2,556

smartthings-metricsmoikot

0.1.0

1 of 1 See more

smartthings-metrics moikot 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
moikot/smartthings-metrics :0.1.0	8625f53aa9b7	golang.org/x/net@v0.0.0-20200602114024-627f9648deb9 stdlib@go1.14.13	0.55.0 1.25.13

Open the chart page →

1,745

smartthings-metrics-feat-log-detailsmoikot

0.0.92

1 of 1 See more

smartthings-metrics-feat-log-details moikot 0.0.92

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
moikot/smartthings-metrics :feat-log-details	fb8565140106	golang.org/x/net@v0.0.0-20200602114024-627f9648deb9 stdlib@go1.14.15	0.55.0 1.25.13

Open the chart page →

1,733

Container images carrying it

5,405 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/eugenmayer/whoami-tls :0.1.0	477be2d05aba	stdlib@go1.24.1	1.25.13	1
ghcr.io/eumel8/rancher-servicemonitor :0.2.1	f34428cac187	golang.org/x/net@v0.22.0 stdlib@go1.22.1	0.55.0 1.25.13	1
ghcr.io/evilgn0me/ingressmonitorcontroller :v0.0.5	0bbfa4db14b9	golang.org/x/net@v0.47.0 stdlib@go1.24.13	0.55.0 1.25.13	1
ghcr.io/external-secrets/external-secrets :v0.3.11	56a1ea4490ba	golang.org/x/net@v0.0.0-20210805182204-aaa1db679c0d stdlib@go1.17.5	0.55.0 1.25.13	1
ghcr.io/external-secrets/external-secrets :v2.4.1	9440a40b3947	golang.org/x/net@v0.52.0 stdlib@go1.26.2	0.55.0 1.25.13	1
ghcr.io/external-secrets/external-secrets :v2.1.0	ec40c3d9c48f	golang.org/x/net@v0.49.0 stdlib@go1.25.7	0.55.0 1.25.13	1
ghcr.io/extrality/cert-manager-webhook-namecheap :latest	e3552fa0c68a	golang.org/x/net@v0.10.0 stdlib@go1.20.6	0.55.0 1.25.13	1
ghcr.io/fabioluciano/tekton-events-relay :0.10.1	84cb5a2b8b81	stdlib@go1.26.4	1.25.13	1
ghcr.io/fbuchner/meerkat-crm :1.7.0	d513bdd3ae80	stdlib@go1.26.5	1.25.13	1
ghcr.io/ferama/rospo :v0.12.0	ab40c1745534	golang.org/x/net@v0.20.0 stdlib@go1.21.6	0.55.0 1.25.13	1
ghcr.io/ferama/vipien :v0.5.3	923a3f704b21	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.17.8	0.55.0 1.25.13	1
ghcr.io/fernferret/mediawiki-backup :v0.2.2	bbef381294ed	golang.org/x/net@v0.3.1-0.20221206200815-1e63c2f08a10 stdlib@go1.19.5	0.55.0 1.25.13	1
ghcr.io/ferretdb/ferretdb :2.7.0	5706414241eb	golang.org/x/net@v0.46.0 stdlib@go1.25.4	0.55.0 1.25.13	1
ghcr.io/ferro-labs/ai-gateway :1.2.0	baa285ec0fc9	stdlib@go1.25.12	1.25.13	1
ghcr.io/fikaworks/grgate :v0.6.3	7104f60d8972	stdlib@go1.20.2	1.25.13	1
ghcr.io/firecrawl/firecrawl :2.11.384	36118ba96cb5	golang.org/x/net@v0.41.0 stdlib@go1.26.4	0.55.0 1.25.13	1
ghcr.io/firecrawl/nuq-postgres :latest	f9388bd25ae2	stdlib@go1.24.6	1.25.13	1
ghcr.io/fission/fission-bundle :v1.27.0	d353720b037a	stdlib@go1.26.4	1.25.13	1
ghcr.io/fission/pre-upgrade-checks :v1.27.0	b053fc3539b4	stdlib@go1.26.4	1.25.13	1
ghcr.io/fission/reporter :v1.27.0	c77cc925debe	stdlib@go1.26.4	1.25.13	1
ghcr.io/fjogeleit/trivy-operator-polr-adapter :0.11.5	37029b4d464f	stdlib@go1.26.4	1.25.13	1
ghcr.io/flanksource/facet :0.1.72	37237038be15	stdlib@go1.23.12	1.25.13	1
ghcr.io/flanksource/postgres :17.6-497383c	ebcf66281fc1	golang.org/x/net@v0.46.0 stdlib@go1.25.4	0.55.0 1.25.13	1
ghcr.io/flannel-io/flannel :v0.28.9	708a2c9c1cfb	stdlib@go1.26.5	1.25.13	1
ghcr.io/flannel-io/flannel-cni-plugin :v1.9.1-flannel3	9fccdf677e6e	stdlib@go1.26.5	1.25.13	1
ghcr.io/flatcar/flatcar-linux-update-operator :v0.10.0-rc1	f9063e20b1f6	golang.org/x/net@v0.8.0 stdlib@go1.20.6	0.55.0 1.25.13	1
ghcr.io/flatcar/nebraska :4.0.0	5c9e99ff7167	golang.org/x/net@v0.44.0 stdlib@go1.24.13	0.55.0 1.25.13	1
ghcr.io/flohansen/dasher-server :latest	7cde8c3fa2d1	golang.org/x/net@v0.22.0 stdlib@go1.22.5	0.55.0 1.25.13	1
ghcr.io/fluent/fluent-operator/fluent-operator :3.10.0	3108194a4ecc	stdlib@go1.26.3	1.25.13	1
ghcr.io/fluxcd/flagger-loadtester :0.39.0	6a8546993cb5	golang.org/x/net@v0.28.0 stdlib@go1.24.12	0.55.0 1.25.13	1
ghcr.io/fluxcd/flux-cli :v2.9.1	020edbaee890	golang.org/x/net@v0.49.0 stdlib@go1.26.4	0.55.0 1.25.13	1
ghcr.io/fluxcd/flux-cli :v2.5.1	274a179fd402	golang.org/x/net@v0.35.0 stdlib@go1.23.6	0.55.0 1.25.13	1
ghcr.io/fluxcd/helm-controller :v1.2.0	62eaa9c9a929	golang.org/x/net@v0.34.0 stdlib@go1.23.6	0.55.0 1.25.13	1
ghcr.io/fluxcd/helm-controller :v1.6.2	e17ab0e5885d	stdlib@go1.26.4	1.25.13	1
ghcr.io/fluxcd/source-controller :v1.5.0	00cd9316a379	golang.org/x/net@v0.34.0 stdlib@go1.23.6	0.55.0 1.25.13	1
ghcr.io/fluxcd/source-controller :v1.9.2	2b8d06650a1b	stdlib@go1.26.4	1.25.13	1
ghcr.io/fluxerapp/fluxer-static :2026.812.125337	cfe98ae544df	golang.org/x/net@v0.42.0 stdlib@go1.25.0	0.55.0 1.25.13	1
ghcr.io/formancehq/console :console-on.v1.1.1	a4d32c2f68b3	stdlib@go1.20.12	1.25.13	1
ghcr.io/formancehq/console-v3 :v1.16.0	c99e8ef2c545	stdlib@go1.23.8	1.25.13	1
ghcr.io/formancehq/dex :v1.0.4	b803fbe1cdb8	golang.org/x/net@v0.0.0-20220927171203-f486391704dc stdlib@go1.19.1	0.55.0 1.25.13	1
ghcr.io/formancehq/ledger :v1.9.2	03c1ddbda33b	golang.org/x/net@v0.4.0 stdlib@go1.18.10	0.55.0 1.25.13	1
ghcr.io/formancehq/membership :v1.11.0	24a0113d5fb0	golang.org/x/net@v0.41.0 stdlib@go1.24.6	0.55.0 1.25.13	1
ghcr.io/formancehq/portal :v1.16.0	6efef5d19d56	stdlib@go1.23.8	1.25.13	1
ghcr.io/foxcpp/maddy :0.9.5	de42151adff6	golang.org/x/net@v0.34.0 stdlib@go1.23.12	0.55.0 1.25.13	1
ghcr.io/fpetr/readium-lcp-server-docker-helm/lcpserver :1.9.0	324f9b7b689c	golang.org/x/net@v0.17.0 stdlib@go1.22.0	0.55.0 1.25.13	1
ghcr.io/fpetr/readium-lcp-server-docker-helm/lsdserver :1.9.0	cdba39e3f3d0	golang.org/x/net@v0.17.0 stdlib@go1.22.0	0.55.0 1.25.13	1
ghcr.io/g0dscookie/aptly :latest	edd095d3c0ee	stdlib@go1.18.3	1.25.13	1
ghcr.io/g0dscookie/icinga2 :2.13.5	da81246ccfc9	golang.org/x/net@v0.0.0-20210813160813-60bc85c4be6d stdlib@go1.18.1	0.55.0 1.25.13	1
ghcr.io/gabe565/ascii-movie :1.9.6	27f85bb98da3	stdlib@go1.24.0	1.25.13	1
ghcr.io/gabe565/castsponsorskip :0.8.1	5f7b4c6dd299	golang.org/x/net@v0.32.0 stdlib@go1.23.4	0.55.0 1.25.13	1