CVE-2026-39821

High

Advisory

Published 22 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,616; of 17,805 indexed, latest versions
Container images: 5,324; deployed by those charts
Fix available: 3 of 3; affected packages

Red Hat Security Advisory: git-lfs security update

Carried by container images the latest versions of 4,616 of 17,805 indexed charts deploy, on 5,324 images.

Affected package	Affected versions	Fixed in	Images
git-lfsrpm	2.13.3-3.el8_6	0:3.4.1-11.el8_10	1
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+190 more	1.25.13	5,284
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+220 more	0.55.0	3,716

OSV records: RHSA-2026:30853 GO-2026-5026

Charts affected

4,616 by stars

Chart

Latest

Affected images

Radar Score

saleor-appstrieb-work

0.6.0

3 of 5 See more

saleor-apps trieb-work 0.6.0

3 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed :1.23.1	1d435b4ab372	stdlib@go1.23.7	1.25.13
ghcr.io/trieb-work/saleor-apps/saleor-app-search :1.24.3	28edefb6c92d	stdlib@go1.23.7	1.25.13
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp :1.4.3	57a06bfba327	stdlib@go1.23.7	1.25.13

Open the chart page →

7,495

harbor-scanner-trivytrivy-operator

0.31.2

1 of 1 See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
aquasec/harbor-scanner-trivy :0.31.2	6e790e233872	golang.org/x/net@v0.25.0 stdlib@go1.22.3	0.55.0 1.25.13

Open the chart page →

2,489

posteetrivy-operator

2.14.0

2 of 3 See more

postee trivy-operator 2.14.0

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
aquasec/postee :2.12.0-amd64	0795cba777e7	golang.org/x/net@v0.7.0 stdlib@go1.18.10	0.55.0 1.25.13
aquasec/postee-ui :2.12.0-amd64	c0467c3941dc	golang.org/x/net@v0.7.0 stdlib@go1.18.10	0.55.0 1.25.13

Open the chart page →

4,817

traceetrivy-operator

0.24.1

1 of 1 See more

tracee trivy-operator 0.24.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
aquasec/tracee :0.24.1	cfbbfee972e6	golang.org/x/net@v0.42.0 stdlib@go1.24.9	0.55.0 1.25.13

Open the chart page →

1,228

trivy-webhook-aws-security-hubtrivy-webhook-aws-security-hub

0.1.20

1 of 1 See more

trivy-webhook-aws-security-hub trivy-webhook-aws-security-hub 0.1.20

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/csepulveda/trivy-webhook-aws-security-hub :v0.1.20	6836b779b060	golang.org/x/net@v0.50.0 stdlib@go1.26.2	0.55.0 1.25.13

Open the chart page →

618

trivy-webhook-elasticsearchtrivy-webhook-elasticsearch

0.1.4

1 of 1 See more

trivy-webhook-elasticsearch trivy-webhook-elasticsearch 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/lbi22/trivy-webhook-elasticsearch :v0.1.4	b51b824e4f19	stdlib@go1.22.8	1.25.13

Open the chart page →

755

trouw-servicetrouw-service

1.0.0

1 of 3 See more

trouw-service trouw-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/trouw-service-php :latest	f745e2870692	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.55.0 1.25.13

Open the chart page →

7,521

monitorortrozz

0.0.1

1 of 1 See more

monitoror trozz 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
monitoror/monitoror :4	4b88edcf51ff	golang.org/x/net@v0.0.0-20191209160850-c0dbc17a3553 stdlib@go1.14.6	0.55.0 1.25.13

Open the chart page →

3,110

clickhouse-operatortruefoundry

0.1.1

2 of 3 See more

clickhouse-operator truefoundry 0.1.1

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.23.3	4baec90b20cd	golang.org/x/net@v0.17.0 stdlib@go1.20.14	0.55.0 1.25.13
altinity/metrics-exporter :0.23.3	2912a6c15b44	golang.org/x/net@v0.17.0 stdlib@go1.20.14	0.55.0 1.25.13

Open the chart page →

1,432

tfy-agenttruefoundry

0.2.104

2 of 5 See more

tfy-agent truefoundry 0.2.104

2 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/external-secrets/external-secrets :v2.4.1	9440a40b3947	golang.org/x/net@v0.52.0 stdlib@go1.26.2	0.55.0 1.25.13
ghcr.io/stakater/reloader :v1.4.19	0530cf462fa3	stdlib@go1.26.4	1.25.13

Open the chart page →

688

tfy-cloudflaredtruefoundry

0.6.0

1 of 2 See more

tfy-cloudflared truefoundry 0.6.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
public.ecr.aws/docker/library/caddy :2.6.3	87cbd356af2e	golang.org/x/net@v0.5.0 stdlib@go1.20	0.55.0 1.25.13

Open the chart page →

2,035

tfy-distributortruefoundry

0.0.1

3 of 4 See more

tfy-distributor truefoundry 0.0.1

3 of the 4 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/nats :2.10.7-alpine	1bcddab51b80	stdlib@go1.21.5	1.25.13
natsio/nats-server-config-reloader :0.14.0	8c28b75bc416	stdlib@go1.20.5	1.25.13
natsio/prometheus-nats-exporter :0.13.0	2adf791d9f9f	stdlib@go1.21.3	1.25.13

Open the chart page →

17,459

tfy-inferentia-operatortruefoundry

0.2.8

3 of 3 See more

tfy-inferentia-operator truefoundry 0.2.8

3 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
public.ecr.aws/eks-distro/kubernetes/kube-scheduler :v1.29.14-eks-1-29-latest	e7e1db003e6a	golang.org/x/net@v0.24.0 stdlib@go1.22.12	0.55.0 1.25.13
public.ecr.aws/neuron/neuron-device-plugin :2.23.30.0	75a6d5ce3bd3	golang.org/x/net@v0.23.0 stdlib@go1.20.4	0.55.0 1.25.13
public.ecr.aws/neuron/neuron-scheduler :2.23.30.0	4cd274463e6b	golang.org/x/net@v0.23.0 stdlib@go1.20.4	0.55.0 1.25.13

Open the chart page →

2,926

tfy-karpentertruefoundry

0.5.11

2 of 3 See more

tfy-karpenter truefoundry 0.5.11

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
public.ecr.aws/karpenter/controller :1.9.0	30a506c64fbb	golang.org/x/net@v0.48.0 stdlib@go1.25.7	0.55.0 1.25.13
public.ecr.aws/truefoundrycloud/eks/eks-node-monitoring-agent :v1.5.1-eksbuild.1	988c8e1a273a	golang.org/x/net@v0.49.0 stdlib@go1.25.6	0.55.0 1.25.13

Open the chart page →

654

tfy-kservetruefoundry

0.1.1

1 of 2 See more

tfy-kserve truefoundry 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
kserve/kserve-controller :v0.10.0	22ff858b57c1	golang.org/x/net@v0.4.0 stdlib@go1.18.10	0.55.0 1.25.13

Open the chart page →

1,178

tfy-llm-gateway-infratruefoundry

0.2.10

2 of 3 See more

tfy-llm-gateway-infra truefoundry 0.2.10

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.23.7	74315beb57db	golang.org/x/net@v0.17.0 stdlib@go1.21.13	0.55.0 1.25.13
altinity/metrics-exporter :0.23.7	a4d7ff0c727e	golang.org/x/net@v0.17.0 stdlib@go1.21.13	0.55.0 1.25.13

Open the chart page →

1,210

tfy-lokitruefoundry

0.1.6

2 of 2 See more

tfy-loki truefoundry 0.1.6

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
grafana/loki :2.9.10	35b02acc6765	golang.org/x/net@v0.26.0 stdlib@go1.22.5	0.55.0 1.25.13
grafana/promtail :2.9.10	63a2e57a5b14	golang.org/x/net@v0.26.0 stdlib@go1.22.5	0.55.0 1.25.13

Open the chart page →

2,828

truefoundry-monitoringtruefoundry

0.1.6

4 of 8 See more

truefoundry-monitoring truefoundry 0.1.6

4 of the 8 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
grafana/grafana :12.3.0	70d9599b186c	golang.org/x/net@v0.46.0 stdlib@go1.25.3	0.55.0 1.25.13
ghcr.io/jkroepke/kube-webhook-certgen :1.7.4	7a62bba56a7c	golang.org/x/net@v0.48.0 stdlib@go1.25.5	0.55.0 1.25.13
quay.io/prometheus-operator/prometheus-operator :v0.88.0	b4f51de53357	golang.org/x/net@v0.48.0 stdlib@go1.25.5	0.55.0 1.25.13
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.18.0	1545919b72e3	golang.org/x/net@v0.48.0 stdlib@go1.25.5	0.55.0 1.25.13

Open the chart page →

4,598

twentytwenty-crm

0.1.11

1 of 4 See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :16-alpine	cf78e76683b9	stdlib@go1.24.6	1.25.13

Open the chart page →

5,644

aws-eks-asg-rolling-update-handlertwin

1.5.0

1 of 1 See more

aws-eks-asg-rolling-update-handler twin 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
twinproduction/aws-eks-asg-rolling-update-handler :v1.7.0	8f38c206972e	golang.org/x/net@v0.1.0 stdlib@go1.19.3	0.55.0 1.25.13

Open the chart page →

1,119

lighthousetwin

1.0.2

1 of 1 See more

lighthouse twin 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/twin/lighthouse :v0.0.4	5aeda2ea2ba2	golang.org/x/net@v0.23.0 stdlib@go1.22.3	0.55.0 1.25.13

Open the chart page →

544

twitter-apptwitter-helm

0.1.12

4 of 8 See more

twitter-app twitter-helm 0.1.12

4 of the 8 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
stakkato95/twitter-service-analytics :0.1.0	5d48906d66b3	golang.org/x/net@v0.0.0-20220520000938-2e3eb7b945c2 stdlib@go1.18.3	0.55.0 1.25.13
stakkato95/twitter-service-graphql :0.1.1	3cbe857234f2	golang.org/x/net@v0.0.0-20220412020605-290c469a71a5 stdlib@go1.18.3	0.55.0 1.25.13
stakkato95/twitter-service-tweets :0.1.1	8412d8a8cac3	stdlib@go1.18.3	1.25.13
stakkato95/twitter-service-users :0.1.1	456049efee9a	golang.org/x/net@v0.0.0-20220412020605-290c469a71a5 stdlib@go1.18.3	0.55.0 1.25.13

Open the chart page →

6,150

kafkatwomartens

0.2.1

2 of 2 See more

kafka twomartens 0.2.1

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
confluentinc/cp-kafka :latest	0ad069035863	stdlib@go1.26.5	1.25.13
danielqsj/kafka-exporter :v1.7.0	e90b7ba06d97	golang.org/x/net@v0.10.0 stdlib@go1.20.4	0.55.0 1.25.13

Open the chart page →

1,570

simple-mongodbtyk-helm

0.1.1

1 of 1 See more

simple-mongodb tyk-helm 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/mongo :4.4	4be76f674fc4	stdlib@go1.21.12	1.25.13

Open the chart page →

4,147

tyk-bootstraptyk-helm

5.3.0

3 of 3 See more

tyk-bootstrap tyk-helm 5.3.0

3 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
tykio/tyk-k8s-bootstrap-post :v2.2.0	55b4d31c7a01	golang.org/x/net@v0.23.0 stdlib@go1.22.7	0.55.0 1.25.13
tykio/tyk-k8s-bootstrap-pre-delete :v2.2.0	1489b58f642b	golang.org/x/net@v0.23.0 stdlib@go1.22.7	0.55.0 1.25.13
tykio/tyk-k8s-bootstrap-pre-install :v2.2.0	205215b815a4	stdlib@go1.22.7	1.25.13

Open the chart page →

1,374

tyk-control-planetyk-helm

5.3.0

6 of 7 See more

tyk-control-plane tyk-helm 5.3.0

6 of the 7 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
tykio/tyk-dashboard :v5.13.1	0e03b94c153d	stdlib@go1.25.11	1.25.13
tykio/tyk-gateway-ee :v5.13.1	3e907e675bf9	stdlib@go1.25.11	1.25.13
tykio/tyk-k8s-bootstrap-post :v2.2.0	55b4d31c7a01	golang.org/x/net@v0.23.0 stdlib@go1.22.7	0.55.0 1.25.13
tykio/tyk-k8s-bootstrap-pre-delete :v2.2.0	1489b58f642b	golang.org/x/net@v0.23.0 stdlib@go1.22.7	0.55.0 1.25.13
tykio/tyk-k8s-bootstrap-pre-install :v2.2.0	205215b815a4	stdlib@go1.22.7	1.25.13
tykio/tyk-mdcb-docker :v2.12.0	942a5b8bf847	stdlib@go1.25.11	1.25.13

Open the chart page →

3,265

tyk-dashboardtyk-helm

5.3.0

1 of 1 See more

tyk-dashboard tyk-helm 5.3.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
tykio/tyk-dashboard :v5.13.1	0e03b94c153d	stdlib@go1.25.11	1.25.13

Open the chart page →

815

tyk-data-planetyk-helm

5.3.0

2 of 3 See more

tyk-data-plane tyk-helm 5.3.0

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
tykio/tyk-gateway-ee :v5.13.1	3e907e675bf9	stdlib@go1.25.11	1.25.13
tykio/tyk-pump-docker-pub :v1.16.0	284b9d2ac5da	stdlib@go1.25.11	1.25.13

Open the chart page →

1,010

tyk-dev-portaltyk-helm

5.3.0

1 of 2 See more

tyk-dev-portal tyk-helm 5.3.0

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
tykio/portal :v1.18.0	92509e00e618	stdlib@go1.25.11	1.25.13

Open the chart page →

915

tyk-mdcbtyk-helm

5.3.0

1 of 1 See more

tyk-mdcb tyk-helm 5.3.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
tykio/tyk-mdcb-docker :v2.12.0	942a5b8bf847	stdlib@go1.25.11	1.25.13

Open the chart page →

166

tyk-stacktyk-helm

5.3.0

6 of 7 See more

tyk-stack tyk-helm 5.3.0

6 of the 7 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
tykio/tyk-dashboard :v5.13.1	0e03b94c153d	stdlib@go1.25.11	1.25.13
tykio/tyk-gateway-ee :v5.13.1	3e907e675bf9	stdlib@go1.25.11	1.25.13
tykio/tyk-k8s-bootstrap-post :v2.2.0	55b4d31c7a01	golang.org/x/net@v0.23.0 stdlib@go1.22.7	0.55.0 1.25.13
tykio/tyk-k8s-bootstrap-pre-delete :v2.2.0	1489b58f642b	golang.org/x/net@v0.23.0 stdlib@go1.22.7	0.55.0 1.25.13
tykio/tyk-k8s-bootstrap-pre-install :v2.2.0	205215b815a4	stdlib@go1.22.7	1.25.13
tykio/tyk-pump-docker-pub :v1.16.0	284b9d2ac5da	stdlib@go1.25.11	1.25.13

Open the chart page →

3,199

typhoontyphoon

0.2.3

2 of 2 See more

typhoon typhoon 0.2.3

2 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/zeiss/typhoon/controller :0.2.3	4fdf4edfda45	golang.org/x/net@v0.35.0 stdlib@go1.24.0	0.55.0 1.25.13
ghcr.io/zeiss/typhoon/typhoon-webhook :0.2.3	78f9b82050bc	golang.org/x/net@v0.35.0 stdlib@go1.24.0	0.55.0 1.25.13

Open the chart page →

1,686

deep-learning-toolsuninettsigma2

9.1.2

1 of 3 See more

deep-learning-tools uninettsigma2 9.1.2

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
sigma2as/goidc-proxy :next	656ac798963a	golang.org/x/net@v0.51.0 stdlib@go1.25.7	0.55.0 1.25.13

Open the chart page →

1,572

desktop-vncuninettsigma2

2.0.2

1 of 2 See more

desktop-vnc uninettsigma2 2.0.2

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
sigma2as/goidc-proxy :next	656ac798963a	golang.org/x/net@v0.51.0 stdlib@go1.25.7	0.55.0 1.25.13

Open the chart page →

476

jupyteruninettsigma2

1.1.4

1 of 2 See more

jupyter uninettsigma2 1.1.4

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
sigma2as/goidc-proxy :next	656ac798963a	golang.org/x/net@v0.51.0 stdlib@go1.25.7	0.55.0 1.25.13

Open the chart page →

476

jupyterhubuninettsigma2

1.6.0

1 of 5 See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
bitnamilegacy/kubectl :1.30	1249fc292e84	golang.org/x/net@v0.23.0 stdlib@go1.22.9	0.55.0 1.25.13

Open the chart page →

8,698

miniouninettsigma2

1.2.0

1 of 1 See more

minio uninettsigma2 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
sigma2as/minio :20240306-3a2e4f5	c284ead9ec3e	golang.org/x/net@v0.1.0 stdlib@go1.19.2	0.55.0 1.25.13

Open the chart page →

4,995

rstudiouninettsigma2

1.3.6

1 of 3 See more

rstudio uninettsigma2 1.3.6

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
sigma2as/goidc-proxy :next	656ac798963a	golang.org/x/net@v0.51.0 stdlib@go1.25.7	0.55.0 1.25.13

Open the chart page →

847

sparkuninettsigma2

1.1.4

1 of 3 See more

spark uninettsigma2 1.1.4

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
sigma2as/goidc-proxy :next	656ac798963a	golang.org/x/net@v0.51.0 stdlib@go1.25.7	0.55.0 1.25.13

Open the chart page →

847

agent-sandbox-controllerunique-oci-agent-sandbox-controller

1.0.1

1 of 2 See more

agent-sandbox-controller unique-oci-agent-sandbox-controller 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
registry.k8s.io/agent-sandbox/sandbox-router-go :v1.0.1	25b1a0939630	stdlib@go1.26.2	1.25.13

Open the chart page →

174

kenerunxwares

2026.2.5

1 of 1 See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
rajnandan1/kener :3.2.19	30407afca731	stdlib@go1.20.7	1.25.13

Open the chart page →

5,287

opencloudunxwares

0.2.3

3 of 13 See more

opencloud unxwares 0.2.3

3 of the 13 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :alpine	d3e1620b530c	stdlib@go1.24.6	1.25.13
minio/minio :latest	14cea493d9a3	golang.org/x/net@v0.39.0 stdlib@go1.24.6	0.55.0 1.25.13
opencloudeu/opencloud-rolling :2.1.0	f9634bb04905	golang.org/x/net@v0.38.0 stdlib@go1.24.2	0.55.0 1.25.13

Open the chart page →

45,548

upcloud-csiupcloud-csi

1.18.0

6 of 7 See more

upcloud-csi upcloud-csi 1.18.0

6 of the 7 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-attacher :v4.12.0	b9dc9a714a48	golang.org/x/net@v0.54.0 stdlib@go1.26.3	0.55.0 1.25.13
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.17.0	f9de845b1701	golang.org/x/net@v0.54.0 stdlib@go1.26.3	0.55.0 1.25.13
registry.k8s.io/sig-storage/csi-provisioner :v6.3.0	a4b0b1a37605	stdlib@go1.26.3	1.25.13
registry.k8s.io/sig-storage/csi-resizer :v2.2.0	a2d40c1c3ccb	golang.org/x/net@v0.49.0 stdlib@go1.26.3	0.55.0 1.25.13
registry.k8s.io/sig-storage/csi-snapshotter :v8.6.0	42af0929bcd6	golang.org/x/net@v0.54.0 stdlib@go1.26.3	0.55.0 1.25.13
registry.k8s.io/sig-storage/snapshot-controller :v8.6.0	81e79f205083	golang.org/x/net@v0.54.0 stdlib@go1.26.3	0.55.0 1.25.13

Open the chart page →

1,924

phonebook-chartusuladams2

0.2.1

1 of 3 See more

phonebook-chart usuladams2 0.2.1

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	stdlib@go1.18.2	1.25.13

Open the chart page →

3,176

kiamuswitch

6.1.2

1 of 1 See more

kiam uswitch 6.1.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
quay.io/uswitch/kiam :v4.0	be3a5846922d	golang.org/x/net@v0.0.0-20201216054612-986b41b23924 stdlib@go1.13.8	0.55.0 1.25.13

Open the chart page →

2,972

utho-app-operator-chartutho-operator

0.1.6

1 of 2 See more

utho-app-operator-chart utho-operator 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
utho/utho-app-operator :0.1.4	6e8a690e8b7a	golang.org/x/net@v0.26.0 stdlib@go1.22.8	0.55.0 1.25.13

Open the chart page →

491

gohttpserverutkuozdemir

0.2.0

1 of 1 See more

gohttpserver utkuozdemir 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
codeskyblue/gohttpserver :latest	caa862590e34	golang.org/x/net@v0.0.0-20201021035429-f5854403a974 stdlib@go1.16.3	0.55.0 1.25.13

Open the chart page →

1,899

transmission-exporterutkuozdemir

1.1.0

1 of 1 See more

transmission-exporter utkuozdemir 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
metalmatze/transmission-exporter :0.3.0	90d6acb6d47d	stdlib@go1.13	1.25.13

Open the chart page →

1,647

proxyv2fly

0.0.6

1 of 1 See more

proxy v2fly 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
v2fly/v2fly-core :latest	d06727b221fe	golang.org/x/net@v0.46.0 stdlib@go1.24.2	0.55.0 1.25.13

Open the chart page →

1,436

vals-operatorvals-operator

0.8.1

1 of 1 See more

vals-operator vals-operator 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/digitalis-io/vals-operator :v0.8.1	7c776499b8c9	golang.org/x/net@v0.49.0 stdlib@go1.25.7	0.55.0 1.25.13

Open the chart page →

730

Container images carrying it

5,324 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/prometheus-operator/prometheus-config-reloader :v0.74.0	d55631c7a740	golang.org/x/net@v0.25.0 stdlib@go1.22.3	0.55.0 1.25.13	3
quay.io/prometheus-operator/prometheus-operator :v0.90.1	52a6a92d915e	golang.org/x/net@v0.52.0 stdlib@go1.25.8	0.55.0 1.25.13	3
quay.io/prometheus-operator/prometheus-operator :v0.92.1	7d9247d23514	stdlib@go1.26.4	1.25.13	3
quay.io/prometheus-operator/prometheus-operator :v0.50.0	ab4f480f2cc6	golang.org/x/net@v0.0.0-20210610132358-84b48f89b13b stdlib@go1.16	0.55.0 1.25.13	3
quay.io/prometheus/prometheus :v2.41.0	1a3e9a878e50	golang.org/x/net@v0.4.0 stdlib@go1.19.4	0.55.0 1.25.13	3
quay.io/prometheus/prometheus :v2.55.0	378f4e037035	golang.org/x/net@v0.28.0 stdlib@go1.23.2	0.55.0 1.25.13	3
quay.io/prometheus/prometheus :v2.26.0	38d40a760569	golang.org/x/net@v0.0.0-20210324051636-2c4c8ecb7826 stdlib@go1.16.2	0.55.0 1.25.13	3
quay.io/prometheus/prometheus :v3.10.0	7571a304e67f	golang.org/x/net@v0.49.0 stdlib@go1.26.0	0.55.0 1.25.13	3
quay.io/prometheus/prometheus :v2.31.1	a8779cfe553e	golang.org/x/net@v0.0.0-20211020060615-d418f374d309 stdlib@go1.17.3	0.55.0 1.25.13	3
quay.io/prometheus/prometheus :v2.43.0	f5c29683a301	golang.org/x/net@v0.8.0 stdlib@go1.19.7	0.55.0 1.25.13	3
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	golang.org/x/net@v0.27.0 stdlib@go1.22.6	0.55.0 1.25.13	3
quay.io/prometheus/pushgateway :v1.10.0	7a4d0696a24e	golang.org/x/net@v0.28.0 stdlib@go1.23.1	0.55.0 1.25.13	3
quay.io/prometheus/pushgateway :v1.8.0	c159e946abf4	golang.org/x/net@v0.22.0 stdlib@go1.22.1	0.55.0 1.25.13	3
quay.io/prometheus/snmp-exporter :v0.30.1	e5fd5e8b43ac	golang.org/x/net@v0.48.0 stdlib@go1.25.5	0.55.0 1.25.13	3
quay.io/redhat-cop/kube-rbac-proxy :v0.11.0	c68135620167	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.15.15	0.55.0 1.25.13	3
quay.io/sighup/permission-manager :v1.7.1-rc1	f5e6a5dcee33	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.16.8	0.55.0 1.25.13	3
registry.k8s.io/ingress-nginx/controller :v1.5.1	4ba73c697770	golang.org/x/net@v0.1.0 stdlib@go1.19.2	0.55.0 1.25.13	3
registry.k8s.io/ingress-nginx/controller :v1.8.1	e5c4824e7375	golang.org/x/net@v0.10.0 stdlib@go1.20.5	0.55.0 1.25.13	3
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.4.1	36d05b4077fb	golang.org/x/net@v0.22.0 stdlib@go1.22.2	0.55.0 1.25.13	3
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.5.2	e8825994b7a2	golang.org/x/net@v0.37.0 stdlib@go1.24.1	0.55.0 1.25.13	3
registry.k8s.io/kubectl :v1.31.0	99b37df34bc4	golang.org/x/net@v0.26.0 stdlib@go1.22.5	0.55.0 1.25.13	3
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.17.0	2bbc91556733	golang.org/x/net@v0.41.0 stdlib@go1.24.6	0.55.0 1.25.13	3
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.19.0	6b2f0b6f2f86	golang.org/x/net@v0.51.0 stdlib@go1.26.2	0.55.0 1.25.13	3
registry.k8s.io/sig-storage/csi-attacher :v4.3.0	4eb73137b663	golang.org/x/net@v0.8.0 stdlib@go1.20.3	0.55.0 1.25.13	3
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.12.0	0d23a6fd60c4	golang.org/x/net@v0.28.0 stdlib@go1.22.5	0.55.0 1.25.13	3
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.14.0	5244abbe87e0	golang.org/x/net@v0.40.0 stdlib@go1.24.2	0.55.0 1.25.13	3
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.10.1	f25af73ee708	golang.org/x/net@v0.18.0 stdlib@go1.21.5	0.55.0 1.25.13	3
registry.k8s.io/sig-storage/csi-provisioner :v5.2.0	d5e46da8aff7	golang.org/x/net@v0.34.0 stdlib@go1.23.1	0.55.0 1.25.13	3
registry.k8s.io/sig-storage/csi-resizer :v1.8.0	2e2b44393539	golang.org/x/net@v0.8.0 stdlib@go1.20.3	0.55.0 1.25.13	3
registry.k8s.io/sig-storage/csi-resizer :v1.13.2	8ddd178ba5d0	golang.org/x/net@v0.34.0 stdlib@go1.23.1	0.55.0 1.25.13	3
registry.k8s.io/sig-storage/csi-resizer :v1.9.0	f1f352df9787	golang.org/x/net@v0.13.0 stdlib@go1.20.5	0.55.0 1.25.13	3
registry.k8s.io/sig-storage/csi-snapshotter :v8.4.0	c7e0a3718832	golang.org/x/net@v0.39.0 stdlib@go1.24.6	0.55.0 1.25.13	3
registry.k8s.io/sig-storage/livenessprobe :v2.10.0	4dc0b87ccd69	golang.org/x/net@v0.8.0 stdlib@go1.20.3	0.55.0 1.25.13	3
registry.k8s.io/sig-storage/nfs-provisioner :v4.0.8	c825f3d5e28b	golang.org/x/net@v0.0.0-20190923162816-aa69164e4478 stdlib@go1.16.2	0.55.0 1.25.13	3
1password/scim :v2.3.1	29d0c6cb67eb	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.16.8	0.55.0 1.25.13	2
abutaha/aws-es-proxy :v1.1	190ed2d1dfc8	stdlib@go1.14.1	1.25.13	2
alazidis/kube-netlag :1.1.0	0e8c84152201	golang.org/x/net@v0.33.0 stdlib@go1.24.13	0.55.0 1.25.13	2
alpine/git :latest	4f9488b7295b	golang.org/x/net@v0.54.0 stdlib@go1.26.3	0.55.0 1.25.13	2
alpine/k8s :1.32.12	048f8d9c8cc7	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.55.0 1.25.13	2
alpine/kubectl :1.35.4	9ccd82364762	golang.org/x/net@v0.47.0 stdlib@go1.25.9	0.55.0 1.25.13	2
alpine/kubectl :1.35.2	ec8f734b0a10	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.55.0 1.25.13	2
altinity/clickhouse-operator :0.21.2	cd9252644ce0	golang.org/x/net@v0.7.0 stdlib@go1.19.10	0.55.0 1.25.13	2
altinity/metrics-exporter :0.21.2	df3d57215356	golang.org/x/net@v0.7.0 stdlib@go1.19.10	0.55.0 1.25.13	2
apache/superset :dockerize	afe59523a6c8	golang.org/x/net@v0.10.0 stdlib@go1.20.4	0.55.0 1.25.13	2
apecloud/apecloud-mcp :0.1.0	94041b080510	stdlib@go1.23.7	1.25.13	2
aquasec/kube-bench :v0.8.0	ea3e33bc3c4e	golang.org/x/net@v0.19.0 stdlib@go1.21.7	0.55.0 1.25.13	2
assistiot/fl_repository_db :latest	ad8f72108636	golang.org/x/net@v0.12.0 stdlib@go1.17.10	0.55.0 1.25.13	2
ayushsobti/kube-monkey :v0.5.2	4c94e8f8924e	golang.org/x/net@v0.0.0-20220520000938-2e3eb7b945c2 stdlib@go1.18.9	0.55.0 1.25.13	2
bitnamilegacy/elasticsearch :9.1.2-debian-12-r0	00176a47afa0	golang.org/x/net@v0.42.0 stdlib@go1.24.6	0.55.0 1.25.13	2
bitnamilegacy/influxdb :2.6.1-debian-11-r18	d17df1f9d745	golang.org/x/net@v0.0.0-20220617184016-355a448f1bc9 stdlib@go1.19.6	0.55.0 1.25.13	2