CVE-2026-39821

High

Advisory

Published 22 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 4,687; of 17,832 indexed, latest versions
Container images: 5,405; deployed by those charts
Fix available: 3 of 3; affected packages

Red Hat Security Advisory: git-lfs security update

Carried by container images the latest versions of 4,687 of 17,832 indexed charts deploy, on 5,405 images.

Affected package	Affected versions	Fixed in	Images
git-lfsrpm	2.13.3-3.el8_6	0:3.4.1-11.el8_10	1
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+193 more	1.25.13	5,361
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+223 more	0.55.0	3,797

OSV records: RHSA-2026:30853 GO-2026-5026

Charts affected

4,687 by stars

Chart

Latest

Affected images

Radar Score

logging-stackhelm-charts-alexis-carbillet

0.1.0

5 of 9 See more

logging-stack helm-charts-alexis-carbillet 0.1.0

5 of the 9 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
grafana/agent-operator :v0.25.1	a136c6208aa3	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18	0.55.0 1.25.13
grafana/grafana :11.1.0	079600c9517b	golang.org/x/net@v0.26.0 stdlib@go1.22.4	0.55.0 1.25.13
grafana/loki :2.6.1	1ee60f980950	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.17.9	0.55.0 1.25.13
grafana/loki :2.8.2	b1da1d23037e	golang.org/x/net@v0.7.0 stdlib@go1.20.4	0.55.0 1.25.13
grafana/loki-canary :2.6.1	ab2a2569307b	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.17.9	0.55.0 1.25.13

Open the chart page →

12,702

monitoring-stackhelm-charts-alexis-carbillet

0.1.0

10 of 11 See more

monitoring-stack helm-charts-alexis-carbillet 0.1.0

10 of the 11 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
grafana/grafana :11.3.0	a0f881232a6f	golang.org/x/net@v0.29.0 stdlib@go1.23.1	0.55.0 1.25.13
grafana/grafana :latest	f772d434e8fa	golang.org/x/net@v0.51.0 stdlib@go1.26.5	0.55.0 1.25.13
prom/prometheus :v2.48.1	a67e5e402ff5	golang.org/x/net@v0.17.0 stdlib@go1.21.5	0.55.0 1.25.13
quay.io/prometheus-operator/prometheus-config-reloader :v0.70.0	e20576b76ffd	golang.org/x/net@v0.19.0 stdlib@go1.21.4	0.55.0 1.25.13
quay.io/prometheus/alertmanager :v0.26.0	361db356b330	golang.org/x/net@v0.10.0 stdlib@go1.20.7	0.55.0 1.25.13
quay.io/prometheus/node-exporter :latest	1b4e4438faca	stdlib@go1.26.5	1.25.13
quay.io/prometheus/node-exporter :v1.7.0	4cb2b9019f17	golang.org/x/net@v0.17.0 stdlib@go1.21.4	0.55.0 1.25.13
quay.io/prometheus/node-exporter :v1.8.1	fa7fa12a57ef	golang.org/x/net@v0.23.0 stdlib@go1.22.3	0.55.0 1.25.13
quay.io/prometheus/pushgateway :v1.6.2	979a69ab4a40	golang.org/x/net@v0.10.0 stdlib@go1.21.1	0.55.0 1.25.13
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.10.1	af8220f53493	golang.org/x/net@v0.17.0 stdlib@go1.20.10	0.55.0 1.25.13

Open the chart page →

10,703

teslamate-apihelm-charts-darox

1.0.1

1 of 1 See more

teslamate-api helm-charts-darox 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
tobiasehlert/teslamateapi :1.20.2	cf09259ad0ea	golang.org/x/net@v0.37.0 stdlib@go1.24.0	0.55.0 1.25.13

Open the chart page →

1,189

aws-ebs-csi-driverhelm-charts-nr

2.17.4

6 of 6 See more

aws-ebs-csi-driver helm-charts-nr 2.17.4

6 of the 6 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
public.ecr.aws/ebs-csi-driver/aws-ebs-csi-driver :v1.16.1	1564359e1e0e	golang.org/x/net@v0.4.0 stdlib@go1.19.6	0.55.0 1.25.13
public.ecr.aws/eks-distro/kubernetes-csi/external-attacher :v4.1.0-eks-1-25-latest	701eea03388c	golang.org/x/net@v0.4.0 stdlib@go1.19.5	0.55.0 1.25.13
public.ecr.aws/eks-distro/kubernetes-csi/external-provisioner :v3.4.0-eks-1-25-latest	460ee1a59fea	golang.org/x/net@v0.4.0 stdlib@go1.19.7	0.55.0 1.25.13
public.ecr.aws/eks-distro/kubernetes-csi/external-resizer :v1.7.0-eks-1-25-latest	e711da25e7a0	golang.org/x/net@v0.4.0 stdlib@go1.19.8	0.55.0 1.25.13
public.ecr.aws/eks-distro/kubernetes-csi/livenessprobe :v2.9.0-eks-1-25-latest	8a305e162caa	golang.org/x/net@v0.7.0 stdlib@go1.19.8	0.55.0 1.25.13
public.ecr.aws/eks-distro/kubernetes-csi/node-driver-registrar :v2.7.0-eks-1-25-latest	f4345e67df8f	golang.org/x/net@v0.7.0 stdlib@go1.19.8	0.55.0 1.25.13

Open the chart page →

6,527

aws-s3-proxyhelm-charts-nr

0.1.7

1 of 1 See more

aws-s3-proxy helm-charts-nr 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
pottava/s3-proxy :2.0	20a0bcb15f76	stdlib@go1.13.7	1.25.13

Open the chart page →

1,323

aws-service-events-exporterhelm-charts-nr

1.0.7

1 of 1 See more

aws-service-events-exporter helm-charts-nr 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
thomasnyambati/aws-service-events-exporter :1.0.0	1e18a0944ceb	stdlib@go1.15.6	1.25.13

Open the chart page →

1,300

aws-service-quotas-exporterhelm-charts-nr

0.1.4

1 of 1 See more

aws-service-quotas-exporter helm-charts-nr 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
thoughtmachine/aws-service-quotas-exporter :v1.3.2	c6065ba55c72	stdlib@go1.19.4	1.25.13

Open the chart page →

772

cortex-gatewayhelm-charts-nr

0.1.9

1 of 1 See more

cortex-gateway helm-charts-nr 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
goelankit/cortex-gateway :v1.1.0	0d9a82dcf026	golang.org/x/net@v0.0.0-20220403103023-749bd193bc2b stdlib@go1.18	0.55.0 1.25.13

Open the chart page →

2,242

datadog-controllerhelm-charts-nr

1.2.0

1 of 1 See more

datadog-controller helm-charts-nr 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
maxrocketinternet/datadog-controller :0.1	a867315facf8	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.15	0.55.0 1.25.13

Open the chart page →

2,295

dregsyhelm-charts-nr

0.1.5

1 of 1 See more

dregsy helm-charts-nr 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
xelalex/dregsy :0.4.3	574054e1c417	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.3	0.55.0 1.25.13

Open the chart page →

2,979

gripmockhelm-charts-nr

1.1.3

1 of 1 See more

gripmock helm-charts-nr 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
tkpd/gripmock :1.10.1	74441dadcfbd	stdlib@go1.14.6	1.25.13

Open the chart page →

2,795

hoppscotchhelm-charts-nr

0.3.1

1 of 1 See more

hoppscotch helm-charts-nr 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
hoppscotch/hoppscotch :2024.8.2	f1da831950b7	golang.org/x/net@v0.17.0 stdlib@go1.21.10	0.55.0 1.25.13

Open the chart page →

3,482

k8s-cloudwatch-adapterhelm-charts-nr

0.2.2

1 of 1 See more

k8s-cloudwatch-adapter helm-charts-nr 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
chankh/k8s-cloudwatch-adapter :v0.9.0	963c44c7f8b1	golang.org/x/net@v0.0.0-20200202094626-16171245cfb2 stdlib@go1.14.5	0.55.0 1.25.13

Open the chart page →

2,476

k8s-event-loggerhelm-charts-nr

1.1.9

1 of 1 See more

k8s-event-logger helm-charts-nr 1.1.9

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
maxrocketinternet/k8s-event-logger :2.1	11224534789d	golang.org/x/net@v0.8.0 stdlib@go1.20.5	0.55.0 1.25.13

Open the chart page →

865

killgravehelm-charts-nr

1.0.2

1 of 1 See more

killgrave helm-charts-nr 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
friendsofgo/killgrave :0.4.1	39cfbecca342	stdlib@go1.16.3	1.25.13

Open the chart page →

1,182

kube-benchhelm-charts-nr

0.1.17

1 of 1 See more

kube-bench helm-charts-nr 0.1.17

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
aquasec/kube-bench :v0.8.0	ea3e33bc3c4e	golang.org/x/net@v0.19.0 stdlib@go1.21.7	0.55.0 1.25.13

Open the chart page →

1,624

labelsmanager-controllerhelm-charts-nr

1.0.4

1 of 1 See more

labelsmanager-controller helm-charts-nr 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
thomasnyambati/labelsmanager-controller :1.0.0	148ae3f99fea	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.15	0.55.0 1.25.13

Open the chart page →

2,306

listmonkhelm-charts-nr

0.1.12

1 of 1 See more

listmonk helm-charts-nr 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
listmonk/listmonk :v2.1.0	d2eac77ddfad	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.17.6	0.55.0 1.25.13

Open the chart page →

2,538

node-local-dnshelm-charts-nr

2.1.4

1 of 1 See more

node-local-dns helm-charts-nr 2.1.4

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
registry.k8s.io/dns/k8s-dns-node-cache :1.23.1	e3dccb1a21d1	golang.org/x/net@v0.17.0 stdlib@go1.22.3	0.55.0 1.25.13

Open the chart page →

2,314

node-problem-detectorhelm-charts-nr

2.3.17

1 of 1 See more

node-problem-detector helm-charts-nr 2.3.17

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
registry.k8s.io/node-problem-detector/node-problem-detector :v0.8.20	52f0618e9bc2	golang.org/x/net@v0.27.0 stdlib@go1.23.2	0.55.0 1.25.13

Open the chart page →

2,516

prometheus-aws-limits-exporterhelm-charts-nr

0.2.2

1 of 1 See more

prometheus-aws-limits-exporter helm-charts-nr 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
danielfm/aws-limits-exporter :0.6.0	7152b84e57cb	stdlib@go1.17.2	1.25.13

Open the chart page →

1,848

prometheus-locust-exporterhelm-charts-nr

1.2.3

1 of 1 See more

prometheus-locust-exporter helm-charts-nr 1.2.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
containersol/locust_exporter :v0.4.1	a914972d19ad	stdlib@go1.15.8	1.25.13

Open the chart page →

1,277

prometheus-soti-mobicontrol-exporterhelm-charts-nr

1.0.3

1 of 1 See more

prometheus-soti-mobicontrol-exporter helm-charts-nr 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
maxrocketinternet/soti-mobicontrol-exporter :0.6	1a281b76efa3	stdlib@go1.14	1.25.13

Open the chart page →

1,644

prometheus-statsd-exporterhelm-charts-nr

0.1.5

1 of 1 See more

prometheus-statsd-exporter helm-charts-nr 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
prom/statsd-exporter :v0.18.0	d23aca343b86	stdlib@go1.14.7	1.25.13

Open the chart page →

1,316

toxiproxyhelm-charts-nr

1.3.9

1 of 2 See more

toxiproxy helm-charts-nr 1.3.9

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/shopify/toxiproxy :2.7.0	fc2d40f4904c	stdlib@go1.19.13	1.25.13

Open the chart page →

598

weblatehelm-charts-nr

0.3.2

1 of 3 See more

weblate helm-charts-nr 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
weblate/weblate :4.2.2-1	69c160d37a3c	golang.org/x/net@v0.0.0-20190620200207-3b0461eec859 stdlib@go1.13.5	0.55.0 1.25.13

Open the chart page →

8,302

helm-controllerhelm-controller

0.1.4

1 of 1 See more

helm-controller helm-controller 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
rancher/helm-controller :v0.17.4	946ae0d13229	stdlib@go1.25.12	1.25.13

Open the chart page →

231

dbapphelmcourse

0.3.3

1 of 2 See more

dbapp helmcourse 0.3.3

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	stdlib@go1.18.2	1.25.13

Open the chart page →

3,974

mysqlhelmcourse

0.2.4

1 of 1 See more

mysql helmcourse 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/mysql :5.7	4bc6bc963e6d	stdlib@go1.18.2	1.25.13

Open the chart page →

1,519

chart-bookhelm-deploy-book

0.1.0

1 of 3 See more

chart-book helm-deploy-book 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
dannielkil/book-db :latest	433290c5c1db	stdlib@go1.18.2	1.25.13

Open the chart page →

9,233

helmfile-gitops-agenthelmfile-gitops-agent

1.1.97

2 of 3 See more

helmfile-gitops-agent helmfile-gitops-agent 1.1.97

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
fluxcd/flux-cli :v2.9.5	704d55295355	golang.org/x/net@v0.49.0 stdlib@go1.26.2	0.55.0 1.25.13
ghcr.io/helmfile/helmfile :v1.8.0	1808ffb76f37	golang.org/x/net@v0.39.0 stdlib@go1.26.4	0.55.0 1.25.13

Open the chart page →

2,046

affinehelmforge

1.0.0

1 of 3 See more

affine helmforge 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
pgvector/pgvector :0.8.6-pg16-bookworm	ccc6e83d6e35	stdlib@go1.24.6	1.25.13

Open the chart page →

4,268

alfiohelmforge

1.2.12

1 of 3 See more

alfio helmforge 1.2.12

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :18.6-trixie	86c951e05bf5	stdlib@go1.24.6	1.25.13

Open the chart page →

1,756

answerhelmforge

1.5.2

1 of 1 See more

answer helmforge 1.5.2

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
apache/answer :2.0.2	a0d71b0e30a5	stdlib@go1.25.12	1.25.13

Open the chart page →

557

appwritehelmforge

2.0.0

2 of 5 See more

appwrite helmforge 2.0.0

2 of the 5 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
appwrite/appwrite :2.2.0	896bdd024de3	golang.org/x/net@v0.51.0	0.55.0
library/mariadb :12.3.3	ab1c3dd38194	stdlib@go1.24.6	1.25.13

Open the chart page →

4,886

archiveboxhelmforge

1.1.12

1 of 1 See more

archivebox helmforge 1.1.12

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
archivebox/archivebox :0.7.4	1a5a37331091	stdlib@go1.24.6	1.25.13

Open the chart page →

7,760

automatischhelmforge

1.3.7

2 of 4 See more

automatisch helmforge 1.3.7

2 of the 4 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
automatischio/automatisch :0.15.0	3bace7a12d5f	stdlib@go1.23.8	1.25.13
library/postgres :18.6-trixie	86c951e05bf5	stdlib@go1.24.6	1.25.13

Open the chart page →

5,243

booklorehelmforge

2.0.1

1 of 3 See more

booklore helmforge 2.0.1

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/mariadb :12.3.3	dd9b303aed4f	stdlib@go1.24.6	1.25.13

Open the chart page →

2,399

castopodhelmforge

1.2.7

2 of 3 See more

castopod helmforge 1.2.7

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
castopod/castopod :1.15.5	4e4f0440520f	golang.org/x/net@v0.50.0 stdlib@go1.25.7	0.55.0 1.25.13
library/mariadb :12.3.3	dd9b303aed4f	stdlib@go1.24.6	1.25.13

Open the chart page →

9,701

chiefonboardinghelmforge

1.1.15

1 of 3 See more

chiefonboarding helmforge 1.1.15

1 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :18.6-trixie	4ef4dbc939d6	stdlib@go1.24.6	1.25.13

Open the chart page →

7,465

ckanhelmforge

1.3.8

2 of 6 See more

ckan helmforge 1.3.8

2 of the 6 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ckan/ckan-solr :2.11-solr9	ef8e5d3e6be1	stdlib@go1.18.1	1.25.13
library/postgres :18.6-trixie	86c951e05bf5	stdlib@go1.24.6	1.25.13

Open the chart page →

9,408

countlyhelmforge

1.2.6

2 of 3 See more

countly helmforge 1.2.6

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
countly/countly-server :25.05.4	e3c238248f99	stdlib@go1.21.11	1.25.13
library/mongo :8.3.8	5211c51171f5	stdlib@go1.26.5	1.25.13

Open the chart page →

71,523

dawarichhelmforge

1.0.1

2 of 4 See more

dawarich helmforge 1.0.1

2 of the 4 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
freikin/dawarich :1.14.5	11826c67e4b1	stdlib@go1.24.4	1.25.13
postgis/postgis :18-3.6	7e00e8c3539f	stdlib@go1.24.6	1.25.13

Open the chart page →

10,891

ddns-updaterhelmforge

1.4.12

1 of 1 See more

ddns-updater helmforge 1.4.12

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
qmcgaw/ddns-updater :2.10.0	3e2aa558946b	golang.org/x/net@v0.53.0 stdlib@go1.26.2	0.55.0 1.25.13

Open the chart page →

211

discount-bandithelmforge

2.0.8

2 of 3 See more

discount-bandit helmforge 2.0.8

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
cybrarist/discount-bandit :v4.0.4	e9e2447ac666	golang.org/x/net@v0.43.0 stdlib@go1.25.4	0.55.0 1.25.13
library/mysql :9.7.2	29abb0a17998	stdlib@go1.24.6	1.25.13

Open the chart page →

31,073

druidhelmforge

1.3.6

2 of 4 See more

druid helmforge 1.3.6

2 of the 4 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :18.6-trixie	86c951e05bf5	stdlib@go1.24.6	1.25.13
library/zookeeper :3.9.5	7d0f24ebb67b	stdlib@go1.18.1	1.25.13

Open the chart page →

8,253

drupalhelmforge

1.2.13

1 of 2 See more

drupal helmforge 1.2.13

1 of the 2 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/mysql :9.7.2	b2cf29815e62	stdlib@go1.24.6	1.25.13

Open the chart page →

3,980

entehelmforge

1.0.2

2 of 4 See more

ente helmforge 1.0.2

2 of the 4 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/postgres :18.6-trixie	86c951e05bf5	stdlib@go1.24.6	1.25.13
ghcr.io/ente/server :0472c929b6070e61fecaf2013d47efce2dcda462	f646b68a1b8d	stdlib@go1.26.4	1.25.13

Open the chart page →

4,037

ghosthelmforge

1.2.7

2 of 3 See more

ghost helmforge 1.2.7

2 of the 3 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
library/ghost :6.63.0	e05bc1169fb2	stdlib@go1.24.6	1.25.13
library/mysql :8.4.11	85b9bf2e29cf	stdlib@go1.24.6	1.25.13

Open the chart page →

2,562

github-mcp-serverhelmforge

1.0.3

1 of 1 See more

github-mcp-server helmforge 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-39821.

Container image	Digest	Package	Fixed in
ghcr.io/github/github-mcp-server :v1.9.0	881b53d6f75f	stdlib@go1.25.12	1.25.13

Open the chart page →

425

Container images carrying it

5,405 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/ncsa/jupyterhub-metrics/collector :1.3.0	dcb8c731bb1b	golang.org/x/net@v0.47.0 stdlib@go1.25.6	0.55.0 1.25.13	1
ghcr.io/nefelim4ag/k8s-ondemand-proxy :0.0.2	078b25d48cf7	golang.org/x/net@v0.13.0 stdlib@go1.21.1	0.55.0 1.25.13	1
ghcr.io/nefelim4ag/k8s-ssh-bastion :0.5.0	4d337e14c80b	golang.org/x/net@v0.23.0 stdlib@go1.21.11	0.55.0 1.25.13	1
ghcr.io/nerdswords/yet-another-cloudwatch-exporter :v0.32.0-alpha	71e24278a049	stdlib@go1.17.3	1.25.13	1
ghcr.io/nerdswords/yet-another-cloudwatch-exporter :v0.61.2	f04925fe1fa6	stdlib@go1.22.4	1.25.13	1
ghcr.io/netbirdio/netbird-operator :v0.8.0	ae2c26cfc547	stdlib@go1.26.5	1.25.13	1
ghcr.io/netsoc/iamd :1.1.2	2fe6b69b20d7	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e stdlib@go1.16.6	0.55.0 1.25.13	1
ghcr.io/netsoc/shhd :0.1.6	0bb44992b62c	golang.org/x/net@v0.0.0-20210405180319-a5a99cb37ef4 stdlib@go1.17	0.55.0 1.25.13	1
ghcr.io/netsoc/webspaced :0.5.1	edc238a538a0	golang.org/x/net@v0.0.0-20210716203947-853a461950ff stdlib@go1.16.8	0.55.0 1.25.13	1
ghcr.io/nginx/nginx-gateway-fabric :2.4.1	80f3a0a51af5	golang.org/x/net@v0.48.0 stdlib@go1.25.7	0.55.0 1.25.13	1
ghcr.io/nginx/nginx-gateway-fabric :2.6.6	c10f734589e9	stdlib@go1.26.4	1.25.13	1
ghcr.io/nicholaswilde/golinks :version-154c581	8e67b26324c5	stdlib@go1.16.5	1.25.13	1
ghcr.io/nicholaswilde/installer :version-0.2.9	47d8ecd310a9	stdlib@go1.15.3	1.25.13	1
ghcr.io/nicholaswilde/notes :version-ee287b9	ab9bc16465bc	golang.org/x/net@v0.0.0-20210610132358-84b48f89b13b stdlib@go1.16.5	0.55.0 1.25.13	1
ghcr.io/nicholaswilde/olivetin :version-2021-07-19	e1d5c8a01008	golang.org/x/net@v0.0.0-20210405180319-a5a99cb37ef4 stdlib@go1.16.5	0.55.0 1.25.13	1
ghcr.io/nicholaswilde/shiori :version-v1.5.0	e0645abe6777	golang.org/x/net@v0.0.0-20190724013045-ca1201d0de80 stdlib@go1.16.5	0.55.0 1.25.13	1
ghcr.io/nicholaswilde/static :version-ee8a20c	d1d47c730bc4	stdlib@go1.16.5	1.25.13	1
ghcr.io/nicholaswilde/todo :941c0d3-ls1	d7ba1341a940	stdlib@go1.14.15	1.25.13	1
ghcr.io/nicholaswilde/twtxt :version-0.1.1	58736a73ca10	golang.org/x/net@v0.0.0-20200822124328-c89045814202 stdlib@go1.16.5	0.55.0 1.25.13	1
ghcr.io/nicholaswilde/wiki :version-900b76a	6c4f261d8f5e	golang.org/x/net@v0.0.0-20190620200207-3b0461eec859 stdlib@go1.16.5	0.55.0 1.25.13	1
ghcr.io/nicholaswilde/writefreely :version-0.13.1	c3c8481b7e56	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.15.12	0.55.0 1.25.13	1
ghcr.io/niklas-letz/cert-manager-webhook-solidserver :1.0.2	f19a306ce759	stdlib@go1.26.4	1.25.13	1
ghcr.io/nimbolus/k8s-openstack-node-upgrade-agent :0.1.0	e0c7cf2415f0	golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023 stdlib@go1.17.6	0.55.0 1.25.13	1
ghcr.io/nimbolus/terraform-backend :0.2.2	bf876252fbe1	golang.org/x/net@v0.46.0 stdlib@go1.24.13	0.55.0 1.25.13	1
ghcr.io/nlamirault/bbox_exporter :1.0.0	f5dd1f7794c6	golang.org/x/net@v0.0.0-20210917221730-978cfadd31cf stdlib@go1.18.3	0.55.0 1.25.13	1
ghcr.io/nlamirault/freebox-exporter :1.0.0	2d522b664e12	golang.org/x/net@v0.0.0-20220909164309-bea034e7d591 stdlib@go1.19.2	0.55.0 1.25.13	1
ghcr.io/nnstd/glauth :2.5	2e6e09fa77dd	golang.org/x/net@v0.41.0 stdlib@go1.24.5	0.55.0 1.25.13	1
ghcr.io/nnstd/seaweedfs-operator :1.4	3ebe2fd253f6	golang.org/x/net@v0.42.0 stdlib@go1.24.5	0.55.0 1.25.13	1
ghcr.io/noahburrell0/sealed-secrets-ui :v0.1.4	7e7368fb472d	golang.org/x/net@v0.6.0 stdlib@go1.19.4	0.55.0 1.25.13	1
ghcr.io/nousefreak/clusterfan :v0.1.0	4ea05e2a7b57	stdlib@go1.17.5	1.25.13	1
ghcr.io/nowakeai/kube-insight :v0.1.4	75849fe6548a	stdlib@go1.26.4	1.25.13	1
ghcr.io/o0th/cert-manager-webhook-bunny :1.0.2	fe7ce555a12d	golang.org/x/net@v0.34.0 stdlib@go1.23.5	0.55.0 1.25.13	1
ghcr.io/oguzhan-yilmaz/argocd-backup-s3 :latest	b61c750ade19	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.24.6	0.55.0 1.25.13	1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots :0.0.203	5bc5ca66d55a	golang.org/x/net@v0.38.0 stdlib@go1.24.7	0.55.0 1.25.13	1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots :0.0.55	d7f93d2182fe	golang.org/x/net@v0.38.0 stdlib@go1.24.4	0.55.0 1.25.13	1
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--powerpipe :latest	a16ab5ca10a7	golang.org/x/net@v0.48.0 stdlib@go1.26.1	0.55.0 1.25.13	1
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--steampipe :latest	c0c8d53df9f3	golang.org/x/net@v0.48.0 stdlib@go1.26.1	0.55.0 1.25.13	1
ghcr.io/okteto/backend :0.0.0-2026-08-24	06f2f6f4ed76	golang.org/x/net@v0.47.0 stdlib@go1.25.12	0.55.0 1.25.13	1
ghcr.io/okteto/buildkit :0.0.0-2026-08-03 :0.0.0-2026-08-17 :0.0.0-2026-08-24	14527ca5d2a9	golang.org/x/net@v0.35.0 stdlib@go1.25.7	0.55.0 1.25.13	1
ghcr.io/okteto/daemon :0.0.0-2026-08-17 :0.0.0-2026-08-24	c6e716a3fbbe	stdlib@go1.26.5	1.25.13	1
ghcr.io/okteto/ingress-nginx-chroot :0.0.0-2026-08-17 :0.0.0-2026-08-24	265eedb3954b	stdlib@go1.26.4	1.25.13	1
ghcr.io/okteto/okteto :3.22.0	4585017f52f6	golang.org/x/net@v0.47.0 stdlib@go1.26.5	0.55.0 1.25.13	1
ghcr.io/okteto/registry :0.0.0-2026-08-17 :0.0.0-2026-08-24	69131511501f	stdlib@go1.26.5	1.25.13	1
ghcr.io/okteto/reloader :0.0.0-2026-08-03 :0.0.0-2026-08-17 :0.0.0-2026-08-24	04a3fce657c4	stdlib@go1.26.4	1.25.13	1
ghcr.io/oliverbaehler/cloudflare-tunnel-ingress-controller :0.2.3	0aec31e36d95	golang.org/x/net@v0.37.0 stdlib@go1.23.7	0.55.0 1.25.13	1
ghcr.io/olivetin/olivetin :2025.2.19	a89958921526	golang.org/x/net@v0.33.0 stdlib@go1.22.0	0.55.0 1.25.13	1
ghcr.io/omkar-shelke25/admission-webhook-no-latest :sha-3316545	5976a1d3236a	golang.org/x/net@v0.38.0 stdlib@go1.26.3	0.55.0 1.25.13	1
ghcr.io/onedr0p/exportarr :v1.6.1	60cf3d44aa0b	stdlib@go1.21.6	1.25.13	1
ghcr.io/openappsec/smartsync :latest	580d68c50cc7	stdlib@go1.18.10	1.25.13	1
ghcr.io/openappsec/smartsync-shared-files :latest	30c1daa0b33e	stdlib@go1.18.10	1.25.13	1