CVE-2026-46600

Unscored

Advisory

Published 14 Jul 2026In the index since 5 Sept 2026

Severity: Unscored; worst across findings
CVSS: —; base score, highest
EPSS: 0.005; 44th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 3,559; of 17,790 indexed, latest versions
Container images: 4,369; deployed by those charts
Fix available: 2 of 2; affected packages

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Carried by container images the latest versions of 3,559 of 17,790 indexed charts deploy, on 4,369 images.

Affected package	Affected versions	Fixed in	Images
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+221 more	0.56.0	3,945
stdlibgolang	go1.26.0, go1.26.1, go1.26.2, go1.26.2-X:boringcrypto+7 more	1.26.6	897

OSV records: GO-2026-5942
Also known as: BIT-golang-2026-46600

Charts affected

3,559 by stars

Chart

Latest

Affected images

Radar Score

mcpmcp-charts

0.0.23

3 of 7 See more

mcp mcp-charts 0.0.23

3 of the 7 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
ghcr.io/gla-rad/mc-mms-edgerouter :latest	3620d5680775	golang.org/x/net@v0.43.0	0.56.0
ghcr.io/gla-rad/mc-mms-router :latest	032e977d9adf	golang.org/x/net@v0.44.0	0.56.0
ghcr.io/maritimeconnectivity/identityregistry :latest	5009fd419742	stdlib@go1.26.5	1.26.6

Open the chart page →

7,025

traefik-forward-authmesosphere

0.3.10

2 of 2 See more

traefik-forward-auth mesosphere 0.3.10

2 of the 2 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
mesosphere/kubeaddons-addon-initializer :v0.5.1	5efa21defcbc	golang.org/x/net@v0.0.0-20200707034311-ab3426394381	0.56.0
mesosphere/traefik-forward-auth :3.1.0	5456581d7b76	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9	0.56.0

Open the chart page →

5,308

metadata-injectormetadata-injector-operator

0.0.1

1 of 1 See more

metadata-injector metadata-injector-operator 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
ruslanguns/metadata-injector-operator :v0.0.1	6c77e4675e07	golang.org/x/net@v0.26.0	0.56.0

Open the chart page →

568

metrics-server-exportermetrics-server-exporter

2.4.0

1 of 1 See more

metrics-server-exporter metrics-server-exporter 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
mrnim94/metrics-server-exporter :v2.4.0	86c4807a4bca	golang.org/x/net@v0.47.0 stdlib@go1.26.3	0.56.0 1.26.6

Open the chart page →

1,273

subspacemglants

0.1.0

1 of 1 See more

subspace mglants 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
subspacecommunity/subspace :1.5.0	e2042b63fb35	golang.org/x/net@v0.0.0-20200519113804-d87ec0cfa476	0.56.0

Open the chart page →

3,254

mw-kube-agent-v2middleware-labs

2.8.6

1 of 1 See more

mw-kube-agent-v2 middleware-labs 2.8.6

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
ghcr.io/middleware-labs/mw-kube-agent :1.12.0	9c7bc0f9bb35	golang.org/x/net@v0.32.0	0.56.0

Open the chart page →

4,197

chartmuseummike7515

1.2.0

1 of 1 See more

chartmuseum mike7515 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
ghcr.io/helm/chartmuseum :v0.15.0	c298183a5208	golang.org/x/net@v0.0.0-20220531201128-c960675eff93	0.56.0

Open the chart page →

3,176

miniomilvus

8.0.17

1 of 1 See more

minio milvus 8.0.17

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
minio/minio :RELEASE.2021-02-14T04-01-33Z	bd11edda91f3	golang.org/x/net@v0.0.0-20201216054612-986b41b23924	0.56.0

Open the chart page →

6,922

mimir-syncmimir-sync

3.1.0

1 of 1 See more

mimir-sync mimir-sync 3.1.0

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
ghcr.io/antnsn/mal-sync :v1.0.5	2f06e72cef36	golang.org/x/net@v0.38.0	0.56.0

Open the chart page →

1,300

minecraft-exporterminecraft-exporter

0.16.0

1 of 1 See more

minecraft-exporter minecraft-exporter 0.16.0

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
ghcr.io/dirien/minecraft-exporter :0.24.0	61d89bf99ff7	golang.org/x/net@v0.51.0	0.56.0

Open the chart page →

362

mlflow-servermlflowserver

0.1.9

1 of 3 See more

mlflow-server mlflowserver 0.1.9

1 of the 3 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
jwilder/dockerize :latest	f94fb59fb4f6	golang.org/x/net@v0.47.0	0.56.0

Open the chart page →

5,804

photoprismmmontes

0.14.0

1 of 1 See more

photoprism mmontes 0.14.0

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
photoprism/photoprism :251130	db16ee6b1ba3	golang.org/x/net@v0.47.0	0.56.0

Open the chart page →

11,109

model-manager-loadermodel-manager-loader

1.27.0

1 of 1 See more

model-manager-loader model-manager-loader 1.27.0

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
public.ecr.aws/cloudnatix/llmariner/model-manager-loader :1.27.0	26ac7263a823	golang.org/x/net@v0.38.0	0.56.0

Open the chart page →

2,710

model-manager-servermodel-manager-server

1.27.0

1 of 1 See more

model-manager-server model-manager-server 1.27.0

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
public.ecr.aws/cloudnatix/llmariner/model-manager-server :1.27.0	c057dcdd9ef3	golang.org/x/net@v0.38.0	0.56.0

Open the chart page →

740

food-managermoreillon

0.5.0

1 of 2 See more

food-manager moreillon 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
bitnamilegacy/mongodb :6.0.10-debian-11-r8	42319decb591	golang.org/x/net@v0.14.0	0.56.0

Open the chart page →

13,812

podsyncmy0n

1.5.4

1 of 2 See more

podsync my0n 1.5.4

1 of the 2 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
tdeutsch/podsync :v2.4.2	b67186f4c9a5	golang.org/x/net@v0.0.0-20210405180319-a5a99cb37ef4	0.56.0

Open the chart page →

2,059

maddymya

22.4.12

1 of 2 See more

maddy mya 22.4.12

1 of the 2 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
foxcpp/maddy :0.7.1	6ab538e2f28b	golang.org/x/net@v0.20.0	0.56.0

Open the chart page →

1,419

surveyornats

0.20.9

1 of 1 See more

surveyor nats 0.20.9

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
natsio/nats-surveyor :0.9.9	104a3e938b23	stdlib@go1.26.1	1.26.6

Open the chart page →

909

natz-operatornatz-operator

0.9.5

1 of 1 See more

natz-operator natz-operator 0.9.5

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
ghcr.io/zeiss/natz-operator/operator :0.9.5	187007974540	golang.org/x/net@v0.35.0	0.56.0

Open the chart page →

745

clowder2ncsa

1.9.7

4 of 12 See more

clowder2 ncsa 1.9.7

4 of the 12 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
bitnamilegacy/elasticsearch :8.12.2	15d4647fd491	golang.org/x/net@v0.21.0	0.56.0
bitnamilegacy/minio :2023.12.23	0b60b6565ab2	golang.org/x/net@v0.19.0	0.56.0
bitnamilegacy/mongodb :5.0.10	3bb1deeaf9d0	golang.org/x/net@v0.0.0-20220708220712-1185a9018129	0.56.0
bitnamilegacy/os-shell :12-debian-12-r16	d24925821dd2	golang.org/x/net@v0.21.0	0.56.0

Open the chart page →

37,504

netobserv-operatornetobserv

1.12.0

1 of 1 See more

netobserv-operator netobserv 1.12.0

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
quay.io/netobserv/network-observability-operator :1.12.0-community	b05d21a015b0	stdlib@go1.26.5	1.26.6

Open the chart page →

347

ngrok-operatorngrok-operator

1.1.0

1 of 2 See more

ngrok-operator ngrok-operator 1.1.0

1 of the 2 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
zufardhiyaulhaq/ngrok-operator :v1.3.0	7cf2ae3fb1fb	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781	0.56.0

Open the chart page →

1,896

node-exporternode-exporter

0.1.10

1 of 1 See more

node-exporter node-exporter 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
prom/node-exporter :v1.6.0	d2e48098c364	golang.org/x/net@v0.10.0	0.56.0

Open the chart page →

1,229

nri-resource-policy-balloonsnri-plugins

0.14.0

1 of 1 See more

nri-resource-policy-balloons nri-plugins 0.14.0

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
ghcr.io/containers/nri-plugins/nri-resource-policy-balloons :v0.14.0	a8c8297c7274	golang.org/x/net@v0.55.0 stdlib@go1.26.0	0.56.0 1.26.6

Open the chart page →

286

nri-resource-policy-topology-awarenri-plugins

0.14.0

1 of 1 See more

nri-resource-policy-topology-aware nri-plugins 0.14.0

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
ghcr.io/containers/nri-plugins/nri-resource-policy-topology-aware :v0.14.0	e2443833726a	golang.org/x/net@v0.55.0 stdlib@go1.26.0	0.56.0 1.26.6

Open the chart page →

286

nutanix-csi-snapshotnutanix-helm-releases

8.3.0

1 of 1 See more

nutanix-csi-snapshot nutanix-helm-releases 8.3.0

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/snapshot-controller :v8.3.0	12c2da094b02	golang.org/x/net@v0.39.0	0.56.0

Open the chart page →

423

octopuso7studios-octopus-helm-charts

1.2.3

2 of 5 See more

octopus o7studios-octopus-helm-charts 1.2.3

2 of the 5 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
natsio/nats-box :0.18.0	abdc9f9f0120	golang.org/x/net@v0.40.0	0.56.0
percona/percona-server-mongodb-operator :1.20.1	d09453ce7886	golang.org/x/net@v0.38.0	0.56.0

Open the chart page →

6,120

oadaoada

5.0.5

1 of 11 See more

oada oada 5.0.5

1 of the 11 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
groundnuty/k8s-wait-for :no-root-v2.0	a26d3d3f6e1c	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b	0.56.0

Open the chart page →

13,329

transfer.shobeone

1.0.5

1 of 1 See more

transfer.sh obeone 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
dutchcoders/transfer.sh :v1.6.1-noroot	8db9ade72a0d	golang.org/x/net@v0.17.0	0.56.0

Open the chart page →

1,178

oci-native-ingress-controlleroci-native-ingress-controller

1.0.0

1 of 1 See more

oci-native-ingress-controller oci-native-ingress-controller 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
amaanx86/oci-native-ingress-controller :master	d7206ac7a319	golang.org/x/net@v0.36.0	0.56.0

Open the chart page →

434

growthbookone-acre-fund

0.3.0

1 of 3 See more

growthbook one-acre-fund 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
jwilder/dockerize :latest	f94fb59fb4f6	golang.org/x/net@v0.47.0	0.56.0

Open the chart page →

502

open5gs-hssopen5gs-hss

2.3.0

1 of 2 See more

open5gs-hss open5gs-hss 2.3.0

1 of the 2 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
bitnami/mongodb :latest	e46cffb66274	stdlib@go1.26.5	1.26.6

Open the chart page →

216

open5gs-pcrfopen5gs-pcrf

2.3.0

1 of 2 See more

open5gs-pcrf open5gs-pcrf 2.3.0

1 of the 2 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
bitnami/mongodb :latest	e46cffb66274	stdlib@go1.26.5	1.26.6

Open the chart page →

216

open5gs-scpopen5gs-scp

2.3.1

1 of 2 See more

open5gs-scp open5gs-scp 2.3.1

1 of the 2 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
bitnami/mongodb :latest	e46cffb66274	stdlib@go1.26.5	1.26.6

Open the chart page →

216

open5gs-udropen5gs-udr

2.3.1

1 of 2 See more

open5gs-udr open5gs-udr 2.3.1

1 of the 2 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
bitnami/mongodb :latest	e46cffb66274	stdlib@go1.26.5	1.26.6

Open the chart page →

216

kruiseopenkruise

1.9.1

2 of 2 See more

kruise openkruise 1.9.1

2 of the 2 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
openkruise/kruise-helm-hook :v0.1.0	edc7cf9428fd	golang.org/x/net@v0.24.0	0.56.0
openkruise/kruise-manager :v1.9.1	f81ae78a36a4	golang.org/x/net@v0.38.0	0.56.0

Open the chart page →

1,503

librechatopenshift

1.9.0

1 of 3 See more

librechat openshift 1.9.0

1 of the 3 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
library/mongo :8.0.20	098862b1339f	golang.org/x/net@v0.47.0	0.56.0

Open the chart page →

5,849

openstack-kamaji-clusteropenstack-kamaji-cluster

0.2.4

1 of 1 See more

openstack-kamaji-cluster openstack-kamaji-cluster 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
registry.k8s.io/autoscaling/cluster-autoscaler :v1.34.0	7b172f42533c	golang.org/x/net@v0.38.0	0.56.0

Open the chart page →

763

opentelemetry-demoopentelemetry-helm

0.41.2

9 of 34 See more

opentelemetry-demo opentelemetry-helm 0.41.2

9 of the 34 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
grafana/grafana :13.1.0	121a7a9ece6d	golang.org/x/net@v0.55.0 stdlib@go1.26.3	0.56.0 1.26.6
jaegertracing/jaeger :2.19.0	ede4864215be	golang.org/x/net@v0.55.0 stdlib@go1.26.3	0.56.0 1.26.6
otel/opentelemetry-collector-contrib :0.156.0	125bdbeb7590	stdlib@go1.26.4	1.26.6
ghcr.io/open-feature/flagd :v0.16.0	32234e63c1d0	golang.org/x/net@v0.52.0	0.56.0
ghcr.io/open-telemetry/demo :3.0.0-product-catalog	278aff685646	golang.org/x/net@v0.55.0 stdlib@go1.26.5	0.56.0 1.26.6
ghcr.io/open-telemetry/demo :3.0.0-checkout	3d18cb304a6a	golang.org/x/net@v0.55.0 stdlib@go1.26.5	0.56.0 1.26.6
ghcr.io/open-telemetry/demo :3.0.0-cart	3f89a444250a	golang.org/x/net@v0.55.0 stdlib@go1.26.4	0.56.0 1.26.6
ghcr.io/open-telemetry/demo :3.0.0-load-generator	cd12cb42fb15	stdlib@go1.26.5	1.26.6
quay.io/prometheus/prometheus :v3.13.1	3c42b892cf72	golang.org/x/net@v0.55.0 stdlib@go1.26.5	0.56.0 1.26.6

Open the chart page →

22,916

opikopik

2.2.64

4 of 13 See more

opik opik 2.2.64

4 of the 13 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
alpine/kubectl :1.35.0	862d86046bbc	golang.org/x/net@v0.47.0	0.56.0
altinity/clickhouse-operator :0.27.1	a802b3a19d20	golang.org/x/net@v0.55.0 stdlib@go1.26.3	0.56.0 1.26.6
cloudpirates/image-minio :RELEASE.2025-10-15T17-29-55Z-hardened	8dc02a7e5093	golang.org/x/net@v0.47.0	0.56.0
ghcr.io/comet-ml/opik/opik-python-backend :2.2.64	272d92a59e8a	golang.org/x/net@v0.54.0 stdlib@go1.26.3	0.56.0 1.26.6

Open the chart page →

14,444

opsops

1.2.0

2 of 2 See more

ops ops 1.2.0

2 of the 2 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
shaowenchen/ops-controller-manager :latest	26da43bb5b66	golang.org/x/net@v0.39.0	0.56.0
shaowenchen/ops-server :latest	315444f703f4	golang.org/x/net@v0.39.0	0.56.0

Open the chart page →

9,101

orbitalregorbitalreg

0.3.0

1 of 4 See more

orbitalreg orbitalreg 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
orbitalreg/orbitalreg-api :0.1.0	45f2620337af	golang.org/x/net@v0.28.0	0.56.0

Open the chart page →

2,286

kubernetes-dashboard-proxyosc

0.7.2

3 of 4 See more

kubernetes-dashboard-proxy osc 0.7.2

3 of the 4 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
kubernetesui/dashboard :v2.7.0	2e500d29e9d5	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b	0.56.0
kubernetesui/metrics-scraper :v1.0.8	76049887f07a	golang.org/x/net@v0.0.0-20220524220425-1d687d428aca	0.56.0
quay.io/oauth2-proxy/oauth2-proxy :v7.1.3	ecd26b74a01f	golang.org/x/net@v0.0.0-20200707034311-ab3426394381	0.56.0

Open the chart page →

6,012

osc-bsu-csi-driverosc-bsu-csi-driver

2.2.0

5 of 6 See more

osc-bsu-csi-driver osc-bsu-csi-driver 2.2.0

5 of the 6 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-attacher :v4.12.0	b9dc9a714a48	golang.org/x/net@v0.54.0 stdlib@go1.26.3	0.56.0 1.26.6
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.15.0	11f199f6bec4	golang.org/x/net@v0.40.0	0.56.0
registry.k8s.io/sig-storage/csi-provisioner :v6.1.1	d992c36d4ddd	golang.org/x/net@v0.43.0	0.56.0
registry.k8s.io/sig-storage/csi-resizer :v2.2.1	ea1d25e23479	golang.org/x/net@v0.55.0 stdlib@go1.26.3	0.56.0 1.26.6
registry.k8s.io/sig-storage/livenessprobe :v2.16.0	88092d100909	golang.org/x/net@v0.40.0	0.56.0

Open the chart page →

2,370

httpbinowan-charts

0.1.9

1 of 1 See more

httpbin owan-charts 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
mccutchen/go-httpbin :latest	20739736d4eb	stdlib@go1.26.5	1.26.6

Open the chart page →

hlf-caowkin

2.1.0

2 of 2 See more

hlf-ca owkin 2.1.0

2 of the 2 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
hyperledger/fabric-ca :1.5.1	c7f3422ec1d5	golang.org/x/net@v0.0.0-20201006153459-a7d1128ccaa0	0.56.0
jwilder/dockerize :latest	f94fb59fb4f6	golang.org/x/net@v0.47.0	0.56.0

Open the chart page →

3,431

hlf-ordowkin

3.1.0

1 of 1 See more

hlf-ord owkin 3.1.0

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
hyperledger/fabric-orderer :2.2.1	37294e05209b	golang.org/x/net@v0.0.0-20190620200207-3b0461eec859	0.56.0

Open the chart page →

3,357

hlf-peerowkin

5.1.0

1 of 1 See more

hlf-peer owkin 5.1.0

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
hyperledger/fabric-peer :2.2.1	bf4995c86af6	golang.org/x/net@v0.0.0-20190620200207-3b0461eec859	0.56.0

Open the chart page →

3,695

ngrok-operatorpaganuzzi

0.0.2

1 of 1 See more

ngrok-operator paganuzzi 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
ghcr.io/paganuzzi/ngrokoperator :latest	5a10cd095699	golang.org/x/net@v0.0.0-20200301022130-244492dfa37a	0.56.0

Open the chart page →

2,811

palworldpalworld-server-chart

2.7.1

1 of 1 See more

palworld palworld-server-chart 2.7.1

1 of the 1 container images this version deploys carry CVE-2026-46600.

Container image	Digest	Package	Fixed in
thijsvanloef/palworld-server-docker :v2.7.1	401d3eb5c053	stdlib@go1.26.3	1.26.6

Open the chart page →

3,715

Container images carrying it

4,369 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
grafana/agent :v0.40.3	f6cbec9409be	golang.org/x/net@v0.20.0	0.56.0	1
grafana/agent-operator :v0.34.1	045c9125634c	golang.org/x/net@v0.10.0	0.56.0	1
grafana/alloy :v1.5.1	01a63f4e032c	golang.org/x/net@v0.31.0	0.56.0	1
grafana/alloy :v1.4.3	06bdcbb51fc2	golang.org/x/net@v0.29.0	0.56.0	1
grafana/alloy :v1.18.1	0f4434c92b3e	stdlib@go1.26.5	1.26.6	1
grafana/alloy :v1.18.0	491b0578c049	stdlib@go1.26.5	1.26.6	1
grafana/alloy :v1.16.3	84b76d56c594	golang.org/x/net@v0.55.0 stdlib@go1.26.3	0.56.0 1.26.6	1
grafana/alloy :v1.11.3	8c7256f412fe	golang.org/x/net@v0.43.0	0.56.0	1
grafana/alloy :v1.1.1	c3dac4e26471	golang.org/x/net@v0.24.0	0.56.0	1
grafana/alloy :v1.14.0	f50931848bd8	golang.org/x/net@v0.50.0	0.56.0	1
grafana/beyla :1.3.3	36d07f8d276e	golang.org/x/net@v0.21.0	0.56.0	1
grafana/beyla-k8s-cache :2	53b2f561cb1b	golang.org/x/net@v0.48.0	0.56.0	1
grafana/cloudcost-exporter :v1.12.0	eeb2cfecb23e	golang.org/x/net@v0.55.0 stdlib@go1.26.4	0.56.0 1.26.6	1
grafana/grafana :6.6.0	052147d7e0ec	golang.org/x/net@v0.0.0-20190923162816-aa69164e4478	0.56.0	1
grafana/grafana :10.1.5	0679e877ba20	golang.org/x/net@v0.12.0	0.56.0	1
grafana/grafana :7.5.6	09bb407e26ab	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777	0.56.0	1
grafana/grafana :13.0.1	0f86bada30d6	golang.org/x/net@v0.52.0 stdlib@go1.26.0	0.56.0 1.26.6	1
grafana/grafana :7.3.3	15b977f5207d	golang.org/x/net@v0.0.0-20200813134508-3edf25e44fcc	0.56.0	1
grafana/grafana :9.4.7	1a359d92f40e	golang.org/x/net@v0.4.0	0.56.0	1
grafana/grafana :10.1.1	1b9ca4bbc4a2	golang.org/x/net@v0.12.0	0.56.0	1
grafana/grafana :13.0.1-security-01	2d1f9ae67c17	golang.org/x/net@v0.52.0 stdlib@go1.26.2	0.56.0 1.26.6	1
grafana/grafana :12.2.2	2ebef928d7e5	golang.org/x/net@v0.45.0	0.56.0	1
grafana/grafana :12.2.1	35c41e0fd029	golang.org/x/net@v0.45.0	0.56.0	1
grafana/grafana :9.5.2	39c849cebccc	golang.org/x/net@v0.8.0	0.56.0	1
grafana/grafana :11.2.2-security-01	464eac539793	golang.org/x/net@v0.28.0	0.56.0	1
grafana/grafana :11.5.1	5781759b3d27	golang.org/x/net@v0.34.0	0.56.0	1
grafana/grafana :11.6.0	62d2b9d20a19	golang.org/x/net@v0.36.0	0.56.0	1
grafana/grafana :8.0.3	696823fbc561	golang.org/x/net@v0.0.0-20210521195947-fe42d452be8f	0.56.0	1
grafana/grafana :10.2.3	6b5b37eb35bb	golang.org/x/net@v0.19.0	0.56.0	1
grafana/grafana :7.3.4	6d42886b3ebe	golang.org/x/net@v0.0.0-20200813134508-3edf25e44fcc	0.56.0	1
grafana/grafana :12.3.0	70d9599b186c	golang.org/x/net@v0.46.0	0.56.0	1
grafana/grafana :7.2.1	733842cca5bd	golang.org/x/net@v0.0.0-20200813134508-3edf25e44fcc	0.56.0	1
grafana/grafana :12.2.0	74144189b384	golang.org/x/net@v0.43.0	0.56.0	1
grafana/grafana :9.4.3	76dcf36e7d2a	golang.org/x/net@v0.4.0	0.56.0	1
grafana/grafana :10.3.3	8640e5038e83	golang.org/x/net@v0.19.0	0.56.0	1
grafana/grafana :11.5.2	8b37a2f028f1	golang.org/x/net@v0.34.0	0.56.0	1
grafana/grafana :9.1.1	9746858c20e6	golang.org/x/net@v0.0.0-20220615171555-694bf12d69de	0.56.0	1
grafana/grafana :12.1.1	a1701c218024	golang.org/x/net@v0.41.0	0.56.0	1
grafana/grafana :9.0.1	a738d0744784	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4	0.56.0	1
grafana/grafana :10.4.19	a9043254ba16	golang.org/x/net@v0.40.0	0.56.0	1
grafana/grafana :13.1.3	ab5cb380e3ff	golang.org/x/net@v0.49.0 stdlib@go1.26.5	0.56.0 1.26.6	1
grafana/grafana :11.1.3	b23b588cf7cb	golang.org/x/net@v0.26.0	0.56.0	1
grafana/grafana :12.0.2	b5b59bfc7561	golang.org/x/net@v0.40.0	0.56.0	1
grafana/grafana :12.3.2	ba93c9d192e5	golang.org/x/net@v0.47.0	0.56.0	1
grafana/grafana :6.5.1	befcd84da2c1	golang.org/x/net@v0.0.0-20190724013045-ca1201d0de80	0.56.0	1
grafana/grafana :8.3.5	cd7cb4345aa7	golang.org/x/net@v0.0.0-20210903162142-ad29c8ab022f	0.56.0	1
grafana/grafana :8.3.4	cf81d2c753c8	golang.org/x/net@v0.0.0-20210903162142-ad29c8ab022f	0.56.0	1
grafana/grafana :7.4.5	d322192ed2fa	golang.org/x/net@v0.0.0-20201022231255-08b38378de70	0.56.0	1
grafana/grafana :8.5.3	ecc1b80b8ca2	golang.org/x/net@v0.0.0-20211118161319-6a13c67c3ce4	0.56.0	1
grafana/grafana :10.4.0	f9811e4e687f	golang.org/x/net@v0.20.0	0.56.0	1