CVE-2026-78659

High

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.006; 46th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,312; of 18,131 indexed, latest versions
Container images: 6,132; deployed by those charts
Fix available: 3 of 5; affected packages

HTTP/2 server memory exhaustion due to Trailer headers in net/http

Carried by container images the latest versions of 5,312 of 18,131 indexed charts deploy, on 6,132 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+209 more	1.26.9, 1.27.2	6,077
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more	0.60.0	4,894
golang-1.19deb	1.19.8-2	no fix listed	1
ingress-nginx-controller-1.15apk	1.15.10-r9	no fix listed	1
minioapk	0.20251015.172955-r10	0.20260922.192518-r2	1

OSV records: CGA-p32r-2pjm-q43g CGA-pjc7-rhj8-2m9q DEBIAN-CVE-2026-78659 GO-2026-6603
Also known as: CGA-w7mj-m6pj-r2xq, CGA-wxcm-45pg-2cp8
Trending: Rank 3 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,312 by stars

Chart

Latest

Affected images

Radar Score

kube-prometheus-stackwenerme

92.7.0

4 See more

kube-prometheus-stack wenerme 92.7.0

4 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
grafana/grafana :13.2.4-distroless	ae3d3add290a	golang.org/x/net@v0.58.0 stdlib@go1.26.7	0.60.0 1.26.9
quay.io/prometheus-operator/prometheus-operator :v0.94.1	7c88d4e7bae6	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9
quay.io/prometheus/node-exporter :v1.12.1-distroless	8c9bac11973b	golang.org/x/net@v0.57.0 stdlib@go1.26.5	0.60.0 1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.20.0	42cfe3723a5f	golang.org/x/net@v0.57.0 stdlib@go1.26.6	0.60.0 1.26.9

Open the chart page →

—

natswenerme

2.15.1

2 of 3 See more

nats wenerme 2.15.1

2 of the 3 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
natsio/nats-box :0.20.0	d2f04223f40e	golang.org/x/net@v0.59.0 stdlib@go1.26.6	0.60.0 1.26.9
natsio/nats-server-config-reloader :0.24.0	d758a82a9c20	stdlib@go1.26.5	1.26.9

Open the chart page →

1,073

prometheus-blackbox-exporterwenerme

11.20.0

1 of 1 See more

prometheus-blackbox-exporter wenerme 11.20.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
quay.io/prometheus/blackbox-exporter :v0.29.0	9613f2884689	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

213

yugabytewenerme

2026.1.2

1 of 1 See more

yugabyte wenerme 2026.1.2

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
yugabytedb/yugabyte :2026.1.2.0-b137	b6dba322c734	golang.org/x/net@v0.58.0 stdlib@go1.26.7	0.60.0 1.26.9

Open the chart page →

444

wharf-ainowharf-helm

0.1.5

5 of 7 See more

wharf-aino wharf-helm 0.1.5

5 of the 7 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
quay.io/iver-wharf/wharf-api :v5.2.0	b736b345437d	golang.org/x/net@v0.0.0-20220325170049-de3da57026de stdlib@go1.18.1	0.60.0 1.26.9
quay.io/iver-wharf/wharf-cmd :v0.8.2	e98d13459cdc	golang.org/x/net@v0.0.0-20220412020605-290c469a71a5 stdlib@go1.18.2	0.60.0 1.26.9
quay.io/iver-wharf/wharf-provider-azuredevops :v3.0.1	2fe7e4dcffdf	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4 stdlib@go1.18.2	0.60.0 1.26.9
quay.io/iver-wharf/wharf-provider-github :v3.0.1	77a22cb45c2a	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4 stdlib@go1.18.2	0.60.0 1.26.9
quay.io/iver-wharf/wharf-provider-gitlab :v2.0.1	d7079e0890da	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4 stdlib@go1.18.2	0.60.0 1.26.9

Open the chart page →

18,581

wharf-cmdwharf-helm

0.3.3

1 of 1 See more

wharf-cmd wharf-helm 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
quay.io/iver-wharf/wharf-cmd :v0.8.2	e98d13459cdc	golang.org/x/net@v0.0.0-20220412020605-290c469a71a5 stdlib@go1.18.2	0.60.0 1.26.9

Open the chart page →

4,452

spark-operatorwikimedia

2.2.8

1 of 1 See more

spark-operator wikimedia 2.2.8

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/kubeflow/spark-operator/controller :2.2.1	865ff4da5686	golang.org/x/net@v0.38.0 stdlib@go1.24.1	0.60.0 1.26.9

Open the chart page →

57,337

external-monitoringwiremind

0.3.0

1 of 1 See more

external-monitoring wiremind 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
quay.io/prometheus/blackbox-exporter :v0.24.0	3af31f8bd1ad	golang.org/x/net@v0.9.0 stdlib@go1.20.4	0.60.0 1.26.9

Open the chart page →

2,015

kubemodwiremind

0.1.5

1 of 2 See more

kubemod wiremind 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
kubemod/kubemod :v0.13.0	cadca39288ad	golang.org/x/net@v0.0.0-20200520004742-59133d7f0dd7 stdlib@go1.14.7	0.60.0 1.26.9

Open the chart page →

4,279

db-backup-retentionwjentner-charts

1.1.0

1 of 1 See more

db-backup-retention wjentner-charts 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/wjentner/k8s-db-backup-retention :v1.1.0	8027bb46d1f4	golang.org/x/net@v0.26.0 stdlib@go1.23.5	0.60.0 1.26.9

Open the chart page →

1,631

wordpress-e2e-setupwoocommerce-e2e-setup

0.1.1

1 of 2 See more

wordpress-e2e-setup woocommerce-e2e-setup 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
library/mysql :8.0	7dcddc01f13b	stdlib@go1.24.6	1.26.9

Open the chart page →

9,667

wordpress-helmwordpress-helm

0.2.9

2 of 4 See more

wordpress-helm wordpress-helm 0.2.9

2 of the 4 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
aapjeisbaas/wp-frankenphp :v0.2.2	6b261abc7fb0	golang.org/x/net@v0.54.0 stdlib@go1.26.3	0.60.0 1.26.9
library/mysql :8	24989179f588	stdlib@go1.24.6	1.26.9

Open the chart page →

10,440

workflows-aggregatorworkflows-aggregator

0.16.12

1 of 1 See more

workflows-aggregator workflows-aggregator 0.16.12

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
registry.gitlab.com/dyff/workflows-aggregator :0.16.12	ce790a4023b6	stdlib@go1.26.7	1.26.9

Open the chart page →

1,103

workflows-informerworkflows-informer

0.4.4

1 of 1 See more

workflows-informer workflows-informer 0.4.4

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
registry.gitlab.com/dyff/workflows-informer :0.4.4	bfbadc49635d	golang.org/x/net@v0.17.0 stdlib@go1.20.14	0.60.0 1.26.9

Open the chart page →

1,907

wraftwraft

0.1.12

2 of 9 See more

wraft wraft 0.1.12

2 of the 9 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
library/postgres :14-alpine	4ea9e5ed0659	stdlib@go1.24.6	1.26.9
quay.io/wraft/wraft-frontend :latest	f1bbbd5e9bb9	stdlib@go1.23.10	1.26.9

Open the chart page →

6,150

pi-hole-exporterwyrihaximusnet

0.1.3

1 of 1 See more

pi-hole-exporter wyrihaximusnet 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ekofr/pihole-exporter :0.0.10	9fdad6f352e0	golang.org/x/net@v0.0.0-20190620200207-3b0461eec859 stdlib@go1.14.7	0.60.0 1.26.9

Open the chart page →

3,029

redis-db-assignment-operatorwyrihaximusnet

1.0.6

1 of 1 See more

redis-db-assignment-operator wyrihaximusnet 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/wyrihaximusnet/kubernetes-redis-db-assignment-operator :v1.0.8	31060be60bec	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.16.15	0.60.0 1.26.9

Open the chart page →

3,298

x402-k8s-operatorx402-k8s-operator

0.1.0

2 of 2 See more

x402-k8s-operator x402-k8s-operator 0.1.0

2 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
bitnami/kubectl :latest	999d5eb28f40	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9
ghcr.io/razvanmacovei/x402-k8s-operator :0.1.0	bf3407fad182	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.60.0 1.26.9

Open the chart page →

881

discord-botxxczaki

0.34.26

1 of 2 See more

discord-bot xxczaki 0.34.26

1 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
bitnami/redisdigest-pinned	d75bda00b778	stdlib@go1.26.7	1.26.9

Open the chart page →

936

prometheusalertxxl-job-admin

1.4.0

1 of 1 See more

prometheusalert xxl-job-admin 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
feiyu563/prometheus-alert :v4.9.2	8192368b0578	golang.org/x/net@v0.24.0 stdlib@go1.20.6	0.60.0 1.26.9

Open the chart page →

1,872

heistyouniqx-oss

1.1.209

1 of 1 See more

heist youniqx-oss 1.1.209

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
quay.io/youniqx/heist :v1.1.209	c43b3a9d98ae	golang.org/x/net@v0.28.0 stdlib@go1.22.7	0.60.0 1.26.9

Open the chart page →

1,346

yugawareyugabyte

2026.1.2

1 of 5 See more

yugaware yugabyte 2026.1.2

1 of the 5 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
library/postgres :14.23	2f439458ab6a	stdlib@go1.24.6	1.26.9

Open the chart page →

2,429

zcash-stackzcash

0.4.7

1 of 2 See more

zcash-stack zcash 0.4.7

1 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
electriccoinco/lightwalletd :v0.5.5	483a36148353	golang.org/x/net@v0.58.0 stdlib@go1.25.14	0.60.0 1.26.9

Open the chart page →

879

tailscale-relayzeet

0.1.5

1 of 1 See more

tailscale-relay zeet 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
zeetdev/tailscale-relay :v1.24.2	1967aa2840b6	golang.org/x/net@v0.0.0-20220407224826-aac1ed45d8e3 stdlib@go1.18.1-ts710a0d8610	0.60.0 1.26.9

Open the chart page →

3,225

crowdsec-web-uizekker6

0.55.0

1 of 1 See more

crowdsec-web-ui zekker6 0.55.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/theduffman85/crowdsec-web-ui :2026.10.2	c334d8fdf7a8	stdlib@go1.24.4	1.26.9

Open the chart page →

1,570

memoszekker6

0.56.0

1 of 1 See more

memos zekker6 0.56.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
neosmemo/memos :0.31.0	24c2707ddd8f	golang.org/x/net@v0.58.0 stdlib@go1.27.0	0.60.0 1.27.2

Open the chart page →

290

cloudflare-zero-trust-operatorzelic-io

0.7.1

1 of 1 See more

cloudflare-zero-trust-operator zelic-io 0.7.1

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/bojanzelic/cloudflare-zero-trust-operator :0.7.1	f4b2dbc19a78	golang.org/x/net@v0.33.0 stdlib@go1.23.4	0.60.0 1.26.9

Open the chart page →

1,116

mikochizer0tonin

1.12.1

1 of 1 See more

mikochi zer0tonin 1.12.1

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
zer0tonin/mikochi :1.12.1	654af3e65245	stdlib@go1.26.7	1.26.9

Open the chart page →

673

velero-notificationszokeber-velero-notifications

0.1.10

1 of 2 See more

velero-notifications zokeber-velero-notifications 0.1.10

1 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/zokeber/velero-notifications :0.0.17	6d84f6c4ce20	golang.org/x/net@v0.52.0 stdlib@go1.25.8	0.60.0 1.26.9

Open the chart page →

1,136

backendzymtrace

26.10.0

2 of 6 See more

backend zymtrace 26.10.0

2 of the 6 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
library/postgres :17.4	304ab8135187	stdlib@go1.18.2	1.26.9
pgsty/silo :RELEASE.2026-09-03T13-18-01Z	b616a0cf8cb2	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

11,264

aaqaaq

0.3.0

1 of 1 See more

aaq aaq 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
quay.io/kubevirt/aaq-operator :v1.7.0	d28a2daa5b15	golang.org/x/net@v0.47.0 stdlib@go1.24.12	0.60.0 1.26.9

Open the chart page →

1,453

cert-manager-webhook-bunnyaardbol-cert-manager-webhook-bunny

1.4.2

1 of 1 See more

cert-manager-webhook-bunny aardbol-cert-manager-webhook-bunny 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/aardbol/cert-manager-webhook-bunny :v1.4.1	be5e446c5ed5	golang.org/x/net@v0.57.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

236

abstract-nodeabstract-node

0.1.49

1 of 2 See more

abstract-node abstract-node 0.1.49

1 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/abstract-foundation/zksync-external-node-sidecar :v1.0.0	3e705d0eb1ce	golang.org/x/net@v0.7.0 stdlib@go1.18.10	0.60.0 1.26.9

Open the chart page →

5,698

accurateaccurate

2.1.0

1 of 1 See more

accurate accurate 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/cybozu-go/accurate :2.1.0	b5cc37ab4d9c	golang.org/x/net@v0.57.0 stdlib@go1.26.3	0.60.0 1.26.9

Open the chart page →

370

rabbitmq-cluster-operatoradeptia-automate-operator

5.2.0

2 of 2 See more

rabbitmq-cluster-operator adeptia-automate-operator 5.2.0

2 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
adeptiainc/adeptia-connect-rabbitmq-cluster-operator :5.2	cf610f8c614c	golang.org/x/net@v0.49.0 stdlib@go1.25.7	0.60.0 1.26.9
adeptiainc/adeptia-connect-rabbitmq-messaging-topology-operator :5.2	7cdf6ac2e738	golang.org/x/net@v0.49.0 stdlib@go1.25.7	0.60.0 1.26.9

Open the chart page →

1,341

jenkinsaditisingh-jenkins

1.0.0

1 of 1 See more

jenkins aditisingh-jenkins 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
jenkins/jenkins :lts	a660310e39ad	golang.org/x/net@v0.57.0 stdlib@go1.27.0	0.60.0 1.27.2

Open the chart page →

2,134

activepiecesadnoctem

0.7.1

1 of 1 See more

activepieces adnoctem 0.7.1

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
activepieces/activepieces :0.92.2	87295caa32a1	stdlib@go1.23.5	1.26.9

Open the chart page →

1,949

glanceadnoctem

0.1.0

1 of 1 See more

glance adnoctem 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
glanceapp/glance :v0.8.6	9dfb09470b20	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

383

gobackupadnoctem

0.4.0

1 of 1 See more

gobackup adnoctem 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
huacnlee/gobackup :v3.1.1	560be93229a5	golang.org/x/net@v0.47.0 stdlib@go1.26.3	0.60.0 1.26.9

Open the chart page →

2,642

gotenbergadnoctem

0.5.0

1 of 1 See more

gotenberg adnoctem 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
gotenberg/gotenberg :8.37.0	f29984bd1e22	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

11,103

linkwardenadnoctem

0.5.1

1 of 2 See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/linkwarden/linkwarden :v2.16.3	0664c28a039b	stdlib@go1.23.7	1.26.9

Open the chart page →

5,139

ntfyadnoctem

0.4.1

1 of 1 See more

ntfy adnoctem 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
binwiederhier/ntfy :v2.29.0	4c599cf08189	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

225

popeyeadnoctem

0.3.0

1 of 1 See more

popeye adnoctem 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
derailed/popeye :v0.22.1	8e68e22c7663	golang.org/x/net@v0.34.0 stdlib@go1.23.5	0.60.0 1.26.9

Open the chart page →

1,959

uptime-kumaadnoctem

0.4.3

1 of 1 See more

uptime-kuma adnoctem 0.4.3

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :2.5.6	9912da7d7d9b	golang.org/x/net@v0.55.0 stdlib@go1.26.3	0.60.0 1.26.9

Open the chart page →

36,587

adresserviceadresservice

1.1.0

1 of 5 See more

adresservice adresservice 1.1.0

1 of the 5 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/adresservice-php :latest	c5075f0320cd	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.60.0 1.26.9

Open the chart page →

9,417

bootaerokube

1.0.1

3 of 4 See more

boot aerokube 1.0.1

3 of the 4 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
quay.io/aerokube/boot :1.0.1	3c269612053f	golang.org/x/net@v0.24.0 stdlib@go1.22.2	0.60.0 1.26.9
quay.io/aerokube/keygen :1.0.1	578934444f04	golang.org/x/net@v0.8.0 stdlib@go1.20.5	0.60.0 1.26.9
quay.io/aerokube/reloader :1.0.1	e4a3661416a5	stdlib@go1.22.2	1.26.9

Open the chart page →

10,292

browser-opsaerokube

2.6.7

1 of 1 See more

browser-ops aerokube 2.6.7

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
quay.io/aerokube/browser-ops :2.6.7	807c1bb67086	golang.org/x/net@v0.23.0 stdlib@go1.22.2	0.60.0 1.26.9

Open the chart page →

1,135

moonaerokube

1.1.37

3 of 3 See more

moon aerokube 1.1.37

3 of the 3 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
aerokube/moon :1.9.17	da76ca51220d	golang.org/x/net@v0.25.0 stdlib@go1.22.3	0.60.0 1.26.9
aerokube/moon-api :1.9.17	6b6323e75785	golang.org/x/net@v0.25.0 stdlib@go1.22.3	0.60.0 1.26.9
aerokube/selenoid-ui :1.10.11	3f3e299509fd	golang.org/x/net@v0.10.0 stdlib@go1.21.5	0.60.0 1.26.9