CVE-2026-78659

Medium

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: Medium; worst across findings
CVSS: 5.5; base score, highest
EPSS: 0.002; 12th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,564; of 18,087 indexed, latest versions
Container images: 6,417; deployed by those charts
Fix available: 6 of 9; affected packages

HTTP/2 server memory exhaustion due to Trailer headers in net/http

Carried by container images the latest versions of 5,564 of 18,087 indexed charts deploy, on 6,417 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+212 more	1.26.9, 1.27.2	6,392
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more	0.60.0	5,161
golang-1.19deb	1.19.8-2	no fix listed	1
helm-4apk	4.3.0-r0	4.3.0-r2	1
ingress-nginx-controller-1.15apk	1.15.10-r3	no fix listed	1
kineapk	0.17.1-r1	0.17.2-r2	1
kubernetes-1.37apk	1.37.1-r0	1.37.1-r2	1
runcapk	1.5.2-r0	no fix listed	1
tetragonapk	1.7.1-r4	1.7.1-r6	1

OSV records: CGA-4wvv-4gxm-pc68 CGA-9hv5-59p6-4m49 CGA-9mpv-qcf2-fr4c CGA-cmf5-g287-mphm CGA-ggmx-8j82-p2pf CGA-hmpr-chf9-7j4f DEBIAN-CVE-2026-78659 GO-2026-6603
Also known as: CGA-2j9j-6w7w-x98q, CGA-32h2-ph4h-6j25, CGA-437c-v9xq-v77f, CGA-5cmh-mcx3-x7xj, CGA-62vw-6x79-rpw5, CGA-7fqm-wjjc-9pfc, CGA-7vrh-rfw7-r9f6, CGA-868g-cgmx-cvph, CGA-8r9c-282h-5mvw, CGA-ch5q-gfj4-q8gh, CGA-fwv6-mhj4-q3jf, CGA-gqw6-fwhv-jpf8, CGA-gw2c-84xv-m8g4, CGA-hcgj-v82p-m28j, CGA-j93h-pjfq-52jm, CGA-jj9f-32xw-j4r7, CGA-mqcg-6v5g-5xp3, CGA-mvr9-28rx-545x, CGA-pjc7-rhj8-2m9q, CGA-q38p-jqw6-276f, CGA-qq83-54q4-2pph, CGA-rhx4-wwr7-qfg4, CGA-v9h6-27pv-3g4r, CGA-w63p-h8hw-xp53, CGA-w7mj-m6pj-r2xq, CGA-wcf2-p3g3-gq3c
Trending: Rank 2 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,564 by stars

Chart

Latest

Affected images

Radar Score

kube-state-metricsromanow-helm-charts

1.7.2

1 of 1 See more

kube-state-metrics romanow-helm-charts 1.7.2

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
bitnamilegacy/kube-state-metrics :2	04a3044b384b	golang.org/x/net@v0.40.0 stdlib@go1.24.5	0.60.0 1.26.9

Open the chart page →

3,348

logstashromanow-helm-charts

1.5.0

1 of 1 See more

logstash romanow-helm-charts 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
library/logstash :7.17.8	17a4f64e9cf5	stdlib@go1.19.3	1.26.9

Open the chart page →

8,582

node-exporterromanow-helm-charts

1.7.1

1 of 1 See more

node-exporter romanow-helm-charts 1.7.1

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
quay.io/prometheus/node-exporter :v1.8.1	fa7fa12a57ef	golang.org/x/net@v0.23.0 stdlib@go1.22.3	0.60.0 1.26.9

Open the chart page →

1,349

postgresromanow-helm-charts

1.7.1

1 of 1 See more

postgres romanow-helm-charts 1.7.1

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
library/postgres :15	724292da1f2e	stdlib@go1.24.6	1.26.9

Open the chart page →

1,853

prometheusromanow-helm-charts

1.7.2

1 of 1 See more

prometheus romanow-helm-charts 1.7.2

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
prom/prometheus :v2.52.0	5c435642ca4d	golang.org/x/net@v0.24.0 stdlib@go1.22.3	0.60.0 1.26.9

Open the chart page →

1,672

routehub-client-hubroutehub-helm

1.0.0

2 of 3 See more

routehub-client-hub routehub-helm 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
eqalpha/keydb :latest	6537505c4235	stdlib@go1.16.7	1.26.9
timescale/timescaledb-ha :pg16	e9f34d8dd276	golang.org/x/net@v0.26.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

15,199

rstudio-pmrstudio

0.20.6

1 of 1 See more

rstudio-pm rstudio 0.20.6

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
posit/package-manager :2026.09.0-ubuntu-24.04	641d5874ccd3	golang.org/x/net@v0.57.0 stdlib@go1.27.0	0.60.0 1.27.2

Open the chart page →

35,120

mealiertomik-helm-charts

0.0.2

1 of 1 See more

mealie rtomik-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/mealie-recipes/mealie :v3.2.1	322369a5b748	stdlib@go1.24.4	1.26.9

Open the chart page →

4,799

kyoorubxkube

0.1.10

1 of 9 See more

kyoo rubxkube 0.1.10

1 of the 9 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/zoriya/kyoo_transcoder :4.7.1	2dadea51a91e	golang.org/x/net@v0.33.0 stdlib@go1.23.4	0.60.0 1.26.9

Open the chart page →

34,010

s3-encryption-gateways3-encryption-gateway

0.12.3

1 of 1 See more

s3-encryption-gateway s3-encryption-gateway 0.12.3

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
cloud37io/s3-encryption-gateway :0.12.3	10e791e98b62	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

141

rabbitmq-operatorsagikazarmark

0.0.3

1 of 1 See more

rabbitmq-operator sagikazarmark 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
rabbitmqoperator/cluster-operator :1.8.3	231e7ce0e905	golang.org/x/net@v0.0.0-20210510120150-4163338589ed stdlib@go1.17	0.60.0 1.26.9

Open the chart page →

3,065

conference-appsalaboy

1.0.0

4 of 7 See more

conference-app salaboy 1.0.0

4 of the 7 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
salaboy/agenda-service-0967b907d9920c99918e2b91b91937b3digest-pinned	ce9ce8293e4e	stdlib@go1.20.1	1.26.9
salaboy/c4p-service-a3dc0474cbfa348afcdf47a8eee70ba9digest-pinned	bb64bf14467d	stdlib@go1.20.1	1.26.9
salaboy/frontend-go-1739aa83b5e69d4ccb8a5615830ae66cdigest-pinned	1ff7c90845e4	stdlib@go1.20.1	1.26.9
salaboy/notifications-service-0e27884e01429ab7e350cb5dff61b525digest-pinned	799c35f9f306	stdlib@go1.20.1	1.26.9

Open the chart page →

13,986

ntfysarab97

0.1.7

1 of 1 See more

ntfy sarab97 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
binwiederhier/ntfy :v2.6.2	83e2e43d9956	golang.org/x/net@v0.11.0 stdlib@go1.20.5	0.60.0 1.26.9

Open the chart page →

2,399

uptime-kumasb-helm-charts

0.4.0

1 of 1 See more

uptime-kuma sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :2.0.2	4c364ef96aad	golang.org/x/net@v0.40.0 stdlib@go1.20.5	0.60.0 1.26.9

Open the chart page →

45,022

scale-sentryscale-sentry

0.5.0

1 of 1 See more

scale-sentry scale-sentry 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/ethan-kane-ops/scale-sentry :0.5.0	17a54e1f7c0b	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

124

scaleway-csiscaleway-charts

0.2.2

8 of 8 See more

scaleway-csi scaleway-charts 0.2.2

8 of the 8 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
scaleway/scaleway-csi :v0.3.4	11135998e31c	golang.org/x/net@v0.42.0 stdlib@go1.24.12	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-attacher :v4.9.0	5aaefc24f315	golang.org/x/net@v0.40.0 stdlib@go1.24.2	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.14.0	5244abbe87e0	golang.org/x/net@v0.40.0 stdlib@go1.24.2	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-provisioner :v5.3.0	bb057f866177	golang.org/x/net@v0.40.0 stdlib@go1.24.2	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-resizer :v1.14.0	5e7cbb63fd49	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-snapshotter :v8.3.0	bc7be893ecc3	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.60.0 1.26.9
registry.k8s.io/sig-storage/livenessprobe :v2.16.0	88092d100909	golang.org/x/net@v0.40.0 stdlib@go1.24.2	0.60.0 1.26.9
registry.k8s.io/sig-storage/snapshot-controller :v8.3.0	12c2da094b02	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.60.0 1.26.9

Open the chart page →

7,129

teamcityscalified-teamcity

2026.2.0

1 of 3 See more

teamcity scalified-teamcity 2026.2.0

1 of the 3 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
library/postgres :14	c2427de38f99	stdlib@go1.24.6	1.26.9

Open the chart page →

1,853

sceptresceptreai

0.1.12

2 of 5 See more

sceptre sceptreai 0.1.12

2 of the 5 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
maponyacharles/sceptreai :postgresql-0.1.12	58881351f309	stdlib@go1.25.12	1.26.9
maponyacharles/sceptreai :seaweedfs-0.1.12	7c8a525f08e9	golang.org/x/net@v0.56.0 stdlib@go1.25.12	0.60.0 1.26.9

Open the chart page →

5,636

schemaheroschemahero

1.4.0

1 of 1 See more

schemahero schemahero 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
schemahero/schemahero-manager :0.22.1	1609e1a05cd3	golang.org/x/net@v0.40.0 stdlib@go1.24.6	0.60.0 1.26.9

Open the chart page →

2,781

scienceboxsciencebox

0.0.7

2 of 17 See more

sciencebox sciencebox 0.0.7

2 of the 17 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
cs3org/revad :v1.19.0	3b57a34a7dfd	golang.org/x/net@v0.0.0-20220325170049-de3da57026de stdlib@go1.17.3	0.60.0 1.26.9
osixia/openldap :1.5.0	18742e9c449c	golang.org/x/net@v0.0.0-20201010224723-4f7140c49acb stdlib@go1.15.5	0.60.0 1.26.9

Open the chart page →

9,493

iopsciencemesh

0.4.0

1 of 2 See more

iop sciencemesh 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
cs3org/revad :v1.24.0	e80a4d67b352	golang.org/x/net@v0.7.0 stdlib@go1.20.4	0.60.0 1.26.9

Open the chart page →

4,831

seatsurfingseatsurfing

0.1.2

1 of 1 See more

seatsurfing seatsurfing 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
seatsurfing/backend :1.119.3	9952e80048b0	golang.org/x/net@v0.56.0 stdlib@go1.26.5	0.60.0 1.26.9

Open the chart page →

887

secrethorsecrethor

1.1.2

1 of 1 See more

secrethor secrethor 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
bonovoo/secrethor :1.1.2	bb93b68fcd17	golang.org/x/net@v0.38.0 stdlib@go1.24.2	0.60.0 1.26.9

Open the chart page →

955

secrets-store-csi-driver-provider-infisicalsecrets-store-csi-driver-provider-infisical

1.1.4

1 of 1 See more

secrets-store-csi-driver-provider-infisical secrets-store-csi-driver-provider-infisical 1.1.4

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
gidoichi/secrets-store-csi-driver-provider-infisical :v1.1.4	2dd5322a0610	golang.org/x/net@v0.57.0 stdlib@go1.26.5	0.60.0 1.26.9

Open the chart page →

499

securosecuro

0.16.3

1 of 4 See more

securo securo 0.16.3

1 of the 4 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
pgvector/pgvector :pg16	7b822b0aac60	stdlib@go1.24.6	1.26.9

Open the chart page →

3,875

selenosis-deployselenosis

2.1.4

4 of 4 See more

selenosis-deploy selenosis 2.1.4

4 of the 4 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
alcounit/browser-controller :v1.0.1	c64222f9e663	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9
alcounit/browser-service :v0.0.9	4bd10defc324	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9
alcounit/browser-ui :v1.0.0	668e7aee5e5c	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9
alcounit/selenosis :v2.1.2	f0964cda6da6	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9

Open the chart page →

3,209

karakeepself-hosters-by-night

2.5.1

1 of 1 See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/karakeep-app/karakeep :0.27.1	abd7d6b11b1b	stdlib@go1.23.10	1.26.9

Open the chart page →

6,194

sentry-k8ssentry-k8s

1.4.1

3 of 11 See more

sentry-k8s sentry-k8s 1.4.1

3 of the 11 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
library/postgres :16	1a6ab3f5345e	stdlib@go1.24.6	1.26.9
library/redis :6.2.20-alpine	77697a75da9f	stdlib@go1.18.2	1.26.9
ghcr.io/getsentry/sentry :26.7.2	7c5052aa4e3c	stdlib@go1.19.8	1.26.9

Open the chart page →

20,679

sentry-operatorsentry-operator

1.2.5

1 of 1 See more

sentry-operator sentry-operator 1.2.5

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/agjmills/sentry-operator :v1.2.5	00389ef6a00e	golang.org/x/net@v0.30.0 stdlib@go1.24.2	0.60.0 1.26.9

Open the chart page →

895

helm64-toolboxserdigital64

0.4.0

1 of 1 See more

helm64-toolbox serdigital64 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/automation64/toolbox/oraclelinux-9-toolbox :latest	7af2216c7b9e	golang.org/x/net@v0.52.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

2,135

vuiseriohub

1.0.6

2 of 3 See more

vui seriohub 1.0.6

2 of the 3 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
dserio83/velero-api :0.3.1	6b3d9115fee2	golang.org/x/net@v0.26.0 stdlib@go1.22.5	0.60.0 1.26.9
dserio83/velero-ui :0.3.1	b4e1ec6664d3	stdlib@go1.23.7	1.26.9

Open the chart page →

13,457

session-manager-agentsession-manager-agent

1.9.0

1 of 2 See more

session-manager-agent session-manager-agent 1.9.0

1 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
public.ecr.aws/cloudnatix/llmariner/session-manager-agent :1.9.0	b9f23db99051	golang.org/x/net@v0.38.0 stdlib@go1.23.11	0.60.0 1.26.9

Open the chart page →

894

session-manager-serversession-manager-server

0.1.0-gfu-dev

1 of 1 See more

session-manager-server session-manager-server 0.1.0-gfu-dev

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
public.ecr.aws/cloudnatix/llmariner/session-manager-server :0.1.0-gfu-dev	b9537499ff9e	golang.org/x/net@v0.35.0 stdlib@go1.23.7	0.60.0 1.26.9

Open the chart page →

1,244

k8s-appliershlomibendavid

1.0.1

1 of 1 See more

k8s-applier shlomibendavid 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
shlomibendavid/k8s-applier :0311240529	a22ffbe0f04e	golang.org/x/net@v0.19.0 stdlib@go1.21.7	0.60.0 1.26.9

Open the chart page →

1,913

clickhousesignoz

24.1.18

3 of 3 See more

clickhouse signoz 24.1.18

3 of the 3 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.21.2	cd9252644ce0	golang.org/x/net@v0.7.0 stdlib@go1.19.10	0.60.0 1.26.9
altinity/metrics-exporter :0.21.2	df3d57215356	golang.org/x/net@v0.7.0 stdlib@go1.19.10	0.60.0 1.26.9
signoz/zookeeper :3.7.1	fcc4a3288154	stdlib@go1.21.2	1.26.9

Open the chart page →

6,710

cosignedsigstore

0.1.23

2 of 2 See more

cosigned sigstore 0.1.23

2 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
gcr.io/projectsigstore/cosigneddigest-pinned	784518ff3ee7	golang.org/x/net@v0.0.0-20220412020605-290c469a71a5 stdlib@go1.17.9	0.60.0 1.26.9
gcr.io/projectsigstore/policy-webhookdigest-pinned	82940e8c3e0d	golang.org/x/net@v0.0.0-20220412020605-290c469a71a5 stdlib@go1.17.9	0.60.0 1.26.9

Open the chart page →

7,370

rekor-tilessigstore

1.2.6

1 of 1 See more

rekor-tiles sigstore 1.2.6

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/sigstore/rekor-tiles/gcp :v2.2.1	e401cfe033c9	golang.org/x/net@v0.55.0 stdlib@go1.26.3	0.60.0 1.26.9

Open the chart page →

609

scaffoldsigstore

0.6.117

11 of 15 See more

scaffold sigstore 0.6.117

11 of the 15 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
library/redisdigest-pinned	148bb5411c18	stdlib@go1.18.2	1.26.9
gcr.io/trillian-opensource-ci/db_serverdigest-pinned	2a685a38dd01	stdlib@go1.18.2	1.26.9
ghcr.io/sigstore/fulcio :v1.9.0	2de0226c5f82	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2
ghcr.io/sigstore/rekor/rekor-server :v1.5.4	100d793d68d0	golang.org/x/net@v0.57.0 stdlib@go1.26.4	0.60.0 1.26.9
ghcr.io/sigstore/scaffolding/createcertsdigest-pinned	4d64dac937e2	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9
ghcr.io/sigstore/scaffolding/createctconfig :v0.7.33	e591f98e3899	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9
ghcr.io/sigstore/scaffolding/createdbdigest-pinned	16673c1099a5	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9
ghcr.io/sigstore/scaffolding/createtreedigest-pinned:v0.7.33	4c845ced03d8	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9
ghcr.io/sigstore/scaffolding/ct_server :v0.7.33	24293fa1ed50	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9
ghcr.io/sigstore/scaffolding/trillian_log_serverdigest-pinned	32ee491f4d00	golang.org/x/net@v0.59.0 stdlib@go1.27.0	0.60.0 1.27.2
ghcr.io/sigstore/scaffolding/trillian_log_signerdigest-pinned	3d0152303816	golang.org/x/net@v0.59.0 stdlib@go1.27.0	0.60.0 1.27.2

Open the chart page →

11,207

octopusdeploysimcube

1.0.21

1 of 2 See more

octopusdeploy simcube 1.0.21

1 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
bitnami/kubectl :latest	f7f9e4f64d9e	golang.org/x/net@v0.57.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

141

simply-dns-webhooksimply-dns-webhook

1.10.0

1 of 1 See more

simply-dns-webhook simply-dns-webhook 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/runnerm/simply-dns-webhook :v1.10.0	fdfffa3984a5	golang.org/x/net@v0.52.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

671

mongodb-backupsinextra

1.1.0

1 of 1 See more

mongodb-backup sinextra 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/sergelogvinov/mongodb :8.0.10	1eee8e20a87f	golang.org/x/net@v0.40.0 stdlib@go1.23.8	0.60.0 1.26.9

Open the chart page →

5,514

postgresql-singlesinextra

1.15.2

1 of 1 See more

postgresql-single sinextra 1.15.2

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/sergelogvinov/postgresql :16.15	fafb72e98f22	golang.org/x/net@v0.47.0 stdlib@go1.24.6	0.60.0 1.26.9

Open the chart page →

6,172

registry-mirrorssinextra

2.0.19

1 of 1 See more

registry-mirrors sinextra 2.0.19

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/project-zot/zot :v2.1.21	6b69512c00dc	golang.org/x/net@v0.58.0 stdlib@go1.26.8-X:jsonv2	0.60.0 1.26.9

Open the chart page →

609

skippersinextra

0.8.13

1 of 1 See more

skipper sinextra 0.8.13

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/zalando/skipper :v0.27.88	3a357a2a4bef	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

317

altinity-clickhouse-operatorslamdev

0.1.2

2 of 2 See more

altinity-clickhouse-operator slamdev 0.1.2

2 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.20.0	8f0f582d41f0	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.17.13	0.60.0 1.26.9
altinity/metrics-exporter :0.20.0	1a46d104406d	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.17.13	0.60.0 1.26.9

Open the chart page →

8,146

docker-registry-uislamdev

0.0.1

1 of 1 See more

docker-registry-ui slamdev 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
quiq/docker-registry-ui :0.9.4	91281da47036	golang.org/x/net@v0.0.0-20211015210444-4f30a5c0130f stdlib@go1.18	0.60.0 1.26.9

Open the chart page →

3,185

external-secrets-operatorslamdev

0.0.15

1 of 1 See more

external-secrets-operator slamdev 0.0.15

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
slamdev/external-secrets-operator :0.0.8	855f6625dda4	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.15	0.60.0 1.26.9

Open the chart page →

3,450

wg-easyslybase-wg-easy

1.2.0

1 of 1 See more

wg-easy slybase-wg-easy 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/wg-easy/wg-easy :15.4.0	0e7bc9d34e86	golang.org/x/net@v0.44.0 stdlib@go1.26.3	0.60.0 1.26.9

Open the chart page →

1,214

wireguardslybase-wireguard

2.0.9

1 of 1 See more

wireguard slybase-wireguard 2.0.9

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
linuxserver/wireguard :1.0.20260223-r0-ls125	437a490f7afc	golang.org/x/net@v0.47.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

662

smallest-self-hostsmallest-self-host

0.2.2

7 of 12 See more

smallest-self-host smallest-self-host 0.2.2

7 of the 12 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
bitnami/redis :latest	f4797b37502e	stdlib@go1.26.8	1.26.9
grafana/grafana :11.0.0	0dc5a246ab16	golang.org/x/net@v0.23.0 stdlib@go1.21.10	0.60.0 1.26.9
quay.io/prometheus-operator/prometheus-operator :v0.74.0	6b3f6d8b4c0a	golang.org/x/net@v0.25.0 stdlib@go1.22.3	0.60.0 1.26.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v20221220-controller-v1.5.1-58-g787ea74b6	4d99688e5573	golang.org/x/net@v0.1.0 stdlib@go1.19.4	0.60.0 1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.12.0	b401fae262a5	golang.org/x/net@v0.22.0 stdlib@go1.21.8	0.60.0 1.26.9
registry.k8s.io/nfd/node-feature-discovery :v0.16.6	19ebca8b3804	golang.org/x/net@v0.25.0 stdlib@go1.22.8	0.60.0 1.26.9
registry.k8s.io/prometheus-adapter/prometheus-adapter :v0.12.0	932eae60e2bc	golang.org/x/net@v0.24.0 stdlib@go1.22.2	0.60.0 1.26.9

Open the chart page →

11,245

Container images carrying it

6,417 by charts deploying them

A fixed version is listed for 6 of the 9 affected packages.

Container image	Digest	Package	Fixed in	Used by
library/traefik :2.4.8	eda951fd29a8	golang.org/x/net@v0.0.0-20210220033124-5f55cee0dc0d stdlib@go1.16.2	0.60.0 1.26.9	2
library/traefik :2.2.8	f5af5a5ce17f	golang.org/x/net@v0.0.0-20200301022130-244492dfa37a stdlib@go1.14.6	0.60.0 1.26.9	2
library/zookeeper :3.9.5	e6b279d01350	stdlib@go1.18.1	1.26.9	2
lightninglabs/lnd :v0.18.3-beta	f86bbec4dfb3	golang.org/x/net@v0.24.0 stdlib@go1.22.5	0.60.0 1.26.9	2
linuxserver/cloud9 :latest :version-1.29.2	45c5fe102ff3	golang.org/x/net@v0.0.0-20201224014010-6772e930b67b stdlib@go1.17.11	0.60.0 1.26.9	2
listmonk/listmonk :v2.1.0	d2eac77ddfad	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.17.6	0.60.0 1.26.9	2
listmonk/listmonk :latest :v6.2.0	f535d59e1499	golang.org/x/net@v0.47.0 stdlib@go1.26.1	0.60.0 1.26.9	2
localstack/localstack-pro :latest	801a3dff7f6a	golang.org/x/net@v0.59.0 stdlib@go1.27.1-X:nojsonv2	0.60.0 1.27.2	2
longhornio/longhorn-manager :v1.2.3	dca34321452c	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.14.1	0.60.0 1.26.9	2
louislam/uptime-kuma :1.23.13	96510915e6be	golang.org/x/net@v0.19.0 stdlib@go1.19.6	0.60.0 1.26.9	2
louislam/uptime-kuma :2.3.2	9aeb4e51d038	golang.org/x/net@v0.40.0 stdlib@go1.20.5	0.60.0 1.26.9	2
louislam/uptime-kuma :2.5.0	a8610b3b4c38	golang.org/x/net@v0.55.0 stdlib@go1.20.5	0.60.0 1.26.9	2
louislam/uptime-kuma :2.5.5	c74379ac4509	golang.org/x/net@v0.55.0 stdlib@go1.20.5	0.60.0 1.26.9	2
mattermost/mattermost-team-edition :10.11.2	b8bd1246cb3a	golang.org/x/net@v0.40.0 stdlib@go1.24.5	0.60.0 1.26.9	2
matthiasluedtke/iconserver :v3.16.0	661d607b0fbc	golang.org/x/net@v0.7.0 stdlib@go1.21.1	0.60.0 1.26.9	2
maxrocketinternet/datadog-controller :0.1	a867315facf8	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.15	0.60.0 1.26.9	2
maxrocketinternet/soti-mobicontrol-exporter :0.6	1a281b76efa3	stdlib@go1.14	1.26.9	2
mesosphere/kubeaddons-catalog :v0.11.4	073db43d0b8b	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.15.2	0.60.0 1.26.9	2
mesosphere/kubectl :v1.35.0-alpine	ea01a9387771	golang.org/x/net@v0.43.0 stdlib@go1.25.5	0.60.0 1.26.9	2
mikefarah/yq :4 :latest	4b3d9475d655	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	2
moby/buildkit :v0.32.2-rootless	504731e577c2	golang.org/x/net@v0.43.0 stdlib@go1.25.7	0.60.0 1.26.9	2
nacos/nacos-server :latest	1c191c30c8cd	stdlib@go1.26.5	1.26.9	2
natsio/nats-box :0.11.0	9fbf7bf684e4	golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2 stdlib@go1.18.1	0.60.0 1.26.9	2
natsio/nats-server-config-reloader :0.20.1	47094fcae2f4	stdlib@go1.24.8	1.26.9	2
natsio/nats-server-config-reloader :0.7.2	911ce7ed2f55	stdlib@go1.19	1.26.9	2
natsio/nats-server-config-reloader :0.10.1	e414cc7e6f59	stdlib@go1.19.4	1.26.9	2
natsio/prometheus-nats-exporter :0.10.0	16048afb67a5	stdlib@go1.19	1.26.9	2
natsio/prometheus-nats-exporter :0.11.0	31c02aac089a	stdlib@go1.20.3	1.26.9	2
neosmemo/memos :0.31.0	24c2707ddd8f	golang.org/x/net@v0.58.0 stdlib@go1.27.0	0.60.0 1.27.2	2
nousresearch/hermes-agent :v2026.9.24	fca358f12efd	stdlib@go1.24.4	1.26.9	2
obolnetwork/charon :v1.10.0	278c7e2897b6	golang.org/x/net@v0.52.0 stdlib@go1.26.1	0.60.0 1.26.9	2
oliver006/redis_exporter :v1.9.0	4af75e9f16f6	stdlib@go1.14.4	1.26.9	2
openbas/caldera-server :5.1.0	a277796d9724	golang-1.19@1.19.8-2 golang.org/x/net@v0.14.0 stdlib@go1.19.8	no fix listed 0.60.0 1.26.9	2
opencloudeu/opencloud-rolling :8.1.0	8fc64ca86173	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9	2
opencloudeu/opencloud-rolling :2.1.0	f9634bb04905	golang.org/x/net@v0.38.0 stdlib@go1.24.2	0.60.0 1.26.9	2
openebs/etcd :3.6.4-debian-12-r0	c86c06f1ce6a	golang.org/x/net@v0.38.0 stdlib@go1.24.5	0.60.0 1.26.9	2
openebs/mc :RELEASE.2024-11-21T17-21-54Z	4d1b85539919	golang.org/x/net@v0.29.0 stdlib@go1.23.4	0.60.0 1.26.9	2
openebs/minio :RELEASE.2024-12-18T13-15-44Z	bb04e41fc1b8	golang.org/x/net@v0.29.0 stdlib@go1.23.4	0.60.0 1.26.9	2
openebs/provisioner-localpv :4.6.0	99f5116f5cb8	golang.org/x/net@v0.55.0 stdlib@go1.25.0	0.60.0 1.26.9	2
openfga/openfga :latest :v1.22.0	9cf9a20af32a	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9	2
openkruise/kruise-helm-hook :v0.1.0	edc7cf9428fd	golang.org/x/net@v0.24.0 stdlib@go1.20.14	0.60.0 1.26.9	2
openpolicyagent/gatekeeper :v3.4.0-rc.1	825370bdb3c3	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777 stdlib@go1.16.2	0.60.0 1.26.9	2
oryd/hydra-maester :v0.0.42	0a7a2bfd0e7d	golang.org/x/net@v0.55.0 stdlib@go1.26.3	0.60.0 1.26.9	2
oryd/kratos :v1.0.0	d06fc5845f63	golang.org/x/net@v0.8.0 stdlib@go1.20.5	0.60.0 1.26.9	2
oryd/kratos :v1.3.1	fe2428f103a6	golang.org/x/net@v0.27.0 stdlib@go1.23.2	0.60.0 1.26.9	2
oryd/oathkeeper :v0.40.6	e8cb9b79a89c	golang.org/x/net@v0.9.0 stdlib@go1.20.5	0.60.0 1.26.9	2
osixia/openldap :1.4.0	ccd95cc6e61e	golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3 stdlib@go1.13.4	0.60.0 1.26.9	2
otel/opentelemetry-collector-contrib :0.96.0	7ef2a2ff46b9	golang.org/x/net@v0.21.0 stdlib@go1.21.7	0.60.0 1.26.9	2
otel/opentelemetry-collector-contrib :0.145.0	a7343f018690	golang.org/x/net@v0.49.0 stdlib@go1.25.7	0.60.0 1.26.9	2
otel/opentelemetry-collector-contrib :0.161.0 :latest	fd328de25524	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	2