CVE-2026-78659

Medium

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: Medium; worst across findings
CVSS: 5.5; base score, highest
EPSS: 0.002; 12th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,530; of 18,090 indexed, latest versions
Container images: 6,374; deployed by those charts
Fix available: 6 of 9; affected packages

HTTP/2 server memory exhaustion due to Trailer headers in net/http

Carried by container images the latest versions of 5,530 of 18,090 indexed charts deploy, on 6,374 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+212 more	1.26.9, 1.27.2	6,355
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more	0.60.0	5,126
golang-1.19deb	1.19.8-2	no fix listed	1
helm-4apk	4.3.0-r0	4.3.0-r2	1
ingress-nginx-controller-1.15apk	1.15.10-r3	no fix listed	1
kineapk	0.17.1-r1	0.17.2-r2	1
kubernetes-1.37apk	1.37.1-r0	1.37.1-r2	1
runcapk	1.5.2-r0	no fix listed	1
tetragonapk	1.7.1-r4	1.7.1-r6	1

OSV records: CGA-4wvv-4gxm-pc68 CGA-9hv5-59p6-4m49 CGA-9mpv-qcf2-fr4c CGA-cmf5-g287-mphm CGA-ggmx-8j82-p2pf CGA-hmpr-chf9-7j4f DEBIAN-CVE-2026-78659 GO-2026-6603
Also known as: CGA-2j9j-6w7w-x98q, CGA-32h2-ph4h-6j25, CGA-437c-v9xq-v77f, CGA-5cmh-mcx3-x7xj, CGA-62vw-6x79-rpw5, CGA-7fqm-wjjc-9pfc, CGA-7vrh-rfw7-r9f6, CGA-868g-cgmx-cvph, CGA-8r9c-282h-5mvw, CGA-ch5q-gfj4-q8gh, CGA-fwv6-mhj4-q3jf, CGA-gqw6-fwhv-jpf8, CGA-gw2c-84xv-m8g4, CGA-hcgj-v82p-m28j, CGA-j93h-pjfq-52jm, CGA-jj9f-32xw-j4r7, CGA-mqcg-6v5g-5xp3, CGA-mvr9-28rx-545x, CGA-pjc7-rhj8-2m9q, CGA-q38p-jqw6-276f, CGA-qq83-54q4-2pph, CGA-rhx4-wwr7-qfg4, CGA-v9h6-27pv-3g4r, CGA-w63p-h8hw-xp53, CGA-w7mj-m6pj-r2xq, CGA-wcf2-p3g3-gq3c
Trending: Rank 2 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,530 by stars

Chart

Latest

Affected images

Radar Score

gloosolo-gloo-edge

0.0.0-fork

4 of 5 See more

gloo solo-gloo-edge 0.0.0-fork

4 of the 5 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
quay.io/solo-io/certgen :0.0.0-fork	b17a8c7d1f32	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.1	0.60.0 1.26.9
quay.io/solo-io/discovery :0.0.0-fork	5b62aaade3c9	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.1	0.60.0 1.26.9
quay.io/solo-io/gloo :0.0.0-fork	9a6c84560d44	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.1	0.60.0 1.26.9
quay.io/solo-io/gloo-envoy-wrapper :0.0.0-fork	26ae185e835a	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.1	0.60.0 1.26.9

Open the chart page →

12,990

sp-otel-collectorsp-otel-collector

1.1.6

1 of 1 See more

sp-otel-collector sp-otel-collector 1.1.6

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
quay.io/geored/spmm-collector-contrib :1.0.0	63baf86a49ac	golang.org/x/net@v0.11.0 stdlib@go1.20.5	0.60.0 1.26.9

Open the chart page →

2,692

sql-exportersql-exporter

0.18.11

1 of 1 See more

sql-exporter sql-exporter 0.18.11

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
burningalchemist/sql_exporter :0.24.9	6c554722facc	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

128

sql-operatorsql-operator

0.11.2

1 of 1 See more

sql-operator sql-operator 0.11.2

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/stenic/sql-operator :1.13.2	f4324baa2aad	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.17.13	0.60.0 1.26.9

Open the chart page →

2,412

gitwebhookproxystakater

0.2.79

1 of 1 See more

gitwebhookproxy stakater 0.2.79

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
stakater/gitwebhookproxy :v0.2.79	c1226e5270cd	stdlib@go1.13.1	1.26.9

Open the chart page →

2,586

splunk-operatorstakater

0.0.6

1 of 2 See more

splunk-operator stakater 0.0.6

1 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
splunk/splunk-operator :2.0.0	c4e0d3146226	golang.org/x/net@v0.0.0-20211029224645-99673261e6eb stdlib@go1.17.12	0.60.0 1.26.9

Open the chart page →

12,363

gethstakewise

2.5.8

1 of 3 See more

geth stakewise 2.5.8

1 of the 3 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ethereum/client-go :v1.15.10	1f36ca5922a5	golang.org/x/net@v0.36.0 stdlib@go1.24.2	0.60.0 1.26.9

Open the chart page →

1,789

graph-nodestakewise

3.1.0

2 of 3 See more

graph-node stakewise 3.1.0

2 of the 3 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
graphprotocol/graph-node :v0.37.0	f4452cdedd68	stdlib@go1.24.1	1.26.9
ipfs/kubo :v0.24.0	e3de33bd746b	golang.org/x/net@v0.17.0 stdlib@go1.19.8	0.60.0 1.26.9

Open the chart page →

6,026

mayastorstartechnica

0.2.0

3 of 13 See more

mayastor startechnica 0.2.0

3 of the 13 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-attacher :v4.0.0	9a685020911e	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.18	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.6.0	f1c25991bac2	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.18	0.60.0 1.26.9
registry.k8s.io/sig-storage/livenessprobe :v2.8.0	cacee2b5c36d	golang.org/x/net@v0.0.0-20220921203646-d300de134e69 stdlib@go1.18	0.60.0 1.26.9

Open the chart page →

7,204

multusstartechnica

0.1.2

1 of 1 See more

multus startechnica 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/k8snetworkplumbingwg/multus-cni :stable	9dc8ca645a78	golang.org/x/net@v0.55.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

616

statpingstatping

0.1.14

1 of 1 See more

statping statping 0.1.14

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
statping/statping :v0.90.74	e874da513a5c	golang.org/x/net@v0.0.0-20200904194848-62affa334b73 stdlib@go1.14.13	0.60.0 1.26.9

Open the chart page →

4,518

thanosstevehipwell-helm-charts-thanos

1.24.1

1 of 1 See more

thanos stevehipwell-helm-charts-thanos 1.24.1

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
quay.io/thanos/thanos :v0.42.4	b567818fe608	golang.org/x/net@v0.56.0 stdlib@go1.26.5	0.60.0 1.26.9

Open the chart page →

426

stornxstornx

1.1.1

9 of 9 See more

stornx stornx 1.1.1

9 of the 9 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
alazidis/kube-netlag :1.1.0	0e8c84152201	golang.org/x/net@v0.33.0 stdlib@go1.24.13	0.60.0 1.26.9
alazidis/stornx :1.1.1	602d4f7f090c	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.60.0 1.26.9
istio/pilot :1.29.1	f8b0e412ac4a	golang.org/x/net@v0.48.0 stdlib@go1.25.8	0.60.0 1.26.9
quay.io/kiali/kiali :v2.23.0	7652b1285f50	golang.org/x/net@v0.49.0 stdlib@go1.25.0	0.60.0 1.26.9
quay.io/prometheus-operator/prometheus-config-reloader :v0.90.0	e5aab3be6873	golang.org/x/net@v0.52.0 stdlib@go1.25.8	0.60.0 1.26.9
quay.io/prometheus/node-exporter :v1.10.2	337ff1d356b6	golang.org/x/net@v0.44.0 stdlib@go1.25.3	0.60.0 1.26.9
quay.io/prometheus/prometheus :v3.10.0	7571a304e67f	golang.org/x/net@v0.49.0 stdlib@go1.26.0	0.60.0 1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.18.0	1545919b72e3	golang.org/x/net@v0.48.0 stdlib@go1.25.5	0.60.0 1.26.9
registry.k8s.io/metrics-server/metrics-server :v0.8.0	89258156d0e9	golang.org/x/net@v0.40.0 stdlib@go1.24.4	0.60.0 1.26.9

Open the chart page →

15,791

consolestratos

4.4.0

1 of 4 See more

console stratos 4.4.0

1 of the 4 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
splatform/stratos-jetstream :4.4.0-bc65c315c	886311c331b9	golang.org/x/net@v0.0.0-20200822124328-c89045814202 stdlib@go1.13.4	0.60.0 1.26.9

Open the chart page →

31,049

stunner-gateway-operatorstunner

1.1.0

2 of 2 See more

stunner-gateway-operator stunner 1.1.0

2 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
l7mp/stunner-auth-server :1.1.0	2f8114477ba6	golang.org/x/net@v0.36.0 stdlib@go1.23.8	0.60.0 1.26.9
l7mp/stunner-gateway-operator :1.1.0	c34f7c931491	golang.org/x/net@v0.36.0 stdlib@go1.23.8	0.60.0 1.26.9

Open the chart page →

2,172

hlf-k8ssubstra

10.2.4

4 of 7 See more

hlf-k8s substra 10.2.4

4 of the 7 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
hyperledger/fabric-ca :1.5.0	f270dfeee91d	golang.org/x/net@v0.0.0-20201006153459-a7d1128ccaa0 stdlib@go1.15.7	0.60.0 1.26.9
jwilder/dockerize :latest	f94fb59fb4f6	golang.org/x/net@v0.47.0 stdlib@go1.25.5	0.60.0 1.26.9
ghcr.io/substra/fabric-peer :0.2.4	f681e0343a31	golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110 stdlib@go1.18.10	0.60.0 1.26.9
ghcr.io/substra/fabric-tools :0.2.4	3491a0f31c4a	golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110 stdlib@go1.18.10	0.60.0 1.26.9

Open the chart page →

16,612

supabasesupabse

0.8.0

4 of 11 See more

supabase supabse 0.8.0

4 of the 11 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
darthsim/imgproxy :v3.30.1	3b709e4a0e5e	golang.org/x/net@v0.44.0 stdlib@go1.25.1	0.60.0 1.26.9
library/postgres :17-alpine	b0f9560a2de0	stdlib@go1.24.6	1.26.9
supabase/gotrue :v2.189.0	385184459f57	golang.org/x/net@v0.52.0 stdlib@go1.25.8	0.60.0 1.26.9
supabase/postgres :17.6.1.136	f371b5f3f2ac	stdlib@go1.26.1	1.26.9

Open the chart page →

22,205

Grafanasurajwarbhe-grafana

0.1.0

1 of 1 See more

Grafana surajwarbhe-grafana 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
surajwarbhe/grafana :v1	85248611e9f1	golang.org/x/net@v0.0.0-20200202094626-16171245cfb2 stdlib@go1.14.3	0.60.0 1.26.9

Open the chart page →

3,787

switchboardswitchboard

0.7.4

1 of 1 See more

switchboard switchboard 0.7.4

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/borchero/switchboard :0.7.4	54a193b757da	golang.org/x/net@v0.51.0 stdlib@go1.26.1	0.60.0 1.26.9

Open the chart page →

1,240

switcher-gitopsswitcherapi

1.0.3

1 of 1 See more

switcher-gitops switcherapi 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
trackerforce/switcher-gitops :latest	20235fe419e4	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

128

syncerdsyncerd

0.2.2

1 of 1 See more

syncerd syncerd 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/clouddrove/syncerd :latest	73a1bb038de3	stdlib@go1.26.7	1.26.9

Open the chart page →

347

synology-proxy-operatorsynology-proxy-operator

0.0.9

1 of 1 See more

synology-proxy-operator synology-proxy-operator 0.0.9

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/phoeluga/synology-proxy-operator :0.0.9	a0b74674d0e3	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

124

hello-appsysintelligent

2.0.1

1 of 1 See more

hello-app sysintelligent 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
sysintelligent/hello-app :2.0.1	77fb30df847d	golang.org/x/net@v0.19.0 stdlib@go1.19.3	0.60.0 1.26.9

Open the chart page →

2,639

system-upgrade-controllersystem-upgrade

0.2.14

1 of 1 See more

system-upgrade-controller system-upgrade 0.2.14

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
rancher/system-upgrade-controller :v0.20.2	61b68d4372ba	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

141

system-upgrade-controllersystem-upgrade-controller

1.12.1

1 of 1 See more

system-upgrade-controller system-upgrade-controller 1.12.1

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
rancher/system-upgrade-controller :v0.20.2	61b68d4372ba	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

141

headscaleszpadel-charts

0.30.2

2 of 3 See more

headscale szpadel-charts 0.30.2

2 of the 3 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/juanfont/headscale :0.29.1	8453e47ea6bf	golang.org/x/net@v0.56.0 stdlib@go1.26.4	0.60.0 1.26.9
ghcr.io/tale/headplane :0.6.3	9476cc5adb12	golang.org/x/net@v0.42.0 stdlib@go1.25.1	0.60.0 1.26.9

Open the chart page →

2,781

tekton-events-relaytekton-events-relay

0.10.1

1 of 1 See more

tekton-events-relay tekton-events-relay 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/fabioluciano/tekton-events-relay :0.10.1	84cb5a2b8b81	golang.org/x/net@v0.56.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

528

tbotteleport-agent-kube

18.11.3

1 of 1 See more

tbot teleport-agent-kube 18.11.3

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
public.ecr.aws/gravitational/tbot-distroless :18.11.3	9aaef195f82c	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

607

tenuretenure

1.0.6

2 of 2 See more

tenure tenure 1.0.6

2 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
mongodb/mongodb-atlas-local :8	3a8affee01fd	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9
tenureai/tenure :v1.0.28	5f5b222df9a5	stdlib@go1.26.2	1.26.9

Open the chart page →

3,512

terraform-controllerterraform-controller

0.0.20

1 of 1 See more

terraform-controller terraform-controller 0.0.20

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
absaoss/terraform-controller :v0.0.20	ad538a1285a0	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.14.8	0.60.0 1.26.9

Open the chart page →

4,690

jenkinstestchart

0.1.9

1 of 2 See more

jenkins testchart 0.1.9

1 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
jenkins/jenkins :2.426.1-jdk11	b470bcdc4ecd	golang.org/x/net@v0.7.0 stdlib@go1.20.6	0.60.0 1.26.9

Open the chart page →

10,258

jenkinstest-jenkins

9.1.0

1 of 2 See more

jenkins test-jenkins 9.1.0

1 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
jenkins/jenkins :2.426.1-jdk11	b470bcdc4ecd	golang.org/x/net@v0.7.0 stdlib@go1.20.6	0.60.0 1.26.9

Open the chart page →

10,258

base-clusterteuto-net

12.4.0

1 of 1 See more

base-cluster teuto-net 12.4.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
registry.k8s.io/kubectl :1.33.4	261a9ed843eb	golang.org/x/net@v0.38.0 stdlib@go1.24.5	0.60.0 1.26.9

Open the chart page →

849

tocktock

0.6.3

1 of 9 See more

tock tock 0.6.3

1 of the 9 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
bitnamilegacy/mongodb :7.0.5-debian-11-r6	6fe59ed5d79f	golang.org/x/net@v0.19.0 stdlib@go1.20.12	0.60.0 1.26.9

Open the chart page →

16,071

goalerttokens-studio

0.0.5

1 of 2 See more

goalert tokens-studio 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
goalert/goalert :v0.32.0	08d57388b0cb	golang.org/x/net@v0.20.0 stdlib@go1.22.1	0.60.0 1.26.9

Open the chart page →

2,044

toolhive-operatortoolhive-operator

0.51.4

1 of 1 See more

toolhive-operator toolhive-operator 0.51.4

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/stacklok/toolhive/operator :v0.51.4	01d8f1c9e432	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

128

tor-snowflake-proxytor-snowflake-proxy

1.2.0

1 of 1 See more

tor-snowflake-proxy tor-snowflake-proxy 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
thetorproject/snowflake-proxy :v2.11.0	1ddc5069d354	golang.org/x/net@v0.35.0 stdlib@go1.23.7	0.60.0 1.26.9

Open the chart page →

1,185

spa-reloadertoucan

0.1.0

1 of 1 See more

spa-reloader toucan 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
toucansoftware/spa-reloader :latest	c187b1fba501	golang.org/x/net@v0.0.0-20200520004742-59133d7f0dd7 stdlib@go1.13.15	0.60.0 1.26.9

Open the chart page →

3,385

traefikeetraefik

4.2.11

1 of 2 See more

traefikee traefik 4.2.11

1 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
traefik/traefikee :v2.12.11	6259bdda7aa6	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

478

traefik-hubtraefik

4.2.0

1 of 1 See more

traefik-hub traefik 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/traefik/traefik-hub :v2.11.0	322f5f8cc105	golang.org/x/net@v0.17.0 stdlib@go1.21.8	0.60.0 1.26.9

Open the chart page →

3,823

transfergwtransfergw

1.0.0

1 of 1 See more

transfergw transfergw 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
thev1ndu/transfergw :latest	a07203713933	golang.org/x/net@v0.57.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

124

starboard-operatortrivy-operator

0.10.25

1 of 1 See more

starboard-operator trivy-operator 0.10.25

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
aquasec/starboard-operator :0.15.38	e0b1c7ddc843	golang.org/x/net@v0.41.0 stdlib@go1.26.3	0.60.0 1.26.9

Open the chart page →

632

atlantistrozz

3.12.11

1 of 1 See more

atlantis trozz 3.12.11

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
runatlantis/atlantis :v0.16.1	45fbaf7e207c	golang.org/x/net@v0.0.0-20191027093000-83d349e8ac1a stdlib@go1.14.7	0.60.0 1.26.9

Open the chart page →

6,524

guardrails-agent-kubernetesturbot

0.3.0

1 of 1 See more

guardrails-agent-kubernetes turbot 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/turbot/guardrails-agent-kubernetes :0.3.0	9d01bf9c9224	golang.org/x/net@v0.26.0 stdlib@go1.22.8	0.60.0 1.26.9

Open the chart page →

4,777

tyk-operatortyk-helm

1.5.0

1 of 1 See more

tyk-operator tyk-helm 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
tykio/tyk-operator :v1.5.0	10f678bfdc27	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

128

boundaryundergrid

0.1.0

2 of 3 See more

boundary undergrid 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
groundnuty/k8s-wait-for :v1.6	84edcf796267	stdlib@go1.18.1	1.26.9
hashicorp/boundary :0.8.1	fb70bd9210ff	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.17.10	0.60.0 1.26.9

Open the chart page →

6,699

understudyunderstudy

0.4.2

1 of 1 See more

understudy understudy 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
ghcr.io/kylan11/understudy :0.4.2	4454589d3884	golang.org/x/net@v0.58.0 stdlib@go1.26.7	0.60.0 1.26.9

Open the chart page →

154

u-storeunifie

1.2.0

1 of 1 See more

u-store unifie 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
public.ecr.aws/g4a0y2u8/unifie-store :staging-19925	a2057fabc948	stdlib@go1.20.12	1.26.9

Open the chart page →

17,093

taigaunxwares

2026.3.8

2 of 6 See more

taiga unxwares 2026.3.8

2 of the 6 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
taigaio/taiga-back :latest	4beed8f62c9f	stdlib@go1.24.4	1.26.9
taigaio/taiga-protected :latest	fd4568a97a59	stdlib@go1.24.4	1.26.9

Open the chart page →

10,711

upbot-operatorupbot-operator

0.0.20

2 of 2 See more

upbot-operator upbot-operator 0.0.20

2 of the 2 container images this version deploys carry CVE-2026-78659.

Container image	Digest	Package	Fixed in
alpine/k8s :1.28.13	e5c0b053fed7	golang.org/x/net@v0.12.0 stdlib@go1.22.5	0.60.0 1.26.9
ghcr.io/upbothq/upbot-operator :v0.0.20	e5da24947c91	golang.org/x/net@v0.38.0 stdlib@go1.24.9	0.60.0 1.26.9

Open the chart page →

5,561

Container images carrying it

6,374 by charts deploying them

A fixed version is listed for 6 of the 9 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/brancz/kube-rbac-proxy :v0.20.0	147cb28fea35	golang.org/x/net@v0.44.0 stdlib@go1.25.1	0.60.0 1.26.9	2
quay.io/brancz/kube-rbac-proxy :v0.14.1	58d91a5faaf8	golang.org/x/net@v0.7.0 stdlib@go1.19.4	0.60.0 1.26.9	2
quay.io/brancz/kube-rbac-proxy :v0.13.1	738c854322f5	golang.org/x/net@v0.0.0-20221002022538-bcab6841153b stdlib@go1.19.1	0.60.0 1.26.9	2
quay.io/brancz/kube-rbac-proxy :v0.18.1	e6a323504999	golang.org/x/net@v0.28.0 stdlib@go1.23.0	0.60.0 1.26.9	2
quay.io/cephcsi/cephcsi :v3.18.1	a8c0653a9565	golang.org/x/net@v0.58.0 stdlib@go1.26.4	0.60.0 1.26.9	2
quay.io/cephcsi/cephcsi :v3.14.2	dc4bbac6efe1	golang.org/x/net@v0.37.0 stdlib@go1.23.4	0.60.0 1.26.9	2
quay.io/cephcsi/ceph-csi-operator :v1.1.0	c42c95c36fa2	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	2
quay.io/cilium/cilium-envoy :v1.37.6-1789133542-cbec91f666af0bf742da986d43832932dbb26b82	af7382699576	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2	2
quay.io/cilium/tetragon :v1.7.1	afc9458ba4bc	golang.org/x/net@v0.58.0 stdlib@go1.26.7	0.60.0 1.26.9	2
quay.io/cilium/tetragon-operator :v1.7.1	cd8b71f6860e	golang.org/x/net@v0.58.0 stdlib@go1.26.7	0.60.0 1.26.9	2
quay.io/coreos/etcd :v3.5.6	28cb0630cb85	golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2 stdlib@go1.16.15	0.60.0 1.26.9	2
quay.io/coreos/etcd :v3.6.12	702d7b4881c6	golang.org/x/net@v0.52.0 stdlib@go1.25.10	0.60.0 1.26.9	2
quay.io/coreos/etcd :v3.7.2	e9afa62b1e91	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	2
quay.io/dexidp/dex :v2.24.0	c9b7f6d0d953	golang.org/x/net@v0.0.0-20190813141303-74dc4d7220e7 stdlib@go1.13.10	0.60.0 1.26.9	2
quay.io/groundcover/grafana :9.3.1	8c65b333a3d3	golang.org/x/net@v0.1.0 stdlib@go1.19.3	0.60.0 1.26.9	2
quay.io/iver-wharf/wharf-api :v5.2.0	b736b345437d	golang.org/x/net@v0.0.0-20220325170049-de3da57026de stdlib@go1.18.1	0.60.0 1.26.9	2
quay.io/iver-wharf/wharf-cmd :v0.8.2	e98d13459cdc	golang.org/x/net@v0.0.0-20220412020605-290c469a71a5 stdlib@go1.18.2	0.60.0 1.26.9	2
quay.io/iver-wharf/wharf-provider-azuredevops :v3.0.1	2fe7e4dcffdf	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4 stdlib@go1.18.2	0.60.0 1.26.9	2
quay.io/iver-wharf/wharf-provider-github :v3.0.1	77a22cb45c2a	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4 stdlib@go1.18.2	0.60.0 1.26.9	2
quay.io/iver-wharf/wharf-provider-gitlab :v2.0.1	d7079e0890da	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4 stdlib@go1.18.2	0.60.0 1.26.9	2
quay.io/jetstack/cert-manager-cainjector :v1.11.0	5c3eb25b0854	golang.org/x/net@v0.5.0 stdlib@go1.19.5	0.60.0 1.26.9	2
quay.io/jetstack/cert-manager-cainjector :v1.13.2	858fee0c4af0	golang.org/x/net@v0.17.0 stdlib@go1.20.10	0.60.0 1.26.9	2
quay.io/jetstack/cert-manager-cainjector :v1.14.3	9395dec77fcf	golang.org/x/net@v0.19.0 stdlib@go1.21.7	0.60.0 1.26.9	2
quay.io/jetstack/cert-manager-cainjector :v1.15.3	e0ce8ae280c8	golang.org/x/net@v0.26.0 stdlib@go1.22.5	0.60.0 1.26.9	2
quay.io/jetstack/cert-manager-cainjector :v1.17.2	ec56edb1161d	golang.org/x/net@v0.38.0 stdlib@go1.23.8	0.60.0 1.26.9	2
quay.io/jetstack/cert-manager-controller :v1.17.2	2c314feeb5e8	golang.org/x/net@v0.38.0 stdlib@go1.23.8	0.60.0 1.26.9	2
quay.io/jetstack/cert-manager-controller :v1.14.3	64adcb95ce09	golang.org/x/net@v0.19.0 stdlib@go1.21.7	0.60.0 1.26.9	2
quay.io/jetstack/cert-manager-controller :v1.13.2	9c67cf8c92d8	golang.org/x/net@v0.17.0 stdlib@go1.20.10	0.60.0 1.26.9	2
quay.io/jetstack/cert-manager-controller :v1.11.0	d429b6d696e0	golang.org/x/net@v0.5.0 stdlib@go1.19.5	0.60.0 1.26.9	2
quay.io/jetstack/cert-manager-controller :v1.15.3	eee34b3de2dd	golang.org/x/net@v0.26.0 stdlib@go1.22.5	0.60.0 1.26.9	2
quay.io/jetstack/cert-manager-ctl :v1.11.0	74611761f052	golang.org/x/net@v0.5.0 stdlib@go1.19.5	0.60.0 1.26.9	2
quay.io/jetstack/cert-manager-startupapicheck :v1.15.3	4cbc1b022a23	golang.org/x/net@v0.26.0 stdlib@go1.22.5	0.60.0 1.26.9	2
quay.io/jetstack/cert-manager-startupapicheck :v1.14.3	df8677135139	golang.org/x/net@v0.19.0 stdlib@go1.21.7	0.60.0 1.26.9	2
quay.io/jetstack/cert-manager-startupapicheck :v1.17.2	e18989b4f912	golang.org/x/net@v0.38.0 stdlib@go1.23.8	0.60.0 1.26.9	2
quay.io/jetstack/cert-manager-webhook :v1.13.2	0a9470447ebf	golang.org/x/net@v0.17.0 stdlib@go1.20.10	0.60.0 1.26.9	2
quay.io/jetstack/cert-manager-webhook :v1.17.2	37b16a9dff00	golang.org/x/net@v0.38.0 stdlib@go1.23.8	0.60.0 1.26.9	2
quay.io/jetstack/cert-manager-webhook :v1.11.0	6730d96fc382	golang.org/x/net@v0.5.0 stdlib@go1.19.5	0.60.0 1.26.9	2
quay.io/jetstack/cert-manager-webhook :v1.14.3	d8ad5515f44f	golang.org/x/net@v0.19.0 stdlib@go1.21.7	0.60.0 1.26.9	2
quay.io/jetstack/cert-manager-webhook :v1.15.3	fdcb9ac4963f	golang.org/x/net@v0.26.0 stdlib@go1.22.5	0.60.0 1.26.9	2
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.15.2	0.60.0 1.26.9	2
quay.io/kubevirt/kubevirt-cloud-controller-manager :v0.6.0	37ad4c475941	golang.org/x/net@v0.49.0 stdlib@go1.24.13	0.60.0 1.26.9	2
quay.io/kubevirt/kubevirt-csi-driver :latest	bbc43bc25025	golang.org/x/net@v0.49.0 stdlib@go1.24.13	0.60.0 1.26.9	2
quay.io/metallb/controller :v0.16.1	f51ab515de9c	golang.org/x/net@v0.53.0 stdlib@go1.25.9	0.60.0 1.26.9	2
quay.io/metallb/frr-k8s :v0.0.25	1cb06fb2d553	golang.org/x/net@v0.39.0 stdlib@go1.25.8	0.60.0 1.26.9	2
quay.io/metallb/speaker :v0.13.10	00406ccb1fa0	golang.org/x/net@v0.8.0 stdlib@go1.19.5	0.60.0 1.26.9	2
quay.io/metallb/speaker :v0.16.1	16561e96531e	golang.org/x/net@v0.53.0 stdlib@go1.25.9	0.60.0 1.26.9	2
quay.io/minio/minio :RELEASE.2024-12-18T13-15-44Z	1dce27c494a1	golang.org/x/net@v0.29.0 stdlib@go1.23.4	0.60.0 1.26.9	2
quay.io/mongodb/mongodb-kubernetes-operator :0.13.0	2dcc6393e6f7	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.60.0 1.26.9	2
quay.io/oauth2-proxy/oauth2-proxy :v7.3.0	8c21390be87d	golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2 stdlib@go1.17.10	0.60.0 1.26.9	2
quay.io/open-cluster-management/argocd-pull-integration :0.30.0	683ae238f351	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	2