StackRadar

CVE-2026-78659

High

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
46th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
5,353
of 18,131 indexed, latest versions
Container images
6,192
deployed by those charts
Fix available
3 of 5
affected packages

HTTP/2 server memory exhaustion due to Trailer headers in net/http

Carried by container images the latest versions of 5,353 of 18,131 indexed charts deploy, on 6,192 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+209 more1.26.9, 1.27.26,123
golang.org/x/netgolangv0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more0.60.04,944
golang-1.19deb1.19.8-2no fix listed1
ingress-nginx-controller-1.15apk1.15.10-r9no fix listed1
minioapk0.20251015.172955-r100.20260922.192518-r21
OSV records
CGA-p32r-2pjm-q43gCGA-pjc7-rhj8-2m9qDEBIAN-CVE-2026-78659GO-2026-6603
Also known as
CGA-w7mj-m6pj-r2xq, CGA-wxcm-45pg-2cp8
Trending
Rank 3 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,353 by stars
ChartLatestAffected imagesRadar Score
pagesthiru-pages1.0.01 of 3See more

pages thiru-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.26.9

Open the chart page →

21,457
system-upgrade-controllerthis-is-tobi-helm-chartsVerified publisher0.1.01 of 1See more

system-upgrade-controller this-is-tobi-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
rancher/system-upgrade-controller:v0.20.261b68d4372ba
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9

Open the chart page →

226
mc-routerthl-chartsVerified publisher0.1.01 of 1See more

mc-router thl-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
itzg/mc-router:1.16.1bb552b59fb53
golang.org/x/net@v0.0.0-20210917221730-978cfadd31cf
stdlib@go1.18.4
0.60.0
1.26.9

Open the chart page →

2,763
monitoringthl-chartsVerified publisher0.1.18 of 10See more

monitoring thl-charts 0.1.1

8 of the 10 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
grafana/grafana:8.5.042d3e6bc1865
golang.org/x/net@v0.0.0-20211118161319-6a13c67c3ce4
stdlib@go1.17.9
0.60.0
1.26.9
grafana/loki:2.5.0f9ef133793af
golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd
stdlib@go1.17.8
0.60.0
1.26.9
grafana/promtail:2.4.2626900031c4e
golang.org/x/net@v0.0.0-20211101193420-4a448f8816b3
stdlib@go1.17.2
0.60.0
1.26.9
jimmidyson/configmap-reload:v0.5.0904d08e9f701
stdlib@go1.15.7
1.26.9
prom/pushgateway:v1.4.2a684e7c830a4
golang.org/x/net@v0.0.0-20210525063256-abc453219eb5
stdlib@go1.16.9
0.60.0
1.26.9
quay.io/prometheus/alertmanager:v0.23.09ab73a421b65
golang.org/x/net@v0.0.0-20210726213435-c6fcb2dbf985
stdlib@go1.16.7
0.60.0
1.26.9
quay.io/prometheus/node-exporter:v1.3.023ff46c728b9
golang.org/x/net@v0.0.0-20210525063256-abc453219eb5
stdlib@go1.17.3
0.60.0
1.26.9
quay.io/prometheus/prometheus:v2.34.0b37103e03399
golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd
stdlib@go1.17.8
0.60.0
1.26.9

Open the chart page →

28,097
pagesthuy-pages1.0.01 of 3See more

pages thuy-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.26.9

Open the chart page →

21,457
tile38tile380.6.11 of 2See more

tile38 tile38 0.6.1

1 of the 2 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
tile38/tile38:1.38.05b61c6f3b32e
golang.org/x/net@v0.48.0
stdlib@go1.26.4
0.60.0
1.26.9

Open the chart page →

746
pock-helm-charttinote-chart0.1.01 of 3See more

pock-helm-chart tinote-chart 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
nginx/nginx-ingress:1.11.1eb5b4fd73325
golang.org/x/net@v0.0.0-20201216054612-986b41b23924
stdlib@go1.15.11
0.60.0
1.26.9

Open the chart page →

8,869
tiny-api-charttiny-api1.0.01 of 1See more

tiny-api-chart tiny-api 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
stubin87/tiny-api:v1.1.02e5c42e92ec8
stdlib@go1.19.1
1.26.9

Open the chart page →

1,858
tlsa-dnsendpoint-controllertlsa-dnsendpoint-controllerVerified publisher0.2.61 of 1See more

tlsa-dnsendpoint-controller tlsa-dnsendpoint-controller 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
ghcr.io/oscrx/tlsa-dnsendpoint-controllerdigest-pinnedddd9b71b2d98
golang.org/x/net@v0.58.0
0.60.0

Open the chart page →

61
grafanatnh5.3.01 of 1See more

grafana tnh 5.3.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
grafana/grafana:7.0.3d72946c8e5d5
golang.org/x/net@v0.0.0-20200202094626-16171245cfb2
stdlib@go1.14.3
0.60.0
1.26.9

Open the chart page →

4,460
jenkinstnh2.7.11 of 2See more

jenkins tnh 2.7.1

1 of the 2 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsa660310e39ad
golang.org/x/net@v0.57.0
stdlib@go1.27.0
0.60.0
1.27.2

Open the chart page →

4,186
prometheustnh11.6.04 of 6See more

prometheus tnh 11.6.0

4 of the 6 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
prom/alertmanager:v0.20.07e4e9f7a0954
golang.org/x/net@v0.0.0-20190724013045-ca1201d0de80
stdlib@go1.13.5
0.60.0
1.26.9
prom/prometheus:v2.19.0bfad037f95e5
golang.org/x/net@v0.0.0-20200602114024-627f9648deb9
stdlib@go1.14.4
0.60.0
1.26.9
prom/pushgateway:v1.2.00a9031142481
stdlib@go1.13.8
1.26.9
quay.io/prometheus/node-exporter:v1.0.1cf66a6bbd573
golang.org/x/net@v0.0.0-20200513185701-a91f0712d120
stdlib@go1.14.4
0.60.0
1.26.9

Open the chart page →

13,390
todolist-charttodolist-chart0.1.77 of 10See more

todolist-chart todolist-chart 0.1.7

7 of the 10 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
erenozcan17/go_backend:v4.250b4f23422b6
golang.org/x/net@v0.10.0
stdlib@go1.23.12
0.60.0
1.26.9
grafana/grafana:latestb28bae15e219
golang.org/x/net@v0.58.0
stdlib@go1.26.7
0.60.0
1.26.9
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.26.9
quay.io/prometheus/blackbox-exporter:latest9613f2884689
golang.org/x/net@v0.59.0
stdlib@go1.27.1
0.60.0
1.27.2
quay.io/prometheus/mysqld-exporter:latestabed8dac117b
golang.org/x/net@v0.57.0
stdlib@go1.26.5
0.60.0
1.26.9
quay.io/prometheus/node-exporter:latest1b4e4438faca
golang.org/x/net@v0.57.0
stdlib@go1.26.5
0.60.0
1.26.9
quay.io/prometheus/prometheus:latestefd719c99d83
golang.org/x/net@v0.58.0
stdlib@go1.27.1
0.60.0
1.27.2

Open the chart page →

8,305
token-servertoken-server1.0.91 of 1See more

token-server token-server 1.0.9

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
udhos/token-server:1.0.9728013f2fac1
golang.org/x/net@v0.44.0
stdlib@go1.25.1
0.60.0
1.26.9

Open the chart page →

1,769
netbirdtotmicro1.8.23 of 4See more

netbird totmicro 1.8.2

3 of the 4 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
netbirdio/management:0.60.252682e5f48f9
golang.org/x/net@v0.42.0
stdlib@go1.23.12
0.60.0
1.26.9
netbirdio/relay:0.60.2a10762533793
golang.org/x/net@v0.42.0
stdlib@go1.23.12
0.60.0
1.26.9
netbirdio/signal:0.60.267176bcbf6ab
golang.org/x/net@v0.42.0
stdlib@go1.23.12
0.60.0
1.26.9

Open the chart page →

8,005
hub-managertraefikVerified publisher1.0.11 of 1See more

hub-manager traefik 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
ghcr.io/traefik/hub-manager:v0.45.371002c4f48cb
golang.org/x/net@v0.57.0
stdlib@go1.26.0
0.60.0
1.26.9

Open the chart page →

903
traefik-jwt-decodetraefik-jwt-decode0.1.01 of 1See more

traefik-jwt-decode traefik-jwt-decode 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
simonschneider/traefik-jwt-decode:latestd674ac370f80
stdlib@go1.17.13
1.26.9

Open the chart page →

2,057
traefik-secrets-exportertraefik-secrets-exporter0.0.21 of 1See more

traefik-secrets-exporter traefik-secrets-exporter 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
ghcr.io/reiche-world/traefik-secrets-exporter:0.0.21485ff93cbf9
golang.org/x/net@v0.47.0
stdlib@go1.25.5
0.60.0
1.26.9

Open the chart page →

2,131
ats-ingresstrafficserver-ingress-controller0.1.01 of 1See more

ats-ingress trafficserver-ingress-controller 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
ghcr.io/apache/ats-ingress:latest2d4d776f6362
golang.org/x/net@v0.55.0
stdlib@go1.26.7
0.60.0
1.26.9

Open the chart page →

634
traktortraktorVerified publisher0.0.171 of 1See more

traktor traktor 0.0.17

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
gdxbsv/traktor:0.0.17675693335054
golang.org/x/net@v0.38.0
stdlib@go1.24.13
0.60.0
1.26.9

Open the chart page →

778
nfs-servertranhailongVerified publisher0.1.21 of 1See more

nfs-server tranhailong 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
tranhailong/nfs-server:4.2-2-gcsfuse028662749be2
golang.org/x/net@v0.4.0
stdlib@go1.18.4
0.60.0
1.26.9

Open the chart page →

3,226
transparent-chart-hosted-repositorytransparencyVerified publisher0.1.21 of 1See more

transparent-chart-hosted-repository transparency 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
bitnami/nginx:latestb8d42f076789
stdlib@go1.26.8
1.26.9

Open the chart page →

170
apptreenityVerified publisher0.1.531 of 2See more

app treenity 0.1.53

1 of the 2 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
library/postgres:17c6222b54873a
stdlib@go1.24.6
1.26.9

Open the chart page →

1,820
treenitytreenityVerified publisher0.1.32 of 4See more

treenity treenity 0.1.3

2 of the 4 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
library/nats:2.9.6-alpine3.16f576cdc17cc3
stdlib@go1.19.3
1.26.9
library/postgres:14ceef4a62198b
stdlib@go1.24.6
1.26.9

Open the chart page →

4,118
cicd-proxytremolo1.0.121 of 1See more

cicd-proxy tremolo 1.0.12

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
ghcr.io/tremolosecurity/kube-oidc-proxy:1.0.13076a87738b13
golang.org/x/net@v0.57.0
stdlib@go1.27.1
0.60.0
1.27.2

Open the chart page →

734
orchestratremolo3.1.582 of 5See more

orchestra tremolo 3.1.58

2 of the 5 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
ghcr.io/headlamp-k8s/headlamp:v0.45.0db3f0e0fc58d
golang.org/x/net@v0.56.0
stdlib@go1.26.7
0.60.0
1.26.9
ghcr.io/tremolosecurity/kube-oidc-proxy:1.0.13076a87738b13
golang.org/x/net@v0.57.0
stdlib@go1.27.1
0.60.0
1.27.2

Open the chart page →

3,230
orchestra-kube-oidc-proxytremolo1.0.211 of 1See more

orchestra-kube-oidc-proxy tremolo 1.0.21

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
ghcr.io/tremolosecurity/kube-oidc-proxy:1.0.13076a87738b13
golang.org/x/net@v0.57.0
stdlib@go1.27.1
0.60.0
1.27.2

Open the chart page →

734
trickstertricksterVerified publisher2.1.01 of 1See more

trickster trickster 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
ghcr.io/trickstercache/trickster:2d7a4d4f2b10f
golang.org/x/net@v0.59.0
stdlib@go1.27.1
0.60.0
1.27.2

Open the chart page →

219
trident-protecttrident-protect100.2606.02 of 2See more

trident-protect trident-protect 100.2606.0

2 of the 2 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
netapp/controller:26.06.08235a77cfc92
golang.org/x/net@v0.54.0
stdlib@go1.26.4
0.60.0
1.26.9
netapp/trident-protect-utils:v2.0.0cd0c18d8f9ec
golang.org/x/net@v0.40.0
stdlib@go1.24.12
0.60.0
1.26.9

Open the chart page →

2,186
trident-protect-bxp-previewtrident-protect100.2511.0-bxp-preview3 of 3See more

trident-protect-bxp-preview trident-protect 100.2511.0-bxp-preview

3 of the 3 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
netapp/controller:25.11.0-bxp-preview06f6c9a0653f
golang.org/x/net@v0.39.0
stdlib@go1.24.9
0.60.0
1.26.9
netapp/trident-protect-connector:25.11.0-bxp-previewec22fc6e5c5a
golang.org/x/net@v0.38.0
stdlib@go1.24.9
0.60.0
1.26.9
netapp/trident-protect-utils:v1.0.058b9fac358bd
golang.org/x/net@v0.38.0
stdlib@go1.24.8
0.60.0
1.26.9

Open the chart page →

3,566
trident-protect-consoletrident-protect100.2609.1-console3 of 3See more

trident-protect-console trident-protect 100.2609.1-console

3 of the 3 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
netapp/controller:26.09.1-console95997a0aaa00
golang.org/x/net@v0.57.0
stdlib@go1.26.4
0.60.0
1.26.9
netapp/trident-protect-connector:26.09.1-consolef5c7007fa7aa
golang.org/x/net@v0.57.0
stdlib@go1.26.4
0.60.0
1.26.9
netapp/trident-protect-utils:v3.0.0cad26cd945d1
golang.org/x/net@v0.40.0
stdlib@go1.24.4
0.60.0
1.26.9

Open the chart page →

7,829
saleor-appstrieb-work0.6.03 of 5See more

saleor-apps trieb-work 0.6.0

3 of the 5 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
ghcr.io/trieb-work/saleor-apps/saleor-app-products-feed:1.23.11d435b4ab372
stdlib@go1.23.7
1.26.9
ghcr.io/trieb-work/saleor-apps/saleor-app-search:1.24.328edefb6c92d
stdlib@go1.23.7
1.26.9
ghcr.io/trieb-work/saleor-apps/saleor-app-smtp:1.4.357a06bfba327
stdlib@go1.23.7
1.26.9

Open the chart page →

9,544
harbor-scanner-trivytrivy-operator0.31.21 of 1See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.31.26e790e233872
golang.org/x/net@v0.25.0
stdlib@go1.22.3
0.60.0
1.26.9

Open the chart page →

3,142
posteetrivy-operator2.14.02 of 3See more

postee trivy-operator 2.14.0

2 of the 3 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
aquasec/postee:2.12.0-amd640795cba777e7
golang.org/x/net@v0.7.0
stdlib@go1.18.10
0.60.0
1.26.9
aquasec/postee-ui:2.12.0-amd64c0467c3941dc
golang.org/x/net@v0.7.0
stdlib@go1.18.10
0.60.0
1.26.9

Open the chart page →

6,512
traceetrivy-operator0.24.11 of 1See more

tracee trivy-operator 0.24.1

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
aquasec/tracee:0.24.1cfbbfee972e6
golang.org/x/net@v0.42.0
stdlib@go1.24.9
0.60.0
1.26.9

Open the chart page →

1,779
trivy-webhook-aws-security-hubtrivy-webhook-aws-security-hubVerified publisher0.1.201 of 1See more

trivy-webhook-aws-security-hub trivy-webhook-aws-security-hub 0.1.20

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
ghcr.io/csepulveda/trivy-webhook-aws-security-hub:v0.1.206836b779b060
golang.org/x/net@v0.50.0
stdlib@go1.26.2
0.60.0
1.26.9

Open the chart page →

1,015
trivy-webhook-elasticsearchtrivy-webhook-elasticsearch0.1.41 of 1See more

trivy-webhook-elasticsearch trivy-webhook-elasticsearch 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
ghcr.io/lbi22/trivy-webhook-elasticsearch:v0.1.4b51b824e4f19
stdlib@go1.22.8
1.26.9

Open the chart page →

1,168
trouw-servicetrouw-service1.0.01 of 3See more

trouw-service trouw-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/trouw-service-php:latestf745e2870692
golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9
stdlib@go1.13.10
0.60.0
1.26.9

Open the chart page →

9,500
karmatrozz0.0.71 of 1See more

karma trozz 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
lmierzwa/karma:latest57c7f1e63e76
stdlib@go1.27.1
1.27.2

Open the chart page →

148
monitorortrozz0.0.11 of 1See more

monitoror trozz 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
monitoror/monitoror:44b88edcf51ff
golang.org/x/net@v0.0.0-20191209160850-c0dbc17a3553
stdlib@go1.14.6
0.60.0
1.26.9

Open the chart page →

4,363
clickhouse-operatortruefoundryVerified publisher0.1.12 of 3See more

clickhouse-operator truefoundry 0.1.1

2 of the 3 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.23.34baec90b20cd
golang.org/x/net@v0.17.0
stdlib@go1.20.14
0.60.0
1.26.9
altinity/metrics-exporter:0.23.32912a6c15b44
golang.org/x/net@v0.17.0
stdlib@go1.20.14
0.60.0
1.26.9

Open the chart page →

2,744
tfy-agenttruefoundryVerified publisher0.2.1082 of 5See more

tfy-agent truefoundry 0.2.108

2 of the 5 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/external-secrets:v2.4.19440a40b3947
golang.org/x/net@v0.52.0
stdlib@go1.26.2
0.60.0
1.26.9
ghcr.io/stakater/reloader:v1.4.190530cf462fa3
golang.org/x/net@v0.55.0
stdlib@go1.26.4
0.60.0
1.26.9

Open the chart page →

1,338
tfy-cloudflaredtruefoundryVerified publisher0.6.01 of 2See more

tfy-cloudflared truefoundry 0.6.0

1 of the 2 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
public.ecr.aws/docker/library/caddy:2.6.387cbd356af2e
golang.org/x/net@v0.5.0
stdlib@go1.20
0.60.0
1.26.9

Open the chart page →

2,891
tfy-distributortruefoundryVerified publisher0.0.13 of 4See more

tfy-distributor truefoundry 0.0.1

3 of the 4 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
library/nats:2.10.7-alpine1bcddab51b80
stdlib@go1.21.5
1.26.9
natsio/nats-server-config-reloader:0.14.08c28b75bc416
stdlib@go1.20.5
1.26.9
natsio/prometheus-nats-exporter:0.13.02adf791d9f9f
stdlib@go1.21.3
1.26.9

Open the chart page →

20,504
tfy-inferentia-operatortruefoundryVerified publisher0.2.83 of 3See more

tfy-inferentia-operator truefoundry 0.2.8

3 of the 3 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
public.ecr.aws/eks-distro/kubernetes/kube-scheduler:v1.29.14-eks-1-29-lateste7e1db003e6a
golang.org/x/net@v0.24.0
stdlib@go1.22.12
0.60.0
1.26.9
public.ecr.aws/neuron/neuron-device-plugin:2.23.30.075a6d5ce3bd3
golang.org/x/net@v0.23.0
stdlib@go1.20.4
0.60.0
1.26.9
public.ecr.aws/neuron/neuron-scheduler:2.23.30.04cd274463e6b
golang.org/x/net@v0.23.0
stdlib@go1.20.4
0.60.0
1.26.9

Open the chart page →

4,861
tfy-karpentertruefoundryVerified publisher0.5.122 of 3See more

tfy-karpenter truefoundry 0.5.12

2 of the 3 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
public.ecr.aws/karpenter/controller:1.9.030a506c64fbb
golang.org/x/net@v0.48.0
stdlib@go1.25.7
0.60.0
1.26.9
public.ecr.aws/truefoundrycloud/eks/eks-node-monitoring-agent:v1.7.1-eksbuild.1d3c1269791d7
golang.org/x/net@v0.58.0
stdlib@go1.26.7
0.60.0
1.26.9

Open the chart page →

880
tfy-kservetruefoundryVerified publisher0.1.11 of 2See more

tfy-kserve truefoundry 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
kserve/kserve-controller:v0.10.022ff858b57c1
golang.org/x/net@v0.4.0
stdlib@go1.18.10
0.60.0
1.26.9

Open the chart page →

2,002
tfy-llm-gateway-infratruefoundryVerified publisher0.2.102 of 3See more

tfy-llm-gateway-infra truefoundry 0.2.10

2 of the 3 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.23.774315beb57db
golang.org/x/net@v0.17.0
stdlib@go1.21.13
0.60.0
1.26.9
altinity/metrics-exporter:0.23.7a4d7ff0c727e
golang.org/x/net@v0.17.0
stdlib@go1.21.13
0.60.0
1.26.9

Open the chart page →

2,362
tfy-lokitruefoundryVerified publisher0.1.62 of 2See more

tfy-loki truefoundry 0.1.6

2 of the 2 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
grafana/loki:2.9.1035b02acc6765
golang.org/x/net@v0.26.0
stdlib@go1.22.5
0.60.0
1.26.9
grafana/promtail:2.9.1063a2e57a5b14
golang.org/x/net@v0.26.0
stdlib@go1.22.5
0.60.0
1.26.9

Open the chart page →

4,041
truefoundry-monitoringtruefoundryVerified publisher0.1.64 of 8See more

truefoundry-monitoring truefoundry 0.1.6

4 of the 8 container images this version deploys carry CVE-2026-78659.

Container imageDigestPackageFixed in
grafana/grafana:12.3.070d9599b186c
golang.org/x/net@v0.46.0
stdlib@go1.25.3
0.60.0
1.26.9
ghcr.io/jkroepke/kube-webhook-certgen:1.7.47a62bba56a7c
golang.org/x/net@v0.48.0
stdlib@go1.25.5
0.60.0
1.26.9
quay.io/prometheus-operator/prometheus-operator:v0.88.0b4f51de53357
golang.org/x/net@v0.48.0
stdlib@go1.25.5
0.60.0
1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.01545919b72e3
golang.org/x/net@v0.48.0
stdlib@go1.25.5
0.60.0
1.26.9

Open the chart page →

6,484

Container images carrying it

6,192 by charts deploying them

A fixed version is listed for 3 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
rustrial/k8s-gitops-secrets-controller:0.6.093326a322a01
golang.org/x/net@v0.56.0
stdlib@go1.26.4
0.60.0
1.26.9
1
ryuunosukeds3/orbital:latest0879f7261b10
golang.org/x/net@v0.37.0
stdlib@go1.23.9
0.60.0
1.26.9
1
sablierapp/sablier:1.16.1413704376656
golang.org/x/net@v0.56.0
stdlib@go1.26.3
0.60.0
1.26.9
1
salaboy/agenda-service-0967b907d9920c99918e2b91b91937b3ce9ce8293e4e
stdlib@go1.20.1
1.26.9
1
salaboy/c4p-service-a3dc0474cbfa348afcdf47a8eee70ba9bb64bf14467d
stdlib@go1.20.1
1.26.9
1
salaboy/frontend-go-1739aa83b5e69d4ccb8a5615830ae66c1ff7c90845e4
stdlib@go1.20.1
1.26.9
1
salaboy/notifications-service-0e27884e01429ab7e350cb5dff61b525799c35f9f306
stdlib@go1.20.1
1.26.9
1
samarthya/spinnaker:v1.0ef06d81036af
golang.org/x/net@v0.0.0-20210913180222-943fd674d43e
stdlib@go1.17.6
0.60.0
1.26.9
1
samcm/checkpointz:latesta66b24a87766
golang.org/x/net@v0.47.0
stdlib@go1.25.1
0.60.0
1.26.9
1
samcm/ethereum-metrics-exporter:0.29.2:latest91a2d9a015c1
golang.org/x/net@v0.43.0
stdlib@go1.25.8
0.60.0
1.26.9
1
samcm/ethereum-metrics-exporter:latestdc6cedebb24b
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9
1
sarwansharma/minio:v359d1da9385d1
golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4
stdlib@go1.18.3
0.60.0
1.26.9
1
saurabh6/grafana_setup:v15c140fda7486
golang.org/x/net@v0.0.0-20210521195947-fe42d452be8f
stdlib@go1.16.1
0.60.0
1.26.9
1
saurabh6/prometheus_setup:v19d4dbe7c1815
golang.org/x/net@v0.0.0-20210610132358-84b48f89b13b
stdlib@go1.16.5
0.60.0
1.26.9
1
sbs20/scanservjs:release-v3.0.3dad1fd6e9a98
stdlib@go1.19.8
1.26.9
1
scaleway/cert-manager-webhook-scaleway:v0.1.36d94c970e710
golang.org/x/net@v0.56.0
stdlib@go1.26.5
0.60.0
1.26.9
1
scaleway/scaleway-csi:v0.3.411135998e31c
golang.org/x/net@v0.42.0
stdlib@go1.24.12
0.60.0
1.26.9
1
scaleway/scaleway-secrets-store-csi:v0.1.19acc53a69962
golang.org/x/net@v0.56.0
stdlib@go1.26.5
0.60.0
1.26.9
1
schemahero/schemahero-manager:0.22.11609e1a05cd3
golang.org/x/net@v0.40.0
stdlib@go1.24.6
0.60.0
1.26.9
1
schmitzis/monorepo:seafile-13.0-latestc583f1be2af2
golang.org/x/net@v0.55.0
stdlib@go1.26.8
0.60.0
1.26.9
1
scholtz2/algorand-participation-aramidmain-extended:4.4.1-stablef12ce1cfb72e
golang.org/x/net@v0.39.0
stdlib@go1.25.3
0.60.0
1.26.9
1
scholtz2/algorand-participation-mainnet-extended:4.4.1-stable5aaa5d4ab8b8
golang.org/x/net@v0.35.0
stdlib@go1.25.3
0.60.0
1.26.9
1
scholtz2/algorand-participation-voimain-extended:4.4.1-stable64966de56d9f
golang.org/x/net@v0.39.0
stdlib@go1.25.3
0.60.0
1.26.9
1
scholtz2/algorand-relay-mainnet:4.4.1-stablee9af7d8ff6bb
golang.org/x/net@v0.39.0
stdlib@go1.25.3
0.60.0
1.26.9
1
scholtz2/aramid-algo-follow-node:v4.3.0-stable1ec63eca86b6
golang.org/x/net@v0.39.0
stdlib@go1.23.9
0.60.0
1.26.9
1
scholtz2/aramid-algo-node:v4.4.1-stable70263d8fab5b
golang.org/x/net@v0.39.0
stdlib@go1.23.11
0.60.0
1.26.9
1
scholtz2/aramid-conduit:v1.9.0-stable3a3b3d3277d2
golang.org/x/net@v0.40.0
stdlib@go1.26.3
0.60.0
1.26.9
1
scholtz2/aramid-indexer:v3.9.0-stable6770214bc881
golang.org/x/net@v0.40.0
stdlib@go1.26.3
0.60.0
1.26.9
1
seafileltd/notification-server:13.0.211cac4101d0f4
stdlib@go1.26.2
1.26.9
1
seafileltd/seafile-mc:9.0.106693911bcc40
stdlib@go1.19
1.26.9
1
seafileltd/seafile-mc:10.0.170628f29c663
stdlib@go1.20
1.26.9
1
seafileltd/seafile-mc:9.0.97ac833196f60
stdlib@go1.19
1.26.9
1
sealio/hermitcrab:v0.1.4a326a2f03660
golang.org/x/net@v0.24.0
stdlib@go1.21.6
0.60.0
1.26.9
1
sealio/terraform-deployer:v1.5.7-seal.1b0389d9848a5
golang.org/x/net@v0.7.0
stdlib@go1.20.7
0.60.0
1.26.9
1
seatsurfing/backend:1.119.39952e80048b0
golang.org/x/net@v0.56.0
stdlib@go1.26.5
0.60.0
1.26.9
1
securecodebox/operator:5.8.0c14bd5c550e3
golang.org/x/net@v0.56.0
stdlib@go1.26.4
0.60.0
1.26.9
1
securesystemsengineering/connaisseur:v3.13.0cef2efbd8bd3
golang.org/x/net@v0.58.0
stdlib@go1.27.1
0.60.0
1.27.2
1
seldonio/seldon-core-operator:1.19.0544e3bf71bd1
golang.org/x/net@v0.44.0
stdlib@go1.24.11
0.60.0
1.26.9
1
selectdb/doris.k8s-operator:1.3.1919210765cb8
golang.org/x/net@v0.10.0
stdlib@go1.19.13
0.60.0
1.26.9
1
selenium/hub:4.48.0-20260905d47c27474cb4
stdlib@go1.27.1
1.27.2
1
selenium/node-chrome:4.48.0-202609055ac71fd8dd1e
golang.org/x/net@v0.57.0
stdlib@go1.27.1
0.60.0
1.27.2
1
selenium/node-firefox:4.48.0-2026090574a5c1c90f95
golang.org/x/net@v0.57.0
stdlib@go1.27.1
0.60.0
1.27.2
1
semaphoreui/semaphore:v2.19.163707a971a57f
golang.org/x/net@v0.36.0
stdlib@go1.23.3
0.60.0
1.26.9
1
semaphoreui/semaphore:v2.9.645b50bc11833f
golang.org/x/net@v0.21.0
stdlib@go1.21.8
0.60.0
1.26.9
1
semaphoreui/semaphore:latest6d45ab59ec50
golang.org/x/net@v0.49.0
stdlib@go1.23.3
0.60.0
1.26.9
1
semaphoreui/semaphore:v2.18.3e9260bfa8255
golang.org/x/net@v0.47.0
stdlib@go1.25.5
0.60.0
1.26.9
1
semitechnologies/weaviate:1.19.17a00d226f063
golang.org/x/net@v0.7.0
stdlib@go1.19.9
0.60.0
1.26.9
1
senthilrch/kubefledged-controller:v0.11.0bf336912a191
golang.org/x/net@v0.55.0
stdlib@go1.26.5
0.60.0
1.26.9
1
senthilrch/kubefledged-webhook-server:v0.11.0836a8bbe7cfb
golang.org/x/net@v0.55.0
stdlib@go1.26.5
0.60.0
1.26.9
1
sentriz/gonic:v0.13.1a74012a6adf3
golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e
stdlib@go1.16.4
0.60.0
1.26.9
1

syft 1.42.1 · advisories as of 15 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.