CVE-2026-78660
UnscoredAdvisory
Published 8 Oct 2026In the index since 9 Oct 2026
- Severity
- Unscored
- worst across findings
- CVSS
- —
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 4,034
- of 18,071 indexed, latest versions
- Container images
- 4,684
- deployed by those charts
- Fix available
- 2 of 3
- affected packages
HTTP/2 transport accepts malformed framing-related headers in net/http
Carried by container images the latest versions of 4,034 of 18,071 indexed charts deploy, on 4,684 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| stdlibgolang | go1.13, go1.13.1, go1.13.3, go1.13.4+201 more | 1.26.9, 1.27.2 | 4,677 |
| golang.org/ | v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+222 more | 0.60.0 | 3,766 |
| golang-1.19deb | 1.19.8-2 | no fix listed | 1 |
- OSV records
- DEBIAN-CVE-2026-78660GO-2026-6610
- Trending
- Rank 4 in indexed charts, since 9 Oct 2026. See the ranking →
Charts affected
4,034 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| kube-prometheus-stackprometheus-communityOfficialVerified publisher | 92.2.0 | 2See more | — |
| cert-managercert-managerOfficialVerified publisher | 1.21.2 | 4 of 4See more | 30 |
| ingress-nginxingress-nginx | 4.15.1 | 2 of 2See more | 1,968 |
| prometheusprometheus-communityOfficialVerified publisher | 29.36.1 | 2See more | — |
| kubernetes-dashboardk8s-dashboard | 7.14.0 | 4 of 5See more | 4,177 |
| lokigrafana | 7.3.0 | 2 of 6See more | 4,760 |
| metrics-servermetrics-serverVerified publisher | 3.14.0 | 1 of 1See more | 261 |
| vaulthashicorpVerified publisher | 0.34.1 | 2 of 2See more | 790 |
| gitlabgitlabVerified publisher | 10.4.1 | 7 of 21See more | 17,958 |
| harborharborOfficialVerified publisher | 1.19.2 | 5 of 8See more | 2,357 |
| airflowapache-airflowOfficialVerified publisher | 1.22.0 | 1 of 4See more | 3,604 |
| velerovmware-tanzu | 12.2.1 | 1See more | — |
| metallbmetallbVerified publisher | 0.16.1 | 3 of 4See more | 2,825 |
| kyvernokyvernoOfficialVerified publisher | 3.9.1 | 1 of 7See more | 34 |
| giteagiteaOfficialVerified publisher | 12.7.0 | 2 of 4See more | 10,046 |
| nfs-subdir-external-provisionernfs-subdir-external-provisioner | 4.0.18 | 1 of 1See more | 3,792 |
| artifact-hubartifact-hubVerified publisher | 1.23.0 | 6 of 7See more | 13,765 |
| kube-state-metricsprometheus-communityVerified publisher | 8.6.0 | 1 of 1See more | 113 |
| consulhashicorpVerified publisher | 2.0.4 | 2 of 2See more | 47 |
| alloygrafana | 1.13.1 | 1See more | — |
| reloaderstakaterVerified publisher | 2.2.18 | 1 of 1See more | 0 |
| argo-rolloutsargoOfficialVerified publisher | 2.43.6 | 1 of 1See more | 160 |
| jupyterhubjupyterhubOfficialVerified publisher | 4.4.2 | 2 of 7See more | 9,679 |
| mimir-distributedgrafana | 6.2.1 | 1 of 5See more | 2,438 |
| headlampheadlampOfficialVerified publisher | 0.45.0 | 1 of 1See more | 326 |
| argocd-image-updaterargoOfficialVerified publisher | 1.3.1 | 1 of 1See more | 1,042 |
| natsnatsVerified publisher | 2.15.0 | 2 of 3See more | 2,524 |
| uptime-kumauptime-kumaVerified publisher | 4.2.0 | 1 of 1See more | 36,123 |
| airflowairflow-helmVerified publisher | 8.9.0 | 1 of 4See more | 12,502 |
| kongkongOfficialVerified publisher | 3.4.1 | 1 of 2See more | 702 |
| nfs-server-provisionerkvaps | 1.8.0 | 1 of 1See more | 3,310 |
| chartmuseumchartmuseumVerified publisher | 3.10.4 | 1 of 1See more | 1,991 |
| prometheus-node-exporterprometheus-communityOfficialVerified publisher | 4.59.0 | 1 of 1See more | 149 |
| argo-eventsargoOfficialVerified publisher | 2.4.27 | 1 of 1See more | 1,393 |
| victoria-metrics-k8s-stackvictoriametricsVerified publisher | 0.95.2 | 3 of 7See more | 629 |
| aws-node-termination-handleraws | 0.21.0 | 1 of 1See more | 2,077 |
| kuredkuredOfficialVerified publisher | 6.1.0 | 1 of 1See more | 325 |
| prometheus-adapterprometheus-communityOfficialVerified publisher | 5.3.0 | 1 of 1See more | 1,349 |
| openebsopenebsOfficialVerified publisher | 4.6.2 | 17 of 35See more | 31,940 |
| open-webuiopen-webui | 16.6.0 | 1 of 4See more | 2,257 |
| actions-runner-controlleractions-runner-controller | 0.23.7 | 2 of 2See more | 4,063 |
| aws-for-fluent-bitaws | 0.2.0 | 1 of 1See more | 408 |
| apisixapisix | 2.18.0 | 1 of 3See more | 3,403 |
| vpafairwinds-stableVerified publisher | 5.1.0 | 4 of 4See more | 2,002 |
| x509-certificate-exporterenixOfficialVerified publisher | 4.2.0 | 1 of 1See more | 149 |
| terraformhashicorpVerified publisher | 1.1.2 | 1 of 1See more | 2,734 |
| trinotrino | 1.42.2 | 1 of 1See more | 1,693 |
| dagsterdagsterVerified publisher | 1.13.25 | 1 of 5See more | 4,212 |
| zabbixzabbix-communityVerified publisher | 7.1.0 | 2 of 5See more | 15,706 |
| keycloakcloudpirates-keycloakVerified publisher | 0.21.46 | 1See more | — |
Container images carrying it
4,684 by charts deploying them
A fixed version is listed for 2 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| library/ | 7dcddc01f13b | stdlib | 1.26.9 | 91 |
| library/ | 4bc6bc963e6d | stdlib | 1.26.9 | 36 |
| registry.k8s.io/ | 42cfe3723a5f | golang.org/ stdlib | 0.60.0 1.26.9 | 15 |
| jimmidyson/ | 904d08e9f701 | stdlib | 1.26.9 | 14 |
| ghcr.io/ | 0b26892cec94 | golang.org/ stdlib | 0.60.0 1.26.9 | 14 |
| quay.io/ | 1b4e4438faca | golang.org/ stdlib | 0.60.0 1.26.9 | 14 |
| codeurjc/ | 9fb4c11e6a49 | golang.org/ stdlib | 0.60.0 1.26.9 | 13 |
| registry.k8s.io/ | a4b0b1a37605 | golang.org/ stdlib | 0.60.0 1.26.9 | 13 |
| registry.k8s.io/ | 1545919b72e3 | golang.org/ stdlib | 0.60.0 1.26.9 | 12 |
| registry.k8s.io/ | f9de845b1701 | golang.org/ stdlib | 0.60.0 1.26.9 | 12 |
| library/ | fc77d54cacef | stdlib | 1.26.9 | 11 |
| jwilder/ | f94fb59fb4f6 | golang.org/ stdlib | 0.60.0 1.26.9 | 10 |
| library/ | 8e70544b6c76 | stdlib | 1.26.9 | 10 |
| quay.io/ | 4032c6d5bfd7 | golang.org/ stdlib | 0.60.0 1.26.9 | 10 |
| dtzar/ | 55429449408e | golang.org/ stdlib | 0.60.0 1.26.9 | 8 |
| library/ | e582c0bc7766 | stdlib | 1.26.9 | 8 |
| prom/ | a684e7c830a4 | golang.org/ stdlib | 0.60.0 1.26.9 | 8 |
| quay.io/ | 8c9bac11973b | golang.org/ stdlib | 0.60.0 1.26.9 | 8 |
| quay.io/ | cf66a6bbd573 | golang.org/ stdlib | 0.60.0 1.26.9 | 8 |
| registry.k8s.io/ | 11f199f6bec4 | golang.org/ stdlib | 0.60.0 1.26.9 | 8 |
| registry.k8s.io/ | ea1d25e23479 | golang.org/ stdlib | 0.60.0 1.26.9 | 8 |
| osixia/ | 18742e9c449c | golang.org/ stdlib | 0.60.0 1.26.9 | 7 |
| wurstmeister/ | 2d4bbf9cc83d | golang.org/ stdlib | 0.60.0 1.26.9 | 7 |
| public.ecr.aws/ | 8e01c0305844 | stdlib | 1.26.9 | 7 |
| quay.io/ | c85268c64f2e | golang.org/ stdlib | 0.60.0 1.26.9 | 7 |
| quay.io/ | 70f532fd9cfd | golang.org/ stdlib | 0.60.0 1.26.9 | 7 |
| quay.io/ | 46e75b686635 | golang.org/ stdlib | 0.60.0 1.26.9 | 7 |
| quay.io/ | a60e2dac46db | golang.org/ stdlib | 0.60.0 1.26.9 | 7 |
| quay.io/ | e13b6ed5cb92 | golang.org/ stdlib | 0.60.0 1.26.9 | 7 |
| quay.io/ | 4ec6df40fdb9 | golang.org/ stdlib | 0.60.0 1.26.9 | 7 |
| registry.k8s.io/ | 37d841299325 | golang.org/ stdlib | 0.60.0 1.26.9 | 7 |
| registry.k8s.io/ | b401fae262a5 | golang.org/ stdlib | 0.60.0 1.26.9 | 7 |
| registry.k8s.io/ | 04c55b93a032 | golang.org/ stdlib | 0.60.0 1.26.9 | 7 |
| registry.k8s.io/ | 5e7cbb63fd49 | golang.org/ stdlib | 0.60.0 1.26.9 | 7 |
| registry.k8s.io/ | 42af0929bcd6 | golang.org/ stdlib | 0.60.0 1.26.9 | 7 |
| bitnamilegacy/ | 42319decb591 | golang.org/ stdlib | 0.60.0 1.26.9 | 6 |
| bitnamilegacy/ | 25bf63f3caf7 | stdlib | 1.26.9 | 6 |
| clastix/ | 22918a06c253 | golang.org/ stdlib | 0.60.0 1.26.9 | 6 |
| csiplugin/ | 60ab9b3e6a03 | golang.org/ stdlib | 0.60.0 1.26.9 | 6 |
| csiplugin/ | 2dee3fe5fe86 | golang.org/ stdlib | 0.60.0 1.26.9 | 6 |
| grafana/ | d72946c8e5d5 | golang.org/ stdlib | 0.60.0 1.26.9 | 6 |
| grafana/ | 1ee60f980950 | golang.org/ stdlib | 0.60.0 1.26.9 | 6 |
| library/ | a02db8cac496 | stdlib | 1.26.9 | 6 |
| library/ | a3d8aaa63ed8 | stdlib | 1.26.9 | 6 |
| natsio/ | 64cb6c858e79 | stdlib | 1.26.9 | 6 |
| postgis/ | 01a6a70e41e6 | stdlib | 1.26.9 | 6 |
| prom/ | 7e4e9f7a0954 | golang.org/ stdlib | 0.60.0 1.26.9 | 6 |
| prom/ | b6763ecb3c47 | golang.org/ stdlib | 0.60.0 1.26.9 | 6 |
| traefik/ | c4717a8d1f01 | golang.org/ stdlib | 0.60.0 1.26.9 | 6 |
| quay.io/ | c8958d9533c7 | golang.org/ stdlib | 0.60.0 1.26.9 | 6 |