StackRadar

CVE-2026-78660

High

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.003
21st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
5,341
of 18,137 indexed, latest versions
Container images
6,191
deployed by those charts
Fix available
3 of 5
affected packages

HTTP/2 transport accepts malformed framing-related headers in net/http

Carried by container images the latest versions of 5,341 of 18,137 indexed charts deploy, on 6,191 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+208 more1.26.9, 1.27.26,115
golang.org/x/netgolangv0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more0.60.04,943
golang-1.19deb1.19.8-2no fix listed1
ingress-nginx-controller-1.15apk1.15.10-r9no fix listed1
minioapk0.20251015.172955-r100.20260922.192518-r21
OSV records
CGA-549w-3rfh-p826CGA-p3fp-cff9-hfhmDEBIAN-CVE-2026-78660GO-2026-6610
Also known as
CGA-w457-vj2x-m6xf, CGA-xjhf-9jv7-7x78
Trending
Rank 10 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,341 by stars
ChartLatestAffected imagesRadar Score

Container images carrying it

6,191 by charts deploying them

A fixed version is listed for 3 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
public.ecr.aws/n8h5y2v5/rad-security/rad-sync:v1.1.1514f3dfbc0225
golang.org/x/net@v0.33.0
stdlib@go1.23.4
0.60.0
1.26.9
1
public.ecr.aws/n8h5y2v5/rad-security/rad-sync:v1.1.38bbba62c5a110
golang.org/x/net@v0.56.0
stdlib@go1.27.1
0.60.0
1.27.2
1
public.ecr.aws/n8h5y2v5/rad-security/rad-watch:v1.1.504e25d84332fc
golang.org/x/net@v0.56.0
stdlib@go1.27.1
0.60.0
1.27.2
1
public.ecr.aws/n8h5y2v5/rad-security/rad-watch:v1.1.25b9a7d6bc2a0c
golang.org/x/net@v0.33.0
stdlib@go1.23.4
0.60.0
1.26.9
1
public.ecr.aws/neuron/neuron-device-plugin:2.23.30.075a6d5ce3bd3
golang.org/x/net@v0.23.0
stdlib@go1.20.4
0.60.0
1.26.9
1
public.ecr.aws/neuron/neuron-scheduler:2.23.30.04cd274463e6b
golang.org/x/net@v0.23.0
stdlib@go1.20.4
0.60.0
1.26.9
1
public.ecr.aws/opslevel/kubectl-opslevel:v2024.9.571697b5ff713
golang.org/x/net@v0.28.0
stdlib@go1.22.6
0.60.0
1.26.9
1
public.ecr.aws/optimizely/webhook-broker:v0.2.3cfc92cc2de65
golang.org/x/net@v0.33.0
stdlib@go1.23.0
0.60.0
1.26.9
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
stdlib@go1.20.2
1.26.9
1
public.ecr.aws/p1t3u8a3/api:v1.28.512aeda8dbac7
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9
1
public.ecr.aws/p1t3u8a3/assets:v1.28.0fee63ead0e74
stdlib@go1.26.8
1.26.9
1
public.ecr.aws/p1t3u8a3/canvases:v1.28.08d2b3a947a14
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9
1
public.ecr.aws/p1t3u8a3/db:v1.28.02c99078d7957
stdlib@go1.26.8
1.26.9
1
public.ecr.aws/p1t3u8a3/http:v1.28.0cd0e4469cd02
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9
1
public.ecr.aws/p1t3u8a3/sink:v1.28.06b80fb10b443
stdlib@go1.26.8
1.26.9
1
public.ecr.aws/p1t3u8a3/spot:v1.28.00ba5cb666370
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9
1
public.ecr.aws/p1t3u8a3/storage:v1.28.02f9784a385ce
stdlib@go1.26.8
1.26.9
1
public.ecr.aws/perfectscale-io/kube-state-metrics:4.1.14-redhat849e235e2d3e
golang.org/x/net@v0.17.0
stdlib@go1.20.12
0.60.0
1.26.9
1
public.ecr.aws/perfectscale-io/psc-exporter:v1.0.45-redhat9083e60c38bc
golang.org/x/net@v0.27.0
stdlib@go1.22.7
0.60.0
1.26.9
1
public.ecr.aws/r3m4q3r9/pleco:0.24.0651739583336
golang.org/x/net@v0.39.0
stdlib@go1.21.6
0.60.0
1.26.9
1
public.ecr.aws/spotinst/spot-network-client:1.0.1486380a01587d
golang.org/x/net@v0.48.0
stdlib@go1.24.13
0.60.0
1.26.9
1
public.ecr.aws/spotinst/spot-network-client:1.0.0-8-lb_endpoint-d0ec127efcecf98b912
golang.org/x/net@v0.0.0-20210525063256-abc453219eb5
stdlib@go1.16.5
0.60.0
1.26.9
1
public.ecr.aws/sumologic/tailing-sidecar-operator:0.111.0920b8f901aef
golang.org/x/net@v0.38.0
stdlib@go1.24.5
0.60.0
1.26.9
1
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd
stdlib@go1.18.1
0.60.0
1.26.9
1
public.ecr.aws/t0u0d5o5/ecr_authenticator:latest077e4e57e41c
golang.org/x/net@v0.17.0
stdlib@go1.21.5
0.60.0
1.26.9
1
public.ecr.aws/truefoundrycloud/eks/eks-node-monitoring-agent:v1.7.1-eksbuild.1d3c1269791d7
golang.org/x/net@v0.58.0
stdlib@go1.26.7
0.60.0
1.26.9
1
public.ecr.aws/v0r6c2e2/minio:latest08c90bd040bf
golang.org/x/net@v0.34.0
stdlib@go1.23.5
0.60.0
1.26.9
1
public.ecr.aws/v0r6c2e2/trino:latestc265156b00d1
stdlib@go1.23.0
1.26.9
1
public.ecr.aws/xray/aws-xray-daemon:3.6.243d051eed000
golang.org/x/net@v0.38.0
stdlib@go1.25.7
0.60.0
1.26.9
1
quay.io/aerokube/boot:1.0.13c269612053f
golang.org/x/net@v0.24.0
stdlib@go1.22.2
0.60.0
1.26.9
1
quay.io/aerokube/browser-ops:2.6.7807c1bb67086
golang.org/x/net@v0.23.0
stdlib@go1.22.2
0.60.0
1.26.9
1
quay.io/aerokube/keygen:1.0.1578934444f04
golang.org/x/net@v0.8.0
stdlib@go1.20.5
0.60.0
1.26.9
1
quay.io/aerokube/moon:2.8.2072f3c5592dc
golang.org/x/net@v0.59.0
stdlib@go1.27.1
0.60.0
1.27.2
1
quay.io/aerokube/moon:2.5.1a8837b00ba1c
golang.org/x/net@v0.7.0
stdlib@go1.20.4
0.60.0
1.26.9
1
quay.io/aerokube/moon-conf:2.8.235c465ab25d8
golang.org/x/net@v0.59.0
stdlib@go1.27.1
0.60.0
1.27.2
1
quay.io/aerokube/moon-conf:2.5.19ca307b30080
golang.org/x/net@v0.7.0
stdlib@go1.20.4
0.60.0
1.26.9
1
quay.io/aerokube/moon-ui:2.0.589990b146824
golang.org/x/net@v0.11.0
stdlib@go1.20.5
0.60.0
1.26.9
1
quay.io/aerokube/moon-ui:2.8.2f374d0b9953b
golang.org/x/net@v0.59.0
stdlib@go1.27.1
0.60.0
1.27.2
1
quay.io/aerokube/reloader:1.0.1e4a3661416a5
stdlib@go1.22.2
1.26.9
1
quay.io/ansible/awx-operator:2.19.17302e0c8e5a7
golang.org/x/net@v0.20.0
stdlib@go1.20.12
0.60.0
1.26.9
1
quay.io/appzygy/ociregistry:1.20.052cfc157ed62
golang.org/x/net@v0.58.0
stdlib@go1.27.1
0.60.0
1.27.2
1
quay.io/argoproj/argocd:v2.4.115b6701d8fb31
golang.org/x/net@v0.0.0-20220621193019-9d032be2e588
stdlib@go1.16.5
0.60.0
1.26.9
1
quay.io/argoproj/argocd:v2.10.783c86003b781
golang.org/x/net@v0.17.0
stdlib@go1.20.10
0.60.0
1.26.9
1
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
golang.org/x/net@v0.33.0
stdlib@go1.22.7
0.60.0
1.26.9
1
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
golang.org/x/net@v0.40.0
stdlib@go1.22.7
0.60.0
1.26.9
1
quay.io/argoproj/argocd:v2.8.6acaf37352569
golang.org/x/net@v0.17.0
stdlib@go1.20.4
0.60.0
1.26.9
1
quay.io/argoproj/argocd:v3.5.3dd3f47d5a5e4
golang.org/x/net@v0.56.0
stdlib@go1.26.4
0.60.0
1.26.9
1
quay.io/argoproj/argocli:v3.7.11577fc18f86ad
golang.org/x/net@v0.47.0
stdlib@go1.25.5
0.60.0
1.26.9
1
quay.io/argoproj/argocli:v3.7.16efd1cb89dc1
golang.org/x/net@v0.40.0
stdlib@go1.24.6
0.60.0
1.26.9
1
quay.io/argoproj/argocli:v3.5.591b9825f09a8
golang.org/x/net@v0.19.0
stdlib@go1.21.7
0.60.0
1.26.9
1

syft 1.42.1 · advisories as of 16 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.