CVE-2026-78660

High

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.003; 21st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,279; of 18,137 indexed, latest versions
Container images: 6,100; deployed by those charts
Fix available: 3 of 5; affected packages

HTTP/2 transport accepts malformed framing-related headers in net/http

Carried by container images the latest versions of 5,279 of 18,137 indexed charts deploy, on 6,100 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+208 more	1.26.9, 1.27.2	6,033
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more	0.60.0	4,876
golang-1.19deb	1.19.8-2	no fix listed	1
ingress-nginx-controller-1.15apk	1.15.10-r9	no fix listed	1
minioapk	0.20251015.172955-r10	0.20260922.192518-r2	1

OSV records: CGA-549w-3rfh-p826 CGA-p3fp-cff9-hfhm DEBIAN-CVE-2026-78660 GO-2026-6610
Also known as: CGA-w457-vj2x-m6xf, CGA-xjhf-9jv7-7x78
Trending: Rank 9 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,279 by stars

Chart

Latest

Affected images

Radar Score

multusk3s

4.0.201+upv4.0.2-build2024020801

2 of 2 See more

multus k3s 4.0.201+upv4.0.2-build2024020801

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
rancher/hardened-cni-plugins :v1.4.0-build20240122	2581c5490bab	stdlib@go1.20.7	1.26.9
rancher/hardened-multus-cni :v4.0.2-build20240208	7d0f41b72eb7	golang.org/x/net@v0.7.0 stdlib@go1.20.7	0.60.0 1.26.9

Open the chart page →

2,906

snapshot-controllerk3s

1.6.1+up1.6.0

1 of 1 See more

snapshot-controller k3s 1.6.1+up1.6.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
rancher/mirrored-sig-storage-snapshot-controller :v6.1.0	934863015367	golang.org/x/net@v0.0.0-20220909164309-bea034e7d591 stdlib@go1.18	0.60.0 1.26.9

Open the chart page →

2,409

snapshot-validation-webhookk3s

1.6.1+up1.6.0

1 of 1 See more

snapshot-validation-webhook k3s 1.6.1+up1.6.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
rancher/mirrored-sig-storage-snapshot-validation-webhook :v6.1.0	deac027820ae	golang.org/x/net@v0.0.0-20220909164309-bea034e7d591 stdlib@go1.18	0.60.0 1.26.9

Open the chart page →

2,409

traefikk3s

20.3.1+up20.3.0

1 of 1 See more

traefik k3s 20.3.1+up20.3.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
rancher/mirrored-library-traefik :2.9.4	0842af6afcdf	golang.org/x/net@v0.0.0-20220927171203-f486391704dc stdlib@go1.19.2	0.60.0 1.26.9

Open the chart page →

4,247

k8-ldap-configmapk8-ldap-configmap

0.16.0

1 of 1 See more

k8-ldap-configmap k8-ldap-configmap 0.16.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/ohiosupercomputercenter/k8-ldap-configmap :v0.16.0	40d0b67afd77	golang.org/x/net@v0.56.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

388

k8-namespace-reaperk8-namespace-reaper

0.11.0

1 of 1 See more

k8-namespace-reaper k8-namespace-reaper 0.11.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/ohiosupercomputercenter/k8-namespace-reaper :v0.11.0	ead1f817e8c2	golang.org/x/net@v0.56.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

347

k8quk8qu

1.4.0

1 of 1 See more

k8qu k8qu 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/gijsvandulmen/k8qu :1.4	e897b18db13d	golang.org/x/net@v0.26.0 stdlib@go1.22.6	0.60.0 1.26.9

Open the chart page →

1,119

k8s-aibomk8s-aibom

1.5.1

1 of 1 See more

k8s-aibom k8s-aibom 1.5.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/googlecloudplatform/k8s-aibomdigest-pinned	7b02731563a5	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

260

k8s-ai-srek8s-ai-sre

3.1.2

1 of 1 See more

k8s-ai-sre k8s-ai-sre 3.1.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
mohankrishna999/k8s-ai-agent :3.1.2	7f980f8c650c	golang.org/x/net@v0.57.0 stdlib@go1.26.5-X:jsonv2	0.60.0 1.26.9

Open the chart page →

981

clonarrk8s-charts

0.10.1

1 of 1 See more

clonarr k8s-charts 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/prophetse7en/clonarr :latest	9400d298b37a	stdlib@go1.26.4	1.26.9

Open the chart page →

770

deltabadgerk8s-charts

2.0.0

1 of 1 See more

deltabadger k8s-charts 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/deltabadger/deltabadger :2.23.3	bffe3c22fabc	stdlib@go1.24.4	1.26.9

Open the chart page →

7,332

palworld-serverk8s-charts

1.2.1

1 of 1 See more

palworld-server k8s-charts 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
thijsvanloef/palworld-server-docker :v2.5.0	b4ac9ee22483	stdlib@go1.26.3	1.26.9

Open the chart page →

4,247

valheim-serverk8s-charts

1.3.0

1 of 1 See more

valheim-server k8s-charts 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
mbround18/valheim :3.1.0	70bd4da591cd	stdlib@go1.18.1	1.26.9

Open the chart page →

65,323

deploydefenderk8s-custom-controller

0.1.3

1 of 1 See more

deploydefender k8s-custom-controller 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/manzil-infinity180/deploydefender :ea3ab0bb646cdbeddd1aca483ecf650f9ac0d084	7fbc6855c8b3	golang.org/x/net@v0.38.0 stdlib@go1.22.7	0.60.0 1.26.9

Open the chart page →

2,505

k8sdb-controllerk8sdb-controller

0.1.2

1 of 1 See more

k8sdb-controller k8sdb-controller 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/doodlescheduling/k8sdb-controller :v0.0.1	a6c2251a6263	golang.org/x/net@v0.0.0-20211108170745-6635138e15ea stdlib@go1.16.14	0.60.0 1.26.9

Open the chart page →

3,026

k8s-dev-podk8s-dev-pod

0.3.1

1 of 1 See more

k8s-dev-pod k8s-dev-pod 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/bryopsida/k8s-dev-pod :main	82d0b161161d	golang.org/x/net@v0.38.0 stdlib@go1.24.3	0.60.0 1.26.9

Open the chart page →

74,251

k8s-drain-surgek8s-drain-surge

0.0.3

1 of 1 See more

k8s-drain-surge k8s-drain-surge 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/aeyrtonvs/k8s-drain-surge :0.0.3	38bce7856b5c	golang.org/x/net@v0.53.0 stdlib@go1.25.10	0.60.0 1.26.9

Open the chart page →

448

k8s-file-explorerk8s-file-explorer

1.8.1

1 of 2 See more

k8s-file-explorer k8s-file-explorer 1.8.1

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
don616/k8s-file-explorer-backend :v1.8.1	3e228fadb3a8	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

1,316

bitmagnetk8s-home-lab-repo

1.0.2

1 of 1 See more

bitmagnet k8s-home-lab-repo 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/bitmagnet-io/bitmagnet :v0.10	b6373349a301	golang.org/x/net@v0.43.0 stdlib@go1.23.6	0.60.0 1.26.9

Open the chart page →

1,725

blockyk8s-home-lab-repo

11.2.1

1 of 1 See more

blocky k8s-home-lab-repo 11.2.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/0xerr0r/blocky :v0.29.0	a6d99f323d30	golang.org/x/net@v0.51.0 stdlib@go1.26.0	0.60.0 1.26.9

Open the chart page →

1,029

ghostk8s-home-lab-repo

4.1.0

1 of 1 See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/ghost :6.41.1	29773d6be407	stdlib@go1.24.6	1.26.9

Open the chart page →

4,311

giteak8s-home-lab-repo

2.6.0

1 of 1 See more

gitea k8s-home-lab-repo 2.6.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
gitea/gitea :1.26.2	7d13848af126	golang.org/x/net@v0.53.0 stdlib@go1.26.3-X:jsonv2	0.60.0 1.26.9

Open the chart page →

2,712

influxdb-exporterk8s-home-lab-repo

1.1.3

1 of 1 See more

influxdb-exporter k8s-home-lab-repo 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
prom/influxdb-exporter :v0.11.4	27e33e18634a	stdlib@go1.19.9	1.26.9

Open the chart page →

1,196

maddyk8s-home-lab-repo

4.2.1

1 of 1 See more

maddy k8s-home-lab-repo 4.2.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
foxcpp/maddy :0.8.2	eeb5813fc4d1	golang.org/x/net@v0.34.0 stdlib@go1.23.12	0.60.0 1.26.9

Open the chart page →

1,779

paperlessk8s-home-lab-repo

11.0.1

1 of 1 See more

paperless k8s-home-lab-repo 11.0.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :2.20.14	b89f83345532	stdlib@go1.24.4	1.26.9

Open the chart page →

11,376

photoprismk8s-home-lab-repo

10.0.1

1 of 1 See more

photoprism k8s-home-lab-repo 10.0.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
photoprism/photoprism :231128-ce	284de9cc4f9c	golang.org/x/net@v0.18.0 stdlib@go1.21.4	0.60.0 1.26.9

Open the chart page →

1,859

zurgk8s-home-lab-repo

1.2.1

1 of 1 See more

zurg k8s-home-lab-repo 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/debridmediamanager/zurg-testing :v0.9.3-final	5c47ef99443a	golang.org/x/net@v0.20.0 stdlib@go1.22.5	0.60.0 1.26.9

Open the chart page →

2,312

k8s-jacoco-operatork8s-jacoco-operator

0.4.0

1 of 4 See more

k8s-jacoco-operator k8s-jacoco-operator 0.4.0

1 of the 4 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/curium-rocks/docker-kubectl :main	d04c003d7593	golang.org/x/net@v0.23.0 stdlib@go1.22.5	0.60.0 1.26.9

Open the chart page →

3,193

k8skeycloak-controllerk8skeycloak-controller

0.1.2

1 of 1 See more

k8skeycloak-controller k8skeycloak-controller 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/doodlescheduling/k8skeycloak-controller :v0.0.1	9befc51b1ad6	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.15.15	0.60.0 1.26.9

Open the chart page →

5,321

k8s-mutating-admission-webhookk8s-mutating-admission-webhook

1.15.1

1 of 1 See more

k8s-mutating-admission-webhook k8s-mutating-admission-webhook 1.15.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
udhos/k8s-mutating-admission-webhook :1.15.1	e588db500edf	golang.org/x/net@v0.55.0 stdlib@go1.26.3	0.60.0 1.26.9

Open the chart page →

1,254

k8s-mutating-webhookk8s-mutating-webhook

0.3.0

1 of 2 See more

k8s-mutating-webhook k8s-mutating-webhook 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/curium-rocks/docker-kubectl :main	d04c003d7593	golang.org/x/net@v0.23.0 stdlib@go1.22.5	0.60.0 1.26.9

Open the chart page →

2,720

k8soauth2-proxy-controllerk8soauth2-proxy-controller

0.1.5

1 of 1 See more

k8soauth2-proxy-controller k8soauth2-proxy-controller 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/doodlescheduling/k8soauth2-proxy-controller :v0.1.2	80d049c9da31	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.17.11	0.60.0 1.26.9

Open the chart page →

2,433

k8s-ondemand-proxyk8s-ondemand-proxy

0.0.6

1 of 1 See more

k8s-ondemand-proxy k8s-ondemand-proxy 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/nefelim4ag/k8s-ondemand-proxy :0.0.2	078b25d48cf7	golang.org/x/net@v0.13.0 stdlib@go1.21.1	0.60.0 1.26.9

Open the chart page →

1,496

github-exporterk8sonlab

0.0.4

1 of 1 See more

github-exporter k8sonlab 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
githubexporter/github-exporter :v2.3.1	a36fbedeedf8	stdlib@go1.26.4	1.26.9

Open the chart page →

274

librephotosk8sonlab

1.1.7

3 of 7 See more

librephotos k8sonlab 1.1.7

3 of the 7 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
alpine/k8s :1.22.6	00ac10bcb759	golang.org/x/net@v0.0.0-20220107192237-5cfca573fb4d stdlib@go1.17.6	0.60.0 1.26.9
bitnamilegacy/redis :latest	5927ff3702df	stdlib@go1.24.5	1.26.9
reallibrephotos/librephotos-frontend :1.2.1	52371b6769d4	stdlib@go1.24.13	1.26.9

Open the chart page →

18,270

thanosk8sonlab

1.1.7

1 of 1 See more

thanos k8sonlab 1.1.7

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
thanosio/thanos :v0.41.0	cf3e9b292e43	golang.org/x/net@v0.49.0 stdlib@go1.25.7	0.60.0 1.26.9

Open the chart page →

1,014

unifik8sonlab

0.3.7

1 of 1 See more

unifi k8sonlab 0.3.7

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
jacobalberty/unifi :v10.0.162	896c0ab82d33	stdlib@go1.24.6	1.26.9

Open the chart page →

8,480

k8s-pausek8s-pause

0.1.4

1 of 1 See more

k8s-pause k8s-pause 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/doodlescheduling/k8s-pause :v0.1.1	6b3215e37738	golang.org/x/net@v0.0.0-20210825183410-e898025ed96a stdlib@go1.17.8	0.60.0 1.26.9

Open the chart page →

2,897

k8sprom-patch-controllerk8sprom-patch-controller

0.1.4

1 of 1 See more

k8sprom-patch-controller k8sprom-patch-controller 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/doodlescheduling/k8sprom-patch-controller :v0.1.2	43b92c9cf029	golang.org/x/net@v0.0.0-20211108170745-6635138e15ea stdlib@go1.17.8	0.60.0 1.26.9

Open the chart page →

2,897

k8s-redirectsk8s-redirects

1.0.0

1 of 1 See more

k8s-redirects k8s-redirects 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
traefik/whoami :latest	c4717a8d1f01	golang.org/x/net@v0.57.0 stdlib@go1.26.5	0.60.0 1.26.9

Open the chart page →

357

k8s-s3-bucket-operatork8s-s3-bucket-operator

0.2.2

1 of 1 See more

k8s-s3-bucket-operator k8s-s3-bucket-operator 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/devangradadiya/k8s-s3-bucket-operator :0.2.2	58288de9f9fa	golang.org/x/net@v0.47.0 stdlib@go1.25.8	0.60.0 1.26.9

Open the chart page →

936

k8s-ssh-bastionk8s-ssh-bastion

0.5.4

1 of 1 See more

k8s-ssh-bastion k8s-ssh-bastion 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/nefelim4ag/k8s-ssh-bastion :0.5.0	4d337e14c80b	golang.org/x/net@v0.23.0 stdlib@go1.21.11	0.60.0 1.26.9

Open the chart page →

4,172

k8stcpmap-controllerk8stcpmap-controller

0.1.2

1 of 1 See more

k8stcpmap-controller k8stcpmap-controller 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/doodlescheduling/k8stcpmap-controller :v0.0.1	ff005643dc97	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.16.14	0.60.0 1.26.9

Open the chart page →

2,566

k8s-validating-webhookk8s-validating-webhook

0.4.0

1 of 2 See more

k8s-validating-webhook k8s-validating-webhook 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/curium-rocks/docker-kubectl :main	d04c003d7593	golang.org/x/net@v0.23.0 stdlib@go1.22.5	0.60.0 1.26.9

Open the chart page →

2,720

kube-admission-controller-starterk8s-validating-webhook

0.2.0

1 of 2 See more

kube-admission-controller-starter k8s-validating-webhook 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/curium-rocks/docker-kubectl :main	d04c003d7593	golang.org/x/net@v0.23.0 stdlib@go1.22.5	0.60.0 1.26.9

Open the chart page →

2,870

k8svault-controllerk8svault-controller

0.1.2

1 of 1 See more

k8svault-controller k8svault-controller 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/doodlescheduling/k8svault-controller :v0.2.0	627e5e211766	golang.org/x/net@v0.0.0-20211108170745-6635138e15ea stdlib@go1.16.15	0.60.0 1.26.9

Open the chart page →

2,936

kagentkagent

0.10.3

5 of 6 See more

kagent kagent 0.10.3

5 of the 6 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/postgres :18.6-alpine3.23	885cf05d376c	stdlib@go1.24.6	1.26.9
mcp/grafana :latest	9362bcf6aa0e	golang.org/x/net@v0.55.0 stdlib@go1.26.5	0.60.0 1.26.9
ghcr.io/kagent-dev/kagent/controller :0.10.3	b2572a59386b	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2
ghcr.io/kagent-dev/kagent/tools :0.3.0	cb89eb762161	golang.org/x/net@v0.57.0 stdlib@go1.26.7	0.60.0 1.26.9
ghcr.io/kagent-dev/kmcp/controller :0.3.0	86ab878da25a	golang.org/x/net@v0.30.0 stdlib@go1.24.13	0.60.0 1.26.9

Open the chart page →

4,252

authentikkagiso-me

0.1.1

1 of 1 See more

authentik kagiso-me 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/goauthentik/server :2026.2.1	46a71d75dfd3	golang.org/x/net@v0.47.0 stdlib@go1.25.5	0.60.0 1.26.9

Open the chart page →

5,721

postgresqlkagiso-me

0.4.0

1 of 1 See more

postgresql kagiso-me 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/postgres :17.4-alpine	7062a2109c4b	stdlib@go1.18.2	1.26.9

Open the chart page →

2,563

rediskagiso-me

0.1.6

1 of 1 See more

redis kagiso-me 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/redis :7.4.2-alpine	02419de7eddf	stdlib@go1.18.2	1.26.9

Open the chart page →

2,360

Container images carrying it

6,100 by charts deploying them

A fixed version is listed for 3 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
registry.gitlab.com/commento/commento :v1.8.0	e0ab1fc86761	golang.org/x/net@v0.0.0-20180811021610-c39426892332 stdlib@go1.14.2	0.60.0 1.26.9	1
registry.gitlab.com/dyff/dyff-operator :0.24.22	7f930cdae40d	golang.org/x/net@v0.44.0 stdlib@go1.24.13	0.60.0 1.26.9	1
registry.gitlab.com/dyff/workflows-aggregator :0.16.12	ce790a4023b6	stdlib@go1.26.7	1.26.9	1
registry.gitlab.com/dyff/workflows-informer :0.4.4	bfbadc49635d	golang.org/x/net@v0.17.0 stdlib@go1.20.14	0.60.0 1.26.9	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend :1.0.31	c7afac3446d6	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.60.0 1.26.9	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer :1.0.31	0e3cd8c7776d	golang.org/x/net@v0.50.0 stdlib@go1.25.7	0.60.0 1.26.9	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb :4.4.5	cf72810d33f5	stdlib@go1.15.8	1.26.9	1
registry.gitlab.com/fmd-foss/fmd-server :0.17.0-distroless	40ff7c195e27	stdlib@go1.26.8	1.26.9	1
registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter :17.0.2	b5c24e466636	golang.org/x/net@v0.56.0 stdlib@go1.26.7	0.60.0 1.26.9	1
registry.gitlab.com/gitlab-org/ci-cd/gitlab-runner-pod-cleanup :latest	4369f3ba1d9a	golang.org/x/net@v0.43.0 stdlib@go1.25.0	0.60.0 1.26.9	1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator :0.5.1	36b19b72120e	golang.org/x/net@v0.0.0-20210805182204-aaa1db679c0d stdlib@go1.16.14	0.60.0 1.26.9	1
registry.gitlab.com/gitlab-org/gitlab-runner :alpine-v19.4.0	a4838319e55b	golang.org/x/net@v0.55.0 stdlib@go1.26.5	0.60.0 1.26.9	1
registry.gitlab.com/lenitech/docker/keycloak-ppolicy :0.6.0	9895d6915075	golang.org/x/net@v0.46.0 stdlib@go1.25.7	0.60.0 1.26.9	1
registry.gitlab.com/lenitech/k8s-operator/keycloak-client :v0.6.1	9065cdd80035	golang.org/x/net@v0.38.0 stdlib@go1.24.5	0.60.0 1.26.9	1
registry.gitlab.com/parrotsec/project/parrot-mirror-docker :main	f91b602ca572	golang.org/x/net@v0.14.0 stdlib@go1.21.0	0.60.0 1.26.9	1
registry.gitlab.com/purelb/purelb/allocator :v0.0.0-106-ipv6-lbip-052cedab	9d1fcb78f529	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.15.15	0.60.0 1.26.9	1
registry.gitlab.com/shortlink-org/shortlink/bff :latest	f2194e526915	golang.org/x/net@v0.49.0 stdlib@go1.25.7	0.60.0 1.26.9	1
registry.gitlab.com/shortlink-org/shortlink/link :latest	86d87291ffd4	golang.org/x/net@v0.49.0 stdlib@go1.25.7	0.60.0 1.26.9	1
registry.gitlab.com/xrow-public/ci-tools/kubectl :main	9357cfeef63c	golang.org/x/net@v0.38.0 stdlib@go1.24.9	0.60.0 1.26.9	1
registry.gitlab.com/xrow-public/ci-tools/tools :main	90a7a94db2b0	golang.org/x/net@v0.57.0 stdlib@go1.26.7	0.60.0 1.26.9	1
registry.gitlab.com/xrow-public/developer-operator/developer-operator-controller :2.1.2	301847adfe16	golang.org/x/net@v0.41.0 stdlib@go1.24.5	0.60.0 1.26.9	1
registry.gitlab.com/xrow-public/helm-clamav/kubectl :1.10.39	7d7a46f5dc6d	golang.org/x/net@v0.57.0 stdlib@go1.26.8	0.60.0 1.26.9	1
registry.gitlab.com/xrow-public/helm-mssql/mssql :1.10.3	f923d842bc47	stdlib@go1.23.1	1.26.9	1
registry.gitlab.com/xrow-public/helm-openclaw/openclaw :1.110.1	51e6f187064f	golang.org/x/net@v0.57.0 stdlib@go1.26.4	0.60.0 1.26.9	1
registry.gitlab.com/xrow-public/ttl-controller/ttl-controller :1.9.1	8092dd72f073	golang.org/x/net@v0.57.0 stdlib@go1.27.0-X:nodwarf5	0.60.0 1.27.2	1
registry.gitlab.com/xrow-public/velero-client/velero-client :1.4.2	03015f863a3e	golang.org/x/net@v0.49.0 stdlib@go1.26.4	0.60.0 1.26.9	1
registry.k8s.io/agent-sandbox/agent-sandbox-controller :v0.5.4	be477ba317d8	golang.org/x/net@v0.57.0 stdlib@go1.26.5	0.60.0 1.26.9	1
registry.k8s.io/agent-sandbox/agent-sandbox-controller :v1.0.4	c241245d7ff0	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
registry.k8s.io/agent-sandbox/agent-sandbox-controller :v0.5.6	dc23fb0d5624	golang.org/x/net@v0.58.0 stdlib@go1.26.6	0.60.0 1.26.9	1
registry.k8s.io/agent-sandbox/agent-sandbox-controller :v1.0.2	dc700a37ecf4	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2	1
registry.k8s.io/agent-sandbox/agent-sandbox-controller :v1.0.1	e1787f95cda4	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2	1
registry.k8s.io/agent-sandbox/sandbox-router-go :v1.0.1	25b1a0939630	golang.org/x/net@v0.58.0 stdlib@go1.26.2	0.60.0 1.26.9	1
registry.k8s.io/autoscaling/cluster-autoscaler :v1.33.0	6ef10d108e0e	golang.org/x/net@v0.38.0 stdlib@go1.24.4	0.60.0 1.26.9	1
registry.k8s.io/autoscaling/cluster-autoscaler :v1.34.0	7b172f42533c	golang.org/x/net@v0.38.0 stdlib@go1.24.7	0.60.0 1.26.9	1
registry.k8s.io/autoscaling/vpa-admission-controller :1.8.0	3d94f53e4c5a	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	1
registry.k8s.io/autoscaling/vpa-admission-controller :1.4.1	71d817780aa9	golang.org/x/net@v0.39.0 stdlib@go1.24.3	0.60.0 1.26.9	1
registry.k8s.io/autoscaling/vpa-admission-controller :1.6.0	80e487edff02	golang.org/x/net@v0.50.0 stdlib@go1.25.7	0.60.0 1.26.9	1
registry.k8s.io/autoscaling/vpa-admission-controller :1.5.1	9928d59477fb	golang.org/x/net@v0.43.0 stdlib@go1.24.6	0.60.0 1.26.9	1
registry.k8s.io/autoscaling/vpa-recommender :1.4.1	40b6d76e8526	golang.org/x/net@v0.39.0 stdlib@go1.24.3	0.60.0 1.26.9	1
registry.k8s.io/autoscaling/vpa-recommender :1.5.1	e629c61b75eb	golang.org/x/net@v0.43.0 stdlib@go1.24.6	0.60.0 1.26.9	1
registry.k8s.io/autoscaling/vpa-recommender :1.8.0	e743e3a7e58a	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	1
registry.k8s.io/autoscaling/vpa-updater :1.8.0	1d0229e52f90	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	1
registry.k8s.io/autoscaling/vpa-updater :1.4.1	8ebf269779c1	golang.org/x/net@v0.39.0 stdlib@go1.24.3	0.60.0 1.26.9	1
registry.k8s.io/autoscaling/vpa-updater :1.6.0	b39d1dfa19cb	golang.org/x/net@v0.50.0 stdlib@go1.25.7	0.60.0 1.26.9	1
registry.k8s.io/autoscaling/vpa-updater :1.5.1	cba2aa4b3239	golang.org/x/net@v0.43.0 stdlib@go1.24.6	0.60.0 1.26.9	1
registry.k8s.io/capi-operator/cluster-api-operator :v0.29.0	465e72f8b06a	golang.org/x/net@v0.56.0 stdlib@go1.26.6	0.60.0 1.26.9	1
registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere :v1.28.0	026f63d9ed42	golang.org/x/net@v0.13.0 stdlib@go1.20.7	0.60.0 1.26.9	1
registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere :v1.32.0	f9f4dfd733ab	golang.org/x/net@v0.32.0 stdlib@go1.23.0	0.60.0 1.26.9	1
registry.k8s.io/coredns/coredns :v1.13.2	94caebb89dcf	golang.org/x/net@v0.47.0 stdlib@go1.25.5	0.60.0 1.26.9	1
registry.k8s.io/csi-secrets-store/driver :v1.6.1	b48d7d13dd06	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	1