CVE-2026-78660

High

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.003; 21st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,278; of 18,137 indexed, latest versions
Container images: 6,099; deployed by those charts
Fix available: 3 of 5; affected packages

HTTP/2 transport accepts malformed framing-related headers in net/http

Carried by container images the latest versions of 5,278 of 18,137 indexed charts deploy, on 6,099 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+208 more	1.26.9, 1.27.2	6,032
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more	0.60.0	4,875
golang-1.19deb	1.19.8-2	no fix listed	1
ingress-nginx-controller-1.15apk	1.15.10-r9	no fix listed	1
minioapk	0.20251015.172955-r10	0.20260922.192518-r2	1

OSV records: CGA-549w-3rfh-p826 CGA-p3fp-cff9-hfhm DEBIAN-CVE-2026-78660 GO-2026-6610
Also known as: CGA-w457-vj2x-m6xf, CGA-xjhf-9jv7-7x78
Trending: Rank 9 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,278 by stars

Chart

Latest

Affected images

Radar Score

drogue-cloud-metricsdrogue-iot

0.7.11

6 of 8 See more

drogue-cloud-metrics drogue-iot 0.7.11

6 of the 8 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
grafana/grafana :9.2.4	057896e23443	golang.org/x/net@v0.0.0-20220909164309-bea034e7d591 stdlib@go1.19.3	0.60.0 1.26.9
jimmidyson/configmap-reload :v0.5.0	904d08e9f701	stdlib@go1.15.7	1.26.9
prom/pushgateway :v1.3.1	8305a33fb80a	stdlib@go1.15.6	1.26.9
quay.io/prometheus/alertmanager :v0.21.0	24a5204b418e	golang.org/x/net@v0.0.0-20200513185701-a91f0712d120 stdlib@go1.14.4	0.60.0 1.26.9
quay.io/prometheus/node-exporter :v1.1.2	22fbde17ab64	golang.org/x/net@v0.0.0-20201224014010-6772e930b67b stdlib@go1.15.8	0.60.0 1.26.9
quay.io/prometheus/prometheus :v2.26.0	38d40a760569	golang.org/x/net@v0.0.0-20210324051636-2c4c8ecb7826 stdlib@go1.16.2	0.60.0 1.26.9

Open the chart page →

20,639

drone-kubernetes-secretsdrone

0.1.4

1 of 1 See more

drone-kubernetes-secrets drone 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
drone/kubernetes-secrets :latest	206df2280ecf	golang.org/x/net@v0.0.0-20180811021610-c39426892332 stdlib@go1.13.15	0.60.0 1.26.9

Open the chart page →

3,985

mtr-exporterdrpsychick

0.0.5

1 of 1 See more

mtr-exporter drpsychick 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/mgumz/mtr-exporter :0.4.0	f4691c8fe8eb	stdlib@go1.22.8	1.26.9

Open the chart page →

815

piraeusdtrdnk-helm-charts

2.2.0

1 of 1 See more

piraeus dtrdnk-helm-charts 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/piraeusdatastore/piraeus-operator :v2.2.0	ec4022c8b0e3	golang.org/x/net@v0.8.0 stdlib@go1.18.10	0.60.0 1.26.9

Open the chart page →

1,867

rook-cephdtrdnk-helm-charts

0.0.1

2 of 2 See more

rook-ceph dtrdnk-helm-charts 0.0.1

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
rook/ceph :v1.19.2	944a1dd70496	golang.org/x/net@v0.47.0 stdlib@go1.25.6	0.60.0 1.26.9
quay.io/cephcsi/ceph-csi-operator :v0.5.0	14fe2f1bffc3	golang.org/x/net@v0.49.0 stdlib@go1.25.7	0.60.0 1.26.9

Open the chart page →

3,012

tempo-operatordtrdnk-helm-charts

0.0.3

1 of 2 See more

tempo-operator dtrdnk-helm-charts 0.0.3

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/grafana/tempo-operator/tempo-operator :v0.4.0	2627be646391	golang.org/x/net@v0.12.0 stdlib@go1.21.0	0.60.0 1.26.9

Open the chart page →

1,599

temporaldtrdnk-helm-charts

0.35.0

8 of 13 See more

temporal dtrdnk-helm-charts 0.35.0

8 of the 13 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
grafana/grafana :6.7.1	1ff3999e0fc0	golang.org/x/net@v0.0.0-20190923162816-aa69164e4478 stdlib@go1.13.4	0.60.0 1.26.9
jimmidyson/configmap-reload :v0.5.0	904d08e9f701	stdlib@go1.15.7	1.26.9
prom/pushgateway :v1.4.2	a684e7c830a4	golang.org/x/net@v0.0.0-20210525063256-abc453219eb5 stdlib@go1.16.9	0.60.0 1.26.9
temporalio/admin-tools :1.22.4	258958fe2ff2	golang.org/x/net@v0.8.0 stdlib@go1.20.10	0.60.0 1.26.9
temporalio/server :1.22.4	c0a44c26397b	golang.org/x/net@v0.7.0 stdlib@go1.20.11	0.60.0 1.26.9
temporalio/ui :2.16.2	af9c9349708f	golang.org/x/net@v0.10.0 stdlib@go1.20.5	0.60.0 1.26.9
quay.io/prometheus/alertmanager :v0.23.0	9ab73a421b65	golang.org/x/net@v0.0.0-20210726213435-c6fcb2dbf985 stdlib@go1.16.7	0.60.0 1.26.9
quay.io/prometheus/prometheus :v2.31.1	a8779cfe553e	golang.org/x/net@v0.0.0-20211020060615-d418f374d309 stdlib@go1.17.3	0.60.0 1.26.9

Open the chart page →

28,709

cloudflaredduck-helm

1.1.3

1 of 1 See more

cloudflared duck-helm 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
cloudflare/cloudflared :2026.3.0	6b599ca3e974	golang.org/x/net@v0.40.0 stdlib@go1.24.13	0.60.0 1.26.9

Open the chart page →

2,051

postgres-backup-localduck-helm

0.1.5

1 of 1 See more

postgres-backup-local duck-helm 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
prodrigestivill/postgres-backup-local :latest	f70742ebe42b	stdlib@go1.22.6	1.26.9

Open the chart page →

4,331

dumpstoredumpstore

0.1.1

1 of 2 See more

dumpstore dumpstore 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/manzil-infinity180/frontend-dumpstore :226f28ca3efa6d3691044813cd09085e28d4a7b4	4e6394b715d9	stdlib@go1.20.12	1.26.9

Open the chart page →

5,219

duplicacyduplicacy

0.1.3

1 of 2 See more

duplicacy duplicacy 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
drumsergio/duplicacy-container :0.1.0	dd3ee9703969	golang.org/x/net@v0.10.0 stdlib@go1.21.13	0.60.0 1.26.9

Open the chart page →

3,236

applause-btnduyet

0.1.3

1 of 1 See more

applause-btn duyet 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
duyetdev/applause-btn :latest	25e59d223eaa	golang.org/x/net@v0.0.0-20200822124328-c89045814202 stdlib@go1.14.9	0.60.0 1.26.9

Open the chart page →

3,861

commentoduyet

0.2.0

1 of 2 See more

commento duyet 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
registry.gitlab.com/commento/commento :v1.8.0	e0ab1fc86761	golang.org/x/net@v0.0.0-20180811021610-c39426892332 stdlib@go1.14.2	0.60.0 1.26.9

Open the chart page →

3,986

kubernetes-database-scalerdvdlevanon

0.1.2

1 of 1 See more

kubernetes-database-scaler dvdlevanon 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
dvdlevanon/kubernetes-database-scaler :v0.0.36	1e79c1643fe4	golang.org/x/net@v0.8.0	0.60.0

Open the chart page →

1,191

ai-scale-authdysnix

0.1.1

2 of 3 See more

ai-scale-auth dysnix 0.1.1

2 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
alex6021710/ai-scale-auth :latest	6c7a47e470c3	golang.org/x/net@v0.0.0-20211104170005-ce137452f963 stdlib@go1.16.12	0.60.0 1.26.9
alex6021710/ai-scale-migrator :latest	744b8a924f35	golang.org/x/net@v0.0.0-20211013171255-e13a2654a71e stdlib@go1.17.2	0.60.0 1.26.9

Open the chart page →

8,404

ai-scale-doerdysnix

0.1.0

1 of 1 See more

ai-scale-doer dysnix 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
alex6021710/ai-scale-doer :latest	31e533cf7cd3	golang.org/x/net@v0.0.0-20211104170005-ce137452f963 stdlib@go1.16.10	0.60.0 1.26.9

Open the chart page →

3,908

ai-scale-providerdysnix

0.1.0

1 of 1 See more

ai-scale-provider dysnix 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
alex6021710/ai-scale-provider :latest	5837d9b30cc7	golang.org/x/net@v0.0.0-20211104170005-ce137452f963 stdlib@go1.15.8	0.60.0 1.26.9

Open the chart page →

3,395

ai-scale-saverdysnix

0.1.0

1 of 1 See more

ai-scale-saver dysnix 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
alex6021710/ai-scale-saver :latest	f73e8d60fd03	golang.org/x/net@v0.0.0-20211105192438-b53810dc28af stdlib@go1.17	0.60.0 1.26.9

Open the chart page →

3,282

arbitrumdysnix

0.1.1

1 of 1 See more

arbitrum dysnix 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
offchainlabs/nitro-node :v3.1.0-7d1d84c	e95865866129	golang.org/x/net@v0.21.0 stdlib@go1.21.10	0.60.0 1.26.9

Open the chart page →

10,479

bitcoinddysnix

0.4.3

1 of 2 See more

bitcoind dysnix 0.4.3

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/dysnix/docker-bitcoind :0.29.0	490ca8e3dd21	stdlib@go1.22.2	1.26.9

Open the chart page →

2,676

bordysnix

0.0.8

1 of 1 See more

bor dysnix 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
0xpolygon/bor :1.3.7	396d3de26d8b	golang.org/x/net@v0.26.0 stdlib@go1.22.1	0.60.0 1.26.9

Open the chart page →

2,025

gcp-local-ssd-raiddysnix

0.1.7

1 of 2 See more

gcp-local-ssd-raid dysnix 0.1.7

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/local-volume-provisioner :v2.8.0	3e2bf2eaef9f	golang.org/x/net@v0.37.0 stdlib@go1.23.4	0.60.0 1.26.9

Open the chart page →

3,003

gke-upgrade-notification-handlerdysnix

0.1.1

1 of 1 See more

gke-upgrade-notification-handler dysnix 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
dysnix/gke-upgrade-notification-handler :latest	c166f958f86a	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e stdlib@go1.17.7	0.60.0 1.26.9

Open the chart page →

3,147

grafana-dashboardsdysnix

0.2.2

1 of 2 See more

grafana-dashboards dysnix 0.2.2

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
grafana/grafana :7.4.5	d322192ed2fa	golang.org/x/net@v0.0.0-20201022231255-08b38378de70 stdlib@go1.15.6	0.60.0 1.26.9

Open the chart page →

6,434

heimdalldysnix

0.0.1

1 of 1 See more

heimdall dysnix 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
0xpolygon/heimdall :1.0.1	34ddf259993c	golang.org/x/net@v0.8.0 stdlib@go1.20.5	0.60.0 1.26.9

Open the chart page →

2,082

local-path-provisionerdysnix

0.0.20

1 of 1 See more

local-path-provisioner dysnix 0.0.20

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
rancher/local-path-provisioner :v0.0.20	d5999b20a1b1	golang.org/x/net@v0.0.0-20201021035429-f5854403a974 stdlib@go1.16.6	0.60.0 1.26.9

Open the chart page →

4,075

pritunldysnix

0.2.7

1 of 3 See more

pritunl dysnix 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/dysnix/bitnami/mongodb :4.4.11-debian-10-r5	073116e61007	stdlib@go1.16.12	1.26.9

Open the chart page →

6,992

servicemonitor-appsdysnix

0.1.0

1 of 1 See more

servicemonitor-apps dysnix 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ethpandaops/ethereum-metrics-exporter :0.21.0	d1780db2e286	golang.org/x/net@v0.0.0-20220607020251-c690dde0001d stdlib@go1.18.10	0.60.0 1.26.9

Open the chart page →

2,406

smokeping-proberdysnix

0.3.1

1 of 1 See more

smokeping-prober dysnix 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
superque/smokeping-prober :v0.11.0	28ca636d1dee	golang.org/x/net@v0.51.0 stdlib@go1.26.1	0.60.0 1.26.9

Open the chart page →

876

eav-componenteav-component

1.0.0

1 of 3 See more

eav-component eav-component 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/eav-component-php :latest	24bbca4a52a8	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.60.0 1.26.9

Open the chart page →

9,155

echoappechoapp

0.1.0

1 of 1 See more

echoapp echoapp 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
hashicorp/http-echo :1.0.0	fcb75f691c8b	stdlib@go1.21.1	1.26.9

Open the chart page →

1,089

aeros-orchestrator-overlayeclipse-aerios

2.0.0

1 of 2 See more

aeros-orchestrator-overlay eclipse-aerios 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
masipcat/wireguard-go :latest	696206e5954d	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.20.14	0.60.0 1.26.9

Open the chart page →

1,852

api-gatewayeclipse-aerios

1.7.0

1 of 1 See more

api-gateway eclipse-aerios 1.7.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
devopsfaith/krakend :2.6.3	4c678c224f67	golang.org/x/net@v0.24.0 stdlib@go1.22.3	0.60.0 1.26.9

Open the chart page →

2,069

federatoreclipse-aerios

1.1.0

1 of 1 See more

federator eclipse-aerios 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
eclipseaerios/federator :1.1.0	18c7f0d101c0	golang.org/x/net@v0.25.0 stdlib@go1.22.12	0.60.0 1.26.9

Open the chart page →

1,278

idmeclipse-aerios

2.0.0

1 of 2 See more

idm eclipse-aerios 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/postgres :16.4	e62fbf9d3e2b	stdlib@go1.18.2	1.26.9

Open the chart page →

5,981

iotaeclipse-aerios

1.0.2

3 of 4 See more

iota eclipse-aerios 1.0.2

3 of the 4 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
eclipseaerios/iota-tangle-peerer :latest	99d7ff18d416	golang.org/x/net@v0.30.0 stdlib@go1.22.12	0.60.0 1.26.9
iotaledger/hornet :2.0	01206f1ba89c	golang.org/x/net@v0.14.0 stdlib@go1.21.10	0.60.0 1.26.9
iotaledger/inx-dashboard :1.0	12c669cb8748	golang.org/x/net@v0.14.0 stdlib@go1.21.1	0.60.0 1.26.9

Open the chart page →

17,081

llo-apieclipse-aerios

1.0.0

1 of 1 See more

llo-api eclipse-aerios 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
eclipseaerios/llo-api :1.2.0	ab7a04182191	golang.org/x/net@v0.17.0 stdlib@go1.21.13	0.60.0 1.26.9

Open the chart page →

1,514

llo-docker-operatoreclipse-aerios

1.0.0

2 of 2 See more

llo-docker-operator eclipse-aerios 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
eclipseaerios/llo-docker-operator :1.1.2	d7ec28bfe735	golang.org/x/net@v0.25.0 stdlib@go1.23.12	0.60.0 1.26.9
quay.io/brancz/kube-rbac-proxy :v0.14.1	58d91a5faaf8	golang.org/x/net@v0.7.0 stdlib@go1.19.4	0.60.0 1.26.9

Open the chart page →

3,550

llo-k8seclipse-aerios

1.1.0

2 of 2 See more

llo-k8s eclipse-aerios 1.1.0

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
eclipseaerios/llo-k8s-operator :1.4.1	2b2c0cf26fd2	golang.org/x/net@v0.10.0 stdlib@go1.21.13	0.60.0 1.26.9
quay.io/brancz/kube-rbac-proxy :v0.14.1	58d91a5faaf8	golang.org/x/net@v0.7.0 stdlib@go1.19.4	0.60.0 1.26.9

Open the chart page →

3,577

llo-natseclipse-aerios

1.0.0

1 of 1 See more

llo-nats eclipse-aerios 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/nats :2.11.4	c8cd23806eef	stdlib@go1.24.3	1.26.9

Open the chart page →

1,265

mintakaeclipse-aerios

1.0.0

1 of 2 See more

mintaka eclipse-aerios 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
timescale/timescaledb-postgis :latest-pg12	7758704d4a14	stdlib@go1.14	1.26.9

Open the chart page →

12,918

openfaas2eclipse-aerios

12.0.5

6 of 6 See more

openfaas2 eclipse-aerios 12.0.5

6 of the 6 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/nats-streaming :0.25.5	ced93c701875	stdlib@go1.19.10	1.26.9
prom/prometheus :v2.51.2	4f6c47e39a90	golang.org/x/net@v0.22.0 stdlib@go1.22.2	0.60.0 1.26.9
ghcr.io/openfaas/faas-netes :0.18.12	24431adc8e2d	golang.org/x/net@v0.32.0 stdlib@go1.23.4	0.60.0 1.26.9
ghcr.io/openfaas/gateway :0.27.13	82b15393116e	stdlib@go1.24.6	1.26.9
ghcr.io/openfaasltd/jetstream-queue-worker :0.3.37	d96366e208b1	stdlib@go1.22.1	1.26.9
quay.io/prometheus/alertmanager :v0.27.0	e13b6ed5cb92	golang.org/x/net@v0.20.0 stdlib@go1.21.7	0.60.0 1.26.9