CVE-2026-78660

High

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.003; 21st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,370; of 18,108 indexed, latest versions
Container images: 6,200; deployed by those charts
Fix available: 3 of 5; affected packages

HTTP/2 transport accepts malformed framing-related headers in net/http

Carried by container images the latest versions of 5,370 of 18,108 indexed charts deploy, on 6,200 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+212 more	1.26.9, 1.27.2	6,157
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more	0.60.0	4,952
golang-1.19deb	1.19.8-2	no fix listed	1
ingress-nginx-controller-1.15apk	1.15.10-r9	no fix listed	1
minioapk	0.20251015.172955-r10	0.20260922.192518-r2	1

OSV records: CGA-549w-3rfh-p826 CGA-p3fp-cff9-hfhm DEBIAN-CVE-2026-78660 GO-2026-6610
Also known as: CGA-w457-vj2x-m6xf, CGA-xjhf-9jv7-7x78
Trending: Rank 10 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,370 by stars

Chart

Latest

Affected images

Radar Score

kubeblocks-csi-driverkubeblocks

0.1.3

1 of 6 See more

kubeblocks-csi-driver kubeblocks 0.1.3

1 of the 6 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
apecloud/kubeblocks-csi-driver :0.1.3	c93655ccb2d7	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.19.13	0.60.0 1.26.9

Open the chart page →

2,811

kubetrankubeblocks

0.1.0

1 of 1 See more

kubetran kubeblocks 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
apecloud/kubetran-platform :latest	32bd92c7f7fa	golang.org/x/net@v0.15.0 stdlib@go1.20.8	0.60.0 1.26.9

Open the chart page →

1,896

lokikubeblocks

5.39.0

3 of 5 See more

loki kubeblocks 5.39.0

3 of the 5 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
grafana/agent-operator :v0.34.1	045c9125634c	golang.org/x/net@v0.10.0 stdlib@go1.20.4	0.60.0 1.26.9
grafana/loki :2.9.2	6074e01dbe03	golang.org/x/net@v0.17.0 stdlib@go1.21.3	0.60.0 1.26.9
grafana/loki-canary :2.9.2	4249db29b992	golang.org/x/net@v0.17.0 stdlib@go1.21.3	0.60.0 1.26.9

Open the chart page →

8,018

metallbkubeblocks

0.14.4

2 of 3 See more

metallb kubeblocks 0.14.4

2 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/metallb/controller :v0.14.4	bbef1ee3e7d3	golang.org/x/net@v0.22.0 stdlib@go1.21.8	0.60.0 1.26.9
quay.io/metallb/speaker :v0.14.4	37611bde45a2	golang.org/x/net@v0.22.0 stdlib@go1.21.8	0.60.0 1.26.9

Open the chart page →

3,845

metrics-serverkubeblocks

3.12.0

1 of 1 See more

metrics-server kubeblocks 3.12.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
registry.k8s.io/metrics-server/metrics-server :v0.7.0	1c0419326500	golang.org/x/net@v0.20.0 stdlib@go1.21.6	0.60.0 1.26.9

Open the chart page →

1,823

nvidia-gpu-exporterkubeblocks

0.3.1

1 of 1 See more

nvidia-gpu-exporter kubeblocks 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
utkuozdemir/nvidia_gpu_exporter :0.3.0	149f9e7e7aa3	golang.org/x/net@v0.0.0-20210525063256-abc453219eb5 stdlib@go1.17	0.60.0 1.26.9

Open the chart page →

5,803

openebskubeblocks

3.10.0

3 of 3 See more

openebs kubeblocks 3.10.0

3 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
openebs/node-disk-manager :2.1.0	f6c18b0f8c8a	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.19.3	0.60.0 1.26.9
openebs/node-disk-operator :2.1.0	6afe2123c457	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.19.3	0.60.0 1.26.9
openebs/provisioner-localpv :3.5.0	aea39e49bb97	golang.org/x/net@v0.17.0 stdlib@go1.19.13	0.60.0 1.26.9

Open the chart page →

13,447

postgres-operatorkubeblocks

1.12.2

1 of 1 See more

postgres-operator kubeblocks 1.12.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/zalando/postgres-operator :v1.12.2	d81cda253f5c	golang.org/x/net@v0.23.0 stdlib@go1.22.3	0.60.0 1.26.9

Open the chart page →

2,142

prometheuskubeblocks

15.16.1

6 of 6 See more

prometheus kubeblocks 15.16.1

6 of the 6 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
jimmidyson/configmap-reload :v0.5.0	904d08e9f701	stdlib@go1.15.7	1.26.9
prom/pushgateway :v1.4.3	3496e0f85943	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.2	0.60.0 1.26.9
quay.io/prometheus/alertmanager :v0.24.0	088464f949de	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.17.8	0.60.0 1.26.9
quay.io/prometheus/node-exporter :v1.3.1	f2269e73124d	golang.org/x/net@v0.0.0-20210525063256-abc453219eb5 stdlib@go1.17.3	0.60.0 1.26.9
quay.io/prometheus/prometheus :v2.39.1	4748e26f9369	golang.org/x/net@v0.0.0-20220920203100-d0c6ba3f52d9 stdlib@go1.19.2	0.60.0 1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.5.0	09a36e2be1db	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.3	0.60.0 1.26.9

Open the chart page →

16,355

servicemirrorkubeblocks

0.5.3

1 of 1 See more

servicemirror kubeblocks 0.5.3

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
apecloud/servicemirror :0.5.3	8c8451abf728	golang.org/x/net@v0.55.0 stdlib@go1.25.14	0.60.0 1.26.9

Open the chart page →

227

smartfs-csi-driverkubeblocks

0.1.2

1 of 6 See more

smartfs-csi-driver kubeblocks 0.1.2

1 of the 6 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
apecloud/smartfs-csi-driver :0.1.1	ff2858eab9cc	golang.org/x/net@v0.5.0 stdlib@go1.19.13	0.60.0 1.26.9

Open the chart page →

10,000

snapshot-controllerkubeblocks

1.7.2

1 of 1 See more

snapshot-controller kubeblocks 1.7.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/snapshot-controller :v6.2.1	98bab4eaf23c	golang.org/x/net@v0.4.0 stdlib@go1.19	0.60.0 1.26.9

Open the chart page →

2,015

spiderpoolkubeblocks

1.2.0

4 of 4 See more

spiderpool kubeblocks 1.2.0

4 of the 4 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/k8snetworkplumbingwg/multus-cni :v4.1.4	09fdfb7ce090	golang.org/x/net@v0.23.0 stdlib@go1.23.4	0.60.0 1.26.9
ghcr.io/spidernet-io/spiderpool/spiderpool-agent :v1.2.0	8bb9411e47e0	golang.org/x/net@v0.42.0 stdlib@go1.25.7	0.60.0 1.26.9
ghcr.io/spidernet-io/spiderpool/spiderpool-controller :v1.2.0	42304e3ed36e	golang.org/x/net@v0.42.0 stdlib@go1.25.7	0.60.0 1.26.9
ghcr.io/spidernet-io/spiderpool/spiderpool-plugins :19f19457ae7cec86457b0411543a3cf21dd9f95a	8edc39be1e22	golang.org/x/net@v0.43.0 stdlib@go1.25.7	0.60.0 1.26.9

Open the chart page →

10,908

traefikkubeblocks

41.6.0

1 of 1 See more

traefik kubeblocks 41.6.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/traefik :v3.7.13	24841fe2de73	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

246

vaultkubeblocks

0.30.0

2 of 2 See more

vault kubeblocks 0.30.0

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
hashicorp/vault :1.19.0	bbb7f98dc67d	golang.org/x/net@v0.35.0 stdlib@go1.23.6	0.60.0 1.26.9
hashicorp/vault-k8s :1.6.2	103a2d817a74	golang.org/x/net@v0.35.0 stdlib@go1.23.6	0.60.0 1.26.9

Open the chart page →

4,259

victoria-metrics-alertkubeblocks

0.8.3-reload

3 of 3 See more

victoria-metrics-alert kubeblocks 0.8.3-reload

3 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
jimmidyson/configmap-reload :v0.5.0	904d08e9f701	stdlib@go1.15.7	1.26.9
victoriametrics/vmalert :v1.95.1	a83e5db0897a	golang.org/x/net@v0.18.0 stdlib@go1.21.4	0.60.0 1.26.9
quay.io/prometheus/alertmanager :v0.25.0	fd4d9a3dd1fd	golang.org/x/net@v0.4.0 stdlib@go1.19.4	0.60.0 1.26.9

Open the chart page →

6,261

kube-bootkube-boot

1.2.2

1 of 1 See more

kube-boot kube-boot 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/eclipse-temurin :21	3e3c176ffed1	stdlib@go1.26.7	1.26.9

Open the chart page →

853

kube-botblocker-operatorkube-botblocker

0.2.2

1 of 2 See more

kube-botblocker-operator kube-botblocker 0.2.2

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/gustavojst/kube-botblocker :0.2.0	4de059bb32ac	golang.org/x/net@v0.41.0 stdlib@go1.24.4	0.60.0 1.26.9

Open the chart page →

993

kubecachekubecache

0.14.1

1 of 1 See more

kubecache kubecache 0.14.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
udhos/kubecache :0.14.1	f44ef986df49	golang.org/x/net@v0.57.0 stdlib@go1.26.5	0.60.0 1.26.9

Open the chart page →

676

kubecheckskubechecks

3.1.0

1 of 1 See more

kubechecks kubechecks 3.1.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/zapier/kubechecks :latest	65780f7c0ae9	golang.org/x/net@v0.58.0 stdlib@go1.26.3	0.60.0 1.26.9

Open the chart page →

927

kubeclaritykubeclarity

2.23.3

3 of 5 See more

kubeclarity kubeclarity 2.23.3

3 of the 5 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/openclarity/grype-server :v0.6.0	79412399f301	golang.org/x/net@v0.14.0 stdlib@go1.20.4	0.60.0 1.26.9
ghcr.io/openclarity/kubeclarity :v2.23.3	14450f52a708	golang.org/x/net@v0.19.0 stdlib@go1.21.6	0.60.0 1.26.9
ghcr.io/openclarity/kubeclarity-sbom-db :v2.23.3	cef2b88bfc76	golang.org/x/net@v0.17.0 stdlib@go1.21.6	0.60.0 1.26.9

Open the chart page →

7,598

kubedns-shepherdkubedns-shepherd

0.4.4

1 of 1 See more

kubedns-shepherd kubedns-shepherd 0.4.4

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/eminaktas/kubedns-shepherd :v0.4.4	0a20e1b41740	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

215

airflow-operatorkubedoop

0.4.0

1 of 1 See more

airflow-operator kubedoop 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/zncdatadev/airflow-operator :0.4.0	b716ef483b75	golang.org/x/net@v0.47.0 stdlib@go1.25.8	0.60.0 1.26.9

Open the chart page →

877

commons-operatorkubedoop

0.4.0

1 of 1 See more

commons-operator kubedoop 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/zncdatadev/commons-operator :0.4.0	1a353def9fe1	golang.org/x/net@v0.49.0 stdlib@go1.25.8	0.60.0 1.26.9

Open the chart page →

829

dolphinscheduler-operatorkubedoop

0.4.0

1 of 1 See more

dolphinscheduler-operator kubedoop 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/zncdatadev/dolphinscheduler-operator :0.4.0	d0a4e55eeb7f	golang.org/x/net@v0.53.0 stdlib@go1.25.8	0.60.0 1.26.9

Open the chart page →

814

hbase-operatorkubedoop

0.4.0

1 of 1 See more

hbase-operator kubedoop 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/zncdatadev/hbase-operator :0.4.0	69e9a1b0daf8	golang.org/x/net@v0.49.0 stdlib@go1.25.8	0.60.0 1.26.9

Open the chart page →

829

hdfs-operatorkubedoop

0.4.0

1 of 1 See more

hdfs-operator kubedoop 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/zncdatadev/hdfs-operator :0.4.0	eb3c2928250e	golang.org/x/net@v0.49.0 stdlib@go1.25.8	0.60.0 1.26.9

Open the chart page →

877

hive-operatorkubedoop

0.4.0

1 of 1 See more

hive-operator kubedoop 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/zncdatadev/hive-operator :0.4.0	d66ba9149c22	golang.org/x/net@v0.53.0 stdlib@go1.25.8	0.60.0 1.26.9

Open the chart page →

814

kafka-operatorkubedoop

0.4.0

1 of 1 See more

kafka-operator kubedoop 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/zncdatadev/kafka-operator :0.4.0	0a0b4c39c1ba	golang.org/x/net@v0.49.0 stdlib@go1.25.8	0.60.0 1.26.9

Open the chart page →

863

listener-operatorkubedoop

0.4.0

6 of 6 See more

listener-operator kubedoop 0.4.0

6 of the 6 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/zncdatadev/listener-csi-driver :0.4.0	b69bed123b02	golang.org/x/net@v0.53.0 stdlib@go1.25.8	0.60.0 1.26.9
quay.io/zncdatadev/listener-operator :0.4.0	68b92dae8d75	golang.org/x/net@v0.53.0 stdlib@go1.25.8	0.60.0 1.26.9
quay.io/zncdatadev/sig-storage/csi-provisioner :v5.1.0	672e45d6a556	golang.org/x/net@v0.28.0 stdlib@go1.22.5	0.60.0 1.26.9
quay.io/zncdatadev/sig-storage/livenessprobe :v2.14.0	33692aed26aa	golang.org/x/net@v0.28.0 stdlib@go1.22.5	0.60.0 1.26.9
quay.io/zncdatadev/tools :1.0.0-kubedoop0.0.0-dev	382fca2054c9	golang.org/x/net@v0.26.0 stdlib@go1.22.6	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.12.0	0d23a6fd60c4	golang.org/x/net@v0.28.0 stdlib@go1.22.5	0.60.0 1.26.9

Open the chart page →

7,688

nifi-operatorkubedoop

0.4.0

1 of 1 See more

nifi-operator kubedoop 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/zncdatadev/nifi-operator :0.4.0	bb4e26ff5e2f	golang.org/x/net@v0.49.0 stdlib@go1.25.8	0.60.0 1.26.9

Open the chart page →

829

secret-operatorkubedoop

0.4.0

5 of 5 See more

secret-operator kubedoop 0.4.0

5 of the 5 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/zncdatadev/secret-csi-driver :0.4.0	604a7d98ab58	golang.org/x/net@v0.47.0 stdlib@go1.25.8	0.60.0 1.26.9
quay.io/zncdatadev/sig-storage/csi-provisioner :v5.1.0	672e45d6a556	golang.org/x/net@v0.28.0 stdlib@go1.22.5	0.60.0 1.26.9
quay.io/zncdatadev/sig-storage/livenessprobe :v2.14.0	33692aed26aa	golang.org/x/net@v0.28.0 stdlib@go1.22.5	0.60.0 1.26.9
quay.io/zncdatadev/tools :1.0.0-kubedoop0.0.0-dev	382fca2054c9	golang.org/x/net@v0.26.0 stdlib@go1.22.6	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.12.0	0d23a6fd60c4	golang.org/x/net@v0.28.0 stdlib@go1.22.5	0.60.0 1.26.9

Open the chart page →

7,196

spark-k8s-operatorkubedoop

0.4.0

1 of 1 See more

spark-k8s-operator kubedoop 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/zncdatadev/spark-k8s-operator :0.4.0	d3f2b10c4a6d	golang.org/x/net@v0.47.0 stdlib@go1.25.8	0.60.0 1.26.9

Open the chart page →

852

superset-operatorkubedoop

0.4.0

1 of 1 See more

superset-operator kubedoop 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/zncdatadev/superset-operator :0.4.0	102e66e32218	golang.org/x/net@v0.49.0 stdlib@go1.25.8	0.60.0 1.26.9

Open the chart page →

829

trino-operatorkubedoop

0.4.0

1 of 1 See more

trino-operator kubedoop 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/zncdatadev/trino-operator :0.4.0	4f516757aee3	golang.org/x/net@v0.54.0 stdlib@go1.25.8	0.60.0 1.26.9

Open the chart page →

810

zookeeper-operatorkubedoop

0.4.0

1 of 1 See more

zookeeper-operator kubedoop 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/zncdatadev/zookeeper-operator :0.4.0	b4f33d89ac45	golang.org/x/net@v0.49.0 stdlib@go1.25.8	0.60.0 1.26.9

Open the chart page →

829

kube-ecr-secrets-operatorkube-ecr-secrets-operator

0.4.0

1 of 2 See more

kube-ecr-secrets-operator kube-ecr-secrets-operator 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/zak905/kube-ecr-secrets-operator/controller-manager :0.2.11	d078e45bac70	golang.org/x/net@v0.49.0 stdlib@go1.26.6	0.60.0 1.26.9

Open the chart page →

366

kubefacetkubefacet

0.2.1

1 of 1 See more

kubefacet kubefacet 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/steeltanuki/kubefacet :0.2.1	994e9468b957	golang.org/x/net@v0.49.0 stdlib@go1.26.7	0.60.0 1.26.9

Open the chart page →

316

kube-fledgedkube-fledged

0.11.0

2 of 2 See more

kube-fledged kube-fledged 0.11.0

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
senthilrch/kubefledged-controller :v0.11.0	bf336912a191	golang.org/x/net@v0.55.0 stdlib@go1.26.5	0.60.0 1.26.9
senthilrch/kubefledged-webhook-server :v0.11.0	836a8bbe7cfb	golang.org/x/net@v0.55.0 stdlib@go1.26.5	0.60.0 1.26.9

Open the chart page →

1,010

istiokubeflow

1.0.0

2 of 2 See more

istio kubeflow 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
istio/pilot :1.9.6	52f25f91d702	golang.org/x/net@v0.0.0-20201224014010-6772e930b67b stdlib@go1.15.13	0.60.0 1.26.9
istio/proxyv2 :1.9.6	87a9db561d2e	golang.org/x/net@v0.0.0-20201224014010-6772e930b67b stdlib@go1.15.13	0.60.0 1.26.9

Open the chart page →

151,439

cephfs-csikubegems

1.0.8

1 of 6 See more

cephfs-csi kubegems 1.0.8

1 of the 6 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.5.1	28a674af1df2	golang.org/x/net@v0.0.0-20210825183410-e898025ed96a stdlib@go1.17.5	0.60.0 1.26.9

Open the chart page →

5,739

chartmuseumkubegems

3.8.0

1 of 1 See more

chartmuseum kubegems 3.8.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/helm/chartmuseum :v0.14.0	878ef6a31fa0	golang.org/x/net@v0.0.0-20220121210141-e204ce36a2ba stdlib@go1.17.6	0.60.0 1.26.9

Open the chart page →

4,619

gatewaykubegems

0.3.2

2 of 2 See more

gateway kubegems 0.3.2

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
kubegems/ingress-nginx-operator :v0.2.0	cc67357beeeb	golang.org/x/net@v0.0.0-20210825183410-e898025ed96a stdlib@go1.22.5	0.60.0 1.26.9
kubegems/kube-rbac-proxy :v0.8.0	941f557ed1ee	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.13.15	0.60.0 1.26.9

Open the chart page →

5,328

giteakubegems

5.0.8

1 of 2 See more

gitea kubegems 5.0.8

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
gitea/gitea :1.16.8	b0bdf102b485	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.2	0.60.0 1.26.9

Open the chart page →

4,558

juicefs-csi-driverkubegems

0.19.2

2 of 6 See more

juicefs-csi-driver kubegems 0.19.2

2 of the 6 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
juicedata/csi-dashboard :v0.23.0	3e4daf9626d5	golang.org/x/net@v0.17.0 stdlib@go1.20.11	0.60.0 1.26.9
juicedata/juicefs-csi-driver :v0.23.0	d915e899e322	golang.org/x/net@v0.9.0 stdlib@go1.19.11	0.60.0 1.26.9

Open the chart page →

6,927

juicefs-tenantkubegems

1.0.1

1 of 3 See more

juicefs-tenant kubegems 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
kubegems/redis :7.2.5-debian-12-r2	870ee3a77add	stdlib@go1.21.11	1.26.9

Open the chart page →

5,195

knative-servingkubegems

1.0.1

7 of 8 See more

knative-serving kubegems 1.0.1

7 of the 8 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourierdigest-pinned	197fbb71d1f1	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.3	0.60.0 1.26.9
gcr.io/knative-releases/knative.dev/serving/cmd/activatordigest-pinned	08315309da4b	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.3	0.60.0 1.26.9
gcr.io/knative-releases/knative.dev/serving/cmd/autoscalerdigest-pinned	105bdd14ecaa	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.3	0.60.0 1.26.9
gcr.io/knative-releases/knative.dev/serving/cmd/controllerdigest-pinned	bac158dfb0c7	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.3	0.60.0 1.26.9
gcr.io/knative-releases/knative.dev/serving/cmd/domain-mappingdigest-pinned	e384a295069b	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.3	0.60.0 1.26.9
gcr.io/knative-releases/knative.dev/serving/cmd/domain-mapping-webhookdigest-pinned	15f1ce7f35b4	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.3	0.60.0 1.26.9
gcr.io/knative-releases/knative.dev/serving/cmd/webhookdigest-pinned	1282a399cbb9	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.3	0.60.0 1.26.9

Open the chart page →

17,197

kubegems-edgekubegems

1.24.10

1 of 1 See more

kubegems-edge kubegems 1.24.10

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
kubegems/kubegems :v1.24.10	a730bcf9322a	golang.org/x/net@v0.19.0 stdlib@go1.24.10	0.60.0 1.26.9

Open the chart page →

4,088

kubegems-multus-cnikubegems

2.4.1

1 of 2 See more

kubegems-multus-cni kubegems 2.4.1

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/k8snetworkplumbingwg/multus-cni :v4.2.1	6bebbda31416	golang.org/x/net@v0.28.0 stdlib@go1.23.9	0.60.0 1.26.9

Open the chart page →

1,992

kubegems-paikubegems

1.0.18

1 of 1 See more

kubegems-pai kubegems 1.0.18

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
kubegems/mysql :8.0.33-debian-11-r0	19cb195b9a50	stdlib@go1.19.8	1.26.9

Open the chart page →

1,764

Container images carrying it

6,200 by charts deploying them

A fixed version is listed for 3 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
iomesh/deck :v0.1.0	a31e26b6ae22	golang.org/x/net@v0.17.0 stdlib@go1.21.10	0.60.0 1.26.9	1
iomesh/deck-plugin-iomesh :v0.1.0	0b13bf217110	golang.org/x/net@v0.19.0 stdlib@go1.21.10	0.60.0 1.26.9	1
iomesh/deck-plugin-iomesh :v0.2.0	df149e4ab39f	golang.org/x/net@v0.19.0 stdlib@go1.22.6	0.60.0 1.26.9	1
iomesh/node-disk-manager :1.8.0	002c4b92fd34	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.14.7	0.60.0 1.26.9	1
iomesh/node-disk-manager :1.8.0-2	292ad270082e	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.14.7	0.60.0 1.26.9	1
iomesh/node-disk-operator :1.8.0-1	de4aa40684ad	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.14.7	0.60.0 1.26.9	1
iomesh/node-disk-operator :1.8.0	f6c76380db34	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.14.7	0.60.0 1.26.9	1
iomesh/operator :v1.1.0	60081c9b2f52	golang.org/x/net@v0.17.0 stdlib@go1.21.4	0.60.0 1.26.9	1
iomesh/operator :v1.2.0	ba4dd6be7e59	golang.org/x/net@v0.17.0 stdlib@go1.21.4	0.60.0 1.26.9	1
iomesh/post-delete-hook :v1.2.0	e3b92f838f4b	golang.org/x/net@v0.17.0 stdlib@go1.21.4	0.60.0 1.26.9	1
iomesh/post-delete-hook :v1.1.0	eea5651f3270	golang.org/x/net@v0.17.0 stdlib@go1.21.4	0.60.0 1.26.9	1
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	golang.org/x/net@v0.0.0-20200202094626-16171245cfb2 stdlib@go1.14.12	0.60.0 1.26.9	1
iotaledger/goshimmer :v0.8.6	b02a8f77474f	golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2 stdlib@go1.17.2	0.60.0 1.26.9	1
iotaledger/hornet :2.0	01206f1ba89c	golang.org/x/net@v0.14.0 stdlib@go1.21.10	0.60.0 1.26.9	1
iotaledger/inx-dashboard :1.0	12c669cb8748	golang.org/x/net@v0.14.0 stdlib@go1.21.1	0.60.0 1.26.9	1
ipfs/go-ipfs :v0.13.1	17259397f587	golang.org/x/net@v0.0.0-20220517181318-183a9ca12b87 stdlib@go1.18.3	0.60.0 1.26.9	1
ipfs/go-ipfs :v0.27.0	bfce363b878b	golang.org/x/net@v0.21.0 stdlib@go1.19.8	0.60.0 1.26.9	1
ipfs/ipfs-cluster :1.0.2	1511f6d57994	golang.org/x/net@v0.0.0-20220517181318-183a9ca12b87 stdlib@go1.18.3	0.60.0 1.26.9	1
ipfs/kubo :v0.41.0	0661819c2e09	golang.org/x/net@v0.53.0 stdlib@go1.26.2	0.60.0 1.26.9	1
ipfs/kubo :v0.17.0	803fac58ba15	golang.org/x/net@v0.1.0 stdlib@go1.19.1	0.60.0 1.26.9	1
ipfs/kubo :latest	b293923d66e4	golang.org/x/net@v0.59.0 stdlib@go1.26.5	0.60.0 1.26.9	1
ipfs/kubo :v0.24.0	e3de33bd746b	golang.org/x/net@v0.17.0 stdlib@go1.19.8	0.60.0 1.26.9	1
ipushc/cassandra-web :latest	fa3e0c66c289	golang.org/x/net@v0.8.0 stdlib@go1.20.2	0.60.0 1.26.9	1
irakli/ms-web-hello :latest	966a4bfefe27	stdlib@go1.19.2	1.26.9	1
ispras/svacer :11-2-0	42aa9fa9f189	golang.org/x/net@v0.37.0 stdlib@go1.24.3	0.60.0 1.26.9	1
istio/install-cni :1.10.3	2232f365aed6	golang.org/x/net@v0.0.0-20210323141857-08027d57d8cf stdlib@go1.16.6	0.60.0 1.26.9	1
istio/install-cni :1.23.6	ab34c4740f44	golang.org/x/net@v0.37.0 stdlib@go1.23.7	0.60.0 1.26.9	1
istio/install-cni :1.29.0	ce27c9ce43c8	golang.org/x/net@v0.48.0 stdlib@go1.25.7	0.60.0 1.26.9	1
istio/operator :1.10.3	655eefa11c84	golang.org/x/net@v0.0.0-20210323141857-08027d57d8cf stdlib@go1.16.6	0.60.0 1.26.9	1
istio/operator :1.12.0	6cfce8a071b9	golang.org/x/net@v0.0.0-20211020060615-d418f374d309 stdlib@go1.17.3	0.60.0 1.26.9	1
istio/operator :1.18.2	70f9d1fe5fff	golang.org/x/net@v0.10.0 stdlib@go1.20.6	0.60.0 1.26.9	1
istio/pilot :1.29.0	325156535773	golang.org/x/net@v0.48.0 stdlib@go1.25.7	0.60.0 1.26.9	1
istio/pilot :1.9.6	52f25f91d702	golang.org/x/net@v0.0.0-20201224014010-6772e930b67b stdlib@go1.15.13	0.60.0 1.26.9	1
istio/pilot :1.23.6	9c3d6a218181	golang.org/x/net@v0.37.0 stdlib@go1.23.7	0.60.0 1.26.9	1
istio/pilot :1.16.0	ac0284d75ec9	golang.org/x/net@v0.0.0-20220921155015-db77216a4ee9 stdlib@go1.19.3	0.60.0 1.26.9	1
istio/pilot :1.17.1	ce9d87606701	golang.org/x/net@v0.5.0 stdlib@go1.20.1	0.60.0 1.26.9	1
istio/pilot :1.15.2	db08d6963975	golang.org/x/net@v0.0.0-20220624214902-1bab6f366d9e stdlib@go1.19.2	0.60.0 1.26.9	1
istio/pilot :1.10.3	e7e110a421c2	golang.org/x/net@v0.0.0-20210323141857-08027d57d8cf stdlib@go1.16.6	0.60.0 1.26.9	1
istio/pilot :1.29.1	f8b0e412ac4a	golang.org/x/net@v0.48.0 stdlib@go1.25.8	0.60.0 1.26.9	1
istio/proxyv2 :1.14.1	df69c1a7af7c	golang.org/x/net@v0.0.0-20220412020605-290c469a71a5 stdlib@go1.18.2	0.60.0 1.26.9	1
itscontained/secret-manager :0.3.0	7ec3e93c6469	golang.org/x/net@v0.0.0-20200822124328-c89045814202 stdlib@go1.15.3	0.60.0 1.26.9	1
itzg/bungeecord :latest	7b7ff61d2a60	golang.org/x/net@v0.58.0 stdlib@go1.26.6	0.60.0 1.26.9	1
itzg/mc-router :latest	64ae69eaa7a6	golang.org/x/net@v0.57.0 stdlib@go1.26.6	0.60.0 1.26.9	1
itzg/mc-router :1.16.1	bb552b59fb53	golang.org/x/net@v0.0.0-20210917221730-978cfadd31cf stdlib@go1.18.4	0.60.0 1.26.9	1
itzg/minecraft-server :2026.9.2	de5d1b1a83eb	golang.org/x/net@v0.58.0 stdlib@go1.26.6	0.60.0 1.26.9	1
itzmanish/ecr-token-renew :latest	02154d1c05b5	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e stdlib@go1.16.6	0.60.0 1.26.9	1
ixsystems/truecommand :3.2.0	19c218455cd2	golang.org/x/net@v0.42.0 stdlib@go1.25.0	0.60.0 1.26.9	1
j0113/haven-compliancy-dashboard :1.3	696cb8ca9f4e	golang.org/x/net@v0.0.0-20210510120150-4163338589ed stdlib@go1.17.2	0.60.0 1.26.9	1
jacobalberty/unifi :v7.1.66	4a3616625dda	stdlib@go1.18	1.26.9	1
jacobalberty/unifi :v7.4.162	b3edc809a3ff	stdlib@go1.20.4	1.26.9	1