CVE-2026-78660

High

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.003; 21st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,553; of 18,090 indexed, latest versions
Container images: 6,402; deployed by those charts
Fix available: 8 of 9; affected packages

HTTP/2 transport accepts malformed framing-related headers in net/http

Carried by container images the latest versions of 5,553 of 18,090 indexed charts deploy, on 6,402 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+212 more	1.26.9, 1.27.2	6,378
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more	0.60.0	5,149
golang-1.19deb	1.19.8-2	no fix listed	1
helm-4apk	4.3.0-r0	4.3.0-r2	1
ingress-nginx-controller-1.15apk	1.15.10-r3	1.15.10-r8	1
kineapk	0.17.1-r1	0.17.2-r2	1
kubernetes-1.37apk	1.37.1-r0	1.37.1-r2	1
runcapk	1.5.2-r0	1.5.2-r3	1
tetragonapk	1.7.1-r4	1.7.1-r6	1

OSV records: CGA-4487-7phw-q6ph CGA-8m3g-7799-mp4m CGA-8p8v-px44-9x8q CGA-8vqq-r2ff-395m CGA-f7qm-qm58-qq95 CGA-gwrf-q2qw-xxw8 DEBIAN-CVE-2026-78660 GO-2026-6610
Also known as: CGA-35vx-wppw-x7qp, CGA-3h29-84h2-fpvm, CGA-4c7c-vv7v-68rj, CGA-549w-3rfh-p826, CGA-5m57-vjc9-f9p9, CGA-674h-jc7r-4mj3, CGA-69vp-383p-x5ch, CGA-75m2-prw5-hwgv, CGA-77wf-8wxg-xgm9, CGA-ch87-vjh7-q5c4, CGA-f6rm-vx2j-c4p8, CGA-g5qq-3wrm-946q, CGA-hhf5-4h2f-jxg6, CGA-hmfx-cqg4-6jpq, CGA-hw83-h7jc-7pmj, CGA-pxv9-259f-f7j4, CGA-q8wf-wv9q-7fmv, CGA-qfx8-xwj3-frq2, CGA-qp96-gpwf-9v2h, CGA-qrx4-5cp4-7xhr, CGA-rpwc-c4h5-9frv, CGA-rr68-65r8-g5vv, CGA-v6p6-9m54-x5pc, CGA-x66q-68px-v2f4, CGA-x9jv-g6mg-h4jq, CGA-xjhf-9jv7-7x78
Trending: Rank 9 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,553 by stars

Chart

Latest

Affected images

Radar Score

corednssoftizy

0.2.0

1 of 1 See more

coredns softizy 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
coredns/coredns :1.10.1	a0ead06651cf	golang.org/x/net@v0.4.0 stdlib@go1.20	0.60.0 1.26.9

Open the chart page →

2,544

knative-servingsoftonic

3.0.0

5 of 5 See more

knative-serving softonic 3.0.0

5 of the 5 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
gcr.io/knative-releases/knative.dev/net-certmanager/cmd/webhookdigest-pinned	873b968f02b5	golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e stdlib@go1.14.2	0.60.0 1.26.9
gcr.io/knative-releases/knative.dev/serving/cmd/activatordigest-pinned	a5de0fb75046	golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e stdlib@go1.14.2	0.60.0 1.26.9
gcr.io/knative-releases/knative.dev/serving/cmd/autoscalerdigest-pinned	2ef460356b17	golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e stdlib@go1.14.2	0.60.0 1.26.9
gcr.io/knative-releases/knative.dev/serving/cmd/controllerdigest-pinned	30ce73388ae5	golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e stdlib@go1.14.2	0.60.0 1.26.9
gcr.io/knative-releases/knative.dev/serving/cmd/webhookdigest-pinned	f16c0e022203	golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e stdlib@go1.14.2	0.60.0 1.26.9

Open the chart page →

18,834

forecastlestakater

2.1.3

1 of 1 See more

forecastle stakater 2.1.3

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
stakater/forecastle :v2.0.2	382cd9572352	golang.org/x/net@v0.51.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

1,105

ingressmonitorcontrollerstakater

2.2.13

1 of 1 See more

ingressmonitorcontroller stakater 2.2.13

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/stakater/ingressmonitorcontroller :v2.2.13	3301afb61c10	golang.org/x/net@v0.47.0 stdlib@go1.24.13	0.60.0 1.26.9

Open the chart page →

992

tigera-operatorstevehipwell

2.15.0

1 of 1 See more

tigera-operator stevehipwell 2.15.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/tigera/operator :v1.44.0	066c2e8d6745	golang.org/x/net@v0.59.0 stdlib@go1.27.1-X:boringcrypto	0.60.0 1.27.2

Open the chart page →

205

vertical-pod-autoscalerstevehipwell-helm-charts-vertical-pod-autoscaler

1.12.1

3 of 3 See more

vertical-pod-autoscaler stevehipwell-helm-charts-vertical-pod-autoscaler 1.12.1

3 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
registry.k8s.io/autoscaling/vpa-admission-controller :1.7.1	be29624f7f12	golang.org/x/net@v0.55.0 stdlib@go1.26.5	0.60.0 1.26.9
registry.k8s.io/autoscaling/vpa-recommender :1.7.1	89cea705535f	golang.org/x/net@v0.55.0 stdlib@go1.26.5	0.60.0 1.26.9
registry.k8s.io/autoscaling/vpa-updater :1.7.1	feb42a526970	golang.org/x/net@v0.55.0 stdlib@go1.26.5	0.60.0 1.26.9

Open the chart page →

1,026

sn-platformstreamnative

1.11.46

6 of 9 See more

sn-platform streamnative 1.11.46

6 of the 9 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
jimmidyson/configmap-reload :v0.8.0	5af9d3041d12	stdlib@go1.19.2	1.26.9
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	golang.org/x/net@v0.8.0 stdlib@go1.20.4	0.60.0 1.26.9
streamnative/pulsar_vault_init :v1.0.7	31533fa9fab7	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.17.11	0.60.0 1.26.9
quay.io/prometheus/alertmanager :v0.25.0	fd4d9a3dd1fd	golang.org/x/net@v0.4.0 stdlib@go1.19.4	0.60.0 1.26.9
quay.io/prometheus/node-exporter :v1.5.0	39c642b2b337	golang.org/x/net@v0.2.0 stdlib@go1.19.3	0.60.0 1.26.9
quay.io/prometheus/prometheus :v2.43.0	f5c29683a301	golang.org/x/net@v0.8.0 stdlib@go1.19.7	0.60.0 1.26.9

Open the chart page →

78,253

stunnerstunner

1.2.1

2 of 2 See more

stunner stunner 1.2.1

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
l7mp/stunner-auth-server :1.2.1	0d2094060b72	golang.org/x/net@v0.55.0 stdlib@go1.26.4	0.60.0 1.26.9
l7mp/stunner-gateway-operator :1.2.1	0ea40a1d42d5	golang.org/x/net@v0.55.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

844

pocketbasetechwolf12

0.29.3

1 of 1 See more

pocketbase techwolf12 0.29.3

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/techwolf12/pocketbase :0.29.3	106099641679	golang.org/x/net@v0.43.0 stdlib@go1.24.6	0.60.0 1.26.9

Open the chart page →

2,021

pretixtechwolf12

2026.7.0

1 of 3 See more

pretix techwolf12 2026.7.0

1 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/postgres :18.4	a02db8cac496	stdlib@go1.24.6	1.26.9

Open the chart page →

12,492

mealieth-charts

0.5.1

1 of 1 See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/mealie-recipes/mealie :v3.7.0	bb2939094eed	stdlib@go1.24.4	1.26.9

Open the chart page →

4,761

thingsboard-clusterthingsboard-cluster-betta

0.2.26

3 of 6 See more

thingsboard-cluster thingsboard-cluster-betta 0.2.26

3 of the 6 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
bitnamilegacy/kafka :3.5.0-debian-11-r0	8657bb93a581	stdlib@go1.20.5	1.26.9
bitnamilegacy/redis :7.2.1-debian-11-r0	fa288394f402	stdlib@go1.19.12	1.26.9
bitnamilegacy/zookeeper :3.9.0-debian-11-r11	10ed1ea3c8d1	stdlib@go1.19.12	1.26.9

Open the chart page →

18,046

feedbacksystemthm-mni-ii

0.48.3

11 of 14 See more

feedbacksystem thm-mni-ii 0.48.3

11 of the 14 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
bitnamilegacy/minio :2023.12.23-debian-11-r2	5bb0aa825d16	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.60.0 1.26.9
bitnamilegacy/mongodb :6.0.10-debian-11-r8	42319decb591	golang.org/x/net@v0.14.0 stdlib@go1.19.12	0.60.0 1.26.9
bitnamilegacy/mysql :8.0.35-debian-11-r2	be03e8ea6129	stdlib@go1.21.5	1.26.9
library/docker :20.10.21-dind	3153fa63f546	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.18.7	0.60.0 1.26.9
ghcr.io/thm-mni-ii/fbs-core :v2.0.9	18e54463756e	stdlib@go1.26.7	1.26.9
ghcr.io/thm-mni-ii/fbs-core-web :v2.0.9	daeca3604040	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9
ghcr.io/thm-mni-ii/fbs-identity-service :v2.0.9	45929f5c1a12	stdlib@go1.26.7	1.26.9
ghcr.io/thm-mni-ii/fbs-qcm-frontend :v2.0.9	083d81d517e7	stdlib@go1.20.12	1.26.9
ghcr.io/thm-mni-ii/fbs-runner :v2.0.9	ffaf49a4d687	golang.org/x/net@v0.8.0 stdlib@go1.20.11	0.60.0 1.26.9
ghcr.io/thm-mni-ii/fbs-sql-playground-web :v2.0.9	806d28c6fac0	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9
ghcr.io/thm-mni-ii/fbs-web-shell :v2.0.9	939ec6417e01	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

29,700

topaztopaz

0.2.5

1 of 1 See more

topaz topaz 0.2.5

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/aserto-dev/topaz :0.32.59	4c708ecf7dc4	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.60.0 1.26.9

Open the chart page →

2,296

maeshtraefik

2.1.2

1 of 7 See more

maesh traefik 2.1.2

1 of the 7 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
containous/maesh :v1.3.2	587162516502	golang.org/x/net@v0.0.0-20200301022130-244492dfa37a stdlib@go1.14.4	0.60.0 1.26.9

Open the chart page →

6,023

traefik-meshtraefik

4.1.1

3 of 7 See more

traefik-mesh traefik 4.1.1

3 of the 7 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
jaegertracing/all-in-one :1.18	db45c07f2e1b	golang.org/x/net@v0.0.0-20200202094626-16171245cfb2 stdlib@go1.14.4	0.60.0 1.26.9
library/traefik :v2.5	7d5a6ae66572	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.17.6	0.60.0 1.26.9
traefik/mesh :v1.4.8	cf071f3e165c	golang.org/x/net@v0.0.0-20220624214902-1bab6f366d9e stdlib@go1.19	0.60.0 1.26.9

Open the chart page →

13,191

ttl-controllerttl-controller

1.9.1

1 of 1 See more

ttl-controller ttl-controller 1.9.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
registry.gitlab.com/xrow-public/ttl-controller/ttl-controller :1.9.1	8092dd72f073	golang.org/x/net@v0.57.0 stdlib@go1.27.0-X:nodwarf5	0.60.0 1.27.2

Open the chart page →

201

k8s-ttl-controllertwin

0.4.0

1 of 1 See more

k8s-ttl-controller twin 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/twin/k8s-ttl-controller :v1.4.0	0525a7def93d	golang.org/x/net@v0.26.0 stdlib@go1.24.1	0.60.0 1.26.9

Open the chart page →

990

argocdtwomartens

0.1.1

2 of 3 See more

argocd twomartens 0.1.1

2 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/dexidp/dex :v2.37.0	f579d00721b0	golang.org/x/net@v0.11.0 stdlib@go1.19.6	0.60.0 1.26.9
quay.io/argoproj/argocd :v2.8.6	acaf37352569	golang.org/x/net@v0.17.0 stdlib@go1.20.4	0.60.0 1.26.9

Open the chart page →

12,589

crossplaneupbound-stable

2.4.2-up.1

1 of 5 See more

crossplane upbound-stable 2.4.2-up.1

1 of the 5 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/postgres :14	14bfab572eec	stdlib@go1.24.6	1.26.9

Open the chart page →

1,802

uptraceuptrace

2.0.2

2 of 2 See more

uptrace uptrace 2.0.2

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
otel/opentelemetry-collector-contrib :latest	fd328de25524	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9
uptrace/uptrace :2.0.2	34a02c3b2d12	golang.org/x/net@v0.42.0 stdlib@go1.24.10	0.60.0 1.26.9

Open the chart page →

2,321

valkey-operatorvalkey

0.7.0

1 of 1 See more

valkey-operator valkey 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/valkey-io/valkey-operator :v0.7.1	bfa3be0b1173	golang.org/x/net@v0.49.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

389

vaultvault

1.22.0

4 of 4 See more

vault vault 1.22.0

4 of the 4 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
alpine/k8s :1.35.5	d870622d0040	golang.org/x/net@v0.48.0 stdlib@go1.26.0	0.60.0 1.26.9
hashicorp/vault :2.0.1	755355002715	golang.org/x/net@v0.54.0 stdlib@go1.26.3	0.60.0 1.26.9
prom/statsd-exporter :v0.29.0	632f70580492	golang.org/x/net@v0.48.0 stdlib@go1.26.0	0.60.0 1.26.9
ghcr.io/bank-vaults/bank-vaults :v1.33.1	98b6ea2ed319	golang.org/x/net@v0.55.0 stdlib@go1.26.3	0.60.0 1.26.9

Open the chart page →

6,263

victoria-logs-clustervictoriametrics

0.2.9

1 of 1 See more

victoria-logs-cluster victoriametrics 0.2.9

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
victoriametrics/victoria-logs :v1.53.0	251121fa882a	stdlib@go1.27.1	1.27.2

Open the chart page →

141

victoria-metrics-authvictoriametrics

0.43.0

1 of 1 See more

victoria-metrics-auth victoriametrics 0.43.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
victoriametrics/vmauth :v1.153.0	4ebf2f21490d	stdlib@go1.27.1	1.27.2

Open the chart page →

153

vouchvouch

3.2.0

1 of 1 See more

vouch vouch 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/vouch/vouch-proxy :0.39	d34e220de3cf	golang.org/x/net@v0.5.0 stdlib@go1.18.10	0.60.0 1.26.9

Open the chart page →

1,856

vsphere-cpivsphere-tmm

1.6.0

1 of 1 See more

vsphere-cpi vsphere-tmm 1.6.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere :v1.28.0	026f63d9ed42	golang.org/x/net@v0.13.0 stdlib@go1.20.7	0.60.0 1.26.9

Open the chart page →

2,068

gethvulcanlink

1.10.23

1 of 1 See more

geth vulcanlink 1.10.23

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ethereum/client-go :v1.10.23	cce21b423165	golang.org/x/net@v0.0.0-20220607020251-c690dde0001d stdlib@go1.18.5	0.60.0 1.26.9

Open the chart page →

3,149

api-firewallwallarm

0.9.6

1 of 1 See more

api-firewall wallarm 0.9.6

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
wallarm/api-firewall :v0.9.6	4d45db0ff240	golang.org/x/net@v0.52.0 stdlib@go1.25.8	0.60.0 1.26.9

Open the chart page →

1,505

wallarm-ingresswallarm

5.3.10-1

2 of 2 See more

wallarm-ingress wallarm 5.3.10-1

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
wallarm/ingress-controller :5.3.10.1	a1fecfdf987e	golang.org/x/net@v0.34.0 stdlib@go1.23.1	0.60.0 1.26.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.4.4	a9f03b34a3cb	golang.org/x/net@v0.28.0 stdlib@go1.22.8	0.60.0 1.26.9

Open the chart page →

2,349

wallarm-sidecarwallarm

6.13.2

2 of 3 See more

wallarm-sidecar wallarm 6.13.2

2 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
wallarm/node-helpers :6.13.2	290a87f01799	golang.org/x/net@v0.56.0 stdlib@go1.26.8	0.60.0 1.26.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.4.1	36d05b4077fb	golang.org/x/net@v0.22.0 stdlib@go1.22.2	0.60.0 1.26.9

Open the chart page →

1,812

wasmcloud-chartwasmcloud-chart

0.7.2

1 of 2 See more

wasmcloud-chart wasmcloud-chart 0.7.2

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/nats :2.10.7-alpine	1bcddab51b80	stdlib@go1.21.5	1.26.9

Open the chart page →

4,211

prometheuswener

29.36.1

6 of 6 See more

prometheus wener 29.36.1

6 of the 6 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/prometheus-operator/prometheus-config-reloader :v0.94.1	06b52bd4dbe3	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9
quay.io/prometheus/alertmanager :v0.34.1	e9733bafb1bd	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9
quay.io/prometheus/node-exporter :v1.12.1	1b4e4438faca	golang.org/x/net@v0.57.0 stdlib@go1.26.5	0.60.0 1.26.9
quay.io/prometheus/prometheus :v3.15.0	efd719c99d83	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2
quay.io/prometheus/pushgateway :v1.11.4	91a56b89b97d	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.20.0	42cfe3723a5f	golang.org/x/net@v0.57.0 stdlib@go1.26.6	0.60.0 1.26.9

Open the chart page →

1,606

argo-cdwenerme

10.10.2

2 of 3 See more

argo-cd wenerme 10.10.2

2 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/dexidp/dex :v2.46.0	933fcd3f5233	golang.org/x/net@v0.56.0 stdlib@go1.27.1	0.60.0 1.27.2
quay.io/argoproj/argocd :v3.5.4	49dff79439bb	golang.org/x/net@v0.38.0 stdlib@go1.25.3	0.60.0 1.26.9

Open the chart page →

2,659

minio-operatorwenerme

4.3.7

1 of 2 See more

minio-operator wenerme 4.3.7

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
minio/operator :v4.3.7	54393e03f3b2	golang.org/x/net@v0.0.0-20210421230115-4e50805a0758 stdlib@go1.17.4	0.60.0 1.26.9

Open the chart page →

7,306

wgerwger

2.0.0

1 of 7 See more

9,263

wharf-helmwharf-helm

3.2.6

4 of 5 See more

wharf-helm wharf-helm 3.2.6

4 of the 5 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/iver-wharf/wharf-api :v5.2.0	b736b345437d	golang.org/x/net@v0.0.0-20220325170049-de3da57026de stdlib@go1.18.1	0.60.0 1.26.9
quay.io/iver-wharf/wharf-provider-azuredevops :v3.0.1	2fe7e4dcffdf	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4 stdlib@go1.18.2	0.60.0 1.26.9
quay.io/iver-wharf/wharf-provider-github :v3.0.1	77a22cb45c2a	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4 stdlib@go1.18.2	0.60.0 1.26.9
quay.io/iver-wharf/wharf-provider-gitlab :v2.0.1	d7079e0890da	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4 stdlib@go1.18.2	0.60.0 1.26.9

Open the chart page →

14,079

windmillwindmill

4.0.280

1 of 3 See more

windmill windmill 4.0.280

1 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/postgres :18	74935e722416	stdlib@go1.24.6	1.26.9

Open the chart page →

1,802

buildkitdwiremind

0.33.1

1 of 1 See more

buildkitd wiremind 0.33.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
moby/buildkit :v0.32.2-rootless	504731e577c2	golang.org/x/net@v0.43.0 stdlib@go1.25.7	0.60.0 1.26.9

Open the chart page →

1,663

keycloak-operatorwiremind

0.0.14

1 of 1 See more

keycloak-operator wiremind 0.0.14

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak-operator :18.0.0-legacy	36ce77526145	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.13.8	0.60.0 1.26.9

Open the chart page →

6,030

yataiyatai

0.4.6

1 of 2 See more

yatai yatai 0.4.6

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/bentoml/yatai :0.4.6	14b482c1f1b8	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4 stdlib@go1.18.4	0.60.0 1.26.9

Open the chart page →

5,851

yet-another-cloudwatch-exporteryet-another-cloudwatch-exporter

0.38.0

1 of 1 See more

yet-another-cloudwatch-exporter yet-another-cloudwatch-exporter 0.38.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/nerdswords/yet-another-cloudwatch-exporter :v0.61.2	f04925fe1fa6	stdlib@go1.22.4	1.26.9

Open the chart page →

1,357

nocodbzekker6

1.10.0

1 of 1 See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
nocodb/nocodb :0.301.5	d9516f0bf546	stdlib@go1.23.12	1.26.9

Open the chart page →

5,377

paperlesszekker6

11.11.0

1 of 1 See more

paperless zekker6 11.11.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :3.3.0	6b94799bc769	stdlib@go1.24.4	1.26.9

Open the chart page →

5,102

adcs-issueradcs-issuer

3.0.2

1 of 1 See more

adcs-issuer adcs-issuer 3.0.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
djkormo/adcs-issuer :2.1.2	9f34e87e7586	golang.org/x/net@v0.26.0 stdlib@go1.22.6	0.60.0 1.26.9

Open the chart page →

1,385

kubernetes-etcd-backupadfinis

1.6.2

1 of 1 See more

kubernetes-etcd-backup adfinis 1.6.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/adfinis/kubernetes-etcd-backup :v1.4.6	8ec6c4812a7e	golang.org/x/net@v0.38.0 stdlib@go1.23.7	0.60.0 1.26.9

Open the chart page →

2,509

no-latest-tag-webhookadmission-webhook-no-latest

1.0.14

1 of 1 See more

no-latest-tag-webhook admission-webhook-no-latest 1.0.14

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/omkar-shelke25/admission-webhook-no-latest :sha-3316545	5976a1d3236a	golang.org/x/net@v0.38.0 stdlib@go1.26.3	0.60.0 1.26.9

Open the chart page →

484

paperless-ngxadnoctem

0.5.0

3 of 5 See more

paperless-ngx adnoctem 0.5.0

3 of the 5 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
bitnami/redis :latest	f4797b37502e	stdlib@go1.26.8	1.26.9
gotenberg/gotenberg :8.36.0	87c16b9f3642	golang.org/x/net@v0.58.0 stdlib@go1.26.5	0.60.0 1.26.9
ghcr.io/paperless-ngx/paperless-ngx :3.3.0	6b94799bc769	stdlib@go1.24.4	1.26.9

Open the chart page →

26,559

agentareaagentarea

0.0.26

8 of 17 See more

agentarea agentarea 0.0.26

8 of the 17 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
agentarea/agentarea-events :latest	71a89daaa2c6	stdlib@go1.25.14	1.26.9
agentarea/agentarea-mcp-manager :latest	0e7e53fef298	golang.org/x/net@v0.58.0 stdlib@go1.25.14	0.60.0 1.26.9
agentarea/agentarea-mcp-runner :latest	9030cc19a0fc	stdlib@go1.19.8	1.26.9
library/postgres :16-alpine	721873c34ceb	stdlib@go1.24.6	1.26.9
library/postgres :alpine	77f585114c32	stdlib@go1.24.6	1.26.9
openfga/openfga :v1.18.0	36097b960f66	golang.org/x/net@v0.55.0 stdlib@go1.26.4	0.60.0 1.26.9
oryd/kratos :v1.3.1	fe2428f103a6	golang.org/x/net@v0.27.0 stdlib@go1.23.2	0.60.0 1.26.9
temporalio/auto-setup :1.29.1	5b3502a3b685	golang.org/x/net@v0.35.0 stdlib@go1.25.0	0.60.0 1.26.9

Open the chart page →

18,220

traefikaigisuk

0.1.1

1 of 1 See more

traefik aigisuk 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/traefik :2.7.0-rc2	b70710baceeb	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.17.8	0.60.0 1.26.9

Open the chart page →

3,946

Container images carrying it

6,402 by charts deploying them

A fixed version is listed for 8 of the 9 affected packages.

Container image	Digest	Package	Fixed in	Used by
mbround18/valheim :3.1.0	70bd4da591cd	stdlib@go1.18.1	1.26.9	1
mccutchen/go-httpbin :latest	20739736d4eb	stdlib@go1.26.5	1.26.9	1
mccutchen/go-httpbin :v2.15.0	24528cf5229d	stdlib@go1.23.1	1.26.9	1
mccutchen/go-httpbin :v2.2.2	5994403ef75b	stdlib@go1.16.2	1.26.9	1
mcp/kubernetes :latest	5ffbf7f0a8aa	golang.org/x/net@v0.38.0 stdlib@go1.26.3	0.60.0 1.26.9	1
mdenda/mycel :3.10.0	9e559aa83030	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9	1
megaease/easegress :latest	fad1c7452958	golang.org/x/net@v0.48.0 stdlib@go1.26.1	0.60.0 1.26.9	1
meshery/meshery-operator :1.0.5	0d245bc8b5c6	golang.org/x/net@v0.57.0 stdlib@go1.26.4	0.60.0 1.26.9	1
mesosphere/dex :v2.37.0-d2iq.1	b093d78a21ed	golang.org/x/net@v0.11.0 stdlib@go1.20.4	0.60.0 1.26.9	1
mesosphere/dex-controller :v0.16.1	1b2dd9c0b0fc	golang.org/x/net@v0.25.0 stdlib@go1.22.7	0.60.0 1.26.9	1
mesosphere/dex-k8s-authenticator :v1.4.1-d2iq	f3d9982cc2fd	golang.org/x/net@v0.13.0 stdlib@go1.23.0	0.60.0 1.26.9	1
mesosphere/karma :v0.55-d2iq-proxy	4693bb4e0814	golang.org/x/net@v0.0.0-20190923162816-aa69164e4478 stdlib@go1.13.7	0.60.0 1.26.9	1
mesosphere/kommander-federation-authorizedlister :v0.21.2	63bc411b930b	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777 stdlib@go1.14.5	0.60.0 1.26.9	1
mesosphere/kommander-federation-controller-manager :v0.21.2	b036785a8862	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777 stdlib@go1.14.5	0.60.0 1.26.9	1
mesosphere/kommander-federation-utility-apiserver :v0.21.2	f9b769c65e24	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777 stdlib@go1.14.5	0.60.0 1.26.9	1
mesosphere/kommander-federation-webhook :v0.21.2	94af41b6dd9a	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777 stdlib@go1.14.5	0.60.0 1.26.9	1
mesosphere/kommander-licensing-controller-manager :v0.21.2	8e18bbe407f7	golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb stdlib@go1.14.5	0.60.0 1.26.9	1
mesosphere/kommander-licensing-webhook :v0.21.2	265edcd2a1ca	golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb stdlib@go1.14.5	0.60.0 1.26.9	1
mesosphere/kubeaddons-addon-initializer :v0.5.1	5efa21defcbc	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.15.11	0.60.0 1.26.9	1
mesosphere/kubeaddons-addon-initializer :v0.2.0	9f863160127b	golang.org/x/net@v0.0.0-20190613194153-d28f0bde5980 stdlib@go1.13.7	0.60.0 1.26.9	1
mesosphere/kubeaddons-addon-initializer :v0.2.8	c10011f866f2	golang.org/x/net@v0.0.0-20191209160850-c0dbc17a3553 stdlib@go1.13.8	0.60.0 1.26.9	1
mesosphere/kubefed :proxyurl	4fd8889195fe	golang.org/x/net@v0.0.0-20201006153459-a7d1128ccaa0 stdlib@go1.15.3	0.60.0 1.26.9	1
mesosphere/traefik-forward-auth :3.1.0	5456581d7b76	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.14.15	0.60.0 1.26.9	1
metacontrollerio/metacontroller :v2.1.1	0336993b88e4	golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023 stdlib@go1.17.6	0.60.0 1.26.9	1
metacontrollerio/metacontroller :v2.0.4	897c9601d2cc	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.16.7	0.60.0 1.26.9	1
metacubex/mihomo :v1.19.29	e1d7dadaa936	golang.org/x/net@v0.35.0 stdlib@go1.26.5	0.60.0 1.26.9	1
metalmatze/alertmanager-bot :0.4.3	426bc2ca7586	golang.org/x/net@v0.0.0-20181213202711-891ebc4b82d6 stdlib@go1.13.15	0.60.0 1.26.9	1
metalmatze/transmission-exporter :0.3.0	90d6acb6d47d	stdlib@go1.13	1.26.9	1
meyay/languagetool :6.8	a682153ae53b	stdlib@go1.27.1	1.27.2	1
microslac/kafka-connect :latest	a90091a1f524	golang.org/x/net@v0.10.0 stdlib@go1.20.4	0.60.0 1.26.9	1
middlewareeng/middleware :0.3.1	747d880812f1	stdlib@go1.17.13	1.26.9	1
mikefarah/yq :4.45.1	2c100efaca06	golang.org/x/net@v0.33.0 stdlib@go1.23.4	0.60.0 1.26.9	1
mikejoh/argocd-extra-app-info-exporter :0.2.0	5c5a3b734271	golang.org/x/net@v0.30.0 stdlib@go1.23.4	0.60.0 1.26.9	1
mikejoh/imagine :0.1.0	78737d7345f9	golang.org/x/net@v0.26.0 stdlib@go1.23.3	0.60.0 1.26.9	1
milvusdb/etcd :3.5.5-r2	102aac62827b	golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2 stdlib@go1.18.2	0.60.0 1.26.9	1
milvusdb/etcd :3.5.25-r1	fededb2f2d63	golang.org/x/net@v0.38.0 stdlib@go1.24.10	0.60.0 1.26.9	1
milvusdb/milvus :v2.2.13	a3a55e1c1497	golang.org/x/net@v0.10.0 stdlib@go1.18.3	0.60.0 1.26.9	1
milvusdb/milvus-config-tool :v0.1.1	2212dfb61401	golang.org/x/net@v0.0.0-20220706163947-c90051bbdb60 stdlib@go1.16.15	0.60.0 1.26.9	1
milvusdb/milvus-operator :v1.3.11	9459806dd11f	golang.org/x/net@v0.58.0 stdlib@go1.26.7	0.60.0 1.26.9	1
mindsdb/mindsdb :latest	163011c09299	stdlib@go1.20.13	1.26.9	1
miniflux/miniflux :2.3.3	49d7b6098761	golang.org/x/net@v0.57.0 stdlib@go1.26.5	0.60.0 1.26.9	1
miniflux/miniflux :2.2.18	a3ca6bbc1f74	golang.org/x/net@v0.52.0 stdlib@go1.26.1	0.60.0 1.26.9	1
miniflux/miniflux :2.0.36	e2fb990dae74	golang.org/x/net@v0.0.0-20210916014120-12bc252f5db8 stdlib@go1.17.8	0.60.0 1.26.9	1
minio/operator :v5.0.9	170b154d2c61	golang.org/x/net@v0.13.0 stdlib@go1.21.1	0.60.0 1.26.9	1
minio/operator :v4.1.0	2adc5be088f5	golang.org/x/net@v0.0.0-20210421230115-4e50805a0758 stdlib@go1.16.3	0.60.0 1.26.9	1
mintel/gcp-quota-exporter :v0.3.2	0e0707b7732b	golang.org/x/net@v0.0.0-20190311183353-d8887717615a stdlib@go1.13.12	0.60.0 1.26.9	1
mirrorgitlabcontainers/gitaly :v13.2.2	83599461ef8b	golang.org/x/net@v0.0.0-20200114155413-6afb5195e5aa stdlib@go1.13.9	0.60.0 1.26.9	1
mirrorgitlabcontainers/gitlab-container-registry :v2.9.1-gitlab	06b19a4bc805	golang.org/x/net@v0.0.0-20191014212845-da9a3fd4c582 stdlib@go1.13.9	0.60.0 1.26.9	1
mirrorgitlabcontainers/gitlab-shell :v13.3.0	9f3654f1eafc	golang.org/x/net@v0.0.0-20200114155413-6afb5195e5aa stdlib@go1.13.9	0.60.0 1.26.9	1
mirrorgitlabcontainers/gitlab-workhorse-ce :v13.2.2	a6d7bf42805a	golang.org/x/net@v0.0.0-20200226121028-0de0cce0169b stdlib@go1.13.9	0.60.0 1.26.9	1