CVE-2026-78660

High

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.003; 21st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,373; of 18,117 indexed, latest versions
Container images: 6,208; deployed by those charts
Fix available: 3 of 5; affected packages

HTTP/2 transport accepts malformed framing-related headers in net/http

Carried by container images the latest versions of 5,373 of 18,117 indexed charts deploy, on 6,208 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+212 more	1.26.9, 1.27.2	6,150
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more	0.60.0	4,957
golang-1.19deb	1.19.8-2	no fix listed	1
ingress-nginx-controller-1.15apk	1.15.10-r9	no fix listed	1
minioapk	0.20251015.172955-r10	0.20260922.192518-r2	1

OSV records: CGA-549w-3rfh-p826 CGA-p3fp-cff9-hfhm DEBIAN-CVE-2026-78660 GO-2026-6610
Also known as: CGA-w457-vj2x-m6xf, CGA-xjhf-9jv7-7x78
Trending: Rank 9 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,373 by stars

Chart

Latest

Affected images

Radar Score

sikalabs-harbor-master-snapshotsikalabs

2023.6.20

5 of 8 See more

sikalabs-harbor-master-snapshot sikalabs 2023.6.20

5 of the 8 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
goharbor/harbor-core :dev	f4707b275f04	golang.org/x/net@v0.58.0	0.60.0
goharbor/harbor-jobservice :dev	97f7d9464924	golang.org/x/net@v0.58.0	0.60.0
goharbor/harbor-registryctl :dev	ca0765d1c0eb	golang.org/x/net@v0.58.0	0.60.0
goharbor/registry-photon :dev	2d344e1d870d	golang.org/x/net@v0.58.0	0.60.0
goharbor/trivy-adapter-photon :dev	72aa75db0f6c	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

1,129

vault-devsikalabs

0.2.0

1 of 1 See more

vault-dev sikalabs 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
hashicorp/vault :latest	c2f666266f38	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

295

sillytavernsillytavern

0.1.19

1 of 1 See more

sillytavern sillytavern 0.1.19

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/sillytavern/sillytavern :1.19.0	eef27ff0c796	golang.org/x/net@v0.55.0 stdlib@go1.25.10	0.60.0 1.26.9

Open the chart page →

2,193

bytesafe-cesimcube

1.0.4

1 of 3 See more

bytesafe-ce simcube 1.0.4

1 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
bytesafe/bytesafe-ce :v1.0.4	ee287384c005	golang.org/x/net@v0.10.0 stdlib@go1.20.5	0.60.0 1.26.9

Open the chart page →

2,238

headscalesinextra

0.1.1

1 of 1 See more

headscale sinextra 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/juanfont/headscale :v0.29.4	8833f828b414	golang.org/x/net@v0.56.0 stdlib@go1.26.5	0.60.0 1.26.9

Open the chart page →

814

infisicalsinextra

0.6.1

1 of 1 See more

infisical sinextra 0.6.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
infisical/infisical :v0.165.16	6b911e3938ac	golang.org/x/net@v0.56.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

3,747

keydbsinextra

0.31.2

1 of 1 See more

keydb sinextra 0.31.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/sergelogvinov/keydb :6.3.3	76a19ddc3626	golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4 stdlib@go1.18.10	0.60.0 1.26.9

Open the chart page →

3,201

mongosqldsinextra

0.3.7

1 of 1 See more

mongosqld sinextra 0.3.7

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/sergelogvinov/mongosqld :2.14.23	0b826375ed42	stdlib@go1.23.8	1.26.9

Open the chart page →

3,279

mongosyncsinextra

0.4.0

1 of 1 See more

mongosync sinextra 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/sergelogvinov/mongosync :1.15.0	fa99ed475f03	golang.org/x/net@v0.41.0 stdlib@go1.24.4	0.60.0 1.26.9

Open the chart page →

3,612

pgbouncersinextra

0.17.0

1 of 1 See more

pgbouncer sinextra 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/sergelogvinov/pgbouncer :16.15	18f1121ba0a4	stdlib@go1.24.6	1.26.9

Open the chart page →

2,617

system-upgrade-controllersinextra

0.6.1

1 of 1 See more

system-upgrade-controller sinextra 0.6.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
rancher/system-upgrade-controller :v0.19.2	34fa058fe453	golang.org/x/net@v0.48.0 stdlib@go1.25.8	0.60.0 1.26.9

Open the chart page →

645

tailscalesinextra

0.18.1

2 of 2 See more

tailscale sinextra 0.18.1

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/sergelogvinov/tailscale :1.102.3	d91287e83d1a	golang.org/x/net@v0.56.0 stdlib@go1.26.6	0.60.0 1.26.9
registry.k8s.io/coredns/coredns :v1.13.2	94caebb89dcf	golang.org/x/net@v0.47.0 stdlib@go1.25.5	0.60.0 1.26.9

Open the chart page →

1,843

talos-backupsinextra

0.1.2

1 of 1 See more

talos-backup sinextra 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/siderolabs/talos-backup :v0.1.0-beta.2	03a71e140f1d	golang.org/x/net@v0.26.0 stdlib@go1.23.0	0.60.0 1.26.9

Open the chart page →

1,470

teamcitysinextra

1.0.2

1 of 3 See more

teamcity sinextra 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/docker :26.1-dind	dd43b430341a	golang.org/x/net@v0.25.0 stdlib@go1.21.11	0.60.0 1.26.9

Open the chart page →

3,115

mariadbsitepilot

1.0.3

1 of 1 See more

mariadb sitepilot 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/mariadb :10.6	23616f0bd3af	stdlib@go1.24.6	1.26.9

Open the chart page →

3,361

sk8lsk8l

0.23.0

1 of 1 See more

sk8l sk8l 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
danroux/sk8l-api :v0.19.0	dee851fc72cc	golang.org/x/net@v0.57.0 stdlib@go1.26.4-X:loopvar	0.60.0 1.26.9

Open the chart page →

546

skupperskupper

2.2.3

1 of 1 See more

skupper skupper 2.2.3

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/skupper/controller :2.2.3	735568990038	golang.org/x/net@v0.55.0 stdlib@go1.25.14	0.60.0 1.26.9

Open the chart page →

235

network-observerskupper-network-observer

2.2.3

2 of 3 See more

network-observer skupper-network-observer 2.2.3

2 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/prometheus/prometheus :v3.11.3	c0b857aead0d	golang.org/x/net@v0.52.0 stdlib@go1.26.2	0.60.0 1.26.9
quay.io/skupper/network-observer :2.2.3	3c20bd40b918	golang.org/x/net@v0.55.0 stdlib@go1.25.14	0.60.0 1.26.9

Open the chart page →

1,217

skyhook-agentskyhook

1.3.15

1 of 1 See more

skyhook-agent skyhook 1.3.15

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/skyhook-io/skyhook-connector :v2.3.2	3deb8e4b1aaa	golang.org/x/net@v0.44.0 stdlib@go1.26.0	0.60.0 1.26.9

Open the chart page →

721

skyhook-connectorskyhook

1.3.25

1 of 1 See more

skyhook-connector skyhook 1.3.25

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/skyhook-io/skyhook-connector :v2.5.5	6c4e3336600d	golang.org/x/net@v0.52.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

441

mimirskyloud-helm-charts

5.5.1

2 of 5 See more

mimir skyloud-helm-charts 5.5.1

2 of the 5 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
grafana/mimir :r292-5f01872	7476e456c738	golang.org/x/net@v0.24.0 stdlib@go1.22.3	0.60.0 1.26.9
grafana/rollout-operator :v0.14.0	3409edfb45c7	golang.org/x/net@v0.21.0 stdlib@go1.22.1	0.60.0 1.26.9

Open the chart page →

4,294

tailscale-operatorskyloud-helm-charts

1.70.3

1 of 1 See more

tailscale-operator skyloud-helm-charts 1.70.3

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
tailscale/k8s-operator :v1.70.0	8edd06cf5bac	golang.org/x/net@v0.26.0 stdlib@go1.22.5	0.60.0 1.26.9

Open the chart page →

1,617

skypilot-prometheus-serverskypilot

0.11.1

3 of 3 See more

skypilot-prometheus-server skypilot 0.11.1

3 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/prometheus-operator/prometheus-config-reloader :v0.83.0	78aec597d87a	golang.org/x/net@v0.40.0 stdlib@go1.24.3	0.60.0 1.26.9
quay.io/prometheus/prometheus :v3.4.1	9abc6cf6aea7	golang.org/x/net@v0.39.0 stdlib@go1.24.3	0.60.0 1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.15.0	db384bf43222	golang.org/x/net@v0.33.0 stdlib@go1.23.5	0.60.0 1.26.9

Open the chart page →

3,926

pritunl-zerosky-sail

0.3.3

1 of 1 See more

pritunl-zero sky-sail 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
pritunl/pritunl-zero :1.0.3648.46	0f2943e0d41b	golang.org/x/net@v0.42.0 stdlib@go1.25.4	0.60.0 1.26.9

Open the chart page →

1,116

yopasssky-sail

1.3.1

1 of 2 See more

yopass sky-sail 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
jhaals/yopass :12.5.0	916a1cf45d36	stdlib@go1.25.5	1.26.9

Open the chart page →

3,751

config-connector-templaterslamdev

0.0.5

1 of 1 See more

config-connector-templater slamdev 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
slamdev/config-connector-templater :0.0.3	a234541c9fa8	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.16.5	0.60.0 1.26.9

Open the chart page →

3,277

flux-notifierslamdev

0.0.7

1 of 1 See more

flux-notifier slamdev 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
slamdev/flux-notifier :v0.0.8	b173d809132d	stdlib@go1.13.11	1.26.9

Open the chart page →

3,090

gitlab-runnerslamdev

0.0.1

1 of 1 See more

gitlab-runner slamdev 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
gitlab/gitlab-runner :v15.3.0	860d4a3fec7a	golang.org/x/net@v0.0.0-20220607020251-c690dde0001d stdlib@go1.17.9	0.60.0 1.26.9

Open the chart page →

10,793

gke-preemptible-notifierslamdev

0.0.6

1 of 1 See more

gke-preemptible-notifier slamdev 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
slamdev/gke-preemptible-notifier :v0.0.3	d5d6430108a3	golang.org/x/net@v0.0.0-20200501053045-e0ff5e5a1de5 stdlib@go1.13.11	0.60.0 1.26.9

Open the chart page →

4,120

octavia-ingress-controllerslamdev

0.0.7

1 of 1 See more

octavia-ingress-controller slamdev 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
k8scloudprovider/octavia-ingress-controller :v1.20.2	6ddf80b34265	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.15	0.60.0 1.26.9

Open the chart page →

4,027

weblateslamdev

0.0.11

1 of 2 See more

weblate slamdev 0.0.11

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
weblate/weblate :3.11.3-1	82848df56ecd	golang.org/x/net@v0.0.0-20190620200207-3b0461eec859 stdlib@go1.13.5	0.60.0 1.26.9

Open the chart page →

11,817

crashloop-operatorslauger-crashloop-operator

0.1.0

1 of 1 See more

crashloop-operator slauger-crashloop-operator 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/slauger/crashloop-operator :0.1.0	76e0216124b7	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

223

slothsloth

0.16.0

2 of 2 See more

sloth sloth 0.16.0

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/slok/sloth :v0.16.0	f0f0075b0d45	golang.org/x/net@v0.52.0 stdlib@go1.26.1	0.60.0 1.26.9
registry.k8s.io/git-sync/git-sync :v4.5.0	0e64aedb0d0a	stdlib@go1.25.1	1.26.9

Open the chart page →

5,168

slurm-bridgeslurm-bridge

1.2.3

3 of 3 See more

slurm-bridge slurm-bridge 1.2.3

3 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/slinkyproject/slurm-bridge-admission :1.2.3	042e3827a68f	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9
ghcr.io/slinkyproject/slurm-bridge-controllers :1.2.3	e2e3e2c82d2c	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9
ghcr.io/slinkyproject/slurm-bridge-scheduler :1.2.3	53db9c40f2b9	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

672

oi-slurm-cluster-chartslurm-cluster-chart

0.25.1

2 of 4 See more

oi-slurm-cluster-chart slurm-cluster-chart 0.25.1

2 of the 4 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
bitnami/kubectl :latest	f7f9e4f64d9e	golang.org/x/net@v0.57.0 stdlib@go1.26.8	0.60.0 1.26.9
library/mariadb :10.10	334b315c10e5	stdlib@go1.18.2	1.26.9

Open the chart page →

5,749

slurm-cluster-chartslurm-cluster-chart

0.25.0

2 of 4 See more

slurm-cluster-chart slurm-cluster-chart 0.25.0

2 of the 4 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
bitnami/kubectl :latest	999d5eb28f40	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9
library/mariadb :10.10	334b315c10e5	stdlib@go1.18.2	1.26.9

Open the chart page →

5,749

slurm-operatorslurm-operator

1.2.3

2 of 2 See more

slurm-operator slurm-operator 1.2.3

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/slinkyproject/slurm-operator :1.2.3	b35e76c09e58	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9
ghcr.io/slinkyproject/slurm-operator-webhook :1.2.3	68a4460abaa1	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

453

deconzsmall-hack

0.1.0

1 of 1 See more

deconz small-hack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
deconzcommunity/deconz :2.26.1	23c86008d73f	stdlib@go1.19.8	1.26.9

Open the chart page →

14,591

home-assistantsmall-hack

2.1.0

1 of 1 See more

home-assistant small-hack 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2026.3.1	0e091dfce306	golang.org/x/net@v0.49.0 stdlib@go1.23.3	0.60.0 1.26.9

Open the chart page →

5,050

smarter-k3s-edgesmarter

0.0.12

1 of 2 See more

smarter-k3s-edge smarter 0.0.12

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
rancher/k3s :v1.25.3-k3s1	eaa270df79cc	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.19.2	0.60.0 1.26.9

Open the chart page →

4,368

smarter-device-managersmarter-device-manager

0.0.10

1 of 1 See more

smarter-device-manager smarter-device-manager 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/smarter-project/smarter-device-manager :v1.20.12	228f7f44594a	golang.org/x/net@v0.2.0 stdlib@go1.19.3	0.60.0 1.26.9

Open the chart page →

1,986

mealiesmarthall

0.0.10

1 of 1 See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/mealie-recipes/mealie :v1.4.0	b56da41cf178	stdlib@go1.19.8	1.26.9

Open the chart page →

6,696

smtp-gotifysmtp-gotify

0.1.4

1 of 1 See more

smtp-gotify smtp-gotify 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/reiml/smtp-gotify :latest	80ffa9d2044a	golang.org/x/net@v0.28.0 stdlib@go1.23.9	0.60.0 1.26.9

Open the chart page →

1,071

snaprsnapr

0.1.0

1 of 2 See more

snapr snapr 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
snapr/app :v0.1.0	e9eb8287bfe1	golang.org/x/net@v0.30.0 stdlib@go1.23.12	0.60.0 1.26.9

Open the chart page →

2,570

sneakerssneakers

1.0.0

1 of 4 See more

sneakers sneakers 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
helga09/my_sql_shoes :v1.1.1	a03657d97897	stdlib@go1.18.2	1.26.9

Open the chart page →

10,016

echobotsngular

0.3.5

1 of 1 See more

echobot sngular 0.3.5

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/sngular/gitops-echobot :v0.2.2	3cde2e04b739	stdlib@go1.16.5	1.26.9

Open the chart page →

3,493

webhooksngular

0.1.1

1 of 1 See more

webhook sngular 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/sngular/gitops-webhook :v0.2.1	caa1c77a5750	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.16.2	0.60.0 1.26.9

Open the chart page →

3,671

avalanchesnowplow-devops

0.12.1

1 of 6 See more

avalanche snowplow-devops 0.12.1

1 of the 6 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/nats :2.10-alpine	b83efabe3e7d	stdlib@go1.24.2	1.26.9

Open the chart page →

1,780

vertical-pod-autoscalersnowplow-devops

0.1.1

3 of 3 See more

vertical-pod-autoscaler snowplow-devops 0.1.1

3 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
registry.k8s.io/autoscaling/vpa-admission-controller :1.4.1	71d817780aa9	golang.org/x/net@v0.39.0 stdlib@go1.24.3	0.60.0 1.26.9
registry.k8s.io/autoscaling/vpa-recommender :1.4.1	40b6d76e8526	golang.org/x/net@v0.39.0 stdlib@go1.24.3	0.60.0 1.26.9
registry.k8s.io/autoscaling/vpa-updater :1.4.1	8ebf269779c1	golang.org/x/net@v0.39.0 stdlib@go1.24.3	0.60.0 1.26.9

Open the chart page →

2,766

snspingsnsping

1.2.9

1 of 1 See more

snsping snsping 1.2.9

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
udhos/snsping :1.2.9	6ae70677b6a3	golang.org/x/net@v0.33.0 stdlib@go1.23.4	0.60.0 1.26.9

Open the chart page →

1,893

Container images carrying it

6,208 by charts deploying them

A fixed version is listed for 3 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
veecode/devportal	e5c84f744994	golang.org/x/net@v0.48.0 stdlib@go1.26.7	0.60.0 1.26.9	1
veecode/devportal-admin-ui :0.4.30	c69fd286b489	golang.org/x/net@v0.23.0 stdlib@go1.22.3	0.60.0 1.26.9	1
velero/velero :v1.9.0	277fbfaf8dcf	golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023 stdlib@go1.18	0.60.0 1.26.9	1
velero/velero :v1.8.1	8d784580931c	golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023 stdlib@go1.16.6	0.60.0 1.26.9	1
velero/velero :v1.18.4	c89fb5b6d1fd	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	1
velero/velero :v1.18.0	e4d1e79be2ee	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.60.0 1.26.9	1
velero/velero-plugin-for-aws :v1.5.0	3d2ea7aab32d	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e stdlib@go1.17.11	0.60.0 1.26.9	1
velero/velero-plugin-for-aws :v1.14.0	7e82f717f44e	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.60.0 1.26.9	1
venturenox/redis :latest	83b471c193ba	stdlib@go1.22.9	1.26.9	1
venturenox/sagawise :latest	c11d32f18718	stdlib@go1.22.2	1.26.9	1
versity/versitygw :v1.8.0	30292fc2eeac	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2	1
versity/versitygw :v1.0.14	5192635d0353	golang.org/x/net@v0.40.0 stdlib@go1.24.3	0.60.0 1.26.9	1
versity/versitygw :v1.1.0	f730e0dbc1ef	golang.org/x/net@v0.49.0 stdlib@go1.25.5	0.60.0 1.26.9	1
vespaengine/vespa :8.526.15	69b160f58211	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.60.0 1.26.9	1
victoriametrics/operator :v0.65.0	716b89a3ed79	golang.org/x/net@v0.46.0 stdlib@go1.25.3	0.60.0 1.26.9	1
victoriametrics/operator :v0.47.2	71be93cfafb6	golang.org/x/net@v0.26.0 stdlib@go1.23.0	0.60.0 1.26.9	1
victoriametrics/operator :v0.68.3	f52e1bd679cb	golang.org/x/net@v0.49.0 stdlib@go1.25.8	0.60.0 1.26.9	1
victoriametrics/victoria-logs :v1.15.0-victorialogs	d7435244eb19	stdlib@go1.24.0	1.26.9	1
victoriametrics/victoria-metrics :v1.93.5	77a9815d0640	golang.org/x/net@v0.15.0 stdlib@go1.21.1	0.60.0 1.26.9	1
victoriametrics/victoria-metrics :v1.120.0	a1cb2f3dfd45	golang.org/x/net@v0.40.0 stdlib@go1.24.4	0.60.0 1.26.9	1
victoriametrics/victoria-metrics :v1.34.7	b50d5c0153f9	stdlib@go1.14.1	1.26.9	1
victoriametrics/victoria-metrics :v1.95.1	f52723a08a44	golang.org/x/net@v0.18.0 stdlib@go1.21.4	0.60.0 1.26.9	1
victoriametrics/vmalert :v1.96.0	150cd08fde94	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.60.0 1.26.9	1
victoriametrics/vmestimator :v0.1.16	ccf603552de2	stdlib@go1.26.6	1.26.9	1
vientoprojects/kubernetes-monitoring-telegram-bot :latest	eb2a71531741	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.16.4	0.60.0 1.26.9	1
vikunja/api :0.17.1	8cba0520bf8c	golang.org/x/net@v0.0.0-20210505024714-0287a6fb4125 stdlib@go1.16.5	0.60.0 1.26.9	1
vineyardcloudnative/vineyard-operator :latest	9d419aa18faa	golang.org/x/net@v0.23.0 stdlib@go1.19.13	0.60.0 1.26.9	1
vmware/kube-fluentd-operator :latest	f028c138a5f4	golang.org/x/net@v0.17.0 stdlib@go1.21.7	0.60.0 1.26.9	1
voidxmh/golang :1.19-alpine-dev	423c6195fab2	stdlib@go1.19	1.26.9	1
voidxmh/xmh-auther :v1	93e42a569ca8	stdlib@go1.16.5	1.26.9	1
voidxmh/xmh-cacher :v1	1b7397412320	stdlib@go1.16.5	1.26.9	1
voidxmh/xmh-ui :v1	2ff3f2146547	stdlib@go1.16.5	1.26.9	1
volantmq/volantmq :v0.4.0-rc.6	9bfe7857ebc3	stdlib@go1.13.6	1.26.9	1
volcanosh/vc-controller-manager :v1.12.1	3815883c32f6	golang.org/x/net@v0.38.0 stdlib@go1.23.7	0.60.0 1.26.9	1
volcanosh/vc-controller-manager :v1.15.3	9063355ee23b	golang.org/x/net@v0.55.0 stdlib@go1.25.0	0.60.0 1.26.9	1
volcanosh/vc-scheduler :v1.15.3	7e9875e5897f	golang.org/x/net@v0.55.0 stdlib@go1.25.0	0.60.0 1.26.9	1
volcanosh/vc-scheduler :v1.12.1	b24ea8af2d16	golang.org/x/net@v0.38.0 stdlib@go1.23.7	0.60.0 1.26.9	1
volcanosh/vc-webhook-manager :v1.15.3	9231c5626249	golang.org/x/net@v0.55.0 stdlib@go1.25.5	0.60.0 1.26.9	1
volcanosh/vc-webhook-manager :v1.12.1	f8b50088a732	golang.org/x/net@v0.30.0 stdlib@go1.23.7	0.60.0 1.26.9	1
voltha/bbsim :1.16.7	d90403d58016	golang.org/x/net@v0.0.0-20210405180319-a5a99cb37ef4 stdlib@go1.13.8	0.60.0 1.26.9	1
voltha/bbsim-sadis-server :0.3.5	259fc3a03f4e	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e stdlib@go1.16.3	0.60.0 1.26.9	1
voltha/bbsim-sadis-server :0.4.0	762b272d439e	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e stdlib@go1.16.3	0.60.0 1.26.9	1
vultr/cert-manager-webhook-vultr :v0.1.0	541c3e0aec58	golang.org/x/net@v0.0.0-20200822124328-c89045814202 stdlib@go1.16.3	0.60.0 1.26.9	1
vultr/vultr-cloud-controller-manager :v0.3.0	1806f17d620c	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.16.7	0.60.0 1.26.9	1
vultr/vultr-csi :v0.3.0	41d26735d437	golang.org/x/net@v0.0.0-20210917221730-978cfadd31cf stdlib@go1.16.8	0.60.0 1.26.9	1
wagnermanganelli164/webserver-hello-world :0.3.0	d4ef27a4f180	stdlib@go1.22.5	1.26.9	1
wait4x/wait4x :3.3.1	4dcd86307de1	golang.org/x/net@v0.39.0 stdlib@go1.24.3	0.60.0 1.26.9	1
wallarm/api-firewall :v0.9.6	4d45db0ff240	golang.org/x/net@v0.52.0 stdlib@go1.25.8	0.60.0 1.26.9	1
wallarm/ebpf-agent :0.11.0-rc0	c8920e60c726	golang.org/x/net@v0.22.0 stdlib@go1.22.1	0.60.0 1.26.9	1
wallarm/gateway-control-plane :0.2.0	a321bc974a19	stdlib@go1.24.13	1.26.9	1