CVE-2026-78660

Medium

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: Medium; worst across findings
CVSS: 5.5; base score, highest
EPSS: 0.002; 8th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,564; of 18,087 indexed, latest versions
Container images: 6,417; deployed by those charts
Fix available: 5 of 9; affected packages

HTTP/2 transport accepts malformed framing-related headers in net/http

Carried by container images the latest versions of 5,564 of 18,087 indexed charts deploy, on 6,417 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+212 more	1.26.9, 1.27.2	6,392
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more	0.60.0	5,161
golang-1.19deb	1.19.8-2	no fix listed	1
helm-4apk	4.3.0-r0	4.3.0-r2	1
ingress-nginx-controller-1.15apk	1.15.10-r3	no fix listed	1
kineapk	0.17.1-r1	no fix listed	1
kubernetes-1.37apk	1.37.1-r0	1.37.1-r2	1
runcapk	1.5.2-r0	no fix listed	1
tetragonapk	1.7.1-r4	1.7.1-r6	1

OSV records: CGA-4487-7phw-q6ph CGA-4c7c-vv7v-68rj CGA-8m3g-7799-mp4m CGA-8vqq-r2ff-395m CGA-f7qm-qm58-qq95 CGA-gwrf-q2qw-xxw8 DEBIAN-CVE-2026-78660 GO-2026-6610
Also known as: CGA-35vx-wppw-x7qp, CGA-3h29-84h2-fpvm, CGA-549w-3rfh-p826, CGA-5m57-vjc9-f9p9, CGA-674h-jc7r-4mj3, CGA-69vp-383p-x5ch, CGA-75m2-prw5-hwgv, CGA-77wf-8wxg-xgm9, CGA-8p8v-px44-9x8q, CGA-ch87-vjh7-q5c4, CGA-f6rm-vx2j-c4p8, CGA-g5qq-3wrm-946q, CGA-hhf5-4h2f-jxg6, CGA-hmfx-cqg4-6jpq, CGA-hw83-h7jc-7pmj, CGA-pxv9-259f-f7j4, CGA-q8wf-wv9q-7fmv, CGA-qfx8-xwj3-frq2, CGA-qp96-gpwf-9v2h, CGA-qrx4-5cp4-7xhr, CGA-rpwc-c4h5-9frv, CGA-rr68-65r8-g5vv, CGA-v6p6-9m54-x5pc, CGA-x66q-68px-v2f4, CGA-x9jv-g6mg-h4jq, CGA-xjhf-9jv7-7x78
Trending: Rank 5 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,564 by stars

Chart

Latest

Affected images

Radar Score

kube-state-metricsromanow-helm-charts

1.7.2

1 of 1 See more

kube-state-metrics romanow-helm-charts 1.7.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
bitnamilegacy/kube-state-metrics :2	04a3044b384b	golang.org/x/net@v0.40.0 stdlib@go1.24.5	0.60.0 1.26.9

Open the chart page →

3,348

logstashromanow-helm-charts

1.5.0

1 of 1 See more

logstash romanow-helm-charts 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/logstash :7.17.8	17a4f64e9cf5	stdlib@go1.19.3	1.26.9

Open the chart page →

8,582

node-exporterromanow-helm-charts

1.7.1

1 of 1 See more

node-exporter romanow-helm-charts 1.7.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quay.io/prometheus/node-exporter :v1.8.1	fa7fa12a57ef	golang.org/x/net@v0.23.0 stdlib@go1.22.3	0.60.0 1.26.9

Open the chart page →

1,349

postgresromanow-helm-charts

1.7.1

1 of 1 See more

postgres romanow-helm-charts 1.7.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/postgres :15	724292da1f2e	stdlib@go1.24.6	1.26.9

Open the chart page →

1,853

prometheusromanow-helm-charts

1.7.2

1 of 1 See more

prometheus romanow-helm-charts 1.7.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
prom/prometheus :v2.52.0	5c435642ca4d	golang.org/x/net@v0.24.0 stdlib@go1.22.3	0.60.0 1.26.9

Open the chart page →

1,672

routehub-client-hubroutehub-helm

1.0.0

2 of 3 See more

routehub-client-hub routehub-helm 1.0.0

2 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
eqalpha/keydb :latest	6537505c4235	stdlib@go1.16.7	1.26.9
timescale/timescaledb-ha :pg16	e9f34d8dd276	golang.org/x/net@v0.26.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

15,199

rstudio-pmrstudio

0.20.6

1 of 1 See more

rstudio-pm rstudio 0.20.6

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
posit/package-manager :2026.09.0-ubuntu-24.04	641d5874ccd3	golang.org/x/net@v0.57.0 stdlib@go1.27.0	0.60.0 1.27.2

Open the chart page →

35,120

mealiertomik-helm-charts

0.0.2

1 of 1 See more

mealie rtomik-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/mealie-recipes/mealie :v3.2.1	322369a5b748	stdlib@go1.24.4	1.26.9

Open the chart page →

4,799

kyoorubxkube

0.1.10

1 of 9 See more

kyoo rubxkube 0.1.10

1 of the 9 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/zoriya/kyoo_transcoder :4.7.1	2dadea51a91e	golang.org/x/net@v0.33.0 stdlib@go1.23.4	0.60.0 1.26.9

Open the chart page →

34,010

s3-encryption-gateways3-encryption-gateway

0.12.3

1 of 1 See more

s3-encryption-gateway s3-encryption-gateway 0.12.3

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
cloud37io/s3-encryption-gateway :0.12.3	10e791e98b62	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

141

rabbitmq-operatorsagikazarmark

0.0.3

1 of 1 See more

rabbitmq-operator sagikazarmark 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
rabbitmqoperator/cluster-operator :1.8.3	231e7ce0e905	golang.org/x/net@v0.0.0-20210510120150-4163338589ed stdlib@go1.17	0.60.0 1.26.9

Open the chart page →

3,065

conference-appsalaboy

1.0.0

4 of 7 See more

conference-app salaboy 1.0.0

4 of the 7 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
salaboy/agenda-service-0967b907d9920c99918e2b91b91937b3digest-pinned	ce9ce8293e4e	stdlib@go1.20.1	1.26.9
salaboy/c4p-service-a3dc0474cbfa348afcdf47a8eee70ba9digest-pinned	bb64bf14467d	stdlib@go1.20.1	1.26.9
salaboy/frontend-go-1739aa83b5e69d4ccb8a5615830ae66cdigest-pinned	1ff7c90845e4	stdlib@go1.20.1	1.26.9
salaboy/notifications-service-0e27884e01429ab7e350cb5dff61b525digest-pinned	799c35f9f306	stdlib@go1.20.1	1.26.9

Open the chart page →

13,986

ntfysarab97

0.1.7

1 of 1 See more

ntfy sarab97 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
binwiederhier/ntfy :v2.6.2	83e2e43d9956	golang.org/x/net@v0.11.0 stdlib@go1.20.5	0.60.0 1.26.9

Open the chart page →

2,399

uptime-kumasb-helm-charts

0.4.0

1 of 1 See more

uptime-kuma sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :2.0.2	4c364ef96aad	golang.org/x/net@v0.40.0 stdlib@go1.20.5	0.60.0 1.26.9

Open the chart page →

45,022

scale-sentryscale-sentry

0.5.0

1 of 1 See more

scale-sentry scale-sentry 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/ethan-kane-ops/scale-sentry :0.5.0	17a54e1f7c0b	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

124

scaleway-csiscaleway-charts

0.2.2

8 of 8 See more

scaleway-csi scaleway-charts 0.2.2

8 of the 8 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
scaleway/scaleway-csi :v0.3.4	11135998e31c	golang.org/x/net@v0.42.0 stdlib@go1.24.12	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-attacher :v4.9.0	5aaefc24f315	golang.org/x/net@v0.40.0 stdlib@go1.24.2	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.14.0	5244abbe87e0	golang.org/x/net@v0.40.0 stdlib@go1.24.2	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-provisioner :v5.3.0	bb057f866177	golang.org/x/net@v0.40.0 stdlib@go1.24.2	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-resizer :v1.14.0	5e7cbb63fd49	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-snapshotter :v8.3.0	bc7be893ecc3	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.60.0 1.26.9
registry.k8s.io/sig-storage/livenessprobe :v2.16.0	88092d100909	golang.org/x/net@v0.40.0 stdlib@go1.24.2	0.60.0 1.26.9
registry.k8s.io/sig-storage/snapshot-controller :v8.3.0	12c2da094b02	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.60.0 1.26.9

Open the chart page →

7,129

teamcityscalified-teamcity

2026.2.0

1 of 3 See more

teamcity scalified-teamcity 2026.2.0

1 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/postgres :14	c2427de38f99	stdlib@go1.24.6	1.26.9

Open the chart page →

1,853

sceptresceptreai

0.1.12

2 of 5 See more

sceptre sceptreai 0.1.12

2 of the 5 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
maponyacharles/sceptreai :postgresql-0.1.12	58881351f309	stdlib@go1.25.12	1.26.9
maponyacharles/sceptreai :seaweedfs-0.1.12	7c8a525f08e9	golang.org/x/net@v0.56.0 stdlib@go1.25.12	0.60.0 1.26.9

Open the chart page →

5,636

schemaheroschemahero

1.4.0

1 of 1 See more

schemahero schemahero 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
schemahero/schemahero-manager :0.22.1	1609e1a05cd3	golang.org/x/net@v0.40.0 stdlib@go1.24.6	0.60.0 1.26.9

Open the chart page →

2,781

scienceboxsciencebox

0.0.7

2 of 17 See more

sciencebox sciencebox 0.0.7

2 of the 17 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
cs3org/revad :v1.19.0	3b57a34a7dfd	golang.org/x/net@v0.0.0-20220325170049-de3da57026de stdlib@go1.17.3	0.60.0 1.26.9
osixia/openldap :1.5.0	18742e9c449c	golang.org/x/net@v0.0.0-20201010224723-4f7140c49acb stdlib@go1.15.5	0.60.0 1.26.9

Open the chart page →

9,493

iopsciencemesh

0.4.0

1 of 2 See more

iop sciencemesh 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
cs3org/revad :v1.24.0	e80a4d67b352	golang.org/x/net@v0.7.0 stdlib@go1.20.4	0.60.0 1.26.9

Open the chart page →

4,831

seatsurfingseatsurfing

0.1.2

1 of 1 See more

seatsurfing seatsurfing 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
seatsurfing/backend :1.119.3	9952e80048b0	golang.org/x/net@v0.56.0 stdlib@go1.26.5	0.60.0 1.26.9

Open the chart page →

887

secrethorsecrethor

1.1.2

1 of 1 See more

secrethor secrethor 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
bonovoo/secrethor :1.1.2	bb93b68fcd17	golang.org/x/net@v0.38.0 stdlib@go1.24.2	0.60.0 1.26.9

Open the chart page →

955

secrets-store-csi-driver-provider-infisicalsecrets-store-csi-driver-provider-infisical

1.1.4

1 of 1 See more

secrets-store-csi-driver-provider-infisical secrets-store-csi-driver-provider-infisical 1.1.4

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
gidoichi/secrets-store-csi-driver-provider-infisical :v1.1.4	2dd5322a0610	golang.org/x/net@v0.57.0 stdlib@go1.26.5	0.60.0 1.26.9

Open the chart page →

499

securosecuro

0.16.3

1 of 4 See more

securo securo 0.16.3

1 of the 4 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
pgvector/pgvector :pg16	7b822b0aac60	stdlib@go1.24.6	1.26.9

Open the chart page →

3,875

selenosis-deployselenosis

2.1.4

4 of 4 See more

selenosis-deploy selenosis 2.1.4

4 of the 4 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
alcounit/browser-controller :v1.0.1	c64222f9e663	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9
alcounit/browser-service :v0.0.9	4bd10defc324	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9
alcounit/browser-ui :v1.0.0	668e7aee5e5c	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9
alcounit/selenosis :v2.1.2	f0964cda6da6	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9

Open the chart page →

3,209

karakeepself-hosters-by-night

2.5.1

1 of 1 See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/karakeep-app/karakeep :0.27.1	abd7d6b11b1b	stdlib@go1.23.10	1.26.9

Open the chart page →

6,194

sentry-k8ssentry-k8s

1.4.1

3 of 11 See more

sentry-k8s sentry-k8s 1.4.1

3 of the 11 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/postgres :16	1a6ab3f5345e	stdlib@go1.24.6	1.26.9
library/redis :6.2.20-alpine	77697a75da9f	stdlib@go1.18.2	1.26.9
ghcr.io/getsentry/sentry :26.7.2	7c5052aa4e3c	stdlib@go1.19.8	1.26.9

Open the chart page →

20,679

sentry-operatorsentry-operator

1.2.5

1 of 1 See more

sentry-operator sentry-operator 1.2.5

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/agjmills/sentry-operator :v1.2.5	00389ef6a00e	golang.org/x/net@v0.30.0 stdlib@go1.24.2	0.60.0 1.26.9

Open the chart page →

895

helm64-toolboxserdigital64

0.4.0

1 of 1 See more

helm64-toolbox serdigital64 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/automation64/toolbox/oraclelinux-9-toolbox :latest	7af2216c7b9e	golang.org/x/net@v0.52.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

2,135

vuiseriohub

1.0.6

2 of 3 See more

vui seriohub 1.0.6

2 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
dserio83/velero-api :0.3.1	6b3d9115fee2	golang.org/x/net@v0.26.0 stdlib@go1.22.5	0.60.0 1.26.9
dserio83/velero-ui :0.3.1	b4e1ec6664d3	stdlib@go1.23.7	1.26.9

Open the chart page →

13,457

session-manager-agentsession-manager-agent

1.9.0

1 of 2 See more

session-manager-agent session-manager-agent 1.9.0

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
public.ecr.aws/cloudnatix/llmariner/session-manager-agent :1.9.0	b9f23db99051	golang.org/x/net@v0.38.0 stdlib@go1.23.11	0.60.0 1.26.9

Open the chart page →

894

session-manager-serversession-manager-server

0.1.0-gfu-dev

1 of 1 See more

session-manager-server session-manager-server 0.1.0-gfu-dev

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
public.ecr.aws/cloudnatix/llmariner/session-manager-server :0.1.0-gfu-dev	b9537499ff9e	golang.org/x/net@v0.35.0 stdlib@go1.23.7	0.60.0 1.26.9

Open the chart page →

1,244

k8s-appliershlomibendavid

1.0.1

1 of 1 See more

k8s-applier shlomibendavid 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
shlomibendavid/k8s-applier :0311240529	a22ffbe0f04e	golang.org/x/net@v0.19.0 stdlib@go1.21.7	0.60.0 1.26.9

Open the chart page →

1,913

clickhousesignoz

24.1.18

3 of 3 See more

clickhouse signoz 24.1.18

3 of the 3 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.21.2	cd9252644ce0	golang.org/x/net@v0.7.0 stdlib@go1.19.10	0.60.0 1.26.9
altinity/metrics-exporter :0.21.2	df3d57215356	golang.org/x/net@v0.7.0 stdlib@go1.19.10	0.60.0 1.26.9
signoz/zookeeper :3.7.1	fcc4a3288154	stdlib@go1.21.2	1.26.9

Open the chart page →

6,710

cosignedsigstore

0.1.23

2 of 2 See more

cosigned sigstore 0.1.23

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
gcr.io/projectsigstore/cosigneddigest-pinned	784518ff3ee7	golang.org/x/net@v0.0.0-20220412020605-290c469a71a5 stdlib@go1.17.9	0.60.0 1.26.9
gcr.io/projectsigstore/policy-webhookdigest-pinned	82940e8c3e0d	golang.org/x/net@v0.0.0-20220412020605-290c469a71a5 stdlib@go1.17.9	0.60.0 1.26.9

Open the chart page →

7,370

rekor-tilessigstore

1.2.6

1 of 1 See more

rekor-tiles sigstore 1.2.6

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/sigstore/rekor-tiles/gcp :v2.2.1	e401cfe033c9	golang.org/x/net@v0.55.0 stdlib@go1.26.3	0.60.0 1.26.9

Open the chart page →

609

scaffoldsigstore

0.6.117

11 of 15 See more

scaffold sigstore 0.6.117

11 of the 15 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
library/redisdigest-pinned	148bb5411c18	stdlib@go1.18.2	1.26.9
gcr.io/trillian-opensource-ci/db_serverdigest-pinned	2a685a38dd01	stdlib@go1.18.2	1.26.9
ghcr.io/sigstore/fulcio :v1.9.0	2de0226c5f82	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2
ghcr.io/sigstore/rekor/rekor-server :v1.5.4	100d793d68d0	golang.org/x/net@v0.57.0 stdlib@go1.26.4	0.60.0 1.26.9
ghcr.io/sigstore/scaffolding/createcertsdigest-pinned	4d64dac937e2	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9
ghcr.io/sigstore/scaffolding/createctconfig :v0.7.33	e591f98e3899	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9
ghcr.io/sigstore/scaffolding/createdbdigest-pinned	16673c1099a5	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9
ghcr.io/sigstore/scaffolding/createtreedigest-pinned:v0.7.33	4c845ced03d8	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9
ghcr.io/sigstore/scaffolding/ct_server :v0.7.33	24293fa1ed50	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9
ghcr.io/sigstore/scaffolding/trillian_log_serverdigest-pinned	32ee491f4d00	golang.org/x/net@v0.59.0 stdlib@go1.27.0	0.60.0 1.27.2
ghcr.io/sigstore/scaffolding/trillian_log_signerdigest-pinned	3d0152303816	golang.org/x/net@v0.59.0 stdlib@go1.27.0	0.60.0 1.27.2

Open the chart page →

11,207

octopusdeploysimcube

1.0.21

1 of 2 See more

octopusdeploy simcube 1.0.21

1 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
bitnami/kubectl :latest	f7f9e4f64d9e	golang.org/x/net@v0.57.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

141

simply-dns-webhooksimply-dns-webhook

1.10.0

1 of 1 See more

simply-dns-webhook simply-dns-webhook 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/runnerm/simply-dns-webhook :v1.10.0	fdfffa3984a5	golang.org/x/net@v0.52.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

671

mongodb-backupsinextra

1.1.0

1 of 1 See more

mongodb-backup sinextra 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/sergelogvinov/mongodb :8.0.10	1eee8e20a87f	golang.org/x/net@v0.40.0 stdlib@go1.23.8	0.60.0 1.26.9

Open the chart page →

5,514

postgresql-singlesinextra

1.15.2

1 of 1 See more

postgresql-single sinextra 1.15.2

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/sergelogvinov/postgresql :16.15	fafb72e98f22	golang.org/x/net@v0.47.0 stdlib@go1.24.6	0.60.0 1.26.9

Open the chart page →

6,172

registry-mirrorssinextra

2.0.19

1 of 1 See more

registry-mirrors sinextra 2.0.19

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/project-zot/zot :v2.1.21	6b69512c00dc	golang.org/x/net@v0.58.0 stdlib@go1.26.8-X:jsonv2	0.60.0 1.26.9

Open the chart page →

609

skippersinextra

0.8.13

1 of 1 See more

skipper sinextra 0.8.13

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/zalando/skipper :v0.27.88	3a357a2a4bef	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

317

altinity-clickhouse-operatorslamdev

0.1.2

2 of 2 See more

altinity-clickhouse-operator slamdev 0.1.2

2 of the 2 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.20.0	8f0f582d41f0	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.17.13	0.60.0 1.26.9
altinity/metrics-exporter :0.20.0	1a46d104406d	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.17.13	0.60.0 1.26.9

Open the chart page →

8,146

docker-registry-uislamdev

0.0.1

1 of 1 See more

docker-registry-ui slamdev 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
quiq/docker-registry-ui :0.9.4	91281da47036	golang.org/x/net@v0.0.0-20211015210444-4f30a5c0130f stdlib@go1.18	0.60.0 1.26.9

Open the chart page →

3,185

external-secrets-operatorslamdev

0.0.15

1 of 1 See more

external-secrets-operator slamdev 0.0.15

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
slamdev/external-secrets-operator :0.0.8	855f6625dda4	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.15	0.60.0 1.26.9

Open the chart page →

3,450

wg-easyslybase-wg-easy

1.2.0

1 of 1 See more

wg-easy slybase-wg-easy 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
ghcr.io/wg-easy/wg-easy :15.4.0	0e7bc9d34e86	golang.org/x/net@v0.44.0 stdlib@go1.26.3	0.60.0 1.26.9

Open the chart page →

1,214

wireguardslybase-wireguard

2.0.9

1 of 1 See more

wireguard slybase-wireguard 2.0.9

1 of the 1 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
linuxserver/wireguard :1.0.20260223-r0-ls125	437a490f7afc	golang.org/x/net@v0.47.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

662

smallest-self-hostsmallest-self-host

0.2.2

7 of 12 See more

smallest-self-host smallest-self-host 0.2.2

7 of the 12 container images this version deploys carry CVE-2026-78660.

Container image	Digest	Package	Fixed in
bitnami/redis :latest	f4797b37502e	stdlib@go1.26.8	1.26.9
grafana/grafana :11.0.0	0dc5a246ab16	golang.org/x/net@v0.23.0 stdlib@go1.21.10	0.60.0 1.26.9
quay.io/prometheus-operator/prometheus-operator :v0.74.0	6b3f6d8b4c0a	golang.org/x/net@v0.25.0 stdlib@go1.22.3	0.60.0 1.26.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v20221220-controller-v1.5.1-58-g787ea74b6	4d99688e5573	golang.org/x/net@v0.1.0 stdlib@go1.19.4	0.60.0 1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.12.0	b401fae262a5	golang.org/x/net@v0.22.0 stdlib@go1.21.8	0.60.0 1.26.9
registry.k8s.io/nfd/node-feature-discovery :v0.16.6	19ebca8b3804	golang.org/x/net@v0.25.0 stdlib@go1.22.8	0.60.0 1.26.9
registry.k8s.io/prometheus-adapter/prometheus-adapter :v0.12.0	932eae60e2bc	golang.org/x/net@v0.24.0 stdlib@go1.22.2	0.60.0 1.26.9

Open the chart page →

11,245

Container images carrying it

6,417 by charts deploying them

A fixed version is listed for 5 of the 9 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/devtron/image-scanner :b278f42b-334-11119	88c64b1b6ec8	golang.org/x/net@v0.0.0-20220114011407-0dd24b26b47d stdlib@go1.16.10	0.60.0 1.26.9	3
quay.io/devtron/image-scanner :94237c18-109-39420	98580969b333	golang.org/x/net@v0.17.0 stdlib@go1.25.5	0.60.0 1.26.9	3
quay.io/devtron/inception :7beef376-948-31378	4c3b91bebd3d	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.14.15	0.60.0 1.26.9	3
quay.io/devtron/jcmhproxy-ingress :v0.14.6	4286bcccda3e	golang.org/x/net@v0.17.0 stdlib@go1.19.13	0.60.0 1.26.9	3
quay.io/devtron/k8s-utils :807ca3c2-488-14005	f296c2ec5db7	golang.org/x/net@v0.8.0 stdlib@go1.20.4	0.60.0 1.26.9	3
quay.io/devtron/kubelink :94237c18-314-39417	9d25865295af	golang.org/x/net@v0.48.0 stdlib@go1.25.0	0.60.0 1.26.9	3
quay.io/devtron/kubelink :09867a9c-564-39289	ea6dd1e4ce71	golang.org/x/net@v0.48.0 stdlib@go1.25.0	0.60.0 1.26.9	3
quay.io/devtron/kubewatch :09867a9c-419-39288	d30a7c640c63	golang.org/x/net@v0.48.0 stdlib@go1.25.5	0.60.0 1.26.9	3
quay.io/devtron/kubewatch :49f906a5-419-14814	eec0305b594c	golang.org/x/net@v0.8.0 stdlib@go1.20.7	0.60.0 1.26.9	3
quay.io/devtron/lens :3b3d6d0e-333-39292	e886b8d2b54b	golang.org/x/net@v0.48.0 stdlib@go1.25.5	0.60.0 1.26.9	3
quay.io/devtron/nats :2.9.3-alpine	f0cf3c3ab495	stdlib@go1.19.2	1.26.9	3
quay.io/devtron/nats-box :latest	48cdd3054b20	golang.org/x/net@v0.0.0-20220906165146-f3363e06e74c stdlib@go1.19.2	0.60.0 1.26.9	3
quay.io/devtron/nats-server-config-reloader :0.6.2	b5252e783fb2	stdlib@go1.15.14	1.26.9	3
quay.io/devtron/prometheus-nats-exporter :0.9.0	94044746cbce	stdlib@go1.16.15	1.26.9	3
quay.io/devtron/silver-surfer :e3b9a2f6-1191-38789	9640e2dc4316	golang.org/x/net@v0.28.0 stdlib@go1.21.5	0.60.0 1.26.9	3
quay.io/devtron/winter-soldier :abf5a822-196-14744	093844c46c19	golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd stdlib@go1.18.10	0.60.0 1.26.9	3
quay.io/dexidp/dex :v2.25.0	7bcf286807b8	golang.org/x/net@v0.0.0-20190813141303-74dc4d7220e7 stdlib@go1.14.9	0.60.0 1.26.9	3
quay.io/metallb/controller :v0.13.10	1b33357b3595	golang.org/x/net@v0.8.0 stdlib@go1.19.5	0.60.0 1.26.9	3
quay.io/oliver006/redis_exporter :v1.35.1	908dbee5c546	stdlib@go1.17.7	1.26.9	3
quay.io/openshift/origin-oauth-proxy :4.14	a7dff785d821	golang.org/x/net@v0.17.0 stdlib@go1.20.10	0.60.0 1.26.9	3
quay.io/prometheus/alertmanager :v0.26.0	361db356b330	golang.org/x/net@v0.10.0 stdlib@go1.20.7	0.60.0 1.26.9	3
quay.io/prometheus/node-exporter :v1.1.2	22fbde17ab64	golang.org/x/net@v0.0.0-20201224014010-6772e930b67b stdlib@go1.15.8	0.60.0 1.26.9	3
quay.io/prometheus/node-exporter :v1.6.1	81f94e50ea37	golang.org/x/net@v0.10.0 stdlib@go1.20.6	0.60.0 1.26.9	3
quay.io/prometheus/node-exporter :v1.8.0	8a57af80a4c7	golang.org/x/net@v0.23.0 stdlib@go1.22.2	0.60.0 1.26.9	3
quay.io/prometheus/node-exporter :v1.2.2	a990408ed288	golang.org/x/net@v0.0.0-20210525063256-abc453219eb5 stdlib@go1.16.7	0.60.0 1.26.9	3
quay.io/prometheus-operator/prometheus-config-reloader :v0.94.0	142a1f11df8d	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	3
quay.io/prometheus-operator/prometheus-operator :v0.90.1	52a6a92d915e	golang.org/x/net@v0.52.0 stdlib@go1.25.8	0.60.0 1.26.9	3
quay.io/prometheus-operator/prometheus-operator :v0.74.0	6b3f6d8b4c0a	golang.org/x/net@v0.25.0 stdlib@go1.22.3	0.60.0 1.26.9	3
quay.io/prometheus-operator/prometheus-operator :v0.92.1	7d9247d23514	golang.org/x/net@v0.56.0 stdlib@go1.26.4	0.60.0 1.26.9	3
quay.io/prometheus/prometheus :v2.41.0	1a3e9a878e50	golang.org/x/net@v0.4.0 stdlib@go1.19.4	0.60.0 1.26.9	3
quay.io/prometheus/prometheus :v2.55.0	378f4e037035	golang.org/x/net@v0.28.0 stdlib@go1.23.2	0.60.0 1.26.9	3
quay.io/prometheus/prometheus :v2.26.0	38d40a760569	golang.org/x/net@v0.0.0-20210324051636-2c4c8ecb7826 stdlib@go1.16.2	0.60.0 1.26.9	3
quay.io/prometheus/prometheus :v3.10.0	7571a304e67f	golang.org/x/net@v0.49.0 stdlib@go1.26.0	0.60.0 1.26.9	3
quay.io/prometheus/prometheus :v2.31.1	a8779cfe553e	golang.org/x/net@v0.0.0-20211020060615-d418f374d309 stdlib@go1.17.3	0.60.0 1.26.9	3
quay.io/prometheus/prometheus :v2.43.0	f5c29683a301	golang.org/x/net@v0.8.0 stdlib@go1.19.7	0.60.0 1.26.9	3
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	golang.org/x/net@v0.27.0 stdlib@go1.22.6	0.60.0 1.26.9	3
quay.io/prometheus/pushgateway :v1.10.0	7a4d0696a24e	golang.org/x/net@v0.28.0 stdlib@go1.23.1	0.60.0 1.26.9	3
quay.io/prometheus/pushgateway :v1.8.0	c159e946abf4	golang.org/x/net@v0.22.0 stdlib@go1.22.1	0.60.0 1.26.9	3
quay.io/prometheus/snmp-exporter :v0.30.1	e5fd5e8b43ac	golang.org/x/net@v0.48.0 stdlib@go1.25.5	0.60.0 1.26.9	3
quay.io/sighup/permission-manager :v1.7.1-rc1	f5e6a5dcee33	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.16.8	0.60.0 1.26.9	3
quay.io/tigera/operator :v1.44.0	066c2e8d6745	golang.org/x/net@v0.59.0 stdlib@go1.27.1-X:boringcrypto	0.60.0 1.27.2	3
registry.k8s.io/autoscaling/vpa-admission-controller :1.7.1	be29624f7f12	golang.org/x/net@v0.55.0 stdlib@go1.26.5	0.60.0 1.26.9	3
registry.k8s.io/autoscaling/vpa-recommender :1.7.1	89cea705535f	golang.org/x/net@v0.55.0 stdlib@go1.26.5	0.60.0 1.26.9	3
registry.k8s.io/autoscaling/vpa-updater :1.7.1	feb42a526970	golang.org/x/net@v0.55.0 stdlib@go1.26.5	0.60.0 1.26.9	3
registry.k8s.io/ingress-nginx/controller :v1.5.1	4ba73c697770	golang.org/x/net@v0.1.0 stdlib@go1.19.2	0.60.0 1.26.9	3
registry.k8s.io/ingress-nginx/controller :v1.8.1	e5c4824e7375	golang.org/x/net@v0.10.0 stdlib@go1.20.5	0.60.0 1.26.9	3
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.4.1	36d05b4077fb	golang.org/x/net@v0.22.0 stdlib@go1.22.2	0.60.0 1.26.9	3
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.5.2	e8825994b7a2	golang.org/x/net@v0.37.0 stdlib@go1.24.1	0.60.0 1.26.9	3
registry.k8s.io/kubectl :v1.31.0	99b37df34bc4	golang.org/x/net@v0.26.0 stdlib@go1.22.5	0.60.0 1.26.9	3
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.17.0	2bbc91556733	golang.org/x/net@v0.41.0 stdlib@go1.24.6	0.60.0 1.26.9	3