CVE-2026-78663

Critical

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: Critical; worst across findings
CVSS: 9.1; base score, highest
EPSS: 0.006; 46th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,401; of 18,104 indexed, latest versions
Container images: 6,250; deployed by those charts
Fix available: 2 of 4; affected packages

Double flow control refund on HTTP/2 server streams in net/http

Carried by container images the latest versions of 5,401 of 18,104 indexed charts deploy, on 6,250 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+212 more	1.26.9, 1.27.2	6,223
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more	0.60.0	5,000
golang-1.19deb	1.19.8-2	no fix listed	1
ingress-nginx-controller-1.15apk	1.15.10-r9	no fix listed	1

OSV records: CGA-25j5-q798-fwm3 DEBIAN-CVE-2026-78663 GO-2026-6612
Also known as: CGA-vqxj-4gp6-23v9
Trending: Rank 1 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,401 by stars

Chart

Latest

Affected images

Radar Score

llmarinerllmariner

1.53.1

18 of 21 See more

llmariner llmariner 1.53.1

18 of the 21 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
dexidp/dex :v2.39.1-distroless	43655afd1a8f	golang.org/x/net@v0.24.0 stdlib@go1.21.6	0.60.0 1.26.9
public.ecr.aws/cloudnatix/llmariner/api-usage-cleaner :1.16.0	d47f43484055	stdlib@go1.23.12	1.26.9
public.ecr.aws/cloudnatix/llmariner/api-usage-server :1.16.0	8f9c32b866b0	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.60.0 1.26.9
public.ecr.aws/cloudnatix/llmariner/cluster-manager-server :1.8.0	364b3ff0fcb7	golang.org/x/net@v0.38.0 stdlib@go1.24.5	0.60.0 1.26.9
public.ecr.aws/cloudnatix/llmariner/cluster-monitor-agent :0.10.2	6769c2275a43	golang.org/x/net@v0.38.0 stdlib@go1.23.11	0.60.0 1.26.9
public.ecr.aws/cloudnatix/llmariner/cluster-monitor-server :0.10.2	2d28f9e3eab4	golang.org/x/net@v0.38.0 stdlib@go1.23.11	0.60.0 1.26.9
public.ecr.aws/cloudnatix/llmariner/database-creator :1.17.0	97065ced2942	stdlib@go1.23.11	1.26.9
public.ecr.aws/cloudnatix/llmariner/file-manager-server :1.11.0	301216788e93	golang.org/x/net@v0.38.0 stdlib@go1.23.11	0.60.0 1.26.9
public.ecr.aws/cloudnatix/llmariner/inference-manager-engine :1.46.0	c46f109c3d0b	golang.org/x/net@v0.48.0 stdlib@go1.25.9	0.60.0 1.26.9
public.ecr.aws/cloudnatix/llmariner/inference-manager-server :1.45.0	90b890f800ab	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.60.0 1.26.9
public.ecr.aws/cloudnatix/llmariner/job-manager-dispatcher :1.27.0	582508903cb0	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.60.0 1.26.9
public.ecr.aws/cloudnatix/llmariner/job-manager-server :1.27.0	fe9de719f91e	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.60.0 1.26.9
public.ecr.aws/cloudnatix/llmariner/model-manager-server :1.27.0	c057dcdd9ef3	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.60.0 1.26.9
public.ecr.aws/cloudnatix/llmariner/rbac-server :1.19.1	df1adeb86679	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.60.0 1.26.9
public.ecr.aws/cloudnatix/llmariner/session-manager-agent :1.9.0	b9f23db99051	golang.org/x/net@v0.38.0 stdlib@go1.23.11	0.60.0 1.26.9
public.ecr.aws/cloudnatix/llmariner/session-manager-server :1.9.0	f24ecd37fbaa	golang.org/x/net@v0.38.0 stdlib@go1.23.11	0.60.0 1.26.9
public.ecr.aws/cloudnatix/llmariner/user-manager-server :1.27.1	628a14449241	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.60.0 1.26.9
public.ecr.aws/cloudnatix/llmariner/vector-store-manager-server :1.7.0	f1f6b884b325	golang.org/x/net@v0.38.0 stdlib@go1.23.11	0.60.0 1.26.9

Open the chart page →

21,531

llm-dllm-d

1.0.23

1 of 2 See more

llm-d llm-d 1.0.23

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/llm-d/llm-d-model-service :v0.0.15	8b99a8104a2f	golang.org/x/net@v0.40.0 stdlib@go1.24.3	0.60.0 1.26.9

Open the chart page →

3,253

home-assistantlmatfy

0.1.38

1 of 1 See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
homeassistant/home-assistant :2026.7	5a531753cea9	golang.org/x/net@v0.49.0 stdlib@go1.25.6	0.60.0 1.26.9

Open the chart page →

3,521

centcomloafoe

0.96.0

1 of 1 See more

centcom loafoe 0.96.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/centcom :v0.267.0	4b26cc8f2b4c	golang.org/x/net@v0.55.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

329

go-ocpp-serverloafoe

0.2.1

1 of 1 See more

go-ocpp-server loafoe 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/go-ocpp-server :v0.2.1	45bb960674ab	stdlib@go1.21.13	1.26.9

Open the chart page →

821

mcp-notifierloafoe

0.2.0

1 of 1 See more

mcp-notifier loafoe 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/mcp-notifier :v0.2.0	ea958b832415	stdlib@go1.26.4	1.26.9

Open the chart page →

270

mt-mcp-grafanaloafoe

0.10.0

2 of 2 See more

mt-mcp-grafana loafoe 0.10.0

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
grafana/mcp-grafana :0.14.0	42f541f22063	golang.org/x/net@v0.53.0 stdlib@go1.26.3	0.60.0 1.26.9
ghcr.io/loafoe/mt-mcp-grafana :v0.1.1	2332d9b47475	golang.org/x/net@v0.55.0 stdlib@go1.26.2	0.60.0 1.26.9

Open the chart page →

2,863

mt-mcp-proxyloafoe

0.4.2

2 of 2 See more

mt-mcp-proxy loafoe 0.4.2

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/github/github-mcp-server :latest	ffced0d76e77	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2
ghcr.io/loafoe/mt-mcp-proxy :v0.3.0	881e7d8097bc	golang.org/x/net@v0.55.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

1,035

picoclawloafoe

0.1.2

1 of 2 See more

picoclaw loafoe 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/picoclaw :v0.0.19	42e1b6862913	golang.org/x/net@v0.53.0 stdlib@go1.26.2	0.60.0 1.26.9

Open the chart page →

849

solgateloafoe

0.0.12

1 of 1 See more

solgate loafoe 0.0.12

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/loafoe/solgate :v0.0.12	b3256cbc7b68	golang.org/x/net@v0.14.0 stdlib@go1.21.0	0.60.0 1.26.9

Open the chart page →

2,870

local-path-exporterlocal-path-exporter

0.2.3

1 of 1 See more

local-path-exporter local-path-exporter 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/tmusial99/local-path-exporter :1.1.0	82476692c680	stdlib@go1.26.4	1.26.9

Open the chart page →

267

weather-app-chartlocal-weatherapp

0.1.0

2 of 4 See more

weather-app-chart local-weatherapp 0.1.0

2 of the 4 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
bitnamilegacy/mysql :8.0.36-debian-11-r3	8aad73aa0c6d	stdlib@go1.21.6	1.26.9
youssef11gaber10/deployment-auth-go :latest	6597b26959d2	golang.org/x/net@v0.10.0 stdlib@go1.26.1	0.60.0 1.26.9

Open the chart page →

8,331

ocatiecataloguslocatiecatalogus

1.0.0

1 of 3 See more

ocatiecatalogus locatiecatalogus 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/ocatiecatalogus-php :latest	c22764cbfa97	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.60.0 1.26.9

Open the chart page →

9,496

locust-pluginslocust-plugins

0.0.4

2 of 3 See more

locust-plugins locust-plugins 0.0.4

2 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
sky5367/locust-plugins-grafana :latest	d51bf68d4b26	golang.org/x/net@v0.22.0 stdlib@go1.21.8	0.60.0 1.26.9
sky5367/locust-plugins-timescale :latest	d3150f201471	stdlib@go1.18.7	1.26.9

Open the chart page →

9,286

uptime-kumaloeken-at-home

2.3.2

1 of 1 See more

uptime-kuma loeken-at-home 2.3.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :2.3.2	9aeb4e51d038	golang.org/x/net@v0.40.0 stdlib@go1.20.5	0.60.0 1.26.9

Open the chart page →

40,129

central-hostpath-mapperloft

0.2.9

1 of 1 See more

central-hostpath-mapper loft 0.2.9

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/central-hostpath-mapper :0.2.9	fa6dba122171	golang.org/x/net@v0.26.0 stdlib@go1.23.2	0.60.0 1.26.9

Open the chart page →

1,478

devpod-proloft

0.0.0-ci.4-do-not-use

1 of 1 See more

devpod-pro loft 0.0.0-ci.4-do-not-use

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/devpod-pro :0.0.0-ci.4-do-not-use	5dfa86b6451f	golang.org/x/net@v0.21.0 stdlib@go1.20.10	0.60.0 1.26.9

Open the chart page →

4,038

devspace-cloudloft

0.3.3

2 of 8 See more

devspace-cloud loft 0.3.3

2 of the 8 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
devspacecloud/manager :0.3.3	49c397413f7b	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.8	0.60.0 1.26.9
library/postgres :11	5d2aa4a7b5f9	stdlib@go1.16.7	1.26.9

Open the chart page →

12,302

kioskloft

0.2.11

1 of 1 See more

kiosk loft 0.2.11

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
kiosksh/kiosk :0.2.11	501725ba2025	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.15.7	0.60.0 1.26.9

Open the chart page →

4,340

license-serverloft

0.6.0

1 of 1 See more

license-server loft 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/license-server :0.6.0	69ce001bb4b0	golang.org/x/net@v0.53.0 stdlib@go1.24.3	0.60.0 1.26.9

Open the chart page →

1,324

loft-agentloft

3.2.4

1 of 1 See more

loft-agent loft 3.2.4

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/agent :3.2.4	5c109914ff73	golang.org/x/net@v0.6.0 stdlib@go1.18.10	0.60.0 1.26.9

Open the chart page →

3,346

loft-direct-cluster-endpointloft

1.14.0

1 of 1 See more

loft-direct-cluster-endpoint loft 1.14.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
loftsh/directclusterendpoint :1.14.0	310cc7d690f5	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.16.6	0.60.0 1.26.9

Open the chart page →

4,266

vcluster-control-planeloft

0.0.0-ci.4-do-not-use

1 of 1 See more

vcluster-control-plane loft 0.0.0-ci.4-do-not-use

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/vcluster-control-plane :0.0.0-ci.4-do-not-use	45e744fc623f	golang.org/x/net@v0.21.0 stdlib@go1.22.0	0.60.0 1.26.9

Open the chart page →

4,038

vcluster-headloft

0.0.0-035ec6e

1 of 2 See more

vcluster-head loft 0.0.0-035ec6e

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/kubernetes :v1.35.0	90097a08b87c	golang.org/x/net@v0.42.0 stdlib@go1.24.11	0.60.0 1.26.9

Open the chart page →

1,868

vcluster-hpmloft

0.2.7

1 of 1 See more

vcluster-hpm loft 0.2.7

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/vcluster-hpm :0.2.7	f65f6810ea23	golang.org/x/net@v0.40.0 stdlib@go1.24.2	0.60.0 1.26.9

Open the chart page →

1,370

vcluster-proloft

0.0.0-ci-run.10

2 of 2 See more

vcluster-pro loft 0.0.0-ci-run.10

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
rancher/k3s :v1.26.0-k3s1	9380f5dbae9a	golang.org/x/net@v0.1.1-0.20221027164007-c63010009c80 stdlib@go1.19.4	0.60.0 1.26.9
ghcr.io/loft-sh/vcluster-pro :0.0.0-ci-run.10	ab2e1fa19dd4	golang.org/x/net@v0.5.0 stdlib@go1.18.10	0.60.0 1.26.9

Open the chart page →

6,920

vcluster-pro-eksloft

0.0.0-ci-run.10

4 of 4 See more

vcluster-pro-eks loft 0.0.0-ci-run.10

4 of the 4 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/vcluster-pro :0.0.0-ci-run.10	ab2e1fa19dd4	golang.org/x/net@v0.5.0 stdlib@go1.18.10	0.60.0 1.26.9
public.ecr.aws/eks-distro/etcd-io/etcd :v3.5.6-eks-1-24-7	efa6dee17ed2	golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2 stdlib@go1.16.15	0.60.0 1.26.9
public.ecr.aws/eks-distro/kubernetes/kube-apiserver :v1.24.9-eks-1-24-7	72e06b605692	stdlib@go1.18.9	1.26.9
public.ecr.aws/eks-distro/kubernetes/kube-controller-manager :v1.24.9-eks-1-24-7	eaea8c230432	stdlib@go1.18.9	1.26.9

Open the chart page →

9,288

vcluster-pro-k0sloft

0.0.0-ci-run.10

2 of 2 See more

vcluster-pro-k0s loft 0.0.0-ci-run.10

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
k0sproject/k0s :v1.26.0-k0s.0	f04635825d51	golang.org/x/net@v0.5.0 stdlib@go1.19.4	0.60.0 1.26.9
ghcr.io/loft-sh/vcluster-pro :0.0.0-ci-run.10	ab2e1fa19dd4	golang.org/x/net@v0.5.0 stdlib@go1.18.10	0.60.0 1.26.9

Open the chart page →

7,623

vcluster-pro-k8sloft

0.0.0-ci-run.10

4 of 4 See more

vcluster-pro-k8s loft 0.0.0-ci-run.10

4 of the 4 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/vcluster-pro :0.0.0-ci-run.10	ab2e1fa19dd4	golang.org/x/net@v0.5.0 stdlib@go1.18.10	0.60.0 1.26.9
registry.k8s.io/etcd :3.5.6-0	dd75ec974b0a	golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2 stdlib@go1.16.15	0.60.0 1.26.9
registry.k8s.io/kube-apiserver :v1.26.1	99e1ed9fbc8a	golang.org/x/net@v0.3.1-0.20221206200815-1e63c2f08a10 stdlib@go1.19.5	0.60.0 1.26.9
registry.k8s.io/kube-controller-manager :v1.26.1	40adecbe3a40	golang.org/x/net@v0.3.1-0.20221206200815-1e63c2f08a10 stdlib@go1.19.5	0.60.0 1.26.9

Open the chart page →

11,930

virtualclusterloft

0.0.28

1 of 2 See more

virtualcluster loft 0.0.28

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
loftsh/virtual-cluster :0.0.28	023b13bf5898	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.15.11	0.60.0 1.26.9

Open the chart page →

4,192

vnode-runtimeloft

0.3.3

1 of 1 See more

vnode-runtime loft 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/vnode-runtime :0.3.3	b065ec5a5239	golang.org/x/net@v0.46.0 stdlib@go1.24.2	0.60.0 1.26.9

Open the chart page →

3,254

filebeatlog10x-elastic-helm-charts

1.5.1

1 of 1 See more

filebeat log10x-elastic-helm-charts 1.5.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
log10x/filebeat-10x :1.1.39-native	7d6a79dacd58	golang.org/x/net@v0.0.0-20220826154423-83b083e8dc8b stdlib@go1.18.7	0.60.0 1.26.9

Open the chart page →

8,020

loggingcomponentloggingcomponent

1.0.0

1 of 3 See more

loggingcomponent loggingcomponent 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/loggingcomponent-php :latest	834b8e1af290	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.60.0 1.26.9

Open the chart page →

9,472

nightingalelogic3579

0.3.1

4 of 6 See more

nightingale logic3579 0.3.1

4 of the 6 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	golang.org/x/net@v0.55.0 stdlib@go1.25.14	0.60.0 1.26.9
flashcatcloud/nightingale :8.5.1	421acb36181b	golang.org/x/net@v0.47.0 stdlib@go1.24.0	0.60.0 1.26.9
library/mysql :5.7	4bc6bc963e6d	stdlib@go1.18.2	1.26.9
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	golang.org/x/net@v0.27.0 stdlib@go1.22.6	0.60.0 1.26.9

Open the chart page →

11,844

logicservicelogicservice

1.0.0

1 of 4 See more

logicservice logicservice 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/logicservice-php :latest	72aae2080595	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.60.0 1.26.9

Open the chart page →

9,462

0.1.0

1 of 2 See more

login-test-backend login-test-backend 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
aboogie/login_test_backend :new	9c41a4483ac8	stdlib@go1.22.5	1.26.9

Open the chart page →

7,435

apica-ascentlogiqai

2.0.4

5 of 19 See more

apica-ascent logiqai 2.0.4

5 of the 19 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
logiqai/flash :v3.10.2	65b996bc7bdc	golang.org/x/net@v0.20.0 stdlib@go1.21.13	0.60.0 1.26.9
logiqai/flash-discovery :v2.0.3	f5b551bca98e	golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e stdlib@go1.18.9	0.60.0 1.26.9
logiqai/logiqctl :2.0.4	798306811f2d	golang.org/x/net@v0.0.0-20200226121028-0de0cce0169b stdlib@go1.13.7	0.60.0 1.26.9
logiqai/tracing :v1.35.2-lq1-c	3e149f6781b8	golang.org/x/net@v0.0.0-20220412020605-290c469a71a5 stdlib@go1.18.2	0.60.0 1.26.9
logiqai/tracing :v1.35.2-lq1-q	4a746ff04d6a	golang.org/x/net@v0.0.0-20220412020605-290c469a71a5 stdlib@go1.18.2	0.60.0 1.26.9

Open the chart page →

22,231

logtidelogtide

2.1.14

1 of 4 See more

logtide logtide 2.1.14

1 of the 4 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
timescale/timescaledb :latest-pg15	6343bdc87ca1	stdlib@go1.24.6	1.26.9

Open the chart page →

4,038

loki-proxyloki-proxy

0.4.1

1 of 1 See more

loki-proxy loki-proxy 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/peak-scale/observability-tenancy/loki-proxy :0.4.1	548e962d0061	golang.org/x/net@v0.43.0 stdlib@go1.24.6	0.60.0 1.26.9

Open the chart page →

1,298

loomwatchloomwatch

1.15.9

1 of 1 See more

loomwatch loomwatch 1.15.9

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/madduck-tech/loomwatch :1.15.9	8f08e7c84910	stdlib@go1.25.14	1.26.9

Open the chart page →

365

cloudflare-tunnel-remotelovemew67

0.1.2

1 of 1 See more

cloudflare-tunnel-remote lovemew67 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
cloudflare/cloudflared :latest	072c067d25cc	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

624

corednslovemew67

1.36.0

1 of 1 See more

coredns lovemew67 1.36.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
coredns/coredns :1.11.3	9caabbf6238b	golang.org/x/net@v0.25.0 stdlib@go1.21.11	0.60.0 1.26.9

Open the chart page →

1,776

oncall-hobbylovemew67

0.0.5

1 of 2 See more

oncall-hobby lovemew67 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/redis :7.0.15	352c1fdadc91	stdlib@go1.18.2	1.26.9

Open the chart page →

7,243

loxilbloxilb

0.1.0

2 of 2 See more

loxilb loxilb 0.1.0

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/loxilb-io/kube-loxilb :latest	6f65e53e252d	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.60.0 1.26.9
ghcr.io/loxilb-io/loxilb :latest	a475b43946b3	golang.org/x/net@v0.55.0 stdlib@go1.22.5	0.60.0 1.26.9

Open the chart page →

5,804

lsdisklsdisk

2.0.7

3 of 4 See more

lsdisk lsdisk 2.0.7

3 of the 4 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.12.0	0d23a6fd60c4	golang.org/x/net@v0.28.0 stdlib@go1.22.5	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-provisioner :v5.0.2	7b9cdb5830d0	golang.org/x/net@v0.25.0 stdlib@go1.22.5	0.60.0 1.26.9
registry.k8s.io/sig-storage/csi-resizer :v1.9.0	f1f352df9787	golang.org/x/net@v0.13.0 stdlib@go1.20.5	0.60.0 1.26.9

Open the chart page →

7,232

chronograflsst-sqre

1.3.5

1 of 1 See more

chronograf lsst-sqre 1.3.5

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
quay.io/influxdb/chronograf :1.9.4	bb0a980bc2bf	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e stdlib@go1.16.4	0.60.0 1.26.9

Open the chart page →

3,540

fireflylsst-sqre

0.3.7

1 of 2 See more

firefly lsst-sqre 0.3.7

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/redis :5	fc5ecd863862	stdlib@go1.16.7	1.26.9

Open the chart page →

2,851

sasquatchlsst-sqre

0.1.13

2 of 6 See more

sasquatch lsst-sqre 0.1.13

2 of the 6 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/kapacitor :1.6.3	7232f6388a4d	golang.org/x/net@v0.0.0-20210324051636-2c4c8ecb7826 stdlib@go1.17.2	0.60.0 1.26.9
quay.io/influxdb/chronograf :1.9.3	c2ed16080689	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e stdlib@go1.16.4	0.60.0 1.26.9

Open the chart page →

13,184

squash-apilsst-sqre

0.1.6

1 of 3 See more

squash-api lsst-sqre 0.1.6

1 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
gcr.io/cloudsql-docker/gce-proxy :1.17	a85176b8e7cc	golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e stdlib@go1.13.5	0.60.0 1.26.9

Open the chart page →

9,327

telegraf-dslsst-sqre

1.0.23

1 of 1 See more

telegraf-ds lsst-sqre 1.0.23

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/telegraf :1.19-alpine	addb86c0c520	golang.org/x/net@v0.0.0-20210405180319-a5a99cb37ef4 stdlib@go1.16.6	0.60.0 1.26.9

Open the chart page →

4,962

Container images carrying it

6,250 by charts deploying them

A fixed version is listed for 2 of the 4 affected packages.

Container image	Digest	Package	Fixed in	Used by
abutaha/aws-es-proxy :v1.1	190ed2d1dfc8	stdlib@go1.14.1	1.26.9	2
alazidis/kube-netlag :1.1.0	0e8c84152201	golang.org/x/net@v0.33.0 stdlib@go1.24.13	0.60.0 1.26.9	2
alpine/git :latest :v2.54.0	832b1cd1a271	golang.org/x/net@v0.57.0 stdlib@go1.26.8	0.60.0 1.26.9	2
alpine/k8s :1.32.12	048f8d9c8cc7	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.60.0 1.26.9	2
alpine/k8s :1.37.0	b421c2e9419e	golang.org/x/net@v0.57.0 stdlib@go1.26.7	0.60.0 1.26.9	2
alpine/kubectl :1.35.4	9ccd82364762	golang.org/x/net@v0.47.0 stdlib@go1.25.9	0.60.0 1.26.9	2
alpine/kubectl :1.35.2	ec8f734b0a10	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.60.0 1.26.9	2
altinity/clickhouse-operator :0.21.2	cd9252644ce0	golang.org/x/net@v0.7.0 stdlib@go1.19.10	0.60.0 1.26.9	2
altinity/clickhouse-operator :0.16.1	db7dde971407	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.13.15	0.60.0 1.26.9	2
altinity/metrics-exporter :0.16.1	85b4fdbae053	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.13.15	0.60.0 1.26.9	2
altinity/metrics-exporter :0.21.2	df3d57215356	golang.org/x/net@v0.7.0 stdlib@go1.19.10	0.60.0 1.26.9	2
amazon/aws-efs-csi-driver :v0.3.0	b55277652ea8	golang.org/x/net@v0.0.0-20190812203447-cdfb69ac37fc stdlib@go1.13.4	0.60.0 1.26.9	2
amazon/aws-fsx-csi-driver :latest	c9b14856fd22	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e stdlib@go1.16.8	0.60.0 1.26.9	2
apache/doris :operator-latest	3a4422656592	golang.org/x/net@v0.33.0 stdlib@go1.23.12	0.60.0 1.26.9	2
apache/skywalking-oap-server :8.1.0-es7	641237e0299b	golang.org/x/net@v0.0.0-20200226121028-0de0cce0169b stdlib@go1.13.3	0.60.0 1.26.9	2
apache/skywalking-ui :8.1.0	67d50e4deff4	golang.org/x/net@v0.0.0-20200226121028-0de0cce0169b stdlib@go1.13.3	0.60.0 1.26.9	2
apache/superset :dockerize	afe59523a6c8	golang.org/x/net@v0.10.0 stdlib@go1.20.4	0.60.0 1.26.9	2
apecloud/apecloud-mcp :0.1.0	94041b080510	stdlib@go1.23.7	1.26.9	2
apecloud/servicemirror :0.5.3	8c8451abf728	golang.org/x/net@v0.55.0 stdlib@go1.25.14	0.60.0 1.26.9	2
aquasec/kube-bench :v0.8.0	ea3e33bc3c4e	golang.org/x/net@v0.19.0 stdlib@go1.21.7	0.60.0 1.26.9	2
assistiot/fl_repository_db :latest	ad8f72108636	golang.org/x/net@v0.12.0 stdlib@go1.17.10	0.60.0 1.26.9	2
ayushsobti/kube-monkey :v0.5.2	4c94e8f8924e	golang.org/x/net@v0.0.0-20220520000938-2e3eb7b945c2 stdlib@go1.18.9	0.60.0 1.26.9	2
binwiederhier/ntfy :v2.11.0	4a7d0f0adc6d	golang.org/x/net@v0.25.0 stdlib@go1.22.2	0.60.0 1.26.9	2
binwiederhier/ntfy :v2.29.0	4c599cf08189	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	2
bitnami/git :latest	27e3b3fe7123	golang.org/x/net@v0.57.0 stdlib@go1.26.8	0.60.0 1.26.9	2
bitnamilegacy/elasticsearch :9.1.2-debian-12-r0	00176a47afa0	golang.org/x/net@v0.42.0 stdlib@go1.24.6	0.60.0 1.26.9	2
bitnamilegacy/influxdb :2.6.1-debian-11-r18	d17df1f9d745	golang.org/x/net@v0.0.0-20220617184016-355a448f1bc9 stdlib@go1.19.6	0.60.0 1.26.9	2
bitnamilegacy/kubectl :1.26.4	a0a972324d93	golang.org/x/net@v0.7.0 stdlib@go1.19.8	0.60.0 1.26.9	2
bitnamilegacy/mariadb :11.4.5-debian-12-r9	33ce23601fc9	stdlib@go1.23.7	1.26.9	2
bitnamilegacy/mongodb :4.4.1	4fe2bd7b4036	stdlib@go1.15.1	1.26.9	2
bitnamilegacy/postgresql :14.4.0-debian-11-r23	7e7ebb082031	stdlib@go1.16.7	1.26.9	2
bitnamilegacy/redis :latest	5927ff3702df	stdlib@go1.24.5	1.26.9	2
bitnamilegacy/zookeeper :3.9.0-debian-11-r11	10ed1ea3c8d1	stdlib@go1.19.12	1.26.9	2
bitnami/redis :latest	33a5a129cadc	stdlib@go1.26.8	1.26.9	2
bitnamisecure/git	72ae5bd9715f	golang.org/x/net@v0.38.0 stdlib@go1.24.6	0.60.0 1.26.9	2
bitpoke/mysql-operator :v0.6.3	f44fa86ab27e	golang.org/x/net@v0.8.0 stdlib@go1.17.13	0.60.0 1.26.9	2
bitpoke/mysql-operator-orchestrator :v0.6.3	d86560c75bed	golang.org/x/net@v0.8.0 stdlib@go1.19.9	0.60.0 1.26.9	2
bloomberg/goldpinger :3.11.5	f7c60d319150	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	2
burningalchemist/sql_exporter :0.24.9 :latest	6c554722facc	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9	2
cagriekin/pg-ha :2.1.0-pg18	111ccc617ce7	golang.org/x/net@v0.58.0 stdlib@go1.25.12	0.60.0 1.26.9	2
casbin/casdoor :3.62.1	7729da148c61	golang.org/x/net@v0.49.0 stdlib@go1.25.8	0.60.0 1.26.9	2
cesanta/docker_auth :1.6.0	4d16885f3d4c	golang.org/x/net@v0.0.0-20190813141303-74dc4d7220e7 stdlib@go1.13.7	0.60.0 1.26.9	2
chankh/k8s-cloudwatch-adapter :v0.9.0	963c44c7f8b1	golang.org/x/net@v0.0.0-20200202094626-16171245cfb2 stdlib@go1.14.5	0.60.0 1.26.9	2
chrislusf/seaweedfs :2.92	db095fe8a8d6	golang.org/x/net@v0.0.0-20210813160813-60bc85c4be6d stdlib@go1.17.7	0.60.0 1.26.9	2
clickhouse/clickhouse-server :24.2	ed9640bfff07	stdlib@go1.19.10	1.26.9	2
cloudflare/cloudflared :2022.1.3	61f608cd1123	golang.org/x/net@v0.0.0-20220114011407-0dd24b26b47d stdlib@go1.17.1	0.60.0 1.26.9	2
cloudflare/cloudflared :2026.6.1	6d91c121b803	golang.org/x/net@v0.55.0 stdlib@go1.26.4	0.60.0 1.26.9	2
containersol/locust_exporter :v0.4.1	a914972d19ad	stdlib@go1.15.8	1.26.9	2
coredns/coredns :1.13.1	9b9128672209	golang.org/x/net@v0.45.0 stdlib@go1.25.2	0.60.0 1.26.9	2
crate/crate_adapter :latest	b8d89fa5d19b	golang.org/x/net@v0.0.0-20210423184538-5f58ad60dda6 stdlib@go1.16.3	0.60.0 1.26.9	2