StackRadar

CVE-2026-78663

Critical

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
Critical
worst across findings
CVSS
9.1
base score, highest
EPSS
0.006
46th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
5,334
of 18,117 indexed, latest versions
Container images
6,152
deployed by those charts
Fix available
3 of 5
affected packages

Double flow control refund on HTTP/2 server streams in net/http

Carried by container images the latest versions of 5,334 of 18,117 indexed charts deploy, on 6,152 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+212 more1.26.9, 1.27.26,105
golang.org/x/netgolangv0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more0.60.04,915
golang-1.19deb1.19.8-2no fix listed1
ingress-nginx-controller-1.15apk1.15.10-r9no fix listed1
minioapk0.20251015.172955-r100.20260922.192518-r21
OSV records
CGA-23xx-p5rw-vrp9CGA-25j5-q798-fwm3DEBIAN-CVE-2026-78663GO-2026-6612
Also known as
CGA-qwrp-9ccr-5qpq, CGA-vqxj-4gp6-23v9
Trending
Rank 2 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,334 by stars
ChartLatestAffected imagesRadar Score
transfer.shobeoneVerified publisher1.0.51 of 1See more

transfer.sh obeone 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
dutchcoders/transfer.sh:v1.6.1-noroot8db9ade72a0d
golang.org/x/net@v0.17.0
stdlib@go1.20.11
0.60.0
1.26.9

Open the chart page →

1,862
oci-native-ingress-controlleroci-native-ingress-controller1.0.01 of 1See more

oci-native-ingress-controller oci-native-ingress-controller 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
amaanx86/oci-native-ingress-controller:masterd7206ac7a319
golang.org/x/net@v0.36.0
stdlib@go1.23.7
0.60.0
1.26.9

Open the chart page →

945
ociregistryociregistryVerified publisher1.20.01 of 1See more

ociregistry ociregistry 1.20.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
quay.io/appzygy/ociregistry:1.20.052cfc157ed62
golang.org/x/net@v0.58.0
stdlib@go1.27.1
0.60.0
1.27.2

Open the chart page →

213
growthbookone-acre-fundVerified publisher0.3.01 of 3See more

growthbook one-acre-fund 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
jwilder/dockerize:latestf94fb59fb4f6
golang.org/x/net@v0.47.0
stdlib@go1.25.5
0.60.0
1.26.9

Open the chart page →

1,834
oom-oracleoom-oracleVerified publisher0.1.21 of 1See more

oom-oracle oom-oracle 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/ethan-kane-ops/k8s-pod-oom-oracle:0.1.2538ed30a4c62
golang.org/x/net@v0.57.0
stdlib@go1.26.8
0.60.0
1.26.9

Open the chart page →

209
open5gs-hssopen5gs-hssVerified publisher2.3.31 of 2See more

open5gs-hss open5gs-hss 2.3.3

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
bitnami/mongodb:latestad05bb9a19fa
golang.org/x/net@v0.59.0
stdlib@go1.26.8
0.60.0
1.26.9

Open the chart page →

701
open5gs-pcrfopen5gs-pcrfVerified publisher2.3.31 of 2See more

open5gs-pcrf open5gs-pcrf 2.3.3

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
bitnami/mongodb:latestad05bb9a19fa
golang.org/x/net@v0.59.0
stdlib@go1.26.8
0.60.0
1.26.9

Open the chart page →

701
open5gs-scpopen5gs-scpVerified publisher2.3.41 of 2See more

open5gs-scp open5gs-scp 2.3.4

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
bitnami/mongodb:latestad05bb9a19fa
golang.org/x/net@v0.59.0
stdlib@go1.26.8
0.60.0
1.26.9

Open the chart page →

701
open5gs-udropen5gs-udrVerified publisher2.3.41 of 2See more

open5gs-udr open5gs-udr 2.3.4

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
bitnami/mongodb:latestad05bb9a19fa
golang.org/x/net@v0.59.0
stdlib@go1.26.8
0.60.0
1.26.9

Open the chart page →

701
open5gs-webuiopen5gs-webuiVerified publisher2.3.31 of 2See more

open5gs-webui open5gs-webui 2.3.3

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:4.4.14fe2bd7b4036
stdlib@go1.15.1
1.26.9

Open the chart page →

7,192
openccuopenccuVerified publisher3.89.111 of 1See more

openccu openccu 3.89.11

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/openccu/openccu:3.89.11.202609193cfcb30e1921
golang.org/x/net@v0.56.0
stdlib@go1.26.6
0.60.0
1.26.9

Open the chart page →

1,929
kruiseopenkruise1.9.12 of 2See more

kruise openkruise 1.9.1

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
openkruise/kruise-helm-hook:v0.1.0edc7cf9428fd
golang.org/x/net@v0.24.0
stdlib@go1.20.14
0.60.0
1.26.9
openkruise/kruise-manager:v1.9.1f81ae78a36a4
golang.org/x/net@v0.38.0
stdlib@go1.23.9
0.60.0
1.26.9

Open the chart page →

2,877
openobserveopenobserve1.0.25 of 6See more

openobserve openobserve 1.0.2

5 of the 6 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
library/nats:2.14.2-alpine952d157e28d5
stdlib@go1.26.3
1.26.9
natsio/nats-box:0.19.7ffce8bd10338
golang.org/x/net@v0.53.0
stdlib@go1.26.3
0.60.0
1.26.9
natsio/nats-server-config-reloader:0.23.064cb6c858e79
stdlib@go1.25.6
1.26.9
natsio/prometheus-nats-exporter:0.20.14fbf6dacb847
stdlib@go1.26.3
1.26.9
openfga/openfga:latest9cf9a20af32a
golang.org/x/net@v0.59.0
stdlib@go1.26.8
0.60.0
1.26.9

Open the chart page →

4,501
openrouter-botopenrouter-botVerified publisher0.2.01 of 1See more

openrouter-bot openrouter-bot 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
lifailon/openrouter-bot:latestea37e4b6b952
stdlib@go1.25.0
1.26.9

Open the chart page →

1,468
librechatopenshift1.9.01 of 3See more

librechat openshift 1.9.0

1 of the 3 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
library/mongo:8.0.20098862b1339f
golang.org/x/net@v0.47.0
stdlib@go1.25.7
0.60.0
1.26.9

Open the chart page →

6,842
openstack-kamaji-clusteropenstack-kamaji-clusterVerified publisher0.2.41 of 1See more

openstack-kamaji-cluster openstack-kamaji-cluster 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
registry.k8s.io/autoscaling/cluster-autoscaler:v1.34.07b172f42533c
golang.org/x/net@v0.38.0
stdlib@go1.24.7
0.60.0
1.26.9

Open the chart page →

1,266
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.410See more

opentelemetry-demo opentelemetry-helm 0.42.4

10 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
grafana/grafana:13.2.2-distroless69a5d2d957ca
golang.org/x/net@v0.56.0
stdlib@go1.26.7
0.60.0
1.26.9
jaegertracing/jaeger:2.20.046a886260e04
golang.org/x/net@v0.56.0
stdlib@go1.26.5
0.60.0
1.26.9
library/postgres:18.4a02db8cac496
stdlib@go1.24.6
1.26.9
otel/opentelemetry-collector-contrib:0.160.0799dc6cf12c9
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9
ghcr.io/open-feature/flagd:v0.16.032234e63c1d0
golang.org/x/net@v0.52.0
stdlib@go1.25.10
0.60.0
1.26.9
ghcr.io/open-telemetry/demo:3.1.0-cart17c881cf29af
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9
ghcr.io/open-telemetry/demo:3.1.0-opamp-server3b6c6220bf9c
stdlib@go1.27.1
1.27.2
ghcr.io/open-telemetry/demo:3.1.0-product-catalog7578cbf65fa4
golang.org/x/net@v0.58.0
stdlib@go1.27.1
0.60.0
1.27.2
ghcr.io/open-telemetry/demo:3.1.0-checkoutd4448ff54129
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9
quay.io/prometheus/prometheus:v3.14.05ce7540c3c00
golang.org/x/net@v0.57.0
stdlib@go1.26.6
0.60.0
1.26.9

Open the chart page →

—
openvaultopenvaultVerified publisher0.9.01 of 2See more

openvault openvault 0.9.0

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-frontend:v1.1.0bfc3118f6565
stdlib@go1.23.7
1.26.9

Open the chart page →

8,177
openvox-operatoropenvox-operatorVerified publisher0.14.01 of 1See more

openvox-operator openvox-operator 0.14.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/slauger/openvox-operator:0.14.0178b6dab6c8c
golang.org/x/net@v0.59.0
stdlib@go1.27.1
0.60.0
1.27.2

Open the chart page →

252
opikopikOfficialVerified publisher2.2.995See more

opik opik 2.2.99

5 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
alpine/kubectl:1.35.0862d86046bbc
golang.org/x/net@v0.47.0
stdlib@go1.25.5
0.60.0
1.26.9
altinity/clickhouse-operator:0.27.1a802b3a19d20
golang.org/x/net@v0.55.0
stdlib@go1.26.3
0.60.0
1.26.9
cloudpirates/image-minio:RELEASE.2025-10-15T17-29-55Z-hardened8dc02a7e5093
golang.org/x/net@v0.47.0
stdlib@go1.25.7
0.60.0
1.26.9
library/mysql:8.4.2ac80b6e09e5b
stdlib@go1.18.2
1.26.9
library/zookeeper:3.9.4dfa9ba46d14b
stdlib@go1.18.1
1.26.9

Open the chart page →

—
opsopsVerified publisher1.2.02 of 2See more

ops ops 1.2.0

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
shaowenchen/ops-controller-manager:latest35575d4f2bfe
golang.org/x/net@v0.39.0
stdlib@go1.24.13
0.60.0
1.26.9
shaowenchen/ops-server:latest6bac5cebd125
golang.org/x/net@v0.39.0
stdlib@go1.24.9
0.60.0
1.26.9

Open the chart page →

100,506
orbitalregorbitalregVerified publisher0.4.13 of 5See more

orbitalreg orbitalreg 0.4.1

3 of the 5 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
stdlib@go1.24.6
1.26.9
orbitalreg/orbitalreg-api:0.4.11a333a6b052c
golang.org/x/net@v0.57.0
stdlib@go1.25.14
0.60.0
1.26.9
orbitalreg/orbitalreg-scanner:0.4.17f05b3fdd78c
golang.org/x/net@v0.57.0
stdlib@go1.25.14
0.60.0
1.26.9

Open the chart page →

5,507
kubernetes-dashboard-proxyosc0.7.23 of 4See more

kubernetes-dashboard-proxy osc 0.7.2

3 of the 4 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
kubernetesui/dashboard:v2.7.02e500d29e9d5
golang.org/x/net@v0.0.0-20220722155237-a158d28d115b
stdlib@go1.19
0.60.0
1.26.9
kubernetesui/metrics-scraper:v1.0.876049887f07a
golang.org/x/net@v0.0.0-20220524220425-1d687d428aca
stdlib@go1.18.2
0.60.0
1.26.9
quay.io/oauth2-proxy/oauth2-proxy:v7.1.3ecd26b74a01f
golang.org/x/net@v0.0.0-20200707034311-ab3426394381
stdlib@go1.16
0.60.0
1.26.9

Open the chart page →

9,137
osc-bsu-csi-driverosc-bsu-csi-driverVerified publisher2.2.06 of 6See more

osc-bsu-csi-driver osc-bsu-csi-driver 2.2.0

6 of the 6 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
outscale/osc-bsu-csi-driver:v1.12.063871940b621
golang.org/x/net@v0.58.0
stdlib@go1.27.1
0.60.0
1.27.2
registry.k8s.io/sig-storage/csi-attacher:v4.12.0b9dc9a714a48
golang.org/x/net@v0.54.0
stdlib@go1.26.3
0.60.0
1.26.9
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.15.011f199f6bec4
golang.org/x/net@v0.40.0
stdlib@go1.24.6
0.60.0
1.26.9
registry.k8s.io/sig-storage/csi-provisioner:v6.1.1d992c36d4ddd
golang.org/x/net@v0.43.0
stdlib@go1.24.6
0.60.0
1.26.9
registry.k8s.io/sig-storage/csi-resizer:v2.2.1ea1d25e23479
golang.org/x/net@v0.55.0
stdlib@go1.26.3
0.60.0
1.26.9
registry.k8s.io/sig-storage/livenessprobe:v2.16.088092d100909
golang.org/x/net@v0.40.0
stdlib@go1.24.2
0.60.0
1.26.9

Open the chart page →

4,749
httpbinowan-charts0.1.91 of 1See more

httpbin owan-charts 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
mccutchen/go-httpbin:latest20739736d4eb
stdlib@go1.26.5
1.26.9

Open the chart page →

255
hlf-caowkin2.1.02 of 2See more

hlf-ca owkin 2.1.0

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
hyperledger/fabric-ca:1.5.1c7f3422ec1d5
golang.org/x/net@v0.0.0-20201006153459-a7d1128ccaa0
stdlib@go1.15.7
0.60.0
1.26.9
jwilder/dockerize:latestf94fb59fb4f6
golang.org/x/net@v0.47.0
stdlib@go1.25.5
0.60.0
1.26.9

Open the chart page →

5,076
hlf-ordowkin3.1.01 of 1See more

hlf-ord owkin 3.1.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
hyperledger/fabric-orderer:2.2.137294e05209b
golang.org/x/net@v0.0.0-20190620200207-3b0461eec859
stdlib@go1.14.4
0.60.0
1.26.9

Open the chart page →

4,620
hlf-peerowkin5.1.01 of 1See more

hlf-peer owkin 5.1.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
hyperledger/fabric-peer:2.2.1bf4995c86af6
golang.org/x/net@v0.0.0-20190620200207-3b0461eec859
stdlib@go1.14.4
0.60.0
1.26.9

Open the chart page →

4,990
prometheus-cachethqoxyno-zetaVerified publisher1.1.11 of 1See more

prometheus-cachethq oxyno-zeta 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
oxynozeta/prometheus-cachethq:1.1.131f11669d597
stdlib@go1.15.1
1.26.9

Open the chart page →

2,778
p10logsp10logsOfficialVerified publisher1.1.42 of 2See more

p10logs p10logs 1.1.4

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/p10node/p10logs-agent:1.1.44bc72bd8ff5a
stdlib@go1.26.8
1.26.9
ghcr.io/p10node/p10logs-hub:1.1.44385afd18845
stdlib@go1.26.8
1.26.9

Open the chart page →

296
ngrok-operatorpaganuzzi0.0.21 of 1See more

ngrok-operator paganuzzi 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/paganuzzi/ngrokoperator:latest5a10cd095699
golang.org/x/net@v0.0.0-20200301022130-244492dfa37a
stdlib@go1.15.12
0.60.0
1.26.9

Open the chart page →

4,018
palworldpalworld-server-chartVerified publisher2.7.11 of 1See more

palworld palworld-server-chart 2.7.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
thijsvanloef/palworld-server-docker:v2.7.1401d3eb5c053
stdlib@go1.25.12
1.26.9

Open the chart page →

4,573
prowlarrpanzer1119Verified publisher0.4.181 of 2See more

prowlarr panzer1119 0.4.18

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
bitnami/kubectl:latestf7f9e4f64d9e
golang.org/x/net@v0.57.0
stdlib@go1.26.8
0.60.0
1.26.9

Open the chart page →

1,235
paperless-ngxpaperlessVerified publisher0.4.01 of 3See more

paperless-ngx paperless 0.4.0

1 of the 3 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngxdigest-pinnedaa810a36942c
stdlib@go1.24.4
1.26.9

Open the chart page →

11,079
pardus-nginx-nodeportpardus-charts0.5.01 of 1See more

pardus-nginx-nodeport pardus-charts 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
uderelier19/pardus-nginx:25-nodeport8ab640b44e3f
stdlib@go1.24.4
1.26.9

Open the chart page →

703
uptime-kumapascaliskeVerified publisher3.0.01 of 1See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
golang.org/x/net@v0.40.0
stdlib@go1.20.5
0.60.0
1.26.9

Open the chart page →

8,528
patch-operatorpatch-operator0.1.112 of 2See more

patch-operator patch-operator 0.1.11

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
quay.io/redhat-cop/kube-rbac-proxy:v0.11.0c68135620167
golang.org/x/net@v0.0.0-20200707034311-ab3426394381
stdlib@go1.15.15
0.60.0
1.26.9
quay.io/redhat-cop/patch-operator:v0.1.11030ade9b9428
golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd
stdlib@go1.21.9
0.60.0
1.26.9

Open the chart page →

9,778
pbuf-registrypbuf-registry0.4.12 of 2See more

pbuf-registry pbuf-registry 0.4.1

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
library/postgres:18.1-alpine3.2144d837eb4c2e
stdlib@go1.24.6
1.26.9
ghcr.io/pbufio/registry:v0.4.177a36c035b4b
golang.org/x/net@v0.45.0
stdlib@go1.25.5
0.60.0
1.26.9

Open the chart page →

3,012
pdf-editor-helmpdf-editor-web1.0.02 of 4See more

pdf-editor-helm pdf-editor-web 1.0.0

2 of the 4 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
dipugodocker/pdf-editor:1.0-backend-rotate316e203b8bf5
stdlib@go1.18.7
1.26.9
dipugodocker/pdf-editor:1.0-backend-merge70b07544a604
stdlib@go1.18.7
1.26.9

Open the chart page →

5,722
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
stdlib@go1.24.4
1.26.9

Open the chart page →

8,710
pg-operatorpercona3.1.01 of 1See more

pg-operator percona 3.1.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
percona/percona-postgresql-operator:3.1.0a7c50ef1545e
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9

Open the chart page →

326
periscopeperiscopeVerified publisher1.1.61 of 1See more

periscope periscope 1.1.6

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/gnana997/periscope:1.1.621b284fb00f2
golang.org/x/net@v0.55.0
stdlib@go1.26.4
0.60.0
1.26.9

Open the chart page →

1,348
perspectivegraphperspectivegraphOfficialVerified publisher1.38.01 of 5See more

perspectivegraph perspectivegraph 1.38.0

1 of the 5 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
library/nats:2.15.0-scratchc0d27f305460
stdlib@go1.27.1
1.27.2

Open the chart page →

156
pgbouncerpgbouncer-helm0.6.01 of 2See more

pgbouncer pgbouncer-helm 0.6.0

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
apache/airflow:airflow-pgbouncer-exporter-2025.03.05-0.18.0adf7260c2c5f
stdlib@go1.23.7
1.26.9

Open the chart page →

877
spirephilips-labsVerified publisher0.12.25 of 6See more

spire philips-labs 0.12.2

5 of the 6 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/spiffe/spiffe-csi-driver:0.2.34144101005b2
golang.org/x/net@v0.7.0
stdlib@go1.20.1
0.60.0
1.26.9
ghcr.io/spiffe/spire-agent:1.6.062517726d0c4
golang.org/x/net@v0.7.0
stdlib@go1.20.1
0.60.0
1.26.9
ghcr.io/spiffe/spire-controller-manager:0.2.25e90b2d092df
golang.org/x/net@v0.7.0
stdlib@go1.20.1
0.60.0
1.26.9
ghcr.io/spiffe/spire-server:1.6.0635b9024cad2
golang.org/x/net@v0.7.0
stdlib@go1.20.1
0.60.0
1.26.9
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.6.2a13bff2ed69a
golang.org/x/net@v0.0.0-20220722155237-a158d28d115b
stdlib@go1.19
0.60.0
1.26.9

Open the chart page →

11,391
full-housephilmtd1.3.21 of 1See more

full-house philmtd 1.3.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
philmtd/full-house:1.10.0224d602420ba
golang.org/x/net@v0.59.0
stdlib@go1.26.3
0.60.0
1.26.9

Open the chart page →

374
chadbotphntom0.2.31 of 1See more

chadbot phntom 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
phntom/chadbot:0.2.397c28e4178ad
golang.org/x/net@v0.11.0
stdlib@go1.21.5
0.60.0
1.26.9

Open the chart page →

1,767
chartmuseumphntom4.0.201 of 1See more

chartmuseum phntom 4.0.20

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
phntom/chartmuseum:v0.16.053883b65d9b7
golang.org/x/net@v0.10.0
stdlib@go1.19.3
0.60.0
1.26.9

Open the chart page →

3,835
matterircdphntom0.1.71 of 2See more

matterircd phntom 0.1.7

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
42wim/matterircd:latest23c951580801
golang.org/x/net@v0.58.0
stdlib@go1.27.1
0.60.0
1.27.2

Open the chart page →

251
phonebook-chartphonebook-chart0.1.01 of 3See more

phonebook-chart phonebook-chart 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
stdlib@go1.18.2
1.26.9

Open the chart page →

3,894

Container images carrying it

6,152 by charts deploying them

A fixed version is listed for 3 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/opnpulse/prom-label-proxy:v2026.9.2247afd6372838
golang.org/x/net@v0.52.0
stdlib@go1.25.14
0.60.0
1.26.9
1
ghcr.io/opnpulse/tenant-operator:v0.0.38fe9b4157ed2
golang.org/x/net@v0.54.0
stdlib@go1.25.14
0.60.0
1.26.9
1
ghcr.io/opnpulse/thanos-operator:v2026.4.24e05a3e701291
golang.org/x/net@v0.49.0
stdlib@go1.26.2
0.60.0
1.26.9
1
ghcr.io/orkspace/orkestra:0.7.1863356a41fbef
golang.org/x/net@v0.59.0
stdlib@go1.26.6
0.60.0
1.26.9
1
ghcr.io/orkspace/orkestra-cc:0.7.18ebb9654ac4d2
stdlib@go1.26.6
1.26.9
1
ghcr.io/oscrx/tlsa-dnsendpoint-controllerddd9b71b2d98
golang.org/x/net@v0.58.0
0.60.0
1
ghcr.io/ot-container-kit/redis-operator/redis-operator:v0.18.090bfeb2e0d71
golang.org/x/net@v0.24.0
stdlib@go1.21.12
0.60.0
1.26.9
1
ghcr.io/ownkube/kubernetes-events-exporter:0.1.2bcb7f0f733f5
golang.org/x/net@v0.53.0
stdlib@go1.26.2
0.60.0
1.26.9
1
ghcr.io/oxidecomputer/cluster-api-provider-oxide:0.2.37b05d3bbfbfa
golang.org/x/net@v0.56.0
stdlib@go1.26.4
0.60.0
1.26.9
1
ghcr.io/p10node/p10logs-agent:1.1.44bc72bd8ff5a
stdlib@go1.26.8
1.26.9
1
ghcr.io/p10node/p10logs-hub:1.1.44385afd18845
stdlib@go1.26.8
1.26.9
1
ghcr.io/paganuzzi/ngrokoperator:latest5a10cd095699
golang.org/x/net@v0.0.0-20200301022130-244492dfa37a
stdlib@go1.15.12
0.60.0
1.26.9
1
ghcr.io/pansalut/koffan:v2.13.12c4dfb1458e6
stdlib@go1.26.6
1.26.9
1
ghcr.io/paperclipinc/hermes-operator:v0.2.07a491ec9b0ff
golang.org/x/net@v0.58.0
stdlib@go1.27.1
0.60.0
1.27.2
1
ghcr.io/paperclipinc/openclaw-operator:v0.40.038e0da31c520
golang.org/x/net@v0.55.0
stdlib@go1.25.14
0.60.0
1.26.9
1
ghcr.io/paperclipinc/paperclip-operator:v0.19.10984b890eb38
golang.org/x/net@v0.55.0
stdlib@go1.25.0
0.60.0
1.26.9
1
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
stdlib@go1.19.8
1.26.9
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
stdlib@go1.24.4
1.26.9
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
stdlib@go1.24.4
1.26.9
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
stdlib@go1.24.4
1.26.9
1
ghcr.io/paperless-ngx/paperless-ngx:2.10.1a132c2ac7c57
stdlib@go1.19.8
1.26.9
1
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
stdlib@go1.19.8
1.26.9
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
stdlib@go1.24.4
1.26.9
1
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
stdlib@go1.20.7
1.26.9
1
ghcr.io/parca-dev/parca:v0.24.23776500fde82
golang.org/x/net@v0.43.0
stdlib@go1.25.1
0.60.0
1.26.9
1
ghcr.io/parca-dev/parca-agent:v0.28.06d6794f45f3e
golang.org/x/net@v0.19.0
stdlib@go1.21.4
0.60.0
1.26.9
1
ghcr.io/parca-dev/parca-agent:v0.42.0adc0eeb4dd05
golang.org/x/net@v0.43.0
stdlib@go1.24.7
0.60.0
1.26.9
1
ghcr.io/parmincloud/arvancloud-certmanager-issuer:v1.0.1e58c98b4d28a
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9
1
ghcr.io/patricklaabs/sample-application:0.0.1f0935fa2eee3
stdlib@go1.22.0
1.26.9
1
ghcr.io/pbufio/registry:v0.4.177a36c035b4b
golang.org/x/net@v0.45.0
stdlib@go1.25.5
0.60.0
1.26.9
1
ghcr.io/peak-scale/capsule-argo-addon:0.8.064b8c5389b33
golang.org/x/net@v0.59.0
stdlib@go1.27.1
0.60.0
1.27.2
1
ghcr.io/peak-scale/observability-tenancy/cortex-proxy:0.4.11838720c13b2
golang.org/x/net@v0.43.0
stdlib@go1.24.6
0.60.0
1.26.9
1
ghcr.io/peak-scale/observability-tenancy/loki-proxy:0.4.1548e962d0061
golang.org/x/net@v0.43.0
stdlib@go1.24.6
0.60.0
1.26.9
1
ghcr.io/peak-scale/sops-operator:0.10.11da9b716b792
golang.org/x/net@v0.57.0
stdlib@go1.26.4
0.60.0
1.26.9
1
ghcr.io/peimanja/artifactory_exporter:v1.16.0d3e3929a3d2b
stdlib@go1.21.13
1.26.9
1
ghcr.io/perceptolab/devops-demo-app:0.0.2cdc0658c40fb
golang.org/x/net@v0.0.0-20220909164309-bea034e7d591
stdlib@go1.18.4
0.60.0
1.26.9
1
ghcr.io/performancecopilot/archive-analysis:latest8bb7902a3e4b
golang.org/x/net@v0.19.0
0.60.0
1
ghcr.io/permify/permify:v1.3.5f0c6f7d7daa6
golang.org/x/net@v0.26.0
stdlib@go1.22.4
0.60.0
1.26.9
1
ghcr.io/petersr/spiffile-operator:0.1.4411070249287
golang.org/x/net@v0.55.0
stdlib@go1.26.4
0.60.0
1.26.9
1
ghcr.io/pgdogdev/pgdog:v0.1.6025d1908886f5
stdlib@go1.26.7
1.26.9
1
ghcr.io/phoeluga/synology-proxy-operator:0.0.9a0b74674d0e3
golang.org/x/net@v0.59.0
stdlib@go1.27.1
0.60.0
1.27.2
1
ghcr.io/pierinho13/github-platform-operator:v0.7.9cd69de76b3d2
golang.org/x/net@v0.59.0
0.60.0
1
ghcr.io/pii-shield/pii-shield-operator:2.2.71d21a4b3683c
golang.org/x/net@v0.57.0
stdlib@go1.27.1
0.60.0
1.27.2
1
ghcr.io/pipe-cd/pipecd:v0.39.00fae829caf29
golang.org/x/net@v0.0.0-20191014212845-da9a3fd4c582
stdlib@go1.14.6
0.60.0
1.26.9
1
ghcr.io/platform-mesh/platform-mesh/account-operator:v0.15.5fa4923226063
golang.org/x/net@v0.57.0
stdlib@go1.26.7
0.60.0
1.26.9
1
ghcr.io/platform-mesh/platform-mesh/extension-manager-operator:v0.10.09371fcf05f76
golang.org/x/net@v0.57.0
stdlib@go1.26.7
0.60.0
1.26.9
1
ghcr.io/platform-mesh/platform-mesh/kubernetes-graphql-gateway:v1.20.02e6c9c111893
golang.org/x/net@v0.57.0
stdlib@go1.26.7
0.60.0
1.26.9
1
ghcr.io/platform-mesh/platform-mesh/platform-mesh-operator:v0.89.0b26d85c68aa8
golang.org/x/net@v0.57.0
stdlib@go1.26.7
0.60.0
1.26.9
1
ghcr.io/platform-mesh/platform-mesh/rebac-authz-webhook:v0.12.0fbb6df9ad2af
golang.org/x/net@v0.57.0
stdlib@go1.26.7
0.60.0
1.26.9
1
ghcr.io/platform-mesh/platform-mesh/security-operator:v0.36.09b26032812fd
golang.org/x/net@v0.57.0
stdlib@go1.26.7
0.60.0
1.26.9
1

syft 1.42.1 · advisories as of 13 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.