StackRadar

CVE-2026-78663

Critical

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
Critical
worst across findings
CVSS
9.1
base score, highest
EPSS
0.006
46th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
5,384
of 18,108 indexed, latest versions
Container images
6,227
deployed by those charts
Fix available
3 of 5
affected packages

Double flow control refund on HTTP/2 server streams in net/http

Carried by container images the latest versions of 5,384 of 18,108 indexed charts deploy, on 6,227 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+212 more1.26.9, 1.27.26,174
golang.org/x/netgolangv0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more0.60.04,974
golang-1.19deb1.19.8-2no fix listed1
ingress-nginx-controller-1.15apk1.15.10-r9no fix listed1
minioapk0.20251015.172955-r100.20260922.192518-r21
OSV records
CGA-23xx-p5rw-vrp9CGA-25j5-q798-fwm3DEBIAN-CVE-2026-78663GO-2026-6612
Also known as
CGA-qwrp-9ccr-5qpq, CGA-vqxj-4gp6-23v9
Trending
Rank 2 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,384 by stars
ChartLatestAffected imagesRadar Score
nebraskanebraska3.0.01 of 2See more

nebraska nebraska 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/flatcar/nebraska:4.0.05c9e99ff7167
golang.org/x/net@v0.44.0
stdlib@go1.24.13
0.60.0
1.26.9

Open the chart page →

5,019
netbird-api-exporternetbird-api-exporterVerified publisher0.2.181 of 1See more

netbird-api-exporter netbird-api-exporter 0.2.18

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/matanbaruch/netbird-api-exporter:0.2.176d259e3a81a3
stdlib@go1.27.1
1.27.2

Open the chart page →

161
netbird-operatornetbird-operator0.8.01 of 1See more

netbird-operator netbird-operator 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/netbirdio/netbird-operator:v0.8.0ae2c26cfc547
golang.org/x/net@v0.56.0
stdlib@go1.26.5
0.60.0
1.26.9

Open the chart page →

329
keycloak-operatornewsaktuell0.1.71 of 1See more

keycloak-operator newsaktuell 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak-operator:19.0.3-legacy09d52508fee9
golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b
stdlib@go1.13.8
0.60.0
1.26.9

Open the chart page →

6,417
mstreamnicholaswildeVerified publisher2.1.21 of 1See more

mstream nicholaswilde 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/mstream:version-v5.2.522c012bcc43c
golang.org/x/net@v0.0.0-20190827160401-ba9fcec4b297
stdlib@go1.15.5
0.60.0
1.26.9

Open the chart page →

5,894
gateway-apinicklasfrahm-gateway-apiVerified publisher0.2.01 of 1See more

gateway-api nicklasfrahm-gateway-api 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
alpine/kubectl:1.33.32c59a3f0726c
golang.org/x/net@v0.38.0
stdlib@go1.24.4
0.60.0
1.26.9

Open the chart page →

1,786
observalobservalVerified publisher1.14.02 of 8See more

observal observal 1.14.0

2 of the 8 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
bitnami/kubectl:latestf7f9e4f64d9e
golang.org/x/net@v0.57.0
stdlib@go1.26.8
0.60.0
1.26.9
library/postgres:161a6ab3f5345e
stdlib@go1.24.6
1.26.9

Open the chart page →

6,755
aws-xrayokgoloveVerified publisher5.0.01 of 1See more

aws-xray okgolove 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
public.ecr.aws/xray/aws-xray-daemon:3.6.243d051eed000
golang.org/x/net@v0.38.0
stdlib@go1.25.7
0.60.0
1.26.9

Open the chart page →

674
olivetinolivetinOfficialVerified publisher4.0.01 of 1See more

olivetin olivetin 4.0.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
jamesread/olivetin:3000.19.0af9d7c4db6dc
golang.org/x/net@v0.57.0
stdlib@go1.26.5
0.60.0
1.26.9

Open the chart page →

755
flagsmithone-acre-fundVerified publisher0.1.51 of 6See more

flagsmith one-acre-fund 0.1.5

1 of the 6 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
jwilder/dockerize:latestf94fb59fb4f6
golang.org/x/net@v0.47.0
stdlib@go1.25.5
0.60.0
1.26.9

Open the chart page →

8,117
kobotoolboxone-acre-fundVerified publisher0.7.42 of 9See more

kobotoolbox one-acre-fund 0.7.4

2 of the 9 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
enketo/enketo-express:3.0.4dcad9c2273f6
stdlib@go1.17.1
1.26.9
jwilder/dockerize:latestf94fb59fb4f6
golang.org/x/net@v0.47.0
stdlib@go1.25.5
0.60.0
1.26.9

Open the chart page →

24,115
secrets-injectoronepassword-connect1.2.01 of 1See more

secrets-injector onepassword-connect 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
1password/kubernetes-secrets-injector:1.0.25884757f7879
golang.org/x/net@v0.8.0
stdlib@go1.20.5
0.60.0
1.26.9

Open the chart page →

1,590
opentelemetry-ebpfopentelemetry-helmOfficialVerified publisher0.1.71 of 4See more

opentelemetry-ebpf opentelemetry-helm 0.1.7

1 of the 4 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
otel/opentelemetry-ebpf-k8s-watcher:v0.10.263a0d1dd2cac
golang.org/x/net@v0.7.0
stdlib@go1.20
0.60.0
1.26.9

Open the chart page →

3,765
opentelemetry-ebpf-instrumentationopentelemetry-helmOfficialVerified publisher0.14.31 of 1See more

opentelemetry-ebpf-instrumentation opentelemetry-helm 0.14.3

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/opentelemetry-ebpf-instrumentation/ebpf-instrument:v0.14.00b063b9ec47e
golang.org/x/net@v0.59.0
stdlib@go1.27.0
0.60.0
1.27.2

Open the chart page →

213
oesopsmxVerified publisher4.0.328 of 25See more

oes opsmx 4.0.32

8 of the 25 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/awsgit:v2-openssh0d21ba756f44
stdlib@go1.17.2
1.26.9
quay.io/opsmxpublic/awsgit:v3-js15a6faada3d4
stdlib@go1.16.15
1.26.9
quay.io/opsmxpublic/create-secret:v4.0.4defc3263e0e9
golang.org/x/net@v0.7.0
stdlib@go1.20.3
0.60.0
1.26.9
quay.io/opsmxpublic/forwarder-controller:v3.5.7f0c5bebaec96
golang.org/x/net@v0.0.0-20220826154423-83b083e8dc8b
stdlib@go1.19.1
0.60.0
1.26.9
quay.io/opsmxpublic/opa:opa-sidecar-v1.03dcbf3caa454
golang.org/x/net@v0.38.0
stdlib@go1.24.11
0.60.0
1.26.9
quay.io/opsmxpublic/opa:1.12.084fb1af7401c
golang.org/x/net@v0.47.0
stdlib@go1.25.5
0.60.0
1.26.9
quay.io/opsmxpublic/rabbitmq:4.2-management3408107e5cc4
stdlib@go1.22.2
1.26.9
quay.io/opsmxpublic/spin-sample-pipeline:v1.0.1c6a934439421
golang.org/x/net@v0.0.0-20200226121028-0de0cce0169b
stdlib@go1.13.1
0.60.0
1.26.9

Open the chart page →

111,612
pacto-operatorpacto-operatorOfficialVerified publisher5.4.21 of 1See more

pacto-operator pacto-operator 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/trianalab/pacto/operator:5.4.2fc2c05866911
golang.org/x/net@v0.58.0
stdlib@go1.26.6
0.60.0
1.26.9

Open the chart page →

236
ipfs-clusterparadeum-teamVerified publisher0.0.192 of 2See more

ipfs-cluster paradeum-team 0.0.19

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ipfs/go-ipfs:v0.13.117259397f587
golang.org/x/net@v0.0.0-20220517181318-183a9ca12b87
stdlib@go1.18.3
0.60.0
1.26.9
ipfs/ipfs-cluster:1.0.21511f6d57994
golang.org/x/net@v0.0.0-20220517181318-183a9ca12b87
stdlib@go1.18.3
0.60.0
1.26.9

Open the chart page →

5,754
permifypermifyVerified publisher0.5.01 of 1See more

permify permify 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/permify/permify:v1.3.5f0c6f7d7daa6
golang.org/x/net@v0.26.0
stdlib@go1.22.4
0.60.0
1.26.9

Open the chart page →

1,593
persespersesOfficialVerified publisher0.23.31 of 1See more

perses perses 0.23.3

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
persesdev/perses:v0.54.0a0e34ddaf9d7
golang.org/x/net@v0.56.0
stdlib@go1.26.5
0.60.0
1.26.9

Open the chart page →

460
platzioplatz-ioVerified publisher0.6.51 of 2See more

platzio platz-io 0.6.5

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
platzio/backend:v0.6.5d5e5972f344b
golang.org/x/net@v0.38.0
stdlib@go1.24.3
0.60.0
1.26.9

Open the chart page →

3,655
plecopleco0.24.01 of 1See more

pleco pleco 0.24.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
public.ecr.aws/r3m4q3r9/pleco:0.24.0651739583336
golang.org/x/net@v0.39.0
stdlib@go1.21.6
0.60.0
1.26.9

Open the chart page →

2,060
ipmi-exporterpnnl-miscscripts0.1.151 of 1See more

ipmi-exporter pnnl-miscscripts 0.1.15

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
pnnlmiscscripts/ipmi-exporter:1.2.0-181e18992d8e3
stdlib@go1.13.10
1.26.9

Open the chart page →

4,380
pomeriumpomerium34.0.11 of 1See more

pomerium pomerium 34.0.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
pomerium/pomerium:v0.22.19c69b10a2126
golang.org/x/net@v0.9.0
stdlib@go1.20.3
0.60.0
1.26.9

Open the chart page →

2,914
prometheus-memcached-exporterprometheus-communityVerified publisher0.6.01 of 1See more

prometheus-memcached-exporter prometheus-community 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
prom/memcached-exporter:v0.17.0995c80e3ffbe
golang.org/x/net@v0.57.0
stdlib@go1.26.6
0.60.0
1.26.9

Open the chart page →

250
prometheus-pgbouncer-exporterprometheus-communityVerified publisher0.10.11 of 1See more

prometheus-pgbouncer-exporter prometheus-community 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
quay.io/prometheuscommunity/pgbouncer-exporter:v0.12.130f31b6c2efd
golang.org/x/net@v0.55.0
stdlib@go1.26.4
0.60.0
1.26.9

Open the chart page →

585
prometheus-systemd-exporterprometheus-communityVerified publisher0.5.21 of 1See more

prometheus-systemd-exporter prometheus-community 0.5.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
quay.io/prometheuscommunity/systemd-exporter:v0.7.078c03f875dfb
golang.org/x/net@v0.33.0
stdlib@go1.24.1
0.60.0
1.26.9

Open the chart page →

1,263
prometheus-yet-another-cloudwatch-exporterprometheus-communityVerified publisher0.48.01 of 1See more

prometheus-yet-another-cloudwatch-exporter prometheus-community 0.48.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
quay.io/prometheuscommunity/yet-another-cloudwatch-exporter:v0.68.0651b4041d9c3
stdlib@go1.26.8
1.26.9

Open the chart page →

148
kube-prometheus-stackprometheus-worawutchan12.8.04 of 6See more

kube-prometheus-stack prometheus-worawutchan 12.8.0

4 of the 6 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
grafana/grafana:7.2.1733842cca5bd
golang.org/x/net@v0.0.0-20200813134508-3edf25e44fcc
stdlib@go1.15.1
0.60.0
1.26.9
jettech/kube-webhook-certgen:v1.5.0fb7c2cd46ccf
golang.org/x/net@v0.0.0-20200707034311-ab3426394381
stdlib@go1.15.3
0.60.0
1.26.9
quay.io/prometheus-operator/prometheus-operator:v0.44.0983627001c89
golang.org/x/net@v0.0.0-20201006153459-a7d1128ccaa0
stdlib@go1.14.12
0.60.0
1.26.9
quay.io/prometheus/node-exporter:v1.0.1cf66a6bbd573
golang.org/x/net@v0.0.0-20200513185701-a91f0712d120
stdlib@go1.14.4
0.60.0
1.26.9

Open the chart page →

17,248
qgis-serverqgis-serverVerified publisher0.1.101 of 3See more

qgis-server qgis-server 0.1.10

1 of the 3 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/cloudnative-pg/cloudnative-pg:1.25.1b5210df46c05
golang.org/x/net@v0.35.0
stdlib@go1.24.0
0.60.0
1.26.9

Open the chart page →

6,438
nfs-server-provisionerraphaelVerified publisher1.3.01 of 1See more

nfs-server-provisioner raphael 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
gcr.io/k8s-staging-sig-storage/nfs-provisioner:v3.0.02de1d15fc1f2
golang.org/x/net@v0.0.0-20190812203447-cdfb69ac37fc
stdlib@go1.15
0.60.0
1.26.9

Open the chart page →

3,978
repoflowrepoflow-helm-public0.9.11 of 8See more

repoflow repoflow-helm-public 0.9.1

1 of the 8 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
library/postgres:16.24aea012537ed
stdlib@go1.18.2
1.26.9

Open the chart page →

14,540
wordpress-hardenedriotkit-org2.0.02 of 2See more

wordpress-hardened riotkit-org 2.0.0

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/riotkit-org/waf-proxy:snapshot683656fdace2
golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4
stdlib@go1.18.3
0.60.0
1.26.9
ghcr.io/riotkit-org/wordpress-hardened:v2.0edc6b69873be
stdlib@go1.17.9
1.26.9

Open the chart page →

8,507
backrestrobertobochetVerified publisher0.7.01 of 1See more

backrest robertobochet 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
garethgeorge/backrest:v1.14.1b85297975428
golang.org/x/net@v0.55.0
stdlib@go1.26.0
0.60.0
1.26.9

Open the chart page →

1,335
supabaserock8sVerified publisher0.0.61 of 1See more

supabase rock8s 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
library/postgres:15-alpinef7d23353e1b1
stdlib@go1.24.6
1.26.9

Open the chart page →

703
rqliterqliteOfficialVerified publisher2.0.01 of 1See more

rqlite rqlite 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
rqlite/rqlite:9.1.37b992a526eee
golang.org/x/net@v0.46.0
stdlib@go1.25.3
0.60.0
1.26.9

Open the chart page →

1,804
qbittorrent-vpnrtomik-helm-chartsVerified publisher0.0.21 of 2See more

qbittorrent-vpn rtomik-helm-charts 0.0.2

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
qmcgaw/gluetun:v3.40.02b42bfa04675
golang.org/x/net@v0.31.0
stdlib@go1.23.4
0.60.0
1.26.9

Open the chart page →

1,774
sabliersablier-helm-chartsOfficialVerified publisher1.8.11 of 1See more

sablier sablier-helm-charts 1.8.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
sablierapp/sablier:1.16.1413704376656
golang.org/x/net@v0.56.0
stdlib@go1.26.3
0.60.0
1.26.9

Open the chart page →

473
satisfactory-serversatisfactoryVerified publisher0.1.61 of 1See more

satisfactory-server satisfactory 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
wolveix/satisfactory-server:v1.9.10e103700ae6ae
stdlib@go1.18.1
1.26.9

Open the chart page →

4,536
seaweedfs-csi-driverseaweedfs-csi-driver0.2.407 of 7See more

seaweedfs-csi-driver seaweedfs-csi-driver 0.2.40

7 of the 7 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
chrislusf/seaweedfs-csi-driver:v1.4.341fca534c9001
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9
chrislusf/seaweedfs-mount:v1.4.347c6250e96001
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9
registry.k8s.io/sig-storage/csi-attacher:v4.3.04eb73137b663
golang.org/x/net@v0.8.0
stdlib@go1.20.3
0.60.0
1.26.9
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.8.0f6717ce72a26
golang.org/x/net@v0.8.0
stdlib@go1.20.3
0.60.0
1.26.9
registry.k8s.io/sig-storage/csi-provisioner:v3.5.0d078dc174323
golang.org/x/net@v0.8.0
stdlib@go1.20.3
0.60.0
1.26.9
registry.k8s.io/sig-storage/csi-resizer:v1.8.02e2b44393539
golang.org/x/net@v0.8.0
stdlib@go1.20.3
0.60.0
1.26.9
registry.k8s.io/sig-storage/livenessprobe:v2.10.04dc0b87ccd69
golang.org/x/net@v0.8.0
stdlib@go1.20.3
0.60.0
1.26.9

Open the chart page →

9,089
seldon-core-operatorseldon1.19.01 of 1See more

seldon-core-operator seldon 1.19.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
seldonio/seldon-core-operator:1.19.0544e3bf71bd1
golang.org/x/net@v0.44.0
stdlib@go1.24.11
0.60.0
1.26.9

Open the chart page →

1,381
bentoself-hosters-by-nightVerified publisher0.9.11 of 1See more

bento self-hosters-by-night 0.9.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/warpstreamlabs/bento:1.8.121715979aefa
golang.org/x/net@v0.37.0
stdlib@go1.23.10
0.60.0
1.26.9

Open the chart page →

1,783
lldapself-hosters-by-nightVerified publisher0.5.22 of 2See more

lldap self-hosters-by-night 0.5.2

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
library/postgres:18.11090bc3a8ccf
stdlib@go1.24.6
1.26.9
ghcr.io/lldap/lldap:2025-05-193de697c3ba57
stdlib@go1.18.2
1.26.9

Open the chart page →

5,044
appshini4iVerified publisher0.4.01 of 1See more

app shini4i 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
traefik/whoami:v1.10.21474027c3166
golang.org/x/net@v0.25.0
stdlib@go1.22.2
0.60.0
1.26.9

Open the chart page →

1,110
skypilotskypilotOfficialVerified publisher0.14.03 of 3See more

skypilot skypilot 0.14.0

3 of the 3 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot:0.14.0a8362d205365
golang.org/x/net@v0.38.0
stdlib@go1.26.2
0.60.0
1.26.9
registry.k8s.io/ingress-nginx/controller:v1.11.8695d79381ee6
golang.org/x/net@v0.41.0
stdlib@go1.24.4
0.60.0
1.26.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.0c9f76a75fd00
golang.org/x/net@v0.41.0
stdlib@go1.24.4
0.60.0
1.26.9

Open the chart page →

6,183
corednssoftizyVerified publisher0.2.01 of 1See more

coredns softizy 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
coredns/coredns:1.10.1a0ead06651cf
golang.org/x/net@v0.4.0
stdlib@go1.20
0.60.0
1.26.9

Open the chart page →

2,552
knative-servingsoftonic3.0.05 of 5See more

knative-serving softonic 3.0.0

5 of the 5 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
gcr.io/knative-releases/knative.dev/net-certmanager/cmd/webhookdigest-pinned873b968f02b5
golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e
stdlib@go1.14.2
0.60.0
1.26.9
gcr.io/knative-releases/knative.dev/serving/cmd/activatordigest-pinneda5de0fb75046
golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e
stdlib@go1.14.2
0.60.0
1.26.9
gcr.io/knative-releases/knative.dev/serving/cmd/autoscalerdigest-pinned2ef460356b17
golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e
stdlib@go1.14.2
0.60.0
1.26.9
gcr.io/knative-releases/knative.dev/serving/cmd/controllerdigest-pinned30ce73388ae5
golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e
stdlib@go1.14.2
0.60.0
1.26.9
gcr.io/knative-releases/knative.dev/serving/cmd/webhookdigest-pinnedf16c0e022203
golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e
stdlib@go1.14.2
0.60.0
1.26.9

Open the chart page →

18,897
forecastlestakaterVerified publisher2.1.31 of 1See more

forecastle stakater 2.1.3

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
stakater/forecastle:v2.0.2382cd9572352
golang.org/x/net@v0.51.0
stdlib@go1.26.4
0.60.0
1.26.9

Open the chart page →

1,112
ingressmonitorcontrollerstakaterVerified publisher2.2.131 of 1See more

ingressmonitorcontroller stakater 2.2.13

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/stakater/ingressmonitorcontroller:v2.2.133301afb61c10
golang.org/x/net@v0.47.0
stdlib@go1.24.13
0.60.0
1.26.9

Open the chart page →

1,000
tigera-operatorstevehipwellVerified publisher2.15.01 of 1See more

tigera-operator stevehipwell 2.15.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
quay.io/tigera/operator:v1.44.0066c2e8d6745
golang.org/x/net@v0.59.0
stdlib@go1.27.1-X:boringcrypto
0.60.0
1.27.2

Open the chart page →

213
vertical-pod-autoscalerstevehipwell-helm-charts-vertical-pod-autoscalerVerified publisher1.12.13 of 3See more

vertical-pod-autoscaler stevehipwell-helm-charts-vertical-pod-autoscaler 1.12.1

3 of the 3 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
registry.k8s.io/autoscaling/vpa-admission-controller:1.7.1be29624f7f12
golang.org/x/net@v0.55.0
stdlib@go1.26.5
0.60.0
1.26.9
registry.k8s.io/autoscaling/vpa-recommender:1.7.189cea705535f
golang.org/x/net@v0.55.0
stdlib@go1.26.5
0.60.0
1.26.9
registry.k8s.io/autoscaling/vpa-updater:1.7.1feb42a526970
golang.org/x/net@v0.55.0
stdlib@go1.26.5
0.60.0
1.26.9

Open the chart page →

1,050

Container images carrying it

6,227 by charts deploying them

A fixed version is listed for 3 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/pgdogdev/pgdog:v0.1.6025d1908886f5
stdlib@go1.26.7
1.26.9
1
ghcr.io/phoeluga/synology-proxy-operator:0.0.9a0b74674d0e3
golang.org/x/net@v0.59.0
stdlib@go1.27.1
0.60.0
1.27.2
1
ghcr.io/pierinho13/github-platform-operator:v0.7.9cd69de76b3d2
golang.org/x/net@v0.59.0
0.60.0
1
ghcr.io/pii-shield/pii-shield-operator:2.2.71d21a4b3683c
golang.org/x/net@v0.57.0
stdlib@go1.27.1
0.60.0
1.27.2
1
ghcr.io/pipe-cd/pipecd:v0.39.00fae829caf29
golang.org/x/net@v0.0.0-20191014212845-da9a3fd4c582
stdlib@go1.14.6
0.60.0
1.26.9
1
ghcr.io/platform-mesh/platform-mesh/account-operator:v0.15.5fa4923226063
golang.org/x/net@v0.57.0
stdlib@go1.26.7
0.60.0
1.26.9
1
ghcr.io/platform-mesh/platform-mesh/extension-manager-operator:v0.10.09371fcf05f76
golang.org/x/net@v0.57.0
stdlib@go1.26.7
0.60.0
1.26.9
1
ghcr.io/platform-mesh/platform-mesh/kubernetes-graphql-gateway:v1.20.02e6c9c111893
golang.org/x/net@v0.57.0
stdlib@go1.26.7
0.60.0
1.26.9
1
ghcr.io/platform-mesh/platform-mesh/platform-mesh-operator:v0.89.0b26d85c68aa8
golang.org/x/net@v0.57.0
stdlib@go1.26.7
0.60.0
1.26.9
1
ghcr.io/platform-mesh/platform-mesh/rebac-authz-webhook:v0.12.0fbb6df9ad2af
golang.org/x/net@v0.57.0
stdlib@go1.26.7
0.60.0
1.26.9
1
ghcr.io/platform-mesh/platform-mesh/security-operator:v0.36.09b26032812fd
golang.org/x/net@v0.57.0
stdlib@go1.26.7
0.60.0
1.26.9
1
ghcr.io/platform-mesh/platform-mesh/virtual-workspaces:v0.17.0bb2ee6241719
golang.org/x/net@v0.57.0
stdlib@go1.26.7
0.60.0
1.26.9
1
ghcr.io/platformrelay/kollect:v0.21.0a86edc5ec3a8
golang.org/x/net@v0.58.0
stdlib@go1.27.1
0.60.0
1.27.2
1
ghcr.io/pocket-id/pocket-id:v2.14.001540977dcf4
golang.org/x/net@v0.57.0
stdlib@go1.26.6
0.60.0
1.26.9
1
ghcr.io/pocket-id/pocket-id:v2.7.045bdeaf3fcd6
golang.org/x/net@v0.53.0
stdlib@go1.26.0
0.60.0
1.26.9
1
ghcr.io/podtato-head/entry:latestc3d9d9c98be7
stdlib@go1.19
1.26.9
1
ghcr.io/podtato-head/hat:latestde37ff39a4c0
stdlib@go1.19
1.26.9
1
ghcr.io/podtato-head/left-arm:latest97596c95276a
stdlib@go1.19
1.26.9
1
ghcr.io/podtato-head/left-leg:latest00bb31622b1e
stdlib@go1.19
1.26.9
1
ghcr.io/podtato-head/right-arm:latest5f8f97a60558
stdlib@go1.19
1.26.9
1
ghcr.io/podtato-head/right-leg:latest03e125b9279e
stdlib@go1.19
1.26.9
1
ghcr.io/port-labs/ocean-gateway:latest452eccee99ba
stdlib@go1.25.14
1.26.9
1
ghcr.io/postfinance/kubelet-csr-approver:v1.2.156469ef517d2b
golang.org/x/net@v0.49.0
stdlib@go1.26.7
0.60.0
1.26.9
1
ghcr.io/poweradmin/cert-manager-webhook-poweradmin:v0.2.166c788f9cb8c4
golang.org/x/net@v0.58.0
stdlib@go1.26.6
0.60.0
1.26.9
1
ghcr.io/predicatelabs/operator:v1.0.5b62113fe1b27
golang.org/x/net@v0.33.0
stdlib@go1.23.5
0.60.0
1.26.9
1
ghcr.io/privacyengineering/collector-go:main7217f1a4fa28
stdlib@go1.17.13
1.26.9
1
ghcr.io/privacyengineering/consumer:main73f59c032812
golang.org/x/net@v0.0.0-20211029224645-99673261e6eb
stdlib@go1.17.13
0.60.0
1.26.9
1
ghcr.io/privacyengineering/hawk-service:latestbfedf47bb5e0
golang.org/x/net@v0.19.0
stdlib@go1.20.11
0.60.0
1.26.9
1
ghcr.io/processone/ejabberd:latestec5cf7bc8562
stdlib@go1.25.14
1.26.9
1
ghcr.io/projectcapsule/capsule-addon-fluxcd:0.2.2e0baf564b706
golang.org/x/net@v0.32.0
stdlib@go1.23.4
0.60.0
1.26.9
1
ghcr.io/projectcontour/contour:v1.30.0b12824d7eb58
golang.org/x/net@v0.26.0
stdlib@go1.22.5
0.60.0
1.26.9
1
ghcr.io/projectcontour/contour:v1.33.0cd6e13fa882d
golang.org/x/net@v0.43.0
stdlib@go1.25.1
0.60.0
1.26.9
1
ghcr.io/projectcontour/contour:v1.33.7d88264ed084a
golang.org/x/net@v0.58.0
stdlib@go1.26.8-X:nodwarf5,nogreenteagc,norandomizedheapbase64
0.60.0
1.26.9
1
ghcr.io/projecthelena/warden:v0.9.0a2df64f001f6
golang.org/x/net@v0.58.0
stdlib@go1.25.13
0.60.0
1.26.9
1
ghcr.io/projection-operator/projection:0.3.2d06374430a17
golang.org/x/net@v0.53.0
stdlib@go1.26.3
0.60.0
1.26.9
1
ghcr.io/project-zot/zot:v2.1.144183bd731bcc
golang.org/x/net@v0.49.0
stdlib@go1.25.6
0.60.0
1.26.9
1
ghcr.io/project-zot/zot:v2.1.216b69512c00dc
golang.org/x/net@v0.58.0
stdlib@go1.26.8-X:jsonv2
0.60.0
1.26.9
1
ghcr.io/project-zot/zot:v2.1.2296cda11459ce
golang.org/x/net@v0.59.0
stdlib@go1.27.1
0.60.0
1.27.2
1
ghcr.io/prophetse7en/clonarr:latest9400d298b37a
stdlib@go1.26.4
1.26.9
1
ghcr.io/prymitive/karma:v0.13190a10c5c6793
stdlib@go1.26.3
1.26.9
1
ghcr.io/prymitive/karma:v0.85d06892218680
golang.org/x/net@v0.0.0-20210503060351-7fd8e65b6420
stdlib@go1.16.3
0.60.0
1.26.9
1
ghcr.io/pschichtel/cert-manager-webhook-cloudns:1.1.01020638bbe23
golang.org/x/net@v0.20.0
stdlib@go1.21.6
0.60.0
1.26.9
1
ghcr.io/pschichtel/s3-backup:0.7.017666811f6a7
golang.org/x/net@v0.55.0
stdlib@go1.26.4
0.60.0
1.26.9
1
ghcr.io/ptrvsrg/csi-driver-ipfs:latest97d2d9ccd7a5
golang.org/x/net@v0.55.0
stdlib@go1.26.4
0.60.0
1.26.9
1
ghcr.io/puckpuck/seashell:1.2ef5e31333821
golang.org/x/net@v0.0.0-20201021035429-f5854403a974
stdlib@go1.20.10
0.60.0
1.26.9
1
ghcr.io/pulumi-labs/pulumi-exporter:0.1.45415d5a46e7d
golang.org/x/net@v0.55.0
stdlib@go1.26.4
0.60.0
1.26.9
1
ghcr.io/pulumi/pulumi-esc-csi-provider:0.1.13fb058e93502
golang.org/x/net@v0.32.0
stdlib@go1.23.1
0.60.0
1.26.9
1
ghcr.io/punchplatform/operator:8.1-dev2a9536c8cee2
golang.org/x/net@v0.20.0
stdlib@go1.22.0
0.60.0
1.26.9
1
ghcr.io/punchplatform/punch-board:8.1-latestb03168275d1c
golang.org/x/net@v0.0.0-20220826154423-83b083e8dc8b
stdlib@go1.21.3
0.60.0
1.26.9
1
ghcr.io/pyrra-dev/pyrra:v0.8.10e02ef538ef0
golang.org/x/net@v0.31.0
stdlib@go1.23.3
0.60.0
1.26.9
1

syft 1.42.1 · advisories as of 13 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.