CVE-2026-78663
MediumAdvisory
Published 8 Oct 2026In the index since 9 Oct 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.5
- base score, highest
- EPSS
- 0.002
- 15th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 5,530
- of 18,090 indexed, latest versions
- Container images
- 6,374
- deployed by those charts
- Fix available
- 6 of 9
- affected packages
Double flow control refund on HTTP/2 server streams in net/http
Carried by container images the latest versions of 5,530 of 18,090 indexed charts deploy, on 6,374 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| stdlibgolang | go1.13, go1.13.1, go1.13.3, go1.13.4+212 more | 1.26.9, 1.27.2 | 6,355 |
| golang.org/ | v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more | 0.60.0 | 5,126 |
| golang-1.19deb | 1.19.8-2 | no fix listed | 1 |
| helm-4apk | 4.3.0-r0 | 4.3.0-r2 | 1 |
| ingress-nginx-controller-1.15apk | 1.15.10-r3 | no fix listed | 1 |
| kineapk | 0.17.1-r1 | 0.17.2-r2 | 1 |
| kubernetes-1.37apk | 1.37.1-r0 | 1.37.1-r2 | 1 |
| runcapk | 1.5.2-r0 | no fix listed | 1 |
| tetragonapk | 1.7.1-r4 | 1.7.1-r6 | 1 |
- OSV records
- CGA-25j5-q798-fwm3CGA-2gqg-cwwv-gpq8CGA-47rc-6mj7-j49qCGA-52wv-3w8x-88q8CGA-gghc-78jw-f5q2CGA-w84h-9v6p-pf3xDEBIAN-CVE-2026-78663GO-2026-6612
- Also known as
- CGA-34ww-96mj-f68f, CGA-496v-v9f7-gg5g, CGA-63wp-c4jp-8rp3, CGA-69c7-fg3r-x52j, CGA-6q57-jhhm-h4wv, CGA-7h68-428w-v8rx, CGA-7r9c-ff6c-hxjj, CGA-83p5-fjgf-7f3c, CGA-8657-wr97-3mfx, CGA-92vv-8vvj-9395, CGA-9fgf-3526-83c2, CGA-9vvh-3x7q-fg3m, CGA-cx87-7wm6-85w4, CGA-frvr-2pgq-38cg, CGA-g5vc-6qvm-vhqf, CGA-mmhx-33v2-g868, CGA-qq63-42gf-c64c, CGA-r8gj-3cwq-xgqj, CGA-r8gm-456m-hwcc, CGA-rc2p-74g8-rgfr, CGA-rp37-mxv6-g5fj, CGA-vqxj-4gp6-23v9, CGA-wfqc-4mv3-qjv3, CGA-wjfh-8wph-66g7, CGA-x3qg-fv98-5j72, CGA-x57q-8qv6-g2j7
- Trending
- Rank 1 in indexed charts, since 9 Oct 2026. See the ranking →
Charts affected
5,530 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| surveyornatsVerified publisher | 0.20.9 | 1 of 1See more | 1,188 |
| natz-operatornatz-operatorVerified publisher | 0.9.5 | 1 of 1See more | 1,203 |
| spring-helmnaveenalla-springboot | 1.0.0 | 1 of 2See more | 1,853 |
| clowder2ncsaVerified publisher | 1.9.7 | 6 of 12See more | 45,509 |
| netbox-operatornetboxOfficialVerified publisher | 1.2.191 | 1 of 1See more | 124 |
| netobserv-operatornetobservOfficialVerified publisher | 2.0.1 | 1 of 1See more | 154 |
| monitorneuvectorchartsVerified publisher | 2.11.2 | 1 of 1See more | 186 |
| cluster-issuersnginx-cert-charts | 0.3.0 | 4 of 4See more | 3,613 |
| ngrok-operatorngrok-operator | 1.1.0 | 1 of 2See more | 2,869 |
| cloud9nicholaswildeVerified publisher | 1.0.0 | 1 of 1See more | 12,936 |
| gotifynicholaswildeVerified publisher | 1.0.0 | 1 of 1See more | 3,895 |
| installernicholaswildeVerified publisher | 1.0.0 | 1 of 1See more | 2,220 |
| shiorinicholaswildeVerified publisher | 1.0.1 | 1 of 1See more | 3,420 |
| writefreelynicholaswildeVerified publisher | 1.0.0 | 1 of 1See more | 9,416 |
| node-exporternode-exporterVerified publisher | 0.1.10 | 1 of 1See more | 1,864 |
| helm-composenousefreakVerified publisher | 0.1.3 | 1 of 2See more | 15,782 |
| nri-resource-policy-balloonsnri-pluginsOfficialVerified publisher | 0.14.0 | 1 of 1See more | 616 |
| nri-resource-policy-topology-awarenri-pluginsOfficialVerified publisher | 0.14.0 | 1 of 1See more | 616 |
| nutanix-csi-snapshotnutanix-helm-releasesOfficialVerified publisher | 8.3.0 | 1 of 1See more | 843 |
| nvidia-gpu-exporternvidia-gpu-exporterVerified publisher | 2.15.1 | 1 of 1See more | 441 |
| octopuso7studios-octopus-helm-chartsOfficialVerified publisher | 1.2.3 | 4 of 5See more | 7,871 |
| oadaoadaVerified publisher | 5.0.6 | 1 of 11See more | 15,388 |
| opengistobeoneVerified publisher | 1.1.6 | 1 of 1See more | 713 |
| transfer.shobeoneVerified publisher | 1.0.5 | 1 of 1See more | 1,778 |
| oci-native-ingress-controlleroci-native-ingress-controller | 1.0.0 | 1 of 1See more | 861 |
| ociregistryociregistryVerified publisher | 1.20.0 | 1 of 1See more | 128 |
| growthbookone-acre-fundVerified publisher | 0.3.0 | 1 of 3See more | 1,751 |
| oom-oracleoom-oracleVerified publisher | 0.1.2 | 1 of 1See more | 124 |
| open5gs-hssopen5gs-hssVerified publisher | 2.3.3 | 1 of 2See more | 617 |
| open5gs-pcrfopen5gs-pcrfVerified publisher | 2.3.3 | 1 of 2See more | 617 |
| open5gs-scpopen5gs-scpVerified publisher | 2.3.4 | 1 of 2See more | 617 |
| open5gs-udropen5gs-udrVerified publisher | 2.3.4 | 1 of 2See more | 617 |
| open5gs-webuiopen5gs-webuiVerified publisher | 2.3.3 | 1 of 2See more | 7,129 |
| openccuopenccuVerified publisher | 3.89.11 | 1 of 1See more | 1,846 |
| kruiseopenkruise | 1.9.1 | 2 of 2See more | 2,709 |
| openobserveopenobserve | 1.0.2 | 5 of 6See more | 4,156 |
| openrouter-botopenrouter-botVerified publisher | 0.2.0 | 1 of 1See more | 1,409 |
| librechatopenshift | 1.9.0 | 1 of 3See more | 6,745 |
| openstack-kamaji-clusteropenstack-kamaji-clusterVerified publisher | 0.2.4 | 1 of 1See more | 1,183 |
| opentelemetry-demoopentelemetry-helmOfficialVerified publisher | 0.42.3 | 10 of 34See more | 26,079 |
| openvaultopenvaultVerified publisher | 0.9.0 | 1 of 2See more | 8,097 |
| openvox-operatoropenvox-operatorVerified publisher | 0.14.0 | 1 of 1See more | 147 |
| opikopikOfficialVerified publisher | 2.2.96 | 6 of 12See more | 15,883 |
| opsopsVerified publisher | 1.2.0 | 2 of 2See more | 100,859 |
| orbitalregorbitalregVerified publisher | 0.4.0 | 3 of 5See more | 5,271 |
| kubernetes-dashboard-proxyosc | 0.7.2 | 3 of 4See more | 8,871 |
| osc-bsu-csi-driverosc-bsu-csi-driverVerified publisher | 2.2.0 | 6 of 6See more | 4,246 |
| httpbinowan-charts | 0.1.9 | 1 of 1See more | 197 |
| hlf-caowkin | 2.1.0 | 2 of 2See more | 4,903 |
| hlf-ordowkin | 3.1.0 | 1 of 1See more | 4,531 |
Container images carrying it
6,374 by charts deploying them
A fixed version is listed for 6 of the 9 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| registry.k8s.io/ | 74a5cf9cfa9f | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | 09a36e2be1db | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | a15ca437f230 | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | af8220f53493 | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | bdab4e49d71d | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | db384bf43222 | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | ec5d6f6be228 | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | 89258156d0e9 | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | 2fa1c99ad09b | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | 5aaefc24f315 | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | 8b9c313c05f5 | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | 9a685020911e | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | be59d0556508 | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | 4fd21f36075b | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | cd21e19cd8bb | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | f1c25991bac2 | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | 122bfb8c1eda | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | d992c36d4ddd | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | e5900dc98b0d | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | 9ebbf9f023e7 | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | bc7be893ecc3 | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | 2c5f9dc4ea5a | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | 5baeb4a6d7d5 | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | cacee2b5c36d | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | dc7746bb081e | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| registry.k8s.io/ | 12c2da094b02 | golang.org/ stdlib | 0.60.0 1.26.9 | 2 |
| 0xpolygon/ | 396d3de26d8b | golang.org/ stdlib | 0.60.0 1.26.9 | 1 |
| 0xpolygon/ | 34ddf259993c | golang.org/ stdlib | 0.60.0 1.26.9 | 1 |
| 1dev/ | cd5b12fe5471 | golang.org/ stdlib | 0.60.0 1.26.9 | 1 |
| 1password/ | 656e4b10df83 | golang.org/ stdlib | 0.60.0 1.26.9 | 1 |
| 1password/ | 6aa94cf713f9 | golang.org/ stdlib | 0.60.0 1.26.9 | 1 |
| 1password/ | a760350c941a | golang.org/ stdlib | 0.60.0 1.26.9 | 1 |
| 1password/ | fe527ed9d81f | golang.org/ stdlib | 0.60.0 1.26.9 | 1 |
| 1password/ | 5884757f7879 | golang.org/ stdlib | 0.60.0 1.26.9 | 1 |
| 42wim/ | 23c951580801 | golang.org/ stdlib | 0.60.0 1.27.2 | 1 |
| aapjeisbaas/ | 6b261abc7fb0 | golang.org/ stdlib | 0.60.0 1.26.9 | 1 |
| aavishay/ | 3d7c4d79595c | golang.org/ stdlib | 0.60.0 1.26.9 | 1 |
| abiondevelopment/ | c741988fbd23 | golang.org/ stdlib | 0.60.0 1.26.9 | 1 |
| abohatyrenko/ | fa98af15a13e | golang.org/ stdlib | 0.60.0 1.26.9 | 1 |
| aboogie/ | 9c41a4483ac8 | stdlib | 1.26.9 | 1 |
| absaoss/ | ad538a1285a0 | golang.org/ stdlib | 0.60.0 1.26.9 | 1 |
| activepieces/ | 87295caa32a1 | stdlib | 1.26.9 | 1 |
| adeptiainc/ | 23d259e0c93e | golang.org/ stdlib | 0.60.0 1.26.9 | 1 |
| adeptiainc/ | cf610f8c614c | golang.org/ stdlib | 0.60.0 1.26.9 | 1 |
| adeptiainc/ | 7cdf6ac2e738 | golang.org/ stdlib | 0.60.0 1.26.9 | 1 |
| adeptiainc/ | d13e3304bda8 | golang.org/ stdlib | 0.60.0 1.26.9 | 1 |
| adguard/ | 3a143e6c071c | golang.org/ stdlib | 0.60.0 1.26.9 | 1 |
| adguard/ | 43ec119419a9 | golang.org/ stdlib | 0.60.0 1.26.9 | 1 |
| adguard/ | 5d5e3aef39a8 | golang.org/ stdlib | 0.60.0 1.26.9 | 1 |
| adguard/ | 7157eb1dc3b2 | golang.org/ stdlib | 0.60.0 1.26.9 | 1 |