StackRadar

CVE-2026-78663

Critical

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
Critical
worst across findings
CVSS
9.1
base score, highest
EPSS
0.006
46th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
5,553
of 18,090 indexed, latest versions
Container images
6,402
deployed by those charts
Fix available
8 of 9
affected packages

Double flow control refund on HTTP/2 server streams in net/http

Carried by container images the latest versions of 5,553 of 18,090 indexed charts deploy, on 6,402 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+212 more1.26.9, 1.27.26,378
golang.org/x/netgolangv0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more0.60.05,149
golang-1.19deb1.19.8-2no fix listed1
helm-4apk4.3.0-r04.3.0-r21
ingress-nginx-controller-1.15apk1.15.10-r31.15.10-r71
kineapk0.17.1-r10.17.2-r21
kubernetes-1.37apk1.37.1-r01.37.1-r21
runcapk1.5.2-r01.5.2-r31
tetragonapk1.7.1-r41.7.1-r61
OSV records
CGA-2gqg-cwwv-gpq8CGA-47rc-6mj7-j49qCGA-52wv-3w8x-88q8CGA-7r9c-ff6c-hxjjCGA-gghc-78jw-f5q2CGA-rp37-mxv6-g5fjDEBIAN-CVE-2026-78663GO-2026-6612
Also known as
CGA-25j5-q798-fwm3, CGA-34ww-96mj-f68f, CGA-496v-v9f7-gg5g, CGA-63wp-c4jp-8rp3, CGA-69c7-fg3r-x52j, CGA-6q57-jhhm-h4wv, CGA-7h68-428w-v8rx, CGA-83p5-fjgf-7f3c, CGA-8657-wr97-3mfx, CGA-92vv-8vvj-9395, CGA-9fgf-3526-83c2, CGA-9vvh-3x7q-fg3m, CGA-cx87-7wm6-85w4, CGA-frvr-2pgq-38cg, CGA-g5vc-6qvm-vhqf, CGA-mmhx-33v2-g868, CGA-qq63-42gf-c64c, CGA-r8gj-3cwq-xgqj, CGA-r8gm-456m-hwcc, CGA-rc2p-74g8-rgfr, CGA-vqxj-4gp6-23v9, CGA-w84h-9v6p-pf3x, CGA-wfqc-4mv3-qjv3, CGA-wjfh-8wph-66g7, CGA-x3qg-fv98-5j72, CGA-x57q-8qv6-g2j7
Trending
Rank 1 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,553 by stars
ChartLatestAffected imagesRadar Score
kube-auth-proxyappscodeVerified publisher2023.11.141 of 1See more

kube-auth-proxy appscode 2023.11.14

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/kube-auth-manager:v0.0.1789692ab9193
golang.org/x/net@v0.8.0
stdlib@go1.20.2
0.60.0
1.26.9

Open the chart page →

2,733
kube-bind-serverappscodeVerified publisher2023.3.231 of 1See more

kube-bind-server appscode 2023.3.23

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/kube-bind-server:v0.0.11762f3f6bb71
golang.org/x/net@v0.8.0
stdlib@go1.20.2
0.60.0
1.26.9

Open the chart page →

2,840
kubedb-autoscalerappscodeVerified publisher0.51.01 of 1See more

kubedb-autoscaler appscode 0.51.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/kubedb/kubedb-autoscaler:v0.51.05d1182ac21f0
golang.org/x/net@v0.55.0
stdlib@go1.25.12
0.60.0
1.26.9

Open the chart page →

907
kubedb-certifiedappscodeVerified publisher2026.7.108 of 8See more

kubedb-certified appscode 2026.7.10

8 of the 8 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/kubectl-nonroot:1.340b26892cec94
golang.org/x/net@v0.38.0
stdlib@go1.24.13
0.60.0
1.26.9
ghcr.io/appscode/petset:v0.1.093fa0daf603c
golang.org/x/net@v0.47.0
stdlib@go1.25.10
0.60.0
1.26.9
ghcr.io/appscode/sidekick:v0.0.15d1036b07e348
golang.org/x/net@v0.47.0
stdlib@go1.25.11
0.60.0
1.26.9
ghcr.io/kubedb/kubedb-autoscaler:v0.51.05d1182ac21f0
golang.org/x/net@v0.55.0
stdlib@go1.25.12
0.60.0
1.26.9
ghcr.io/kubedb/kubedb-crd-manager:v0.21.09506a6cb98d1
golang.org/x/net@v0.55.0
stdlib@go1.25.12
0.60.0
1.26.9
ghcr.io/kubedb/kubedb-ops-manager:v0.53.06d4c9fe66e4f
golang.org/x/net@v0.55.0
stdlib@go1.25.12
0.60.0
1.26.9
ghcr.io/kubedb/kubedb-provisioner:v0.66.0e7041c3b41e7
golang.org/x/net@v0.55.0
stdlib@go1.25.13
0.60.0
1.26.9
ghcr.io/kubedb/kubedb-webhook-server:v0.42.0e0f4431c4704
golang.org/x/net@v0.55.0
stdlib@go1.25.13
0.60.0
1.26.9

Open the chart page →

7,423
kubedb-communityappscodeVerified publisher0.24.21 of 2See more

kubedb-community appscode 0.24.2

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
kubedb/operator:v0.24.01a06ff0bda52
golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781
stdlib@go1.17.6
0.60.0
1.26.9

Open the chart page →

3,840
kubedb-courierappscodeVerified publisher0.6.01 of 1See more

kubedb-courier appscode 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/kubedb/kubedb-courier:v0.6.02f88856584a8
golang.org/x/net@v0.55.0
stdlib@go1.25.12
0.60.0
1.26.9

Open the chart page →

563
kubedb-crd-managerappscodeVerified publisher0.21.01 of 1See more

kubedb-crd-manager appscode 0.21.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/kubedb/kubedb-crd-manager:v0.21.09506a6cb98d1
golang.org/x/net@v0.55.0
stdlib@go1.25.12
0.60.0
1.26.9

Open the chart page →

890
kubedb-dashboardappscodeVerified publisher0.42.01 of 1See more

kubedb-dashboard appscode 0.42.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/kubedb/kubedb-kibana:v0.42.0735dd5d2709d
golang.org/x/net@v0.55.0
stdlib@go1.25.12
0.60.0
1.26.9

Open the chart page →

474
kubedb-enterpriseappscodeVerified publisher0.11.21 of 2See more

kubedb-enterprise appscode 0.11.2

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
kubedb/kubedb-enterprise:v0.11.05829bcedcb0d
golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781
stdlib@go1.17.3
0.60.0
1.26.9

Open the chart page →

3,878
kubedb-gitopsappscodeVerified publisher0.14.01 of 1See more

kubedb-gitops appscode 0.14.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/kubedb/kubedb-gitops:v0.14.0c743f8d7a199
golang.org/x/net@v0.55.0
stdlib@go1.25.12
0.60.0
1.26.9

Open the chart page →

816
kubedb-migratorappscodeVerified publisher0.5.01 of 1See more

kubedb-migrator appscode 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/kubedb/migrator-operator:v0.5.098ffb48f5b60
golang.org/x/net@v0.55.0
stdlib@go1.25.11
0.60.0
1.26.9

Open the chart page →

582
kubedb-oneappscodeVerified publisher2023.12.289 of 10See more

kubedb-one appscode 2023.12.28

9 of the 10 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
prom/pushgateway:v1.4.2a684e7c830a4
golang.org/x/net@v0.0.0-20210525063256-abc453219eb5
stdlib@go1.16.9
0.60.0
1.26.9
ghcr.io/kubedb/kubedb-autoscaler:v0.25.0df6b11907d33
golang.org/x/net@v0.17.0
stdlib@go1.21.5
0.60.0
1.26.9
ghcr.io/kubedb/kubedb-dashboard:v0.16.07bfe1c07bd9b
golang.org/x/net@v0.17.0
stdlib@go1.20.7
0.60.0
1.26.9
ghcr.io/kubedb/kubedb-ops-manager:v0.27.1ec36422b09af
golang.org/x/net@v0.17.0
stdlib@go1.20.14
0.60.0
1.26.9
ghcr.io/kubedb/kubedb-provisioner:v0.40.242574f512837
golang.org/x/net@v0.17.0
stdlib@go1.20.14
0.60.0
1.26.9
ghcr.io/kubedb/kubedb-schema-manager:v0.16.09518de37eed5
golang.org/x/net@v0.17.0
stdlib@go1.20.7
0.60.0
1.26.9
ghcr.io/kubedb/kubedb-webhook-server:v0.16.2e24894e32cbc
golang.org/x/net@v0.17.0
stdlib@go1.20.14
0.60.0
1.26.9
ghcr.io/stashed/stash-crd-installer:v0.32.0c6f2a844b5dd
golang.org/x/net@v0.15.0
stdlib@go1.20.8
0.60.0
1.26.9
ghcr.io/stashed/stash-enterprise:v0.32.0e9bde36e34b7
golang.org/x/net@v0.15.0
stdlib@go1.20.7
0.60.0
1.26.9

Open the chart page →

22,450
kubedb-ops-managerappscodeVerified publisher0.53.01 of 1See more

kubedb-ops-manager appscode 0.53.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/kubedb/kubedb-ops-manager:v0.53.06d4c9fe66e4f
golang.org/x/net@v0.55.0
stdlib@go1.25.12
0.60.0
1.26.9

Open the chart page →

1,102
kubedb-provider-awsappscodeVerified publisher2026.7.101 of 1See more

kubedb-provider-aws appscode 2026.7.10

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/kubedb/provider-aws:v0.27.049b1c312e342
golang.org/x/net@v0.7.0
stdlib@go1.20.7
0.60.0
1.26.9

Open the chart page →

3,304
kubedb-provider-azureappscodeVerified publisher2026.7.101 of 1See more

kubedb-provider-azure appscode 2026.7.10

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/kubedb/provider-azure:v0.27.0aa0c8526ae5e
golang.org/x/net@v0.0.0-20220927171203-f486391704dc
stdlib@go1.19.3
0.60.0
1.26.9

Open the chart page →

3,626
kubedb-provider-gcpappscodeVerified publisher2026.7.102 of 2See more

kubedb-provider-gcp appscode 2026.7.10

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/kubectl-nonroot:1.340b26892cec94
golang.org/x/net@v0.38.0
stdlib@go1.24.13
0.60.0
1.26.9
ghcr.io/kubedb/provider-gcp:v0.27.0a1d4cf8b8fe1
golang.org/x/net@v0.23.0
stdlib@go1.19.1
0.60.0
1.26.9

Open the chart page →

4,354
kubedb-schema-managerappscodeVerified publisher0.42.01 of 1See more

kubedb-schema-manager appscode 0.42.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/kubedb/kubedb-schema-manager:v0.42.04e2a3cce7ce8
golang.org/x/net@v0.55.0
stdlib@go1.25.12
0.60.0
1.26.9

Open the chart page →

471
kubedb-ui-serverappscodeVerified publisher2021.12.211 of 1See more

kubedb-ui-server appscode 2021.12.21

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
kubedb/kubedb-ui-server:v0.0.1_linux_amd647d27865514ee
golang.org/x/net@v0.0.0-20210614182718-04defd469f4e
stdlib@go1.17.8
0.60.0
1.26.9

Open the chart page →

3,097
kubedb-webhook-serverappscodeVerified publisher0.42.01 of 1See more

kubedb-webhook-server appscode 0.42.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/kubedb/kubedb-webhook-server:v0.42.0e0f4431c4704
golang.org/x/net@v0.55.0
stdlib@go1.25.13
0.60.0
1.26.9

Open the chart page →

772
kubeform-provider-awsappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-aws appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-aws:v0.0.1e3d1f1302e49
golang.org/x/net@v0.10.0
stdlib@go1.19.1
0.60.0
1.26.9

Open the chart page →

3,724
kubeform-provider-azureappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-azure appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-azure:v0.0.1ac8459f70f85
golang.org/x/net@v0.0.0-20220927171203-f486391704dc
stdlib@go1.20.5
0.60.0
1.26.9

Open the chart page →

3,638
kubeform-provider-gcpappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-gcp appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-gcp:v0.0.1af77073c184f
golang.org/x/net@v0.9.0
stdlib@go1.19.9
0.60.0
1.26.9

Open the chart page →

3,665
kubestashappscodeVerified publisher2026.7.102 of 2See more

kubestash appscode 2026.7.10

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/kubectl-nonroot:1.340b26892cec94
golang.org/x/net@v0.38.0
stdlib@go1.24.13
0.60.0
1.26.9
ghcr.io/kubestash/kubestash:v0.29.00686b2a40280
golang.org/x/net@v0.55.0
stdlib@go1.25.13
0.60.0
1.26.9

Open the chart page →

1,798
kubestash-certifiedappscodeVerified publisher2026.7.102 of 2See more

kubestash-certified appscode 2026.7.10

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/kubectl-nonroot:1.340b26892cec94
golang.org/x/net@v0.38.0
stdlib@go1.24.13
0.60.0
1.26.9
ghcr.io/kubestash/kubestash:v0.29.00686b2a40280
golang.org/x/net@v0.55.0
stdlib@go1.25.13
0.60.0
1.26.9

Open the chart page →

1,798
kubestash-operatorappscodeVerified publisher0.29.02 of 2See more

kubestash-operator appscode 0.29.0

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/kubectl-nonroot:1.340b26892cec94
golang.org/x/net@v0.38.0
stdlib@go1.24.13
0.60.0
1.26.9
ghcr.io/kubestash/kubestash:v0.29.00686b2a40280
golang.org/x/net@v0.55.0
stdlib@go1.25.13
0.60.0
1.26.9

Open the chart page →

1,798
kube-ui-serverappscodeVerified publisher2026.9.111 of 1See more

kube-ui-server appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/kube-ui-server:v0.7.0eca7c8fc48ad
golang.org/x/net@v0.57.0
stdlib@go1.25.13
0.60.0
1.26.9

Open the chart page →

490
kubevaultappscodeVerified publisher2026.8.72 of 2See more

kubevault appscode 2026.8.7

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/kubectl-nonroot:1.340b26892cec94
golang.org/x/net@v0.38.0
stdlib@go1.24.13
0.60.0
1.26.9
ghcr.io/kubevault/vault-operator:v0.25.0c8e042b5cee8
golang.org/x/net@v0.55.0
stdlib@go1.25.12
0.60.0
1.26.9

Open the chart page →

1,607
kubevault-certifiedappscodeVerified publisher2026.2.271 of 1See more

kubevault-certified appscode 2026.2.27

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/kubevault/vault-operator:v0.24.00087cb49616f
golang.org/x/net@v0.48.0
stdlib@go1.25.9
0.60.0
1.26.9

Open the chart page →

1,609
kubevault-operatorappscodeVerified publisher0.25.01 of 1See more

kubevault-operator appscode 0.25.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/kubevault/vault-operator:v0.25.0c8e042b5cee8
golang.org/x/net@v0.55.0
stdlib@go1.25.12
0.60.0
1.26.9

Open the chart page →

906
kubevault-webhook-serverappscodeVerified publisher0.25.02 of 2See more

kubevault-webhook-server appscode 0.25.0

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/kubectl-nonroot:1.340b26892cec94
golang.org/x/net@v0.38.0
stdlib@go1.24.13
0.60.0
1.26.9
ghcr.io/kubevault/vault-operator:v0.25.0c8e042b5cee8
golang.org/x/net@v0.55.0
stdlib@go1.25.12
0.60.0
1.26.9

Open the chart page →

1,607
kubevirt-infra-csi-driverappscodeVerified publisher0.1.05 of 6See more

kubevirt-infra-csi-driver appscode 0.1.0

5 of the 6 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
quay.io/kubevirt/kubevirt-csi-driver:latestbbc43bc25025
golang.org/x/net@v0.49.0
stdlib@go1.24.13
0.60.0
1.26.9
quay.io/openshift/origin-csi-external-attacher:latestd984102dfcdb
golang.org/x/net@v0.40.0
stdlib@go1.24.11
0.60.0
1.26.9
quay.io/openshift/origin-csi-external-provisioner:latest250b9a4fce50
golang.org/x/net@v0.43.0
stdlib@go1.24.6
0.60.0
1.26.9
quay.io/openshift/origin-csi-livenessprobe:latesta6341950c413
golang.org/x/net@v0.40.0
stdlib@go1.24.6
0.60.0
1.26.9
registry.k8s.io/sig-storage/csi-resizer:v1.13.12a0b297cc7c4
golang.org/x/net@v0.34.0
stdlib@go1.23.1
0.60.0
1.26.9

Open the chart page →

5,918
kubevirt-tenant-csi-driverappscodeVerified publisher0.1.04 of 4See more

kubevirt-tenant-csi-driver appscode 0.1.0

4 of the 4 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
quay.io/kubevirt/kubevirt-csi-driver:latestbbc43bc25025
golang.org/x/net@v0.49.0
stdlib@go1.24.13
0.60.0
1.26.9
quay.io/openshift/origin-csi-livenessprobe:latesta6341950c413
golang.org/x/net@v0.40.0
stdlib@go1.24.6
0.60.0
1.26.9
quay.io/openshift/origin-csi-node-driver-registrar:latest5102b02862b8
golang.org/x/net@v0.40.0
stdlib@go1.24.6
0.60.0
1.26.9
registry.k8s.io/sig-storage/snapshot-controller:v6.3.1ce6ca3c0e30b
golang.org/x/net@v0.17.0
stdlib@go1.20.5
0.60.0
1.26.9

Open the chart page →

4,626
license-proxyserverappscodeVerified publisher2026.9.181 of 1See more

license-proxyserver appscode 2026.9.18

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/license-proxyserver:v0.1.28dfd7a44f362
golang.org/x/net@v0.57.0
stdlib@go1.25.13
0.60.0
1.26.9

Open the chart page →

318
license-proxyserver-addon-managerappscodeVerified publisher2024.2.251 of 1See more

license-proxyserver-addon-manager appscode 2024.2.25

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/license-proxyserver:v0.0.8d6c2532ea386
golang.org/x/net@v0.19.0
stdlib@go1.22.1
0.60.0
1.26.9

Open the chart page →

2,059
license-proxyserver-managerappscodeVerified publisher2026.9.181 of 1See more

license-proxyserver-manager appscode 2026.9.18

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/license-proxyserver:v0.1.28dfd7a44f362
golang.org/x/net@v0.57.0
stdlib@go1.25.13
0.60.0
1.26.9

Open the chart page →

318
managed-serviceaccountappscodeVerified publisher2024.2.251 of 1See more

managed-serviceaccount appscode 2024.2.25

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/kluster-manager/managed-serviceaccount:latest365183f83ac9
golang.org/x/net@v0.19.0
stdlib@go1.22.0
0.60.0
1.26.9

Open the chart page →

3,123
managed-serviceaccount-managerappscodeVerified publisher2026.2.161 of 1See more

managed-serviceaccount-manager appscode 2026.2.16

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/kluster-manager/managed-serviceaccount:v0.10.0fc256885915b
golang.org/x/net@v0.49.0
stdlib@go1.25.8
0.60.0
1.26.9

Open the chart page →

1,389
marketplace-apiappscodeVerified publisher2026.9.111 of 1See more

marketplace-api appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/b3:v2026.9.1149b706354a6f
golang.org/x/net@v0.57.0
stdlib@go1.25.3
0.60.0
1.26.9

Open the chart page →

2,977
monitoring-operatorappscodeVerified publisher2026.6.121 of 1See more

monitoring-operator appscode 2026.6.12

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/grafana-tools:v0.8.077c9d29080eb
golang.org/x/net@v0.52.0
stdlib@go1.25.13
0.60.0
1.26.9

Open the chart page →

635
multicluster-controlplaneappscodeVerified publisher2025.4.301 of 1See more

multicluster-controlplane appscode 2025.4.30

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/kluster-manager/multicluster-controlplane:latest6de40f528be9
golang.org/x/net@v0.19.0
stdlib@go1.21.8
0.60.0
1.26.9

Open the chart page →

3,293
multicluster-ingress-readerappscodeVerified publisher2024.7.101 of 1See more

multicluster-ingress-reader appscode 2024.7.10

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/kubectl-nonroot:1.340b26892cec94
golang.org/x/net@v0.38.0
stdlib@go1.24.13
0.60.0
1.26.9

Open the chart page →

701
offline-license-serverappscodeVerified publisher2026.9.111 of 2See more

offline-license-server appscode 2026.9.11

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/offline-license-server:v0.0.76e4b66308d8f6
golang.org/x/net@v0.47.0
stdlib@go1.25.5
0.60.0
1.26.9

Open the chart page →

2,209
opentelemetry-kube-stackappscodeVerified publisher0.14.123 of 3See more

opentelemetry-kube-stack appscode 0.14.12

3 of the 3 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
rancher/kubectl:v1.34.1090bef429ed1
golang.org/x/net@v0.38.0
stdlib@go1.24.6
0.60.0
1.26.9
ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator:0.144.079b81912f1fb
golang.org/x/net@v0.48.0
stdlib@go1.25.6
0.60.0
1.26.9
quay.io/brancz/kube-rbac-proxy:v0.20.0147cb28fea35
golang.org/x/net@v0.44.0
stdlib@go1.25.1
0.60.0
1.26.9

Open the chart page →

3,302
operator-shard-managerappscodeVerified publisher2026.6.221 of 1See more

operator-shard-manager appscode 2026.6.22

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/operator-shard-manager:v0.0.64a16c6ccecb8
golang.org/x/net@v0.53.0
stdlib@go1.25.11
0.60.0
1.26.9

Open the chart page →

806
opscenter-configappscodeVerified publisher2022.6.141 of 2See more

opscenter-config appscode 2022.6.14

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/panopticon:v0.0.62cdae231ed8a
golang.org/x/net@v0.4.1-0.20221223171606-2aa82152a53e
stdlib@go1.19.4
0.60.0
1.26.9

Open the chart page →

2,668
opscenter-coreappscodeVerified publisher2022.6.144 of 4See more

opscenter-core appscode 2022.6.14

4 of the 4 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/grafana-tools:v0.0.1f60324bca644
golang.org/x/net@v0.0.0-20220909164309-bea034e7d591
stdlib@go1.19.4
0.60.0
1.26.9
ghcr.io/appscode/kube-ui-server:v0.0.1340775d6850b5
golang.org/x/net@v0.4.1-0.20221210045730-e1ec361d0b39
stdlib@go1.19.5
0.60.0
1.26.9
ghcr.io/appscode/license-proxyserver:v0.0.372a5c874d854
golang.org/x/net@v0.0.0-20220909164309-bea034e7d591
stdlib@go1.19.6
0.60.0
1.26.9
ghcr.io/appscode/supervisor:v0.0.21a58f56724da
golang.org/x/net@v0.4.1-0.20221210045730-e1ec361d0b39
stdlib@go1.19.4
0.60.0
1.26.9

Open the chart page →

11,072
outbox-syncerappscodeVerified publisher2026.9.111 of 1See more

outbox-syncer appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/outboxsyncer:v0.6.0c52861c4669f
golang.org/x/net@v0.57.0
stdlib@go1.25.13
0.60.0
1.26.9

Open the chart page →

347
panopticonappscodeVerified publisher2026.9.182 of 2See more

panopticon appscode 2026.9.18

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/kubectl-nonroot:1.340b26892cec94
golang.org/x/net@v0.38.0
stdlib@go1.24.13
0.60.0
1.26.9
ghcr.io/appscode/panopticon:v0.0.243ea0e226a86d
golang.org/x/net@v0.55.0
stdlib@go1.25.13
0.60.0
1.26.9

Open the chart page →

1,070
persesappscodeVerified publisher2026.6.22 of 2See more

perses appscode 2026.6.2

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode-images/postgres:18.3-bookworm8d320c6facbc
stdlib@go1.24.6
1.26.9
ghcr.io/opnpulse/perses:v2026.4.247f540d844c54
golang.org/x/net@v0.42.0
stdlib@go1.25.14
0.60.0
1.26.9

Open the chart page →

3,775
petsetappscodeVerified publisher2026.9.181 of 1See more

petset appscode 2026.9.18

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container imageDigestPackageFixed in
ghcr.io/appscode/petset:v0.2.0913f0858eb24
golang.org/x/net@v0.47.0
stdlib@go1.25.13
0.60.0
1.26.9

Open the chart page →

728

Container images carrying it

6,402 by charts deploying them

A fixed version is listed for 8 of the 9 affected packages.

Container imageDigestPackageFixed inUsed by
adguard/adguardhome:v0.107.767157eb1dc3b2
golang.org/x/net@v0.53.0
stdlib@go1.26.3
0.60.0
1.26.9
1
adguard/adguardhome:v0.107.737fbf01d73ecb
golang.org/x/net@v0.50.0
stdlib@go1.25.7
0.60.0
1.26.9
1
adguard/adguardhome:v0.107.0-b.5a9668737b1d6
golang.org/x/net@v0.0.0-20210510120150-4163338589ed
stdlib@go1.16.6
0.60.0
1.26.9
1
adguard/adguardhome:v0.107.7b9974aed13d0
golang.org/x/net@v0.0.0-20220425223048-2871e0cb64e4
stdlib@go1.17.9
0.60.0
1.26.9
1
adguard/adguardhome:v0.107.56c64a0b37f7b9
golang.org/x/net@v0.33.0
stdlib@go1.23.5
0.60.0
1.26.9
1
adguard/adguardhome:v0.107.65d765078d2140
golang.org/x/net@v0.43.0
stdlib@go1.24.6
0.60.0
1.26.9
1
adrianberger/fluxcd-webui:latest76848c0d2780
golang.org/x/net@v0.0.0-20200707034311-ab3426394381
stdlib@go1.16.2
0.60.0
1.26.9
1
adyanth/cloudflare-operator6b168dc237d5
golang.org/x/net@v0.39.0
stdlib@go1.24.4
0.60.0
1.26.9
1
aerokube/moon:1.9.17da76ca51220d
golang.org/x/net@v0.25.0
stdlib@go1.22.3
0.60.0
1.26.9
1
aerokube/moon-api:1.9.176b6323e75785
golang.org/x/net@v0.25.0
stdlib@go1.22.3
0.60.0
1.26.9
1
aerokube/selenoid-ui:1.10.113f3e299509fd
golang.org/x/net@v0.10.0
stdlib@go1.21.5
0.60.0
1.26.9
1
aerospike/aerospike-kubernetes-operator:4.6.0d0828d4c4db7
golang.org/x/net@v0.56.0
stdlib@go1.26.8
0.60.0
1.26.9
1
afgane/galaxy-k8s-monitor:latest457173db5640
golang.org/x/net@v0.30.0
stdlib@go1.24.13
0.60.0
1.26.9
1
agentarea/agentarea-events:latest71a89daaa2c6
stdlib@go1.25.14
1.26.9
1
agentarea/agentarea-mcp-manager:latest0e7e53fef298
golang.org/x/net@v0.58.0
stdlib@go1.25.14
0.60.0
1.26.9
1
agentarea/agentarea-mcp-runner:latest9030cc19a0fc
stdlib@go1.19.8
1.26.9
1
aibrix/controller-manager:v0.7.076aabbbfda79
golang.org/x/net@v0.34.0
stdlib@go1.22.12
0.60.0
1.26.9
1
aibrix/gateway-plugins:v0.7.05b93ea4c753a
golang.org/x/net@v0.34.0
stdlib@go1.22.12
0.60.0
1.26.9
1
airbyte/db:2.4.091f7b485f019
stdlib@go1.24.6
1.26.9
1
airbyte/minio:RELEASE.2023-11-20T22-40-07Zfdae972eaf0e
golang.org/x/net@v0.17.0
stdlib@go1.21.4
0.60.0
1.26.9
1
airbyte/pod-sweeper:1.5.198d2c39d512e
golang.org/x/net@v0.26.0
stdlib@go1.23.4
0.60.0
1.26.9
1
aistorage/ais-operator:v4.1.0151fc5b9f917
golang.org/x/net@v0.58.0
stdlib@go1.26.8
0.60.0
1.26.9
1
ajilaag/clamav-rest:latestad689c7b75b1
stdlib@go1.26.0
1.26.9
1
akeyless/akeyless-csi-provider:lateste48bddc5dd72
golang.org/x/net@v0.55.0
stdlib@go1.26.4
0.60.0
1.26.9
1
akeyless/base:latest759e4289fae8
stdlib@go1.26.3
1.26.9
1
akeyless/base-rhel:0.0.14ba8900a0061
stdlib@go1.22.1
1.26.9
1
akeyless/gateway:5.5.053301745cb50
golang.org/x/net@v0.58.0
stdlib@go1.26.6
0.60.0
1.26.9
1
akeyless/k8s-webhook-server:0.39.0996cd9afb3b4
golang.org/x/net@v0.55.0
stdlib@go1.26.4
0.60.0
1.26.9
1
aktosecurity/akto-puppeteer-replay:doom_latest853e37321e6e
stdlib@go1.22.5
1.26.9
1
aktosecurity/akto-threat-detection-backend:1.18.75a0c66e59678
stdlib@go1.26.7
1.26.9
1
aktosecurity/akto-threat-detection-backend:latestd9d0e7c78578
stdlib@go1.26.7
1.26.9
1
aktosecurity/data-ingestion-service:1.4.946ed5bcb04b2
golang.org/x/net@v0.40.0
stdlib@go1.26.3
0.60.0
1.26.9
1
aktosecurity/guardrails-service:2.40.663e9235153a3
golang.org/x/net@v0.55.0
stdlib@go1.25.14
0.60.0
1.26.9
1
aktosecurity/guardrails-service:2.14.8a6218d07e84f
golang.org/x/net@v0.55.0
stdlib@go1.25.14
0.60.0
1.26.9
1
aktosecurity/mini-runtime:1.72.15498e3e35ecc2
stdlib@go1.26.5
1.26.9
1
aktosecurity/mirror-api-logging:api-gateway-logging-openapi12ed2544756f
stdlib@go1.23.3
1.26.9
1
aktosecurity/mirror-api-logging:api-gateway-logging-multi-logging1a1bc76d50fe
stdlib@go1.23.3
1.26.9
1
aktosecurity/mirror-api-logging:k8s_ebpf3e506f5e5f47
golang.org/x/net@v0.38.0
stdlib@go1.26.5
0.60.0
1.26.9
1
aktosecurity/mirror-api-logging:k8s_agentc8266e943ff9
golang.org/x/net@v0.56.0
stdlib@go1.26.8
0.60.0
1.26.9
1
alazidis/stornx:1.1.1602d4f7f090c
golang.org/x/net@v0.47.0
stdlib@go1.25.7
0.60.0
1.26.9
1
alcounit/browser-controller:v1.0.1c64222f9e663
golang.org/x/net@v0.47.0
stdlib@go1.25.0
0.60.0
1.26.9
1
alcounit/browser-service:v0.0.94bd10defc324
golang.org/x/net@v0.47.0
stdlib@go1.25.0
0.60.0
1.26.9
1
alcounit/browser-ui:v1.0.0668e7aee5e5c
golang.org/x/net@v0.47.0
stdlib@go1.25.0
0.60.0
1.26.9
1
alcounit/selenosis:v2.1.2f0964cda6da6
golang.org/x/net@v0.47.0
stdlib@go1.25.0
0.60.0
1.26.9
1
alex6021710/ai-scale-auth:latest6c7a47e470c3
golang.org/x/net@v0.0.0-20211104170005-ce137452f963
stdlib@go1.16.12
0.60.0
1.26.9
1
alex6021710/ai-scale-doer:latest31e533cf7cd3
golang.org/x/net@v0.0.0-20211104170005-ce137452f963
stdlib@go1.16.10
0.60.0
1.26.9
1
alex6021710/ai-scale-migrator:latest744b8a924f35
golang.org/x/net@v0.0.0-20211013171255-e13a2654a71e
stdlib@go1.17.2
0.60.0
1.26.9
1
alex6021710/ai-scale-provider:latest5837d9b30cc7
golang.org/x/net@v0.0.0-20211104170005-ce137452f963
stdlib@go1.15.8
0.60.0
1.26.9
1
alex6021710/ai-scale-saver:latestf73e8d60fd03
golang.org/x/net@v0.0.0-20211105192438-b53810dc28af
stdlib@go1.17
0.60.0
1.26.9
1
alireza7/s-ui:1.5.302aa86983cdb
golang.org/x/net@v0.55.0
stdlib@go1.26.4
0.60.0
1.26.9
1

syft 1.42.1 · advisories as of 11 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.