CVE-2026-78663

Medium

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: Medium; worst across findings
CVSS: 5.5; base score, highest
EPSS: 0.002; 15th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,530; of 18,090 indexed, latest versions
Container images: 6,374; deployed by those charts
Fix available: 6 of 9; affected packages

Double flow control refund on HTTP/2 server streams in net/http

Carried by container images the latest versions of 5,530 of 18,090 indexed charts deploy, on 6,374 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+212 more	1.26.9, 1.27.2	6,355
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more	0.60.0	5,126
golang-1.19deb	1.19.8-2	no fix listed	1
helm-4apk	4.3.0-r0	4.3.0-r2	1
ingress-nginx-controller-1.15apk	1.15.10-r3	no fix listed	1
kineapk	0.17.1-r1	0.17.2-r2	1
kubernetes-1.37apk	1.37.1-r0	1.37.1-r2	1
runcapk	1.5.2-r0	no fix listed	1
tetragonapk	1.7.1-r4	1.7.1-r6	1

OSV records: CGA-25j5-q798-fwm3 CGA-2gqg-cwwv-gpq8 CGA-47rc-6mj7-j49q CGA-52wv-3w8x-88q8 CGA-gghc-78jw-f5q2 CGA-w84h-9v6p-pf3x DEBIAN-CVE-2026-78663 GO-2026-6612
Also known as: CGA-34ww-96mj-f68f, CGA-496v-v9f7-gg5g, CGA-63wp-c4jp-8rp3, CGA-69c7-fg3r-x52j, CGA-6q57-jhhm-h4wv, CGA-7h68-428w-v8rx, CGA-7r9c-ff6c-hxjj, CGA-83p5-fjgf-7f3c, CGA-8657-wr97-3mfx, CGA-92vv-8vvj-9395, CGA-9fgf-3526-83c2, CGA-9vvh-3x7q-fg3m, CGA-cx87-7wm6-85w4, CGA-frvr-2pgq-38cg, CGA-g5vc-6qvm-vhqf, CGA-mmhx-33v2-g868, CGA-qq63-42gf-c64c, CGA-r8gj-3cwq-xgqj, CGA-r8gm-456m-hwcc, CGA-rc2p-74g8-rgfr, CGA-rp37-mxv6-g5fj, CGA-vqxj-4gp6-23v9, CGA-wfqc-4mv3-qjv3, CGA-wjfh-8wph-66g7, CGA-x3qg-fv98-5j72, CGA-x57q-8qv6-g2j7
Trending: Rank 1 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,530 by stars

Chart

Latest

Affected images

Radar Score

dbrepodbrepo

1.13.3

11 of 25 See more

dbrepo dbrepo 1.13.3

11 of the 25 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
bitnamilegacy/grafana :11.4.0-debian-12-r0	cb8ab5515676	golang.org/x/net@v0.29.0 stdlib@go1.23.4	0.60.0 1.26.9
bitnamilegacy/mariadb :11.4.5-debian-12-r12	8bc50a0961a7	stdlib@go1.23.8	1.26.9
bitnamilegacy/mariadb-galera :11.3.2-debian-12-r9	aee9c668098f	stdlib@go1.22.5	1.26.9
bitnamilegacy/mysqld-exporter :0.15.1-debian-12-r26	11a5f0b79e79	golang.org/x/net@v0.17.0 stdlib@go1.21.12	0.60.0 1.26.9
bitnamilegacy/nginx :1.28.0-debian-12-r0	eaf9066e86f6	stdlib@go1.23.8	1.26.9
bitnamilegacy/opensearch :2.18.0-debian-12-r0	d8440eb6b290	golang.org/x/net@v0.27.0 stdlib@go1.22.8	0.60.0 1.26.9
bitnamilegacy/os-shell :12-debian-12-r32	17444b4b2c96	golang.org/x/net@v0.27.0 stdlib@go1.22.8	0.60.0 1.26.9
bitnamilegacy/postgres-exporter :0.15.0-debian-12-r44	e7e1b3a90682	golang.org/x/net@v0.17.0 stdlib@go1.22.8	0.60.0 1.26.9
bitnamilegacy/prometheus :2.54.1-debian-12-r4	08b1b7cb6a5b	golang.org/x/net@v0.27.0 stdlib@go1.22.7	0.60.0 1.26.9
bitnamilegacy/seaweedfs :3.87.0-debian-12-r1	0cb31d0fc356	golang.org/x/net@v0.39.0 stdlib@go1.24.1	0.60.0 1.26.9
bitnamilegacy/valkey :latest	0384ca2eec63	stdlib@go1.23.10	1.26.9

Open the chart page →

62,810

deckarddeckard

0.1.8

3 of 3 See more

deckard deckard 0.1.8

3 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
bitnami/mongodb :latest	ad05bb9a19fa	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9
bitnami/redis :latest	f4797b37502e	stdlib@go1.26.8	1.26.9
blipai/deckard :0.1.8	db8cd873d0eb	golang.org/x/net@v0.56.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

1,054

mealiedeimosfr-charts

1.0.16

1 of 1 See more

mealie deimosfr-charts 1.0.16

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/mealie-recipes/mealie :v3.28.0	8b02290f4d18	stdlib@go1.24.4	1.26.9

Open the chart page →

3,916

dregsydeliveryhero

0.1.5

1 of 1 See more

dregsy deliveryhero 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
xelalex/dregsy :0.4.3	574054e1c417	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.3	0.60.0 1.26.9

Open the chart page →

3,917

gripmockdeliveryhero

1.1.3

1 of 1 See more

gripmock deliveryhero 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
tkpd/gripmock :1.10.1	74441dadcfbd	stdlib@go1.14.6	1.26.9

Open the chart page →

3,832

labelsmanager-controllerdeliveryhero

1.0.4

1 of 1 See more

labelsmanager-controller deliveryhero 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
thomasnyambati/labelsmanager-controller :1.0.0	148ae3f99fea	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.15	0.60.0 1.26.9

Open the chart page →

3,453

weblatedeliveryhero

0.3.2

1 of 3 See more

weblate deliveryhero 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
weblate/weblate :4.2.2-1	69c160d37a3c	golang.org/x/net@v0.0.0-20190620200207-3b0461eec859 stdlib@go1.13.5	0.60.0 1.26.9

Open the chart page →

10,735

snapshot-controllerdemocratic-csi

0.3.0

1 of 1 See more

snapshot-controller democratic-csi 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/snapshot-controller :v8.2.1	472fa35a89da	golang.org/x/net@v0.33.0 stdlib@go1.23.6	0.60.0 1.26.9

Open the chart page →

903

developer-operatordeveloper-operator

2.1.2

1 of 1 See more

developer-operator developer-operator 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
registry.gitlab.com/xrow-public/developer-operator/developer-operator-controller :2.1.2	301847adfe16	golang.org/x/net@v0.41.0 stdlib@go1.24.5	0.60.0 1.26.9

Open the chart page →

2,419

kube-bench-metricsdevopstales

0.1.0

1 of 1 See more

kube-bench-metrics devopstales 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
elastisys/kube-bench-metrics :0.1.6	509b94f1da55	stdlib@go1.15.7	1.26.9

Open the chart page →

3,101

kubedashdevopstales

4.0.0

5 of 8 See more

kubedash devopstales 4.0.0

5 of the 8 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/postgres :18.3	a9abf4275f9e	stdlib@go1.24.6	1.26.9
oliver006/redis_exporter :v1.82.0-alpine	da9e89ee4e75	stdlib@go1.26.1	1.26.9
prom/statsd-exporter :v0.22.4	8be660470961	stdlib@go1.17.3	1.26.9
sosedoff/pgweb :latest	a5256d416e2e	golang.org/x/net@v0.47.0 stdlib@go1.24.6	0.60.0 1.26.9
quay.io/prometheuscommunity/postgres-exporter :v0.19.1	e96064f87622	golang.org/x/net@v0.48.0 stdlib@go1.25.7	0.60.0 1.26.9

Open the chart page →

12,543

permission-managerdevopstales

1.8.0

1 of 1 See more

permission-manager devopstales 1.8.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
quay.io/sighup/permission-manager :v1.7.1-rc1	f5e6a5dcee33	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.16.8	0.60.0 1.26.9

Open the chart page →

3,316

trivy-operatordevopstales

2.5.0

1 of 1 See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
devopstales/trivy-operator :2.5	75136aa7a26e	golang.org/x/net@v0.4.0 stdlib@go1.18.10	0.60.0 1.26.9

Open the chart page →

6,489

dnsmasqdevplayer0

0.1.5

1 of 2 See more

dnsmasq devplayer0 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/devplayer0/kubelan :0.2.3	b776dae45d08	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e stdlib@go1.16.5	0.60.0 1.26.9

Open the chart page →

4,453

whoamidevplayer0

0.1.2

1 of 1 See more

whoami devplayer0 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
traefik/whoami :v1.6.1	2c52bb2c8480	stdlib@go1.15.6	1.26.9

Open the chart page →

2,202

calicodevtron

0.1.1

4 of 4 See more

calico devtron 0.1.1

4 of the 4 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
quay.io/devtron/calico-networking :kube-controllers-v3.19.1	2ff71ba65cd7	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.15.2	0.60.0 1.26.9
quay.io/devtron/calico-networking :cni-v3.19.1	51f294c56842	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.15.2	0.60.0 1.26.9
quay.io/devtron/calico-networking :node-v3.19.1	bc4aa22272ef	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.15.2	0.60.0 1.26.9
quay.io/devtron/calico-networking :pod2daemon-flexvol-v3.19.1	c1f36b6e18e0	stdlib@go1.15.2	1.26.9

Open the chart page →

14,577

clairdevtron

0.1.14

1 of 2 See more

clair devtron 0.1.14

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
quay.io/devtron/clair :4.3.6	75fb847ac045	golang.org/x/net@v0.0.0-20210805182204-aaa1db679c0d stdlib@go1.17.6	0.60.0 1.26.9

Open the chart page →

7,985

discord-alertmanagerdevtron-labs

0.10.0

1 of 1 See more

discord-alertmanager devtron-labs 0.10.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
quay.io/devtron/discord-alertmanager :ceceb475-65-352	03586419ca31	stdlib@go1.18.1	1.26.9

Open the chart page →

1,746

dex-serverdex-server

1.19.1

2 of 3 See more

dex-server dex-server 1.19.1

2 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
dexidp/dex :v2.39.1-distroless	43655afd1a8f	golang.org/x/net@v0.24.0 stdlib@go1.21.6	0.60.0 1.26.9
public.ecr.aws/cloudnatix/llmariner/database-creator :1.19.1	62375abc3c56	stdlib@go1.23.12	1.26.9

Open the chart page →

3,214

digispoof-interfacedigispoof-interface

1.0.0

1 of 3 See more

digispoof-interface digispoof-interface 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/digispoof-interface-php :latest	03aba499950f	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.60.0 1.26.9

Open the chart page →

9,801

matomodigitalist-open-cloud-matomo

12.0.21

1 of 3 See more

matomo digitalist-open-cloud-matomo 12.0.21

1 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
hipages/php-fpm_exporter :2.2.0	9b5be9d3d955	stdlib@go1.17.10	1.26.9

Open the chart page →

3,593

directusdirectus-io

2.1.0

3 of 3 See more

directus directus-io 2.1.0

3 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
bitnamilegacy/mysql :9.4.0-debian-12-r1	ec13e229247a	stdlib@go1.24.6	1.26.9
bitnamilegacy/redis :8.2.1-debian-12-r0	25bf63f3caf7	stdlib@go1.25.0	1.26.9
directus/directus :12.0.2	9c8470ea465c	stdlib@go1.23.12	1.26.9

Open the chart page →

9,746

alertmanager-ntfydjjudas21

0.1.2

1 of 1 See more

alertmanager-ntfy djjudas21 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/alexbakker/alertmanager-ntfy :1.0.1	2f4db8064595	golang.org/x/net@v0.41.0 stdlib@go1.24.4	0.60.0 1.26.9

Open the chart page →

1,062

dkim-managerdkim-manager

0.2.0

1 of 1 See more

dkim-manager dkim-manager 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/hsn723/dkim-manager :1.4.0	0312232b31a2	golang.org/x/net@v0.50.0 stdlib@go1.26.0	0.60.0 1.26.9

Open the chart page →

633

myappdl-grafana-webapp

0.1.0

1 of 2 See more

myapp dl-grafana-webapp 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
onkar17/grafana :latest	aef3ebd6e24e	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777 stdlib@go1.16.1	0.60.0 1.26.9

Open the chart page →

3,654

dnation-pingdnationcloud

0.1.9

4 of 5 See more

dnation-ping dnationcloud 0.1.9

4 of the 5 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
grafana/grafana :7.3.5	511bc20bfcd1	golang.org/x/net@v0.0.0-20201022231255-08b38378de70 stdlib@go1.15.5	0.60.0 1.26.9
jimmidyson/configmap-reload :v0.4.0	17d34fd73f9e	stdlib@go1.14.4	1.26.9
prom/blackbox-exporter :v0.18.0	1ffc3f109eb3	golang.org/x/net@v0.0.0-20200602114024-627f9648deb9 stdlib@go1.15.2	0.60.0 1.26.9
prom/prometheus :v2.21.0	d43417c260e5	golang.org/x/net@v0.0.0-20200822124328-c89045814202 stdlib@go1.15.2	0.60.0 1.26.9

Open the chart page →

14,994

docker-in-dockerdocker-in-docker

0.0.3

1 of 2 See more

docker-in-docker docker-in-docker 0.0.3

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/docker :24.0.2-dind	1d148deae16a	golang.org/x/net@v0.8.0 stdlib@go1.20.4	0.60.0 1.26.9

Open the chart page →

3,292

docker-registrydocker-repository

0.1.0

1 of 1 See more

docker-registry docker-repository 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/registry :latest	ddf754342cfc	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

172

dockyarddockyard

0.5.0

1 of 1 See more

dockyard dockyard 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/kgma74/dockyard :0.5.0	15d1d5769e91	golang.org/x/net@v0.29.0 stdlib@go1.22.7	0.60.0 1.26.9

Open the chart page →

2,076

thermitedollarshaveclub

0.1.17

1 of 1 See more

thermite dollarshaveclub 0.1.17

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
dollarshaveclub/thermite :0.0.31	663cbf25fcfe	golang.org/x/net@v0.0.0-20210805182204-aaa1db679c0d stdlib@go1.17.1	0.60.0 1.26.9

Open the chart page →

3,786

domain-lockerdomain-locker

0.3.3

1 of 2 See more

domain-locker domain-locker 0.3.3

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/postgres :15-alpine	f7d23353e1b1	stdlib@go1.24.6	1.26.9

Open the chart page →

1,154

dominodomino

0.1.11

1 of 3 See more

domino domino 0.1.11

1 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/postgres :13	4689940c6838	stdlib@go1.24.6	1.26.9

Open the chart page →

10,065

archerydouban

0.4.3

2 of 6 See more

archery douban 0.4.3

2 of the 6 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
hanchuanchuan/goinception :latest	b3c0dd26fb50	golang.org/x/net@v0.23.0 stdlib@go1.22.1	0.60.0 1.26.9
hhyo/archery :v1.9.1	1aa41843419e	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.15.6	0.60.0 1.26.9

Open the chart page →

7,797

karmadouban

1.9.2

1 of 1 See more

karma douban 1.9.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/prymitive/karma :v0.85	d06892218680	golang.org/x/net@v0.0.0-20210503060351-7fd8e65b6420 stdlib@go1.16.3	0.60.0 1.26.9

Open the chart page →

3,273

agent-sandboxdovakiin0

1.0.5

1 of 2 See more

agent-sandbox dovakiin0 1.0.5

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
registry.k8s.io/agent-sandbox/agent-sandbox-controller :v1.0.2	dc700a37ecf4	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

141

seafiledr300481

0.12.1

1 of 1 See more

seafile dr300481 0.12.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
seafileltd/seafile-mc :11.0.12	d0c66e4621bd	stdlib@go1.21.4	1.26.9

Open the chart page →

77,498

dragonfly-stackdragonfly

0.1.2

4 of 7 See more

dragonfly-stack dragonfly 0.1.2

4 of the 7 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
dragonflyoss/client :v0.1.82	edf3e921f4e0	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.60.0 1.26.9
dragonflyoss/manager :v2.1.49	c3ef7f10698d	golang.org/x/net@v0.19.0 stdlib@go1.21.1	0.60.0 1.26.9
dragonflyoss/scheduler :v2.1.49	523785c77787	golang.org/x/net@v0.19.0 stdlib@go1.21.1	0.60.0 1.26.9
ghcr.io/containerd/nydus-snapshotter :v0.9.0	56f8617363b4	golang.org/x/net@v0.8.0 stdlib@go1.18.10	0.60.0 1.26.9

Open the chart page →

22,491

nydus-snapshotterdragonfly

0.0.10

1 of 2 See more

nydus-snapshotter dragonfly 0.0.10

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/containerd/nydus-snapshotter :v0.9.0	56f8617363b4	golang.org/x/net@v0.8.0 stdlib@go1.18.10	0.60.0 1.26.9

Open the chart page →

4,448

rstudiodsri-helm-charts

0.1.28

1 of 1 See more

rstudio dsri-helm-charts 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/maastrichtu-ids/rstudio :latest	981aa4c109e1	stdlib@go1.20.12	1.26.9

Open the chart page →

76,409

gaxyduyet

0.1.1

1 of 1 See more

gaxy duyet 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/duyet/gaxy :latest	31d658a22bd1	stdlib@go1.27.1	1.27.2

Open the chart page →

dyff-operatordyff-operator

0.24.22

1 of 1 See more

dyff-operator dyff-operator 0.24.22

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
registry.gitlab.com/dyff/dyff-operator :0.24.22	7f930cdae40d	golang.org/x/net@v0.44.0 stdlib@go1.24.13	0.60.0 1.26.9

Open the chart page →

590

gethdysnix

1.1.2

1 of 1 See more

geth dysnix 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ethereum/client-go :v1.14.8	886ec69b35b0	golang.org/x/net@v0.24.0 stdlib@go1.22.6	0.60.0 1.26.9

Open the chart page →

2,113

jenkinsedu

2.7.1

1 of 2 See more

jenkins edu 2.7.1

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
jenkins/jenkins :lts	a660310e39ad	golang.org/x/net@v0.57.0 stdlib@go1.27.0	0.60.0 1.27.2

Open the chart page →

4,023

glpieftechcombr-glpi

2.12.0

1 of 5 See more

glpi eftechcombr-glpi 2.12.0

1 of the 5 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/mariadb :12.3.2	a02fe89cb597	stdlib@go1.24.6	1.26.9

Open the chart page →

3,743

egagenteginnovations

0.10.0

1 of 1 See more

egagent eginnovations 0.10.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
eginnovations/agent :7.5.4	e4dfe242fe9f	golang.org/x/net@v0.55.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

1,719

glideeinstack

0.0.2

1 of 1 See more

glide einstack 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/einstack/glide :0.0.1-alpine	ab3f7d0a1d50	golang.org/x/net@v0.19.0 stdlib@go1.21.6	0.60.0 1.26.9

Open the chart page →

1,917

elaraelara

0.5.2

1 of 1 See more

elara elara 0.5.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/sergeyslonimsky/elara :0.5.2	a410a7ed1ee8	golang.org/x/net@v0.58.0 stdlib@go1.27.0	0.60.0 1.27.2

Open the chart page →

143

elchi-discoveryelchi

1.0.0

1 of 1 See more

elchi-discovery elchi 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
jhonbrownn/elchi-discovery :v1.0.0	8f6551ecc98c	golang.org/x/net@v0.13.0 stdlib@go1.23.1	0.60.0 1.26.9

Open the chart page →

1,105

elchi-stackelchi

2.0.4

4 See more

elchi-stack elchi 2.0.4

4 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
grafana/grafana :12.2.0	74144189b384	golang.org/x/net@v0.43.0 stdlib@go1.24.6	0.60.0 1.26.9
library/mongo :6.0.12	646902910d6a	stdlib@go1.18.2	1.26.9
otel/opentelemetry-collector-contrib :0.89.0	995f17004231	golang.org/x/net@v0.18.0 stdlib@go1.21.4	0.60.0 1.26.9
victoriametrics/victoria-metrics :v1.93.5	77a9815d0640	golang.org/x/net@v0.15.0 stdlib@go1.21.1	0.60.0 1.26.9

Open the chart page →

—

navidromeemmas-charts

0.0.6

1 of 1 See more

navidrome emmas-charts 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
deluan/navidrome :0.50.0	2cf4442b0099	golang.org/x/net@v0.18.0 stdlib@go1.21.0	0.60.0 1.26.9

Open the chart page →

2,822

Container images carrying it

6,374 by charts deploying them

A fixed version is listed for 6 of the 9 affected packages.

Container image	Digest	Package	Fixed in	Used by
chriseaton/adventureworks :latest	54c3384ce701	stdlib@go1.23.1	1.26.9	1
chrislusf/seaweedfs :3.64	634b094b2183	golang.org/x/net@v0.21.0 stdlib@go1.22.1	0.60.0 1.26.9	1
chrislusf/seaweedfs :4.34	6620371e8af8	golang.org/x/net@v0.54.0 stdlib@go1.25.11	0.60.0 1.26.9	1
chrislusf/seaweedfs :3.56	ed80f00fde46	golang.org/x/net@v0.14.0 stdlib@go1.20.8	0.60.0 1.26.9	1
chrislusf/seaweedfs-csi-driver :v1.4.34	1fca534c9001	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	1
chrislusf/seaweedfs-mount :v1.4.34	7c6250e96001	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	1
chriswells0/first-mate :1.0.5	f3918ec8471c	golang.org/x/net@v0.8.0 stdlib@go1.20.5	0.60.0 1.26.9	1
circleci/container-agent :3	4d8d0ae5efc3	golang.org/x/net@v0.8.0 stdlib@go1.19.7	0.60.0 1.26.9	1
circleci/runner :launch-agent	9bdc62f02162	stdlib@go1.21.5	1.26.9	1
ciscolabs/msm-nc :07102023	36d02faad958	golang.org/x/net@v0.10.0 stdlib@go1.20.5	0.60.0 1.26.9	1
ckan/ckan-solr :2.11-solr9	ef8e5d3e6be1	stdlib@go1.18.1	1.26.9	1
clastix/capsule-rancher-addon :v0.1.1	43d301afbca8	golang.org/x/net@v0.4.0 stdlib@go1.19.2	0.60.0 1.26.9	1
clastix/kamaji :latest	bb4bd5e1d9eb	golang.org/x/net@v0.58.0 stdlib@go1.26.5	0.60.0 1.26.9	1
cleanstart/minio :latest	f1156f7fd14a	golang.org/x/net@v0.55.0 stdlib@go1.26.4	0.60.0 1.26.9	1
clickhouse/clickhouse-server :23.8	512bb8a21483	stdlib@go1.19.10	1.26.9	1
clickhouse/clickhouse-server :23.4.2.11	dc5658853ce1	stdlib@go1.19.5	1.26.9	1
cloud37io/s3-encryption-gateway :0.12.3	10e791e98b62	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
cloudbees/cert-requester :2.3.3	1d44fb4f799b	golang.org/x/net@v0.0.0-20200927032502-5d4f70055728 stdlib@go1.20.1	0.60.0 1.26.9	1
cloudbees/sidecar-injector :2.3.3	8f102ef0383a	golang.org/x/net@v0.0.0-20200927032502-5d4f70055728 stdlib@go1.20.1	0.60.0 1.26.9	1
cloudecho/hello :0.1.0	f76ede067ab9	stdlib@go1.16.6	1.26.9	1
cloudentity/openbanking-quickstart-bank :1.11.1	9402ec4b5016	golang.org/x/net@v0.0.0-20201207224615-747e23833adb stdlib@go1.15.14	0.60.0 1.26.9	1
cloudentity/openbanking-quickstart-configuration :1.11.1	8a1890eb8265	golang.org/x/net@v0.0.0-20201207224615-747e23833adb stdlib@go1.15.14	0.60.0 1.26.9	1
cloudentity/openbanking-quickstart-consent-admin-portal :1.11.1	ee83cdd45b7b	golang.org/x/net@v0.0.0-20201207224615-747e23833adb stdlib@go1.15.2	0.60.0 1.26.9	1
cloudentity/openbanking-quickstart-consent-page :1.11.1	5728654cecb7	golang.org/x/net@v0.0.0-20201207224615-747e23833adb stdlib@go1.16.6	0.60.0 1.26.9	1
cloudentity/openbanking-quickstart-consent-self-service-portal :1.11.1	8ca94ae6acf4	golang.org/x/net@v0.0.0-20201207224615-747e23833adb stdlib@go1.15.2	0.60.0 1.26.9	1
cloudentity/openbanking-quickstart-financroo-tpp :1.11.1	c04eb10c77b7	golang.org/x/net@v0.0.0-20201207224615-747e23833adb stdlib@go1.15.2	0.60.0 1.26.9	1
cloudflare/cloudflared :2024.8.3	14d9c6b01b29	golang.org/x/net@v0.25.0 stdlib@go1.22.2-devel-cf	0.60.0 1.26.9	1
cloudflare/cloudflared :2024.5.0	5d5f70a59d5e	golang.org/x/net@v0.25.0 stdlib@go1.22.2-devel-cf	0.60.0 1.26.9	1
cloudflare/cloudflared :2024.11.1	665dda65335e	golang.org/x/net@v0.25.0 stdlib@go1.22.5-devel-cf	0.60.0 1.26.9	1
cloudflare/cloudflared :2023.10.0	c18744ae1767	golang.org/x/net@v0.12.0 stdlib@go1.20.6	0.60.0 1.26.9	1
cloudflare/cloudflared :2025.8.0	eb5c9324efe3	golang.org/x/net@v0.40.0 stdlib@go1.24.4	0.60.0 1.26.9	1
cloudflare/origin-ca-issuer :v0.15.0	9ee05675fa9c	golang.org/x/net@v0.56.0 stdlib@go1.27.1	0.60.0 1.27.2	1
cloudnativelabs/kube-router :v1.6.0	0ec7cd73f43f	golang.org/x/net@v0.4.0 stdlib@go1.19.5	0.60.0 1.26.9	1
cloudposse/bastion :latest	0d9507e8a760	stdlib@go1.13.3	1.26.9	1
cloudreve/cloudreve :3.8.0	09093aec5a20	golang.org/x/net@v0.0.0-20220630215102-69896b714898 stdlib@go1.20	0.60.0 1.26.9	1
cloudreve/cloudreve :4.18.0	f7a464100bf6	golang.org/x/net@v0.55.0 stdlib@go1.25.5	0.60.0 1.26.9	1
cloudtooling/moodle :5.3.0.2	d3e3607acf56	stdlib@go1.26.4	1.26.9	1
cloudtooling/wordpress :7.1.3	fb4863035a05	stdlib@go1.26.4	1.26.9	1
cmacrae/d2-prometheus-exporter :v0.1.0	fc5fecba436e	stdlib@go1.15	1.26.9	1
cmacrae/lgtm :0.1.0	dec8d490fe40	golang.org/x/net@v0.0.0-20181108082009-03003ca0c849 stdlib@go1.14.1	0.60.0 1.26.9	1
cockroachdb/cockroach-operator :v2.1.0	983312754620	golang.org/x/net@v0.0.0-20200602114024-627f9648deb9 stdlib@go1.13.14	0.60.0 1.26.9	1
codecov/self-hosted-gateway :24.4.1	de483faad6e5	golang.org/x/net@v0.21.0 stdlib@go1.22.0	0.60.0 1.26.9	1
codenotary/immudb :1.9.7	7c85d7cc4f22	golang.org/x/net@v0.17.0 stdlib@go1.18.10	0.60.0 1.26.9	1
codercom/code-server :4.11.0-debian	1e2cc688008e	stdlib@go1.14.4	1.26.9	1
codercom/code-server :3.10.2	47605610ad8d	stdlib@go1.14.4	1.26.9	1
coderenvs/coder-service :1.44.6	1deffc4670e6	golang.org/x/net@v0.24.0 stdlib@go1.21.9	0.60.0 1.26.9	1
codeskyblue/gohttpserver :latest	caa862590e34	golang.org/x/net@v0.0.0-20201021035429-f5854403a974 stdlib@go1.16.3	0.60.0 1.26.9	1
codiacimages/codiac-deployment-bundle :0.0.15	d7d1e91eccde	golang.org/x/net@v0.38.0 stdlib@go1.24.11	0.60.0 1.26.9	1
cometbft/cometbft :v0.38.17	22c2ac018f40	golang.org/x/net@v0.34.0 stdlib@go1.22.11	0.60.0 1.26.9	1
concourse/concourse :8.3.1	c9d48dfbf4f9	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2	1