CVE-2026-78663

Critical

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: Critical; worst across findings
CVSS: 9.1; base score, highest
EPSS: 0.006; 46th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,373; of 18,117 indexed, latest versions
Container images: 6,208; deployed by those charts
Fix available: 3 of 5; affected packages

Double flow control refund on HTTP/2 server streams in net/http

Carried by container images the latest versions of 5,373 of 18,117 indexed charts deploy, on 6,208 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+212 more	1.26.9, 1.27.2	6,150
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more	0.60.0	4,957
golang-1.19deb	1.19.8-2	no fix listed	1
ingress-nginx-controller-1.15apk	1.15.10-r9	no fix listed	1
minioapk	0.20251015.172955-r10	0.20260922.192518-r2	1

OSV records: CGA-23xx-p5rw-vrp9 CGA-25j5-q798-fwm3 DEBIAN-CVE-2026-78663 GO-2026-6612
Also known as: CGA-qwrp-9ccr-5qpq, CGA-vqxj-4gp6-23v9
Trending: Rank 2 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,373 by stars

Chart

Latest

Affected images

Radar Score

geonetwork-k8sgeonetwork-k8s

4.2.8

2 of 5 See more

geonetwork-k8s geonetwork-k8s 4.2.8

2 of the 5 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
geonetwork/gn-cloud-ogc-api-records-service :4.2.8-0	20c9bb761f67	golang.org/x/net@v0.11.0 stdlib@go1.19.11	0.60.0 1.26.9
postgis/postgis :11-2.5	f479f6c3435e	stdlib@go1.16.7	1.26.9

Open the chart page →

38,273

istiogetindata

1.11.1

2 of 2 See more

istio getindata 1.11.1

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
gcr.io/istio-release/pilot :1.11.1	c552478f8f11	golang.org/x/net@v0.0.0-20210525063256-abc453219eb5 stdlib@go1.16.7	0.60.0 1.26.9
gcr.io/istio-release/proxyv2 :1.11.1	9538fabe49fd	golang.org/x/net@v0.0.0-20210525063256-abc453219eb5 stdlib@go1.16.7	0.60.0 1.26.9

Open the chart page →

19,693

ghostghost

0.1.0

3 of 4 See more

ghost ghost 0.1.0

3 of the 4 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
cloudflare/cloudflared :latest	9b49eed8f628	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9
library/ghost :5.79.0	83f7bf209844	stdlib@go1.18.2	1.26.9
litestream/litestream :0.3	c5a1e1b01916	golang.org/x/net@v0.14.0 stdlib@go1.21.3	0.60.0 1.26.9

Open the chart page →

11,261

rabbitmqginger-society

0.1.0

2 of 2 See more

rabbitmq ginger-society 0.1.0

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
kbudde/rabbitmq-exporter :latest	12f27d6d84e6	stdlib@go1.21.8	1.26.9
library/rabbitmq :4-management	8dd6e3570dda	stdlib@go1.22.2	1.26.9

Open the chart page →

2,345

gitanagitana

1.4.0

1 of 1 See more

gitana gitana 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ntakashi/gitana :1.4.0	4171ec641120	golang.org/x/net@v0.0.0-20210929161516-d455829e376d stdlib@go1.17.7	0.60.0 1.26.9

Open the chart page →

5,807

github-rate-limits-prometheus-exportergithub-rate-limit-prometheus-exporter

0.2.15

1 of 1 See more

github-rate-limits-prometheus-exporter github-rate-limit-prometheus-exporter 0.2.15

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/kalgurn/grl-exporter :v3.2.0	bd109b2bda38	stdlib@go1.23.5	1.26.9

Open the chart page →

1,336

gitlab-goproxygitlab-goproxy

0.2.2

1 of 1 See more

gitlab-goproxy gitlab-goproxy 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/djcass44/gitlab-goproxy :v0.1.8	a43323732181	golang.org/x/net@v0.10.0 stdlib@go1.21.0	0.60.0 1.26.9

Open the chart page →

2,060

gitlab-mr-conformgitlab-mr-conform

0.6.0

1 of 1 See more

gitlab-mr-conform gitlab-mr-conform 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/chrxmvtik/gitlab-mr-conform :0.6.0	facdb9bf0394	golang.org/x/net@v0.51.0 stdlib@go1.25.9	0.60.0 1.26.9

Open the chart page →

798

apid-helpergkarthiks

0.1.4

1 of 1 See more

apid-helper gkarthiks 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
quay.io/gkarthics/apid-helper :v0.2.3	d7d93debf1f4	golang.org/x/net@v0.11.0 stdlib@go1.19.12	0.60.0 1.26.9

Open the chart page →

3,348

prometheus-container-resource-exportergkarthiks

0.3.1

1 of 1 See more

prometheus-container-resource-exporter gkarthiks 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
gkarthics/container-resource-exporter :latest	6799af333e8a	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.14.7	0.60.0 1.26.9

Open the chart page →

3,466

prometheus-couchdb-exportergkarthiks

0.1.3

1 of 1 See more

prometheus-couchdb-exporter gkarthiks 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
gesellix/couchdb-prometheus-exporter :v27.2.0	5b891f1fc2b9	stdlib@go1.13.10	1.26.9

Open the chart page →

2,366

glassflow-etlglassflow

0.5.21

11 of 16 See more

glassflow-etl glassflow 0.5.21

11 of the 16 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
bitnami/kubectl :latest	f7f9e4f64d9e	golang.org/x/net@v0.57.0 stdlib@go1.26.8	0.60.0 1.26.9
library/nats :2.12.3-alpine	88fe8e0e09d6	stdlib@go1.25.5	1.26.9
library/postgres :17-alpine	b0f9560a2de0	stdlib@go1.24.6	1.26.9
natsio/nats-box :0.19.2	8031d190c7ee	golang.org/x/net@v0.44.0 stdlib@go1.25.2	0.60.0 1.26.9
natsio/nats-server-config-reloader :0.21.1	10ff229eaf52	stdlib@go1.25.5	1.26.9
natsio/prometheus-nats-exporter :0.17.3	26c826662ac8	stdlib@go1.24.2	1.26.9
otel/opentelemetry-collector-contrib :0.108.0	923eb1cfae32	golang.org/x/net@v0.28.0 stdlib@go1.23.0	0.60.0 1.26.9
ghcr.io/glassflow/glassflow-etl-be :v3.2.0	20f066d0f631	golang.org/x/net@v0.52.0 stdlib@go1.25.0	0.60.0 1.26.9
ghcr.io/glassflow/glassflow-etl-k8s-operator :v3.2.1	e70364e88629	golang.org/x/net@v0.43.0 stdlib@go1.25.0	0.60.0 1.26.9
ghcr.io/glassflow/glassflow-etl-migration :v3.2.0	7db1a1bf3dae	golang.org/x/net@v0.47.0 stdlib@go1.25.4	0.60.0 1.26.9
ghcr.io/glassflow/kafka-kerberos-gateway :latest	2ae01c524a6e	stdlib@go1.21.13	1.26.9

Open the chart page →

17,380

pgbouncerglassflow

0.1.0

1 of 1 See more

pgbouncer glassflow 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
bitnamilegacy/pgbouncer :1.23.1	92356da09704	stdlib@go1.22.10	1.26.9

Open the chart page →

4,006

postgresqlglassflow

0.1.9

1 of 1 See more

postgresql glassflow 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/postgres :17-alpine	b0f9560a2de0	stdlib@go1.24.6	1.26.9

Open the chart page →

703

glassflow-operatorglassflow-operator

0.8.5

2 of 3 See more

glassflow-operator glassflow-operator 0.8.5

2 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
bitnami/kubectl :latest	f7f9e4f64d9e	golang.org/x/net@v0.57.0 stdlib@go1.26.8	0.60.0 1.26.9
ghcr.io/glassflow/glassflow-etl-k8s-operator :v3.2.1	e70364e88629	golang.org/x/net@v0.43.0 stdlib@go1.25.0	0.60.0 1.26.9

Open the chart page →

1,501

glauthglauth

0.3.17

1 of 2 See more

glauth glauth 0.3.17

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/nnstd/glauth :2.5	2e6e09fa77dd	golang.org/x/net@v0.41.0 stdlib@go1.24.5	0.60.0 1.26.9

Open the chart page →

3,454

gliderglider

0.1.5

1 of 1 See more

glider glider 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
nadoo/glider :0.16	38aadefbd607	golang.org/x/net@v0.28.0 stdlib@go1.20.14	0.60.0 1.26.9

Open the chart page →

1,534

glpiglpi-chart

0.1.1

1 of 3 See more

glpi glpi-chart 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/mariadb :latest	f1bba652ba57	stdlib@go1.26.7	1.26.9

Open the chart page →

13,115

gnp-stackgnp-stack

0.0.5

11 of 14 See more

gnp-stack gnp-stack 0.0.5

11 of the 14 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
grafana/grafana :12.2.1	35c41e0fd029	golang.org/x/net@v0.45.0 stdlib@go1.25.3	0.60.0 1.26.9
library/nats :2.12.1-alpine	b3f2bd84176a	stdlib@go1.25.3	1.26.9
natsio/nats-box :0.19.2	8031d190c7ee	golang.org/x/net@v0.44.0 stdlib@go1.25.2	0.60.0 1.26.9
natsio/nats-server-config-reloader :0.20.1	47094fcae2f4	stdlib@go1.24.8	1.26.9
natsio/prometheus-nats-exporter :0.17.3	26c826662ac8	stdlib@go1.24.2	1.26.9
rancher/local-path-provisioner :v0.0.32	9289da488b07	golang.org/x/net@v0.38.0 stdlib@go1.24.4	0.60.0 1.26.9
ghcr.io/openconfig/gnmic :0.45.0	d422a9ebd4a2	golang.org/x/net@v0.50.0 stdlib@go1.24.12	0.60.0 1.26.9
quay.io/prometheus-operator/prometheus-operator :v0.85.0	890b3bb05cf4	golang.org/x/net@v0.43.0 stdlib@go1.24.6	0.60.0 1.26.9
quay.io/prometheus/node-exporter :v1.9.1	d00a542e409e	golang.org/x/net@v0.37.0 stdlib@go1.23.7	0.60.0 1.26.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.6.3	3d671cf20a35	golang.org/x/net@v0.44.0 stdlib@go1.25.1	0.60.0 1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.17.0	2bbc91556733	golang.org/x/net@v0.41.0 stdlib@go1.24.6	0.60.0 1.26.9

Open the chart page →

18,647

go-app-helmgo-app-helm

0.1.0

1 of 1 See more

go-app-helm go-app-helm 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
manojchaulagain/go-k8s :0.1.0	f237b5f637ae	stdlib@go1.20.1	1.26.9

Open the chart page →

2,874

go-file-servergo-file-server

1.0.0

1 of 2 See more

go-file-server go-file-server 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
goccx/go-file-server :latest	f4b3ebea0303	golang.org/x/net@v0.27.0 stdlib@go1.21.10	0.60.0 1.26.9

Open the chart page →

2,872

gofitgofit

0.0.1

1 of 1 See more

gofit gofit 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/bamaas/gofit :0.0.1	32b6a174b419	stdlib@go1.22.11	1.26.9

Open the chart page →

1,065

goldpingergoldpinger

1.2.0

1 of 1 See more

goldpinger goldpinger 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
bloomberg/goldpinger :3.11.5	f7c60d319150	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

209

googly-logingoogly-login

0.1.0

1 of 2 See more

googly-login googly-login 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/postgres :16	65b16a8b326e	stdlib@go1.24.6	1.26.9

Open the chart page →

1,806

gorsegorse-io

0.4.2

3 of 4 See more

gorse gorse-io 0.4.2

3 of the 4 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
zhenghaoz/gorse-master :0.4.12	033046b432ec	golang.org/x/net@v0.7.0 stdlib@go1.20.1	0.60.0 1.26.9
zhenghaoz/gorse-server :0.4.12	39c565685b01	golang.org/x/net@v0.7.0 stdlib@go1.20.1	0.60.0 1.26.9
zhenghaoz/gorse-worker :0.4.12	f7739f64c9b0	golang.org/x/net@v0.7.0 stdlib@go1.20.1	0.60.0 1.26.9

Open the chart page →

6,830

gosmee-clientgosmee-client

0.1.3

1 of 1 See more

gosmee-client gosmee-client 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/chmouel/gosmee :v0.32.0	60b8db1f68cc	golang.org/x/net@v0.55.0 stdlib@go1.26.5	0.60.0 1.26.9

Open the chart page →

630

gotwaygotway

0.8.0

1 of 1 See more

gotway gotway 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/gotway/gotway :v0.0.13	7ed73c1979ee	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.18.3	0.60.0 1.26.9

Open the chart page →

2,811

Governify-Bluejaygovernify

0.1.0

2 of 12 See more

Governify-Bluejay governify 0.1.0

2 of the 12 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
governify/dashboard :latest	e83a17ba5038	golang.org/x/net@v0.0.0-20210726213435-c6fcb2dbf985 stdlib@go1.17	0.60.0 1.26.9
library/mongo :latest	bac22ea7710d	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

24,266

Governify-Falcongovernify

0.1.0

3 of 10 See more

Governify-Falcon governify 0.1.0

3 of the 10 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
governify/dashboard :latest	e83a17ba5038	golang.org/x/net@v0.0.0-20210726213435-c6fcb2dbf985 stdlib@go1.17	0.60.0 1.26.9
library/mongo :latest	bac22ea7710d	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9
quay.io/prometheus/prometheus :latest	efd719c99d83	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

26,687

goweeklygoweekly

2.0.0

1 of 1 See more

goweekly goweekly 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
zufardhiyaulhaq/goweekly :v2.0.0	08dcc130fbea	golang.org/x/net@v0.0.0-20220520000938-2e3eb7b945c2 stdlib@go1.17.12	0.60.0 1.26.9

Open the chart page →

2,126

harborgpg-dev

1.18.3

5 of 8 See more

harbor gpg-dev 1.18.3

5 of the 8 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
goharbor/harbor-core :v2.14.3	a30e5a8be3d9	golang.org/x/net@v0.47.0 stdlib@go1.24.13	0.60.0 1.26.9
goharbor/harbor-jobservice :v2.14.3	e2b0298e894d	golang.org/x/net@v0.47.0 stdlib@go1.24.13	0.60.0 1.26.9
goharbor/harbor-registryctl :v2.14.3	ddf6bb429eb6	golang.org/x/net@v0.47.0 stdlib@go1.24.13	0.60.0 1.26.9
goharbor/registry-photon :v2.14.3	6533fc396cbc	stdlib@go1.24.13	1.26.9
goharbor/trivy-adapter-photon :v2.14.3	5c6f7162804c	golang.org/x/net@v0.28.0 stdlib@go1.25.7	0.60.0 1.26.9

Open the chart page →

5,507

ingress-nginxgpg-dev

4.9.0

2 of 2 See more

ingress-nginx gpg-dev 4.9.0

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
registry.k8s.io/ingress-nginx/controller :v1.9.5	b3aba22b1da8	golang.org/x/net@v0.17.0 stdlib@go1.21.5	0.60.0 1.26.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v20231011-8b53cabe0	a7943503b45d	golang.org/x/net@v0.16.0 stdlib@go1.21.3	0.60.0 1.26.9

Open the chart page →

3,222

jaegergpg-dev

3.3.3

4 of 5 See more

jaeger gpg-dev 3.3.3

4 of the 5 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-agent :1.53.0	0214a0ef24b1	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.60.0 1.26.9
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	stdlib@go1.18.2	1.26.9
jaegertracing/jaeger-collector :1.53.0	7f1269222903	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.60.0 1.26.9
jaegertracing/jaeger-query :1.53.0	049bb0d64ea3	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.60.0 1.26.9

Open the chart page →

22,255

kube-prometheus-stackgpg-dev

84.0.0

5 of 6 See more

kube-prometheus-stack gpg-dev 84.0.0

5 of the 6 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
grafana/grafana :13.0.1	0f86bada30d6	golang.org/x/net@v0.52.0 stdlib@go1.26.0	0.60.0 1.26.9
ghcr.io/jkroepke/kube-webhook-certgen :1.8.1	4f6da0256b1b	golang.org/x/net@v0.53.0 stdlib@go1.26.2	0.60.0 1.26.9
quay.io/prometheus-operator/prometheus-operator :v0.90.1	52a6a92d915e	golang.org/x/net@v0.52.0 stdlib@go1.25.8	0.60.0 1.26.9
quay.io/prometheus/node-exporter :v1.11.1	0f422f62c15f	golang.org/x/net@v0.52.0 stdlib@go1.26.1	0.60.0 1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.18.0	1545919b72e3	golang.org/x/net@v0.48.0 stdlib@go1.25.5	0.60.0 1.26.9

Open the chart page →

5,450

kubernetes-dashboardgpg-dev

7.5.0

4 of 5 See more

kubernetes-dashboard gpg-dev 7.5.0

4 of the 5 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
kubernetesui/dashboard-api :1.7.0	60595892c2cf	golang.org/x/net@v0.25.0 stdlib@go1.22.3	0.60.0 1.26.9
kubernetesui/dashboard-auth :1.1.3	07135c09e9ff	golang.org/x/net@v0.22.0 stdlib@go1.22.2	0.60.0 1.26.9
kubernetesui/dashboard-metrics-scraper :1.1.1	7747d363c9fe	golang.org/x/net@v0.21.0 stdlib@go1.22.1	0.60.0 1.26.9
kubernetesui/dashboard-web :1.4.0	4445b31a2c25	golang.org/x/net@v0.25.0 stdlib@go1.22.3	0.60.0 1.26.9

Open the chart page →

7,915

metrics-servergpg-dev

3.12.1

1 of 1 See more

metrics-server gpg-dev 3.12.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
registry.k8s.io/metrics-server/metrics-server :v0.7.1	db3800085a09	golang.org/x/net@v0.20.0 stdlib@go1.21.8	0.60.0 1.26.9

Open the chart page →

1,539

opentelemetry-demogpg-dev

0.33.8

8 of 27 See more

opentelemetry-demo gpg-dev 0.33.8

8 of the 27 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
grafana/grafana :11.3.1	fa801ab6e1ae	golang.org/x/net@v0.29.0 stdlib@go1.23.1	0.60.0 1.26.9
jaegertracing/all-in-one :1.53.0	60e65bfffe1f	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.60.0 1.26.9
otel/opentelemetry-collector-contrib :0.114.0	37fa87091cfa	golang.org/x/net@v0.31.0 stdlib@go1.23.3	0.60.0 1.26.9
ghcr.io/open-feature/flagd :v0.11.1	a7ea52f87446	golang.org/x/net@v0.27.0 stdlib@go1.22.5	0.60.0 1.26.9
ghcr.io/open-telemetry/demo :1.12.0-productcatalogservice	008b9b662289	golang.org/x/net@v0.25.0 stdlib@go1.22.8	0.60.0 1.26.9
ghcr.io/open-telemetry/demo :1.12.0-checkoutservice	380eccdc29e9	golang.org/x/net@v0.25.0 stdlib@go1.22.8	0.60.0 1.26.9
ghcr.io/open-telemetry/demo :1.12.0-shippingservice	a3ca4c02a5df	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.60.0 1.26.9
quay.io/prometheus/prometheus :v3.0.0	3b9b2a15d376	golang.org/x/net@v0.30.0 stdlib@go1.23.3	0.60.0 1.26.9

Open the chart page →

58,805

prometheusgpg-dev

29.2.1

6 of 6 See more

prometheus gpg-dev 29.2.1

6 of the 6 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
quay.io/prometheus-operator/prometheus-config-reloader :v0.90.1	693faa0b8724	golang.org/x/net@v0.52.0 stdlib@go1.25.8	0.60.0 1.26.9
quay.io/prometheus/alertmanager :v0.32.0	58e117eabcce	golang.org/x/net@v0.52.0 stdlib@go1.26.2	0.60.0 1.26.9
quay.io/prometheus/node-exporter :v1.11.1	0f422f62c15f	golang.org/x/net@v0.52.0 stdlib@go1.26.1	0.60.0 1.26.9
quay.io/prometheus/prometheus :v3.11.2	cd37346c9745	golang.org/x/net@v0.52.0 stdlib@go1.26.2	0.60.0 1.26.9
quay.io/prometheus/pushgateway :v1.11.2	49ed9fdf3780	golang.org/x/net@v0.46.0 stdlib@go1.25.3	0.60.0 1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.18.0	1545919b72e3	golang.org/x/net@v0.48.0 stdlib@go1.25.5	0.60.0 1.26.9

Open the chart page →

5,747

prometheus-operator-admission-webhookgpg-dev

0.18.1

2 of 2 See more

prometheus-operator-admission-webhook gpg-dev 0.18.1

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
quay.io/prometheus-operator/admission-webhook :v0.79.2	d4c97a1b2d67	golang.org/x/net@v0.32.0 stdlib@go1.23.4	0.60.0 1.26.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v20221220-controller-v1.5.1-58-g787ea74b6	4d99688e5573	golang.org/x/net@v0.1.0 stdlib@go1.19.4	0.60.0 1.26.9

Open the chart page →

3,053

thanosgpg-dev

0.5.3

1 of 1 See more

thanos gpg-dev 0.5.3

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
thanosio/thanos :v0.41.0	cf3e9b292e43	golang.org/x/net@v0.49.0 stdlib@go1.25.7	0.60.0 1.26.9

Open the chart page →

1,015

traefikgpg-dev

39.0.8

1 of 1 See more

traefik gpg-dev 39.0.8

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/traefik :v3.6.13	34d5089d0b41	golang.org/x/net@v0.51.0 stdlib@go1.25.8	0.60.0 1.26.9

Open the chart page →

1,791

velerogpg-dev

12.0.0

1 of 1 See more

velero gpg-dev 12.0.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
velero/velero :v1.18.0	e4d1e79be2ee	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.60.0 1.26.9

Open the chart page →

2,110

whoami-demogpg-dev

0.1.0

1 of 1 See more

whoami-demo gpg-dev 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
containous/whoami :latest	7d6a3c8f9147	stdlib@go1.14	1.26.9

Open the chart page →

2,369

spark-standalonegradiant-bigdata

0.1.0

1 of 2 See more

spark-standalone gradiant-bigdata 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
prom/graphite-exporter :latest	c1a266f63a84	golang.org/x/net@v0.55.0 stdlib@go1.26.5	0.60.0 1.26.9

Open the chart page →

6,531

cloudcost-exportergrafana

1.1.16

1 of 1 See more

cloudcost-exporter grafana 1.1.16

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
grafana/cloudcost-exporter :v1.15.0	6c7f78bd104e	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

213

grafana-cloud-onboardinggrafana

0.4.7

5 of 5 See more

grafana-cloud-onboarding grafana 0.4.7

5 of the 5 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
grafana/beyla-k8s-cache :2	53b2f561cb1b	golang.org/x/net@v0.48.0 stdlib@go1.25.3	0.60.0 1.26.9
ghcr.io/grafana/alloy-operator :1.8.1	ae85d68749c7	golang.org/x/net@v0.49.0 stdlib@go1.25.8	0.60.0 1.26.9
ghcr.io/grafana/helm-chart-toolbox-kubectl :0.1.1	c137478627cc	golang.org/x/net@v0.23.0 stdlib@go1.23.6	0.60.0 1.26.9
quay.io/prometheus/node-exporter :v1.11.1	0f422f62c15f	golang.org/x/net@v0.52.0 stdlib@go1.26.1	0.60.0 1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.18.0	1545919b72e3	golang.org/x/net@v0.48.0 stdlib@go1.25.5	0.60.0 1.26.9

Open the chart page →

7,070

grafana-samplinggrafana

1.1.7

2 of 2 See more

grafana-sampling grafana 1.1.7

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
grafana/alloy :v1.11.3	8c7256f412fe	golang.org/x/net@v0.43.0 stdlib@go1.24.6	0.60.0 1.26.9
quay.io/prometheus-operator/prometheus-config-reloader :v0.81.0	959d47672fbf	golang.org/x/net@v0.37.0 stdlib@go1.23.7	0.60.0 1.26.9

Open the chart page →

4,719

k8s-injection-controllergrafana

0.2.1

1 of 1 See more

k8s-injection-controller grafana 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/grafana/k8s-injection-controller :0.2.0	c5bad40655a3	golang.org/x/net@v0.55.0 stdlib@go1.26.5	0.60.0 1.26.9

Open the chart page →

406

mimir-openshift-experimentalgrafana

2.1.0

1 of 4 See more

mimir-openshift-experimental grafana 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
grafana/mimir :2.0.0	80c1a8eb24dd	golang.org/x/net@v0.0.0-20220105145211-5b0dc2dfae98 stdlib@go1.17.8	0.60.0 1.26.9

Open the chart page →

5,321

pyroscope-monitoringgrafana

0.1.1

5 of 6 See more

pyroscope-monitoring grafana 0.1.1

5 of the 6 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
grafana/otel-lgtm :0.11.10	09d8c3ce4f3a	golang.org/x/net@v0.38.0 stdlib@go1.24.6	0.60.0 1.26.9
ghcr.io/grafana/alloy-operator :1.3.0	2088dcb22aaa	golang.org/x/net@v0.41.0 stdlib@go1.24.5	0.60.0 1.26.9
ghcr.io/grafana/helm-chart-toolbox-kubectl :0.1.1	c137478627cc	golang.org/x/net@v0.23.0 stdlib@go1.23.6	0.60.0 1.26.9
quay.io/prometheus/node-exporter :v1.9.1	d00a542e409e	golang.org/x/net@v0.37.0 stdlib@go1.23.7	0.60.0 1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.17.0	2bbc91556733	golang.org/x/net@v0.41.0 stdlib@go1.24.6	0.60.0 1.26.9

Open the chart page →

11,642

Container images carrying it

6,208 by charts deploying them

A fixed version is listed for 3 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
tensorzero/ui :2026.6.0	f2563d54724e	stdlib@go1.23.12	1.26.9	1
tenureai/tenure :v1.0.28	5f5b222df9a5	stdlib@go1.26.2	1.26.9	1
thanosio/thanos :v0.19.0	88276fcd1491	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777 stdlib@go1.15.10	0.60.0 1.26.9	1
thanosio/thanos :v0.15.0	b12d5c31bf5a	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.14.2	0.60.0 1.26.9	1
thecampagnards/trafficlight-api :main	7dca9d973837	stdlib@go1.16.4	1.26.9	1
thecodingmachine/workadventure-back :helm-chart	53a30c962ce9	stdlib@go1.20.12	1.26.9	1
thecodingmachine/workadventure-back :v1.17.7	64001369dad5	stdlib@go1.20.7	1.26.9	1
thecodingmachine/workadventure-ejabberd :v1.17.7	01df99622ad3	stdlib@go1.17.13	1.26.9	1
thecodingmachine/workadventure-ejabberd :helm-chart	e1775ca7b145	stdlib@go1.17.13	1.26.9	1
thecodingmachine/workadventure-map-storage :helm-chart	519c31c6e7ec	stdlib@go1.20.12	1.26.9	1
thecodingmachine/workadventure-map-storage :v1.17.7	5bdab56da2fa	stdlib@go1.19.3	1.26.9	1
thecodingmachine/workadventure-play :v1.17.7	d8f66979b9b4	stdlib@go1.20.7	1.26.9	1
thecodingmachine/workadventure-play :helm-chart	df31006cc4ce	stdlib@go1.20.12	1.26.9	1
thecodingmachine/workadventure-uploader :v1.17.7	3ccd467543b3	stdlib@go1.20.7	1.26.9	1
thecodingmachine/workadventure-uploader :helm-chart	962e98843fb2	stdlib@go1.20.12	1.26.9	1
thelande/openmeteo_exporter :v1.0.7	7e9072ace15f	golang.org/x/net@v0.38.0 stdlib@go1.23.11	0.60.0 1.26.9	1
thelisdeep/pii-shield :2.2.7	6a8b0c89227b	stdlib@go1.27.1	1.27.2	1
thesisrobot/lnd :v0.16.4-beta-c	287129953689	golang.org/x/net@v0.8.0 stdlib@go1.21.0	0.60.0 1.26.9	1
thesisrobot/lnd :v0.14.1-beta	d94c8dbf6dac	golang.org/x/net@v0.0.0-20210913180222-943fd674d43e stdlib@go1.17.1	0.60.0 1.26.9	1
thetorproject/snowflake-proxy :v2.11.0	1ddc5069d354	golang.org/x/net@v0.35.0 stdlib@go1.23.7	0.60.0 1.26.9	1
thev1ndu/transfergw :latest	a07203713933	golang.org/x/net@v0.57.0 stdlib@go1.26.8	0.60.0 1.26.9	1
thijsvanloef/palworld-server-docker :v2.7.1	401d3eb5c053	stdlib@go1.25.12	1.26.9	1
thijsvanloef/palworld-server-docker :v2.5.0	b4ac9ee22483	stdlib@go1.26.3	1.26.9	1
thingsboard/toolbox :1.29.0	0f6c14031777	golang.org/x/net@v0.58.0 stdlib@go1.27.0	0.60.0 1.27.2	1
thomseddon/traefik-forward-auth :2	69a2c985d2c5	golang.org/x/net@v0.0.0-20190930134127-c5a3c61f89f3 stdlib@go1.13.12	0.60.0 1.26.9	1
thomseddon/traefik-forward-auth :latest	b364aa6a4117	golang.org/x/net@v0.0.0-20190930134127-c5a3c61f89f3 stdlib@go1.13.15	0.60.0 1.26.9	1
tile38/tile38 :1.38.0	5b61c6f3b32e	golang.org/x/net@v0.48.0 stdlib@go1.26.4	0.60.0 1.26.9	1
tile38/tile38 :1.33.4	afb7e82f9485	golang.org/x/net@v0.23.0 stdlib@go1.23.2	0.60.0 1.26.9	1
timescale/timescaledb :latest-pg12	645fd9e92d76	stdlib@go1.18.7	1.26.9	1
timescale/timescaledb :latest-pg16	6f139d560429	stdlib@go1.26.2	1.26.9	1
timescale/timescaledb-ha :pg15-latest	a8e3322e1cf9	stdlib@go1.19.1	1.26.9	1
timescale/timescaledb-ha :pg14.6-ts2.9.1-p1	cdb9ae118899	stdlib@go1.19.1	1.26.9	1
timescale/timescaledb-ha :pg17.2-ts2.18.2	e8d0a9cc3db5	golang.org/x/net@v0.33.0 stdlib@go1.21.13	0.60.0 1.26.9	1
timescale/timescaledb-ha :pg16	e9f34d8dd276	golang.org/x/net@v0.26.0 stdlib@go1.27.1	0.60.0 1.27.2	1
timescale/timescaledb-ha :pg14-ts2.6-latest	ed719c0cd19d	stdlib@go1.15.6	1.26.9	1
timescale/timescaledb-postgis :latest-pg12	7758704d4a14	stdlib@go1.14	1.26.9	1
timonwong/prometheus-webhook-dingtalk :v1.4.0	a0fcc028bd8d	stdlib@go1.13.5	1.26.9	1
tinymediamanager/tinymediamanager :5.3.4	48c15784a127	stdlib@go1.24.4	1.26.9	1
tksky1/cubeuniverse :0.1alpha	ec7b889f380f	golang.org/x/net@v0.3.1-0.20221206200815-1e63c2f08a10 stdlib@go1.20.3	0.60.0 1.26.9	1
tobiasbp/db-backup :0.0.3	14bee6e33a26	golang.org/x/net@v0.0.0-20191109021931-daa7c04131f5 stdlib@go1.13.10	0.60.0 1.26.9	1
tobiasehlert/teslamateapi :1.20.2	cf09259ad0ea	golang.org/x/net@v0.37.0 stdlib@go1.24.0	0.60.0 1.26.9	1
tobirachel/node-project3 :v1	7d9f37154994	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e stdlib@go1.17.5	0.60.0 1.26.9	1
tolgee/tolgee :v3.234.0	63a45daf1e72	stdlib@go1.24.6	1.26.9	1
toniblyx/prowler :stable	9dbcc3c9abd7	golang.org/x/net@v0.58.0 stdlib@go1.26.6-X:jsonv2	0.60.0 1.26.9	1
toucansoftware/spa-reloader :latest	c187b1fba501	golang.org/x/net@v0.0.0-20200520004742-59133d7f0dd7 stdlib@go1.13.15	0.60.0 1.26.9	1
trackerforce/switcher-gitops :latest	20235fe419e4	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
traefik/mesh :v1.4.8	cf071f3e165c	golang.org/x/net@v0.0.0-20220624214902-1bab6f366d9e stdlib@go1.19	0.60.0 1.26.9	1
traefik/traefikee :v2.12.11	6259bdda7aa6	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9	1
traefik/whoami :v1.10.2	1474027c3166	golang.org/x/net@v0.25.0 stdlib@go1.22.2	0.60.0 1.26.9	1
traefik/whoami :v1.10	1699d99cb4b9	stdlib@go1.23.5	1.26.9	1