CVE-2026-78663

Medium

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: Medium; worst across findings
CVSS: 5.5; base score, highest
EPSS: 0.002; 15th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,564; of 18,087 indexed, latest versions
Container images: 6,417; deployed by those charts
Fix available: 6 of 9; affected packages

Double flow control refund on HTTP/2 server streams in net/http

Carried by container images the latest versions of 5,564 of 18,087 indexed charts deploy, on 6,417 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+212 more	1.26.9, 1.27.2	6,392
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more	0.60.0	5,161
golang-1.19deb	1.19.8-2	no fix listed	1
helm-4apk	4.3.0-r0	4.3.0-r2	1
ingress-nginx-controller-1.15apk	1.15.10-r3	no fix listed	1
kineapk	0.17.1-r1	0.17.2-r2	1
kubernetes-1.37apk	1.37.1-r0	1.37.1-r2	1
runcapk	1.5.2-r0	no fix listed	1
tetragonapk	1.7.1-r4	1.7.1-r6	1

OSV records: CGA-25j5-q798-fwm3 CGA-2gqg-cwwv-gpq8 CGA-47rc-6mj7-j49q CGA-52wv-3w8x-88q8 CGA-gghc-78jw-f5q2 CGA-w84h-9v6p-pf3x DEBIAN-CVE-2026-78663 GO-2026-6612
Also known as: CGA-34ww-96mj-f68f, CGA-496v-v9f7-gg5g, CGA-63wp-c4jp-8rp3, CGA-69c7-fg3r-x52j, CGA-6q57-jhhm-h4wv, CGA-7h68-428w-v8rx, CGA-7r9c-ff6c-hxjj, CGA-83p5-fjgf-7f3c, CGA-8657-wr97-3mfx, CGA-92vv-8vvj-9395, CGA-9fgf-3526-83c2, CGA-9vvh-3x7q-fg3m, CGA-cx87-7wm6-85w4, CGA-frvr-2pgq-38cg, CGA-g5vc-6qvm-vhqf, CGA-mmhx-33v2-g868, CGA-qq63-42gf-c64c, CGA-r8gj-3cwq-xgqj, CGA-r8gm-456m-hwcc, CGA-rc2p-74g8-rgfr, CGA-rp37-mxv6-g5fj, CGA-vqxj-4gp6-23v9, CGA-wfqc-4mv3-qjv3, CGA-wjfh-8wph-66g7, CGA-x3qg-fv98-5j72, CGA-x57q-8qv6-g2j7
Trending: Rank 1 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,564 by stars

Chart

Latest

Affected images

Radar Score

opscenter-coreappscode

2022.6.14

4 of 4 See more

opscenter-core appscode 2022.6.14

4 of the 4 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/grafana-tools :v0.0.1	f60324bca644	golang.org/x/net@v0.0.0-20220909164309-bea034e7d591 stdlib@go1.19.4	0.60.0 1.26.9
ghcr.io/appscode/kube-ui-server :v0.0.13	40775d6850b5	golang.org/x/net@v0.4.1-0.20221210045730-e1ec361d0b39 stdlib@go1.19.5	0.60.0 1.26.9
ghcr.io/appscode/license-proxyserver :v0.0.3	72a5c874d854	golang.org/x/net@v0.0.0-20220909164309-bea034e7d591 stdlib@go1.19.6	0.60.0 1.26.9
ghcr.io/appscode/supervisor :v0.0.2	1a58f56724da	golang.org/x/net@v0.4.1-0.20221210045730-e1ec361d0b39 stdlib@go1.19.4	0.60.0 1.26.9

Open the chart page →

10,766

outbox-syncerappscode

2026.9.11

1 of 1 See more

outbox-syncer appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/outboxsyncer :v0.6.0	c52861c4669f	golang.org/x/net@v0.57.0 stdlib@go1.25.13	0.60.0 1.26.9

Open the chart page →

270

panopticonappscode

2026.9.18

2 of 2 See more

panopticon appscode 2026.9.18

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/kubectl-nonroot :1.34	0b26892cec94	golang.org/x/net@v0.38.0 stdlib@go1.24.13	0.60.0 1.26.9
ghcr.io/appscode/panopticon :v0.0.24	3ea0e226a86d	golang.org/x/net@v0.55.0 stdlib@go1.25.13	0.60.0 1.26.9

Open the chart page →

917

persesappscode

2026.6.2

2 of 2 See more

perses appscode 2026.6.2

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/appscode-images/postgres :18.3-bookworm	8d320c6facbc	stdlib@go1.24.6	1.26.9
ghcr.io/opnpulse/perses :v2026.4.24	7f540d844c54	golang.org/x/net@v0.42.0 stdlib@go1.25.14	0.60.0 1.26.9

Open the chart page →

3,632

petsetappscode

2026.9.18

1 of 1 See more

petset appscode 2026.9.18

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/petset :v0.2.0	913f0858eb24	golang.org/x/net@v0.47.0 stdlib@go1.25.13	0.60.0 1.26.9

Open the chart page →

651

pgoutboxappscode

2026.7.10

1 of 1 See more

pgoutbox appscode 2026.7.10

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/pgoutbox :v0.0.4	a96e06ec5e9f	golang.org/x/net@v0.47.0 stdlib@go1.25.12	0.60.0 1.26.9

Open the chart page →

1,191

platform-apiappscode

2026.9.11

2 of 3 See more

platform-api appscode 2026.9.11

2 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/b3 :v2026.9.11	49b706354a6f	golang.org/x/net@v0.57.0 stdlib@go1.25.3	0.60.0 1.26.9
ghcr.io/appscode/gotenberg :8.25	f9104080d9a7	golang.org/x/net@v0.47.0 stdlib@go1.25.4	0.60.0 1.26.9

Open the chart page →

43,818

platform-linksappscode

2026.9.11

1 of 1 See more

platform-links appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/fileserver :v0.0.2	b1857871e06c	golang.org/x/net@v0.26.0 stdlib@go1.25.4	0.60.0 1.26.9

Open the chart page →

1,177

prom-label-proxyappscode

2026.9.22

1 of 1 See more

prom-label-proxy appscode 2026.9.22

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/opnpulse/prom-label-proxy :v2026.9.22	47afd6372838	golang.org/x/net@v0.52.0 stdlib@go1.25.14	0.60.0 1.26.9

Open the chart page →

267

prom-proxyappscode

2023.3.23

1 of 1 See more

prom-proxy appscode 2023.3.23

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/b3 :v2023.03.23	5f5a40fc1702	golang.org/x/net@v0.8.0 stdlib@go1.20.2	0.60.0 1.26.9

Open the chart page →

3,438

regcacheappscode

2026.9.11

1 of 1 See more

regcache appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/registry :3.1.1	1be55279f18a	golang.org/x/net@v0.52.0 stdlib@go1.25.9	0.60.0 1.26.9

Open the chart page →

984

secrets-store-csi-driver-provider-virtual-secretsappscode

2026.8.14

1 of 1 See more

secrets-store-csi-driver-provider-virtual-secrets appscode 2026.8.14

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/secrets-store-csi-driver-provider-virtual-secrets :v0.2.0	7afb394f9f97	golang.org/x/net@v0.55.0 stdlib@go1.25.12	0.60.0 1.26.9

Open the chart page →

974

service-backendappscode

2026.9.11

1 of 1 See more

service-backend appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/service-provider :v0.0.2	f6e481386d70	golang.org/x/net@v0.47.0 stdlib@go1.25.5	0.60.0 1.26.9

Open the chart page →

1,767

service-gatewayappscode

2026.9.11

3 of 3 See more

service-gateway appscode 2026.9.11

3 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/voyagermesh/crd-manager :v0.3.0	e67f14e5c853	golang.org/x/net@v0.47.0 stdlib@go1.25.12	0.60.0 1.26.9
ghcr.io/voyagermesh/echoserver :v20221109	fa56a9251de6	stdlib@go1.19	1.26.9
ghcr.io/voyagermesh/gateway :v1.8.2	4237fd16a3cb	golang.org/x/net@v0.55.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

3,449

service-presetsappscode

2024.2.11

1 of 1 See more

service-presets appscode 2024.2.11

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/voyagermesh/echoserver :v20221109-7ee2f3e	fa56a9251de6	stdlib@go1.19	1.26.9

Open the chart page →

1,513

service-providerappscode

2026.9.11

2 of 2 See more

service-provider appscode 2026.9.11

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/kube-rbac-proxy :v0.18.2	7de54b6dedc8	golang.org/x/net@v0.31.0 stdlib@go1.23.3	0.60.0 1.26.9
ghcr.io/appscode/service-provider :v0.0.2	f6e481386d70	golang.org/x/net@v0.47.0 stdlib@go1.25.5	0.60.0 1.26.9

Open the chart page →

3,154

service-vaultappscode

2026.9.11

2 of 2 See more

service-vault appscode 2026.9.11

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/kubectl-nonroot :1.34	0b26892cec94	golang.org/x/net@v0.38.0 stdlib@go1.24.13	0.60.0 1.26.9
ghcr.io/kubevault/vault-operator :v0.25.0	c8e042b5cee8	golang.org/x/net@v0.55.0 stdlib@go1.25.12	0.60.0 1.26.9

Open the chart page →

1,454

sidekickappscode

2026.7.10

1 of 1 See more

sidekick appscode 2026.7.10

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/sidekick :v0.0.16	d8d2a3c22ee7	golang.org/x/net@v0.55.0 stdlib@go1.25.12	0.60.0 1.26.9

Open the chart page →

559

stash-communityappscode

0.42.0

4 of 4 See more

stash-community appscode 0.42.0

4 of the 4 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
prom/pushgateway :v1.4.2	a684e7c830a4	golang.org/x/net@v0.0.0-20210525063256-abc453219eb5 stdlib@go1.16.9	0.60.0 1.26.9
ghcr.io/appscode/kubectl-nonroot :1.31	83d43cc41590	golang.org/x/net@v0.26.0 stdlib@go1.24.9	0.60.0 1.26.9
ghcr.io/stashed/stash :v0.42.0	3a98245a7667	golang.org/x/net@v0.26.0 stdlib@go1.25.3	0.60.0 1.26.9
ghcr.io/stashed/stash-crd-installer :v0.42.0	76f0a650e44b	golang.org/x/net@v0.38.0 stdlib@go1.25.3	0.60.0 1.26.9

Open the chart page →

5,919

stash-opscenterappscode

2025.10.17

1 of 1 See more

stash-opscenter appscode 2025.10.17

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/stashed/stash-ui-server :v0.23.0	47cffbc65700	golang.org/x/net@v0.38.0 stdlib@go1.25.3	0.60.0 1.26.9

Open the chart page →

1,068

stash-ui-serverappscode

0.23.0

1 of 1 See more

stash-ui-server appscode 0.23.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/stashed/stash-ui-server :v0.23.0	47cffbc65700	golang.org/x/net@v0.38.0 stdlib@go1.25.3	0.60.0 1.26.9

Open the chart page →

1,068

statefulsetappscode

0.0.1

2 of 3 See more

statefulset appscode 0.0.1

2 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/kube-rbac-proxy :v0.11.0	0df4ae70e3bd	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.15.14	0.60.0 1.26.9
ghcr.io/appscode/kubectl-nonroot :v1.24	8ee5bdd68977	stdlib@go1.20.7	1.26.9

Open the chart page →

4,294

storage-metrics-serverappscode

2026.7.8

1 of 1 See more

storage-metrics-server appscode 2026.7.8

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/storage-metrics-server :v0.1.0	9cb4acb742a9	golang.org/x/net@v0.48.0 stdlib@go1.25.12	0.60.0 1.26.9

Open the chart page →

880

supervisorappscode

2026.2.16

1 of 1 See more

supervisor appscode 2026.2.16

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/supervisor :v0.0.12	23affde10a92	golang.org/x/net@v0.47.0 stdlib@go1.25.12	0.60.0 1.26.9

Open the chart page →

446

taskqueueappscode

2026.2.16

1 of 1 See more

taskqueue appscode 2026.2.16

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/taskqueue :v0.0.3	6877c958a3c6	golang.org/x/net@v0.47.0 stdlib@go1.25.5	0.60.0 1.26.9

Open the chart page →

1,455

tenant-operatorappscode

2026.9.22

1 of 1 See more

tenant-operator appscode 2026.9.22

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/opnpulse/tenant-operator :v0.0.3	8fe9b4157ed2	golang.org/x/net@v0.54.0 stdlib@go1.25.14	0.60.0 1.26.9

Open the chart page →

348

thanos-operatorappscode

2026.6.2

1 of 1 See more

thanos-operator appscode 2026.6.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/opnpulse/thanos-operator :v2026.4.24	e05a3e701291	golang.org/x/net@v0.49.0 stdlib@go1.26.2	0.60.0 1.26.9

Open the chart page →

668

tricksterappscode

2026.1.15

1 of 1 See more

trickster appscode 2026.1.15

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/trickster :v2.0.0	cdbbed831f28	golang.org/x/net@v0.47.0 stdlib@go1.25.5	0.60.0 1.26.9

Open the chart page →

1,609

vcd-lb-gcappscode

2026.6.25

1 of 1 See more

vcd-lb-gc appscode 2026.6.25

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/appscode/vcd-lb-gc :v0.1.0	524c4045cd21	golang.org/x/net@v0.23.0 stdlib@go1.25.11	0.60.0 1.26.9

Open the chart page →

415

voyagerappscode

2026.3.23

1 of 1 See more

voyager appscode 2026.3.23

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/voyagermesh/voyager :v17.5.0	4964ceaf9d35	golang.org/x/net@v0.52.0 stdlib@go1.25.8	0.60.0 1.26.9

Open the chart page →

1,057

voyager-gatewayappscode

2026.10.10

2 of 2 See more

voyager-gateway appscode 2026.10.10

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/voyagermesh/crd-manager :v0.4.0	4466bb77dc78	golang.org/x/net@v0.47.0 stdlib@go1.25.13	0.60.0 1.26.9
ghcr.io/voyagermesh/gateway :v1.8.2	4237fd16a3cb	golang.org/x/net@v0.55.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

1,842

haproxyappuio

2.7.2

1 of 1 See more

haproxy appuio 2.7.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/vshn/haproxy-with-mysql :1.0.0	a3c27ee3fb2f	golang.org/x/net@v0.11.0 stdlib@go1.21.1	0.60.0 1.26.9

Open the chart page →

6,653

stardog-userrole-operatorappuio

0.4.0

1 of 1 See more

stardog-userrole-operator appuio 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/vshn/stardog-userrole-operator :v0.3.0	4774237c9e86	golang.org/x/net@v0.19.0 stdlib@go1.22.2	0.60.0 1.26.9

Open the chart page →

1,729

chart-app-vidapp-vid-chart

0.0.7

1 of 2 See more

chart-app-vid app-vid-chart 0.0.7

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/mongo :latest	bac22ea7710d	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

9,006

appwriteappwrite-helm

1.3.2

4 of 8 See more

appwrite appwrite-helm 1.3.2

4 of the 8 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
appwrite/appwrite :1.9.0	1aaa70127114	golang.org/x/net@v0.40.0 stdlib@go1.25.7	0.60.0 1.26.9
bitnamilegacy/mariadb :10.6.12-debian-11-r13	15edb5643b73	stdlib@go1.19.7	1.26.9
bitnamilegacy/redis :7.0.10-debian-11-r0	59293f5206b7	stdlib@go1.19.7	1.26.9
openruntimes/executor :0.11.4	2228f186dcbb	stdlib@go1.21.10	1.26.9

Open the chart page →

13,059

harbor-scanner-trivyaqua-helm

0.17.0

1 of 1 See more

harbor-scanner-trivy aqua-helm 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
aquasec/harbor-scanner-trivy :0.20.0	7ea4aa3d2eb6	golang.org/x/net@v0.0.0-20190613194153-d28f0bde5980 stdlib@go1.16.4	0.60.0 1.26.9

Open the chart page →

6,392

arcadearcade

1.11.1

1 of 10 See more

arcade arcade 1.11.1

1 of the 10 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/postgres :17-alpine	b0f9560a2de0	stdlib@go1.24.6	1.26.9

Open the chart page →

985

argocd-ecr-updaterargocd-aws-ecr-updater

0.3.39

1 of 1 See more

argocd-ecr-updater argocd-aws-ecr-updater 0.3.39

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/karlderkaefer/argocd-ecr-updater :1.4.6	ed5d4b74792c	golang.org/x/net@v0.55.0 stdlib@go1.26.5	0.60.0 1.26.9

Open the chart page →

275

argocd-bitbucket-proxyargocd-bitbucket-proxy

1.1.1

1 of 1 See more

argocd-bitbucket-proxy argocd-bitbucket-proxy 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/salemgolemugoo/argocd-bitbucket-proxy :latest	a72df069095b	stdlib@go1.26.1	1.26.9

Open the chart page →

427

argocdargo-helm-charts

1.0.0

3 of 3 See more

argocd argo-helm-charts 1.0.0

3 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/dexidp/dex :v2.42.1	8186d6dd81f4	golang.org/x/net@v0.32.0 stdlib@go1.23.4	0.60.0 1.26.9
public.ecr.aws/docker/library/redis :7.2.8-alpine	c88ea2979a49	stdlib@go1.18.2	1.26.9
quay.io/argoproj/argocd :v2.14.11	5fc69e31c755	golang.org/x/net@v0.34.0 stdlib@go1.22.2	0.60.0 1.26.9

Open the chart page →

9,972

argo-workflowsargo-helm-charts

1.0.0

2 of 2 See more

argo-workflows argo-helm-charts 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
quay.io/argoproj/argocli :v3.7.1	6efd1cb89dc1	golang.org/x/net@v0.40.0 stdlib@go1.24.6	0.60.0 1.26.9
quay.io/argoproj/workflow-controller :v3.7.1	66388d1b2f08	golang.org/x/net@v0.40.0 stdlib@go1.24.6	0.60.0 1.26.9

Open the chart page →

2,691

clickhouseargonaut-charts

0.6.8

2 of 3 See more

clickhouse argonaut-charts 0.6.8

2 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.16.1	db7dde971407	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.13.15	0.60.0 1.26.9
altinity/metrics-exporter :0.16.1	85b4fdbae053	golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781 stdlib@go1.13.15	0.60.0 1.26.9

Open the chart page →

11,616

istio-discoveryargonaut-charts

0.3.3

1 of 1 See more

istio-discovery argonaut-charts 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
istio/pilot :1.10.0	294ca55bd1cc	golang.org/x/net@v0.0.0-20210323141857-08027d57d8cf stdlib@go1.16.4	0.60.0 1.26.9

Open the chart page →

76,097

istio-ingressargonaut-charts

0.3.3

1 of 1 See more

istio-ingress argonaut-charts 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
istio/proxyv2 :1.10.0	88c6c693e67a	golang.org/x/net@v0.0.0-20210323141857-08027d57d8cf stdlib@go1.16.4	0.60.0 1.26.9

Open the chart page →

76,043

argonix-apiargonix

0.6.5

1 of 4 See more

argonix-api argonix 0.6.5

1 of the 4 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/argonix-io/argonix-api :0.6.5	431abcce7c1e	golang.org/x/net@v0.23.0 stdlib@go1.22.7	0.60.0 1.26.9

Open the chart page →

5,988

argo-zombiesargo-zombies

0.1.52

1 of 1 See more

argo-zombies argo-zombies 0.1.52

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/henrywhitaker3/argo-zombies :v0.4.4	316c397906c9	golang.org/x/net@v0.47.0 stdlib@go1.26.1	0.60.0 1.26.9

Open the chart page →

570

otel-collectorarieotech

0.1.0

1 of 1 See more

otel-collector arieotech 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
otel/opentelemetry-collector-contrib :0.154.0	b3079f45e19b	golang.org/x/net@v0.55.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

675

arlas-aiasarlas-stack

28.9.0

6 of 22 See more

arlas-aias arlas-stack 28.9.0

6 of the 22 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
bitnamilegacy/elasticsearch :9.0.1-debian-12-r0	e6f6ddcce2f1	golang.org/x/net@v0.39.0 stdlib@go1.23.9	0.60.0 1.26.9
bitnamilegacy/keycloak :26.3.3-debian-12-r0	da3df0976a9f	stdlib@go1.25.0	1.26.9
bitnamilegacy/minio :2024.12.18-debian-12-r1	c0ede65eb88e	golang.org/x/net@v0.29.0 stdlib@go1.22.11	0.60.0 1.26.9
bitnamilegacy/minio :2025.4.22-debian-12-r1	d7cd0e172c4c	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.60.0 1.26.9
bitnamilegacy/os-shell :12-debian-12-r43	9ba5d16f9c64	golang.org/x/net@v0.33.0 stdlib@go1.23.8	0.60.0 1.26.9
bitnamilegacy/redis :8.0.3-debian-12-r1	189aae381e7f	stdlib@go1.24.4	1.26.9

Open the chart page →

46,930

arma-reforgerarma-reforger

0.5.3

8 of 8 See more

arma-reforger arma-reforger 0.5.3

8 of the 8 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
prom/pushgateway :v1.5.1	28fe26c8b8b1	golang.org/x/net@v0.0.0-20220909164309-bea034e7d591 stdlib@go1.19.3	0.60.0 1.26.9
stakater/reloader :v1.0.15	f4b87a8e56d4	golang.org/x/net@v0.7.0 stdlib@go1.20.1	0.60.0 1.26.9
ghcr.io/brittonhayes/arma-reforger :latest	6fde1edc0983	golang.org/x/net@v0.7.0 stdlib@go1.18.10	0.60.0 1.26.9
quay.io/prometheus-operator/prometheus-config-reloader :v0.63.0	3f976422884e	stdlib@go1.19.5	1.26.9
quay.io/prometheus/alertmanager :v0.25.0	fd4d9a3dd1fd	golang.org/x/net@v0.4.0 stdlib@go1.19.4	0.60.0 1.26.9
quay.io/prometheus/node-exporter :v1.5.0	39c642b2b337	golang.org/x/net@v0.2.0 stdlib@go1.19.3	0.60.0 1.26.9
quay.io/prometheus/prometheus :v2.41.0	1a3e9a878e50	golang.org/x/net@v0.4.0 stdlib@go1.19.4	0.60.0 1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.8.0	5658d0011a41	golang.org/x/net@v0.4.0 stdlib@go1.19.4	0.60.0 1.26.9

Open the chart page →

30,023

articom-k8s-crdarticomio-helm-charts

1.2.3

2 of 2 See more

articom-k8s-crd articomio-helm-charts 1.2.3

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
articomio/articom-cx-operator :v1.2.3	89efda334136	golang.org/x/net@v0.47.0 stdlib@go1.25.14	0.60.0 1.26.9
hashicorp/vault :1.18	750bb37c1638	golang.org/x/net@v0.34.0 stdlib@go1.23.6	0.60.0 1.26.9

Open the chart page →

2,813

Container images carrying it

6,417 by charts deploying them

A fixed version is listed for 6 of the 9 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/hatchet-dev/hatchet/hatchet-frontend :v0.110.5	136c6a29a81a	stdlib@go1.26.8	1.26.9	3
ghcr.io/hatchet-dev/hatchet/hatchet-migrate :v0.110.5	b2112d73f37a	stdlib@go1.26.8	1.26.9	3
ghcr.io/kuberocketci/krci-cache :0.3.0	5f6cd61e6da6	golang.org/x/net@v0.55.0 stdlib@go1.25.8	0.60.0 1.26.9	3
ghcr.io/quenchworks/images/alertmanager	d1e7285865d8	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	3
ghcr.io/quenchworks/images/caddy	015a4b181ab2	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9	3
ghcr.io/quenchworks/images/cert-manager-cainjector	cdb9b39d2eaf	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	3
ghcr.io/quenchworks/images/cert-manager-controller	b4e5fb144442	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	3
ghcr.io/quenchworks/images/cert-manager-webhook	d342342b50a6	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	3
ghcr.io/quenchworks/images/kube-state-metrics	15a1f0e114c0	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2	3
ghcr.io/quenchworks/images/kyverno	fe359fcd4ff7	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	3
ghcr.io/quenchworks/images/loki	42ab0d3d3b27	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	3
ghcr.io/quenchworks/images/node-exporter	33cb1038d69b	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	3
ghcr.io/quenchworks/images/otel-collector	a3b591872cdb	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9	3
ghcr.io/quenchworks/images/seaweedfs	d884b75765cf	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	3
ghcr.io/quenchworks/images/tempo	21bde52fb227	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2	3
ghcr.io/rabbitmq/messaging-topology-operator :1.20.3	f377d3c3e221	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2	3
ghcr.io/sigstore/scaffolding/createctconfig :v0.7.33	e591f98e3899	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9	3
ghcr.io/sigstore/scaffolding/createdb	16673c1099a5	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9	3
ghcr.io/sigstore/scaffolding/ct_server :v0.7.33	24293fa1ed50	golang.org/x/net@v0.47.0 stdlib@go1.25.0	0.60.0 1.26.9	3
ghcr.io/sigstore/scaffolding/trillian_log_server	32ee491f4d00	golang.org/x/net@v0.59.0 stdlib@go1.27.0	0.60.0 1.27.2	3
ghcr.io/sigstore/scaffolding/trillian_log_signer	3d0152303816	golang.org/x/net@v0.59.0 stdlib@go1.27.0	0.60.0 1.27.2	3
ghcr.io/spiffe/spire-agent :1.15.3	41b0dcd8b258	golang.org/x/net@v0.57.0 stdlib@go1.26.6	0.60.0 1.26.9	3
ghcr.io/victoriametrics/sync-job :v0.0.17	b6f233532a85	golang.org/x/net@v0.56.0 stdlib@go1.26.4-X:jsonv2	0.60.0 1.26.9	3
public.ecr.aws/docker/library/redis :7.2.8-alpine	c88ea2979a49	stdlib@go1.18.2	1.26.9	3
public.ecr.aws/zinclabs/zinc :latest	fefa9ee7256a	golang.org/x/net@v0.0.0-20221002022538-bcab6841153b stdlib@go1.19.7	0.60.0 1.26.9	3
quay.io/argoproj/argocli :v4.1.5	e0824b55297b	stdlib@go1.26.5	1.26.9	3
quay.io/argoproj/argo-events :v1.9.11	fa07b2c9ece6	golang.org/x/net@v0.57.0 stdlib@go1.25.6	0.60.0 1.26.9	3
quay.io/argoproj/argo-rollouts :v1.10.0	187630ba7228	golang.org/x/net@v0.56.0 stdlib@go1.26.7	0.60.0 1.26.9	3
quay.io/argoproj/argo-workflows-crdinstaller :v4.1.5	93534a0d0ba3	golang.org/x/net@v0.49.0 stdlib@go1.26.5	0.60.0 1.26.9	3
quay.io/argoproj/workflow-controller :v4.1.5	328307c9436f	stdlib@go1.26.5	1.26.9	3
quay.io/argoproj/workflow-controller :v3.0.7	aa4da00c5b96	golang.org/x/net@v0.0.0-20201216054612-986b41b23924 stdlib@go1.15.7	0.60.0 1.26.9	3
quay.io/argoproj/workflow-controller :v3.4.7	f0c6fba81a24	golang.org/x/net@v0.8.0 stdlib@go1.19.8	0.60.0 1.26.9	3
quay.io/cilium/cilium :v1.20.2	2939231d0d3e	golang.org/x/net@v0.56.0 stdlib@go1.26.8	0.60.0 1.26.9	3
quay.io/cilium/operator-generic :v1.20.2	64d8798350e8	golang.org/x/net@v0.56.0 stdlib@go1.26.8	0.60.0 1.26.9	3
quay.io/devtron/ai-agent :0.0.1	6545dac92173	golang.org/x/net@v0.23.0 stdlib@go1.22.4	0.60.0 1.26.9	3
quay.io/devtron/argocd-cert-refresh :v10	2b6db27eaf3d	golang.org/x/net@v0.3.1-0.20221206200815-1e63c2f08a10 stdlib@go1.17.13	0.60.0 1.26.9	3
quay.io/devtron/calico-networking :kube-controllers-v3.19.1	2ff71ba65cd7	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.15.2	0.60.0 1.26.9	3
quay.io/devtron/calico-networking :cni-v3.19.1	51f294c56842	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.15.2	0.60.0 1.26.9	3
quay.io/devtron/calico-networking :node-v3.19.1	bc4aa22272ef	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.15.2	0.60.0 1.26.9	3
quay.io/devtron/calico-networking :pod2daemon-flexvol-v3.19.1	c1f36b6e18e0	stdlib@go1.15.2	1.26.9	3
quay.io/devtron/casbin :172ef62b-9450794d-464-39422	5bf041aacadd	golang.org/x/net@v0.48.0 stdlib@go1.24.0	0.60.0 1.26.9	3
quay.io/devtron/chart-sync :94237c18-1021-39419	60566529446a	golang.org/x/net@v0.48.0 stdlib@go1.25.0	0.60.0 1.26.9	3
quay.io/devtron/chart-sync :3b3d6d0e-836-39296	721b5c9634d4	golang.org/x/net@v0.48.0 stdlib@go1.25.0	0.60.0 1.26.9	3
quay.io/devtron/clair :4.3.6	75fb847ac045	golang.org/x/net@v0.0.0-20210805182204-aaa1db679c0d stdlib@go1.17.6	0.60.0 1.26.9	3
quay.io/devtron/cost-sync :172ef62b-1159-39429	edf210d763ca	golang.org/x/net@v0.40.0 stdlib@go1.24.13	0.60.0 1.26.9	3
quay.io/devtron/devtron :9450794d-930-39415	9795f3f9f031	golang.org/x/net@v0.48.0 stdlib@go1.25.0	0.60.0 1.26.9	3
quay.io/devtron/discord-alertmanager :ceceb475-65-352	03586419ca31	stdlib@go1.18.1	1.26.9	3
quay.io/devtron/git-sensor :94237c18-950-39418	03c7bf249aa1	golang.org/x/net@v0.48.0 stdlib@go1.25.5	0.60.0 1.26.9	3
quay.io/devtron/google-chat-alert-manager :v2.0.2	39f2c6e0af38	stdlib@go1.18	1.26.9	3
quay.io/devtron/hyperion :0874dcaf-280-39287	01d5d8c4cecb	golang.org/x/net@v0.48.0 stdlib@go1.25.6	0.60.0 1.26.9	3