CVE-2026-78663

Critical

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: Critical; worst across findings
CVSS: 9.1; base score, highest
EPSS: 0.006; 46th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,401; of 18,104 indexed, latest versions
Container images: 6,250; deployed by those charts
Fix available: 2 of 4; affected packages

Double flow control refund on HTTP/2 server streams in net/http

Carried by container images the latest versions of 5,401 of 18,104 indexed charts deploy, on 6,250 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+212 more	1.26.9, 1.27.2	6,223
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more	0.60.0	5,000
golang-1.19deb	1.19.8-2	no fix listed	1
ingress-nginx-controller-1.15apk	1.15.10-r9	no fix listed	1

OSV records: CGA-25j5-q798-fwm3 DEBIAN-CVE-2026-78663 GO-2026-6612
Also known as: CGA-vqxj-4gp6-23v9
Trending: Rank 1 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,401 by stars

Chart

Latest

Affected images

Radar Score

intel-gpu-resource-driverintel

0.7.0

1 of 1 See more

intel-gpu-resource-driver intel 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
intel/intel-gpu-resource-driver :v0.7.0	e158711e32ce	golang.org/x/net@v0.33.0 stdlib@go1.23.4	0.60.0 1.26.9

Open the chart page →

1,088

jenkins-operatorjenkins

0.8.1

1 of 1 See more

jenkins-operator jenkins 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
quay.io/jenkins-kubernetes-operator/operator :v0.8.1	71cb50263c3b	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.15.6	0.60.0 1.26.9

Open the chart page →

3,439

dayz-dedicated-serverjespernohr

0.1.2

1 of 3 See more

dayz-dedicated-server jespernohr 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
bitnami/kubectl :latest	f7f9e4f64d9e	golang.org/x/net@v0.57.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

5,076

amazon-eks-pod-identity-webhookjkroepke

2.6.5

1 of 1 See more

amazon-eks-pod-identity-webhook jkroepke 2.6.5

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
public.ecr.aws/eks/amazon-eks-pod-identity-webhook :v0.6.17	3071570e8e8c	golang.org/x/net@v0.49.0 stdlib@go1.26.3	0.60.0 1.26.9

Open the chart page →

469

k8s-ephemeral-storage-metricsk8s-ephemeral-storage-metrics

1.21.3

1 of 1 See more

k8s-ephemeral-storage-metrics k8s-ephemeral-storage-metrics 1.21.3

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/jmcgrath207/k8s-ephemeral-storage-metrics :1.21.3	8297aa4a9278	golang.org/x/net@v0.56.0 stdlib@go1.26.5	0.60.0 1.26.9

Open the chart page →

309

rustrial-k8s-gitops-secrets-controllerk8s-gitops-secrets

0.6.0

1 of 1 See more

rustrial-k8s-gitops-secrets-controller k8s-gitops-secrets 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
rustrial/k8s-gitops-secrets-controller :0.6.0	93326a322a01	golang.org/x/net@v0.56.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

340

calibre-webk8s-home-lab-repo

9.1.1

1 of 1 See more

calibre-web k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/linuxserver/calibre-web :0.6.26	7c0464228f2f	stdlib@go1.17.8	1.26.9

Open the chart page →

6,440

home-assistantk8s-home-lab-repo

16.3.1

1 of 1 See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/home-operations/home-assistant :2026.3.1	067e54e2e107	golang.org/x/net@v0.49.0 stdlib@go1.25.6	0.60.0 1.26.9

Open the chart page →

5,801

wireguardk8s-home-lab-repo

1.6.0

1 of 1 See more

wireguard k8s-home-lab-repo 1.6.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/k8s-home-lab/wireguard :v1.0.20210914	779858b5e11d	stdlib@go1.18.5	1.26.9

Open the chart page →

8,459

k8s-sftp-gcsk8s-sftp-gcs

0.1.4

1 of 1 See more

k8s-sftp-gcs k8s-sftp-gcs 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
danuk/k8s-sftp-gcs :latest	dd0e6585c44f	stdlib@go1.18.4	1.26.9

Open the chart page →

2,635

k8statusk8status

0.17.0

1 of 1 See more

k8status k8status 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/stenic/k8status :0.17.0	93298e03089e	golang.org/x/net@v0.26.0 stdlib@go1.23.12	0.60.0 1.26.9

Open the chart page →

1,213

kanister-operatorkanister

0.118.0

1 of 1 See more

kanister-operator kanister 0.118.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/kanisterio/controller :0.118.0	d22616a5998b	golang.org/x/net@v0.41.0 stdlib@go1.25.6	0.60.0 1.26.9

Open the chart page →

1,687

kiali-operatorkiali

2.33.0

1 of 1 See more

kiali-operator kiali 2.33.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
quay.io/kiali/kiali-operator :v2.33.0	035995403eed	golang.org/x/net@v0.33.0 stdlib@go1.23.4	0.60.0 1.26.9

Open the chart page →

1,719

kividb-operator-chartkividb-operator

0.4.0

2 of 2 See more

kividb-operator-chart kividb-operator 0.4.0

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
quay.io/kividbio/kividb-operator :0.4.0	a2395d6f47b7	golang.org/x/net@v0.56.0 stdlib@go1.26.8	0.60.0 1.26.9
quay.io/kividbio/kividb-operator-gui :0.4.0	276352c04b9c	golang.org/x/net@v0.56.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

402

mysqldumpkokuwa

7.0.3

1 of 1 See more

mysqldump kokuwa 7.0.3

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/kokuwaio/gcloud-mysql :v3.2.19	63098135c550	stdlib@go1.26.1	1.26.9

Open the chart page →

1,197

kong-operatorkong

1.4.1

1 of 1 See more

kong-operator kong 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
kong/kong-operator :2.3.2	814eaeee4cc8	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

222

kraken-cikraken-ci

1.7.36

1 of 10 See more

kraken-ci kraken-ci 1.7.36

1 of the 10 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/postgres :11	5d2aa4a7b5f9	stdlib@go1.16.7	1.26.9

Open the chart page →

3,490

kuadrant-operatorkuadrant

1.5.3

4 of 4 See more

kuadrant-operator kuadrant 1.5.3

4 of the 4 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
quay.io/kuadrant/authorino-operator :v0.25.3	95a0670bffe6	golang.org/x/net@v0.55.0 stdlib@go1.26.7	0.60.0 1.26.9
quay.io/kuadrant/dns-operator :v0.17.2	da9ff8211856	golang.org/x/net@v0.57.0 stdlib@go1.26.7	0.60.0 1.26.9
quay.io/kuadrant/kuadrant-operator :v1.5.3	18ad777aeb7a	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9
quay.io/kuadrant/limitador-operator :v0.18.4	9a9c533e58bb	golang.org/x/net@v0.58.0 stdlib@go1.26.7	0.60.0 1.26.9

Open the chart page →

1,213

kubearmorkubearmor

1.7.5

3 of 4 See more

kubearmor kubearmor 1.7.5

3 of the 4 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
kubearmor/kubearmor :stable	a08141311045	golang.org/x/net@v0.55.0 stdlib@go1.26.4	0.60.0 1.26.9
kubearmor/kubearmor-controller :latest	43674bb4806f	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9
kubearmor/kubearmor-relay-server :latest	f82b9c97e97d	golang.org/x/net@v0.53.0 stdlib@go1.25.14	0.60.0 1.26.9

Open the chart page →

2,262

kubebadgeskubebadges

0.1.3

1 of 2 See more

kubebadges kubebadges 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
neosu/kubebadges :v0.0.5	256530d8e5c6	golang.org/x/net@v0.17.0 stdlib@go1.21.3	0.60.0 1.26.9

Open the chart page →

2,389

pyroscopekubeblocks

0.2.92

1 of 1 See more

pyroscope kubeblocks 0.2.92

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
apecloud/pyroscope :0.37.2	dbca95a15bc1	golang.org/x/net@v0.1.0 stdlib@go1.19.6	0.60.0 1.26.9

Open the chart page →

2,416

kubepatternkubepattern

0.0.5

1 of 1 See more

kubepattern kubepattern 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/kubepattern/kubepattern :0.0.5	0762baa6d9b0	golang.org/x/net@v0.47.0 stdlib@go1.25.8	0.60.0 1.26.9

Open the chart page →

621

kuberay-operatorkuberay-operator

1.7.1

1 of 1 See more

kuberay-operator kuberay-operator 1.7.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
quay.io/kuberay/operator :v1.7.1	e69b9cde8f1d	golang.org/x/net@v0.57.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

632

skywalkingkubesphere-test

3.1.0

2 of 4 See more

skywalking kubesphere-test 3.1.0

2 of the 4 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
apache/skywalking-oap-server :8.1.0-es7	641237e0299b	golang.org/x/net@v0.0.0-20200226121028-0de0cce0169b stdlib@go1.13.3	0.60.0 1.26.9
apache/skywalking-ui :8.1.0	67d50e4deff4	golang.org/x/net@v0.0.0-20200226121028-0de0cce0169b stdlib@go1.13.3	0.60.0 1.26.9

Open the chart page →

20,787

kubeviouskubevious

1.2.2

3 of 7 See more

kubevious kubevious 1.2.2

3 of the 7 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
kubevious/ui :1.2.1	6233e84bdd59	golang.org/x/net@v0.0.0-20220812165438-1d4ff48094d1 stdlib@go1.19.1	0.60.0 1.26.9
library/mysql :8.0.30	3c1aab708f6e	stdlib@go1.16.7	1.26.9
redislabs/redisearch :2.4.14	33561794c5c8	stdlib@go1.16.7	1.26.9

Open the chart page →

18,035

kubevpnkubevpn-charts

2.11.9

1 of 1 See more

kubevpn kubevpn-charts 2.11.9

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/kubenetworks/kubevpn :v2.11.9	3feb9da85270	golang.org/x/net@v0.52.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

2,115

kubewallkubewall

0.0.23

1 of 1 See more

kubewall kubewall 0.0.23

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/kubewall/kubewall :0.0.23	d9a03cfb557b	golang.org/x/net@v0.57.0 stdlib@go1.26.7	0.60.0 1.26.9

Open the chart page →

473

kubeservice-lxcfs-webhookkubservice-charts

1.6.0

5 of 6 See more

kubeservice-lxcfs-webhook kubservice-charts 1.6.0

5 of the 6 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
dongjiang1989/lxcfs-webhook :latest	c1f19557bdcb	golang.org/x/net@v0.56.0 stdlib@go1.26.0	0.60.0 1.26.9
quay.io/jetstack/cert-manager-cainjector :v1.13.1	72072d492b43	golang.org/x/net@v0.15.0 stdlib@go1.20.8	0.60.0 1.26.9
quay.io/jetstack/cert-manager-controller :v1.13.1	6b83f55bd99e	golang.org/x/net@v0.15.0 stdlib@go1.20.8	0.60.0 1.26.9
quay.io/jetstack/cert-manager-ctl :v1.13.1	c10bde7ff9ad	golang.org/x/net@v0.15.0 stdlib@go1.20.8	0.60.0 1.26.9
quay.io/jetstack/cert-manager-webhook :v1.13.1	48ea4a77dfa7	golang.org/x/net@v0.15.0 stdlib@go1.20.8	0.60.0 1.26.9

Open the chart page →

63,079

prometheus-pingmesh-exporterkubservice-charts

1.1.1

1 of 1 See more

prometheus-pingmesh-exporter kubservice-charts 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
dongjiang1989/pingmesh-agent :latest	355fa4be8e97	golang.org/x/net@v0.29.0 stdlib@go1.22.9	0.60.0 1.26.9

Open the chart page →

1,399

karporkusionstack

0.7.6

2 of 3 See more

karpor kusionstack 0.7.6

2 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
kusionstack/karpor :v0.6.4	b707d3bf0abd	golang.org/x/net@v0.19.0 stdlib@go1.22.12	0.60.0 1.26.9
quay.io/coreos/etcd :v3.5.11	842975891182	golang.org/x/net@v0.17.0 stdlib@go1.20.12	0.60.0 1.26.9

Open the chart page →

4,622

kwokkwok

0.3.0

1 of 1 See more

kwok kwok 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
registry.k8s.io/kwok/kwok :v0.8.0	6d25aa8fbdfe	golang.org/x/net@v0.51.0 stdlib@go1.26.0	0.60.0 1.26.9

Open the chart page →

1,150

machinarislib42

0.2.0

1 of 1 See more

machinaris lib42 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/guydavis/machinaris :test	50a71a30f18e	stdlib@go1.26.5	1.26.9

Open the chart page →

39,696

litellm-operatorlitellm-operator

1.1.2

1 of 1 See more

litellm-operator litellm-operator 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/bbdsoftware/litellm-operator :1.1.2	167a51113d90	golang.org/x/net@v0.49.0 stdlib@go1.26.2	0.60.0 1.26.9

Open the chart page →

642

loftloft

0.0.0-ci.14

1 of 1 See more

loft loft 0.0.0-ci.14

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/loft :0.0.0-ci.14	b69bcdaa8492	golang.org/x/net@v0.14.0 stdlib@go1.20.7	0.60.0 1.26.9

Open the chart page →

4,615

vcluster-k8sloft

0.0.0-ci.3

3 of 4 See more

vcluster-k8s loft 0.0.0-ci.3

3 of the 4 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
registry.k8s.io/etcd :3.5.6-0	dd75ec974b0a	golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2 stdlib@go1.16.15	0.60.0 1.26.9
registry.k8s.io/kube-apiserver :v1.26.1	99e1ed9fbc8a	golang.org/x/net@v0.3.1-0.20221206200815-1e63c2f08a10 stdlib@go1.19.5	0.60.0 1.26.9
registry.k8s.io/kube-controller-manager :v1.26.1	40adecbe3a40	golang.org/x/net@v0.3.1-0.20221206200815-1e63c2f08a10 stdlib@go1.19.5	0.60.0 1.26.9

Open the chart page →

8,354

vcluster-platformloft

4.12.2

1 of 1 See more

vcluster-platform loft 4.12.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/loft-sh/vcluster-platform :4.12.2	71d869f989e9	golang.org/x/net@v0.52.0 stdlib@go1.26.5	0.60.0 1.26.9

Open the chart page →

1,180

logging-operatorlogging-operator

6.9.0

1 of 1 See more

logging-operator logging-operator 6.9.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/kube-logging/logging-operator :6.9.0	527033b7032b	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

201

lumigo-operatorlumigo-operator

69.0.0

6 of 8 See more

lumigo-operator lumigo-operator 69.0.0

6 of the 8 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/open-telemetry/opentelemetry-operator/target-allocator :0.124.0	8936271cf56a	golang.org/x/net@v0.38.0 stdlib@go1.24.2	0.60.0 1.26.9
public.ecr.aws/lumigo/lumigo-kubernetes-operator :69	491c39346b19	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.60.0 1.26.9
public.ecr.aws/lumigo/lumigo-kubernetes-telemetry-proxy :69	1d548e59c2c8	golang.org/x/net@v0.41.0 stdlib@go1.24.5	0.60.0 1.26.9
public.ecr.aws/lumigo/lumigo-kubernetes-watchdog :69	6458fcd61e0c	golang.org/x/net@v0.37.0 stdlib@go1.23.12	0.60.0 1.26.9
quay.io/prometheus/node-exporter :v1.8.2	4032c6d5bfd7	golang.org/x/net@v0.23.0 stdlib@go1.22.5	0.60.0 1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.14.0	37d841299325	golang.org/x/net@v0.29.0 stdlib@go1.23.3	0.60.0 1.26.9

Open the chart page →

9,845

lxcfs-on-kuberneteslxcfs-on-kubernetes

0.2.8

1 of 2 See more

lxcfs-on-kubernetes lxcfs-on-kubernetes 0.2.8

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/cndoit18/lxcfs-agent :v0.2.8	154741f8596e	golang.org/x/net@v0.38.0 stdlib@go1.24.1	0.60.0 1.26.9

Open the chart page →

2,658

mariadbmariadb

0.4.0

1 of 1 See more

mariadb mariadb 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/mariadb :10.11	7db29378d4fd	stdlib@go1.24.6	1.26.9

Open the chart page →

2,818

marmotmarmot

1.6.0

2 of 2 See more

marmot marmot 1.6.0

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
bitnami/kubectl :latest	999d5eb28f40	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9
ghcr.io/marmotdata/marmot :0.11.0	cbc560cba46e	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

503

mattermost-rtcdmattermost

1.4.1

1 of 1 See more

mattermost-rtcd mattermost 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
mattermost/rtcd :latest	a27058aaa53a	golang.org/x/net@v0.50.0 stdlib@go1.24.13	0.60.0 1.26.9

Open the chart page →

1,008

veleromesosphere

3.2.5

1 of 1 See more

velero mesosphere 3.2.5

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
bitnamilegacy/kubectl :1.26.4	a0a972324d93	golang.org/x/net@v0.7.0 stdlib@go1.19.8	0.60.0 1.26.9

Open the chart page →

2,807

kubecostmesosphere-stable

0.37.5

7 of 9 See more

kubecost mesosphere-stable 0.37.5

7 of the 9 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
bitnamilegacy/kubectl :1.30.5	744f84cf7493	golang.org/x/net@v0.23.0 stdlib@go1.22.7	0.60.0 1.26.9
grafana/grafana :9.4.7	1a359d92f40e	golang.org/x/net@v0.4.0 stdlib@go1.20.1	0.60.0 1.26.9
gcr.io/kubecost1/cost-model :prod-1.108.1	852f7923fad3	golang.org/x/net@v0.18.0 stdlib@go1.21.5	0.60.0 1.26.9
quay.io/prometheus-operator/prometheus-config-reloader :v0.69.1	7bbe804260f3	golang.org/x/net@v0.17.0 stdlib@go1.21.4	0.60.0 1.26.9
quay.io/prometheus/alertmanager :v0.27.0	e13b6ed5cb92	golang.org/x/net@v0.20.0 stdlib@go1.21.7	0.60.0 1.26.9
quay.io/prometheus/prometheus :v2.55.0	378f4e037035	golang.org/x/net@v0.28.0 stdlib@go1.23.2	0.60.0 1.26.9
quay.io/thanos/thanos :v0.36.1	e542959e1b36	golang.org/x/net@v0.26.0 stdlib@go1.21.13	0.60.0 1.26.9

Open the chart page →

23,294

m8b-stackmetricshub

2.1.3

1 of 4 See more

m8b-stack metricshub 2.1.3

1 of the 4 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
prom/prometheus :v3.13.3	6976aa8a60fe	golang.org/x/net@v0.57.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

336

rclonemglants

2.3.4

1 of 1 See more

rclone mglants 2.3.4

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
rclone/rclone :1.57.0	1e6eeabddc01	golang.org/x/net@v0.0.0-20210813160813-60bc85c4be6d stdlib@go1.17.2	0.60.0 1.26.9

Open the chart page →

3,889

helm-ai-kernelmindburn-labs

0.11.1

2 of 2 See more

helm-ai-kernel mindburn-labs 0.11.1

2 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
alpine/helmdigest-pinned	105741fa6621	golang.org/x/net@v0.23.0 stdlib@go1.22.5	0.60.0 1.26.9
ghcr.io/mindburn-labs/helm-ai-kernel :v0.11.1	0e7a5cd11858	golang.org/x/net@v0.58.0 stdlib@go1.25.13	0.60.0 1.26.9

Open the chart page →

2,964

mc-routerminecraft-server-charts

1.5.0

1 of 1 See more

mc-router minecraft-server-charts 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
itzg/mc-router :latest	64ae69eaa7a6	golang.org/x/net@v0.57.0 stdlib@go1.26.6	0.60.0 1.26.9

Open the chart page →

245

mocomoco

0.27.0

1 of 1 See more

moco moco 0.27.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/cybozu-go/moco :0.37.0	32e7cab1bdd8	golang.org/x/net@v0.56.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

251

mogenius-operatormogenius

2.30.0

1 of 2 See more

mogenius-operator mogenius 2.30.0

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/mogenius/mogenius-operator :2.30.0	51bebfb32413	golang.org/x/net@v0.58.0 stdlib@go1.27.0	0.60.0 1.27.2

Open the chart page →

1,141

Container images carrying it

6,250 by charts deploying them

A fixed version is listed for 2 of the 4 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/cosmo-workspace/cosmo-controller-manager :v0.9.0	8c7fa5552028	golang.org/x/net@v0.10.0 stdlib@go1.20.5	0.60.0 1.26.9	1
ghcr.io/cosmo-workspace/cosmo-dashboard :v0.9.1	6a1c4a81a924	golang.org/x/net@v0.10.0 stdlib@go1.20.5	0.60.0 1.26.9	1
ghcr.io/cosmo-workspace/dev-code-server :v0.0.3	16fda01ae58a	golang.org/x/net@v0.23.0 stdlib@go1.22.5	0.60.0 1.26.9	1
ghcr.io/crashappsec/chalk-operator :v0.1.1	28eee62e9bfa	golang.org/x/net@v0.38.0 stdlib@go1.24.13	0.60.0 1.26.9	1
ghcr.io/crashappsec/chalkular-controller :v0.0.8	d31986456626	golang.org/x/net@v0.58.0 stdlib@go1.26.6	0.60.0 1.26.9	1
ghcr.io/crashappsec/ocular-controller :v0.4.1	22060cf61e0e	golang.org/x/net@v0.58.0 stdlib@go1.26.6	0.60.0 1.26.9	1
ghcr.io/crazygit/cert-manager-alidns-webhook :0.1.4	976be6506eb6	golang.org/x/net@v0.47.0 stdlib@go1.25.3	0.60.0 1.26.9	1
ghcr.io/crazy-max/cloudflared :2025.9.1	9b4e856d18f6	golang.org/x/net@v0.40.0 stdlib@go1.24.7	0.60.0 1.26.9	1
ghcr.io/crazy-max/diun :4.19.0	c94e32b888e4	golang.org/x/net@v0.0.0-20210610132358-84b48f89b13b stdlib@go1.16.5	0.60.0 1.26.9	1
ghcr.io/crazy-max/samba :4.15.5	bed6f4ec2e82	stdlib@go1.17.2	1.26.9	1
ghcr.io/cronschedules/cronjob-scale-down-operator :0.4.4	fd521f0034a0	golang.org/x/net@v0.52.0 stdlib@go1.25.0	0.60.0 1.26.9	1
ghcr.io/crossplane-contrib/crossview :v4.6.0	7b54c5ba60e5	golang.org/x/net@v0.57.0 stdlib@go1.25.14	0.60.0 1.26.9	1
ghcr.io/csepulveda/trivy-webhook-aws-security-hub :v0.1.20	6836b779b060	golang.org/x/net@v0.50.0 stdlib@go1.26.2	0.60.0 1.26.9	1
ghcr.io/ctron/kubectl :1.25	e37d61b5277c	golang.org/x/net@v0.17.0 stdlib@go1.20.10	0.60.0 1.26.9	1
ghcr.io/cubefs/cfs-csi-driver :3.2.0.150.0	8723616a976a	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.18.4	0.60.0 1.26.9	1
ghcr.io/cybozu-go/accurate :2.1.0	b5cc37ab4d9c	golang.org/x/net@v0.57.0 stdlib@go1.26.3	0.60.0 1.26.9	1
ghcr.io/cybozu-go/moco :0.37.0	32e7cab1bdd8	golang.org/x/net@v0.56.0 stdlib@go1.26.8	0.60.0 1.26.9	1
ghcr.io/d0ugal/internet-perf-exporter :v0.2.91	f5c9a96fe52a	golang.org/x/net@v0.56.0 stdlib@go1.26.4	0.60.0 1.26.9	1
ghcr.io/dadrus/heimdall :0.17.23	deb6931bd162	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2	1
ghcr.io/danieldonoghue/vault-sync-operator :v0.0.1-beta.3	8d7ec69a193c	golang.org/x/net@v0.52.0 stdlib@go1.25.9	0.60.0 1.26.9	1
ghcr.io/daocloud/crproxy/crproxy :v0.8.0	ee1eb3c9c9a1	golang.org/x/net@v0.26.0 stdlib@go1.21.11	0.60.0 1.26.9	1
ghcr.io/dapr/injector :1.17.0-rc.3	7a2fd888ed5f	golang.org/x/net@v0.48.0 stdlib@go1.24.11	0.60.0 1.26.9	1
ghcr.io/dapr/operator :1.17.0-rc.3	d5cc61cbe735	golang.org/x/net@v0.48.0 stdlib@go1.24.11	0.60.0 1.26.9	1
ghcr.io/dapr/placement :1.17.0-rc.3	a237b43cd5c6	golang.org/x/net@v0.48.0 stdlib@go1.24.11	0.60.0 1.26.9	1
ghcr.io/dapr/scheduler :1.17.0-rc.3	6c62e01e736b	golang.org/x/net@v0.48.0 stdlib@go1.24.11	0.60.0 1.26.9	1
ghcr.io/dapr/sentry :1.17.0-rc.3	bf79b03591e0	golang.org/x/net@v0.48.0 stdlib@go1.24.11	0.60.0 1.26.9	1
ghcr.io/dash0hq/operator-controller :0.157.0	2103617548e2	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
ghcr.io/dask/dask-notebook :2024.1.0	f53bde3acd4f	golang.org/x/net@v0.17.0 stdlib@go1.21.5	0.60.0 1.26.9	1
ghcr.io/davidkarlsen/flyway-operator :0.2.13	66f60b461c0d	golang.org/x/net@v0.38.0 stdlib@go1.24.4	0.60.0 1.26.9	1
ghcr.io/db-operator/db-operator :2.44.0	4a789f7347d8	golang.org/x/net@v0.59.0	0.60.0	1
ghcr.io/dcristobalhmad/kube-secrets-exporter :latest	a9043737cb73	golang.org/x/net@v0.23.0 stdlib@go1.22.3	0.60.0 1.26.9	1
ghcr.io/dc-tec/openbao-operator :0.5.1	599c439b4fea	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2	1
ghcr.io/debridmediamanager/zurg-testing :v0.9.3-final	5c47ef99443a	golang.org/x/net@v0.20.0 stdlib@go1.22.5	0.60.0 1.26.9	1
ghcr.io/decayofmind/kube-better-node :master	ccd2ce03b682	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.16.6	0.60.0 1.26.9	1
ghcr.io/deepch/rtsptoweb :v2.2.0	f9de3a1a5deb	golang.org/x/net@v0.0.0-20211216030914-fe4d6282115f	0.60.0	1
ghcr.io/defensia/agent :1.4.66	9857f54bce8d	golang.org/x/net@v0.47.0 stdlib@go1.26.8	0.60.0 1.26.9	1
ghcr.io/deliveryhero/field-exporter :v1.4.0	6b71ba4f9297	golang.org/x/net@v0.26.0 stdlib@go1.22.12	0.60.0 1.26.9	1
ghcr.io/dellnoantechnp/alloy-remote-config/fleet-management :master	4371b566d238	golang.org/x/net@v0.48.0 stdlib@go1.25.10	0.60.0 1.26.9	1
ghcr.io/deltabadger/deltabadger :2.23.3	bffe3c22fabc	stdlib@go1.24.4	1.26.9	1
ghcr.io/depthmark/github-sts :0.1.1	29fda68298da	golang.org/x/net@v0.57.0 stdlib@go1.27.1	0.60.0 1.27.2	1
ghcr.io/desuuuu/cluster-network-policy-operator :v1.1.0	d943d13c5281	golang.org/x/net@v0.56.0 stdlib@go1.26.0	0.60.0 1.26.9	1
ghcr.io/devangradadiya/k8s-s3-bucket-operator :0.2.2	58288de9f9fa	golang.org/x/net@v0.47.0 stdlib@go1.25.8	0.60.0 1.26.9	1
ghcr.io/devhatro/clamav-api :1.0.2	ff0cd9db78d3	golang.org/x/net@v0.25.0 stdlib@go1.20.14	0.60.0 1.26.9	1
ghcr.io/devops-dojo7/fauxgpu/device-plugin :0.2.4	e5a12388e3d8	golang.org/x/net@v0.29.0 stdlib@go1.23.12	0.60.0 1.26.9	1
ghcr.io/devops-ia/cp-schema-registry :8.1.1-msk-iam-auth2.3.5	30d1a445acc7	stdlib@go1.25.4	1.26.9	1
ghcr.io/devops-ia/dwpk :1.0.0	d76dbf82a81d	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	1
ghcr.io/devops-ia/dwpk-gateway :1.0.0	2911d8b02c64	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	1
ghcr.io/devops-ia/dwpk-ui :1.0.0	b1af8311eba8	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9	1
ghcr.io/devops-ia/steampipe :v2.4.1	a982103d91d3	golang.org/x/net@v0.48.0 stdlib@go1.26.1	0.60.0 1.26.9	1
ghcr.io/devplayer0/lxd8s :0.3.1	e159ba41aede	golang.org/x/net@v0.0.0-20201006153459-a7d1128ccaa0 stdlib@go1.17	0.60.0 1.26.9	1