CVE-2026-78663

Critical

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: Critical; worst across findings
CVSS: 9.1; base score, highest
EPSS: 0.006; 46th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,384; of 18,108 indexed, latest versions
Container images: 6,227; deployed by those charts
Fix available: 3 of 5; affected packages

Double flow control refund on HTTP/2 server streams in net/http

Carried by container images the latest versions of 5,384 of 18,108 indexed charts deploy, on 6,227 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+212 more	1.26.9, 1.27.2	6,174
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more	0.60.0	4,974
golang-1.19deb	1.19.8-2	no fix listed	1
ingress-nginx-controller-1.15apk	1.15.10-r9	no fix listed	1
minioapk	0.20251015.172955-r10	0.20260922.192518-r2	1

OSV records: CGA-23xx-p5rw-vrp9 CGA-25j5-q798-fwm3 DEBIAN-CVE-2026-78663 GO-2026-6612
Also known as: CGA-qwrp-9ccr-5qpq, CGA-vqxj-4gp6-23v9
Trending: Rank 2 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,384 by stars

Chart

Latest

Affected images

Radar Score

deckarddeckard

0.1.8

3 of 3 See more

deckard deckard 0.1.8

3 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
bitnami/mongodb :latest	ad05bb9a19fa	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9
bitnami/redis :latest	f4797b37502e	stdlib@go1.26.8	1.26.9
blipai/deckard :0.1.8	db8cd873d0eb	golang.org/x/net@v0.56.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

1,280

mealiedeimosfr-charts

1.0.16

1 of 1 See more

mealie deimosfr-charts 1.0.16

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/mealie-recipes/mealie :v3.28.0	8b02290f4d18	stdlib@go1.24.4	1.26.9

Open the chart page →

3,989

dregsydeliveryhero

0.1.5

1 of 1 See more

dregsy deliveryhero 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
xelalex/dregsy :0.4.3	574054e1c417	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.3	0.60.0 1.26.9

Open the chart page →

4,006

gripmockdeliveryhero

1.1.3

1 of 1 See more

gripmock deliveryhero 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
tkpd/gripmock :1.10.1	74441dadcfbd	stdlib@go1.14.6	1.26.9

Open the chart page →

3,897

labelsmanager-controllerdeliveryhero

1.0.4

1 of 1 See more

labelsmanager-controller deliveryhero 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
thomasnyambati/labelsmanager-controller :1.0.0	148ae3f99fea	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.15	0.60.0 1.26.9

Open the chart page →

3,542

weblatedeliveryhero

0.3.2

1 of 3 See more

weblate deliveryhero 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
weblate/weblate :4.2.2-1	69c160d37a3c	golang.org/x/net@v0.0.0-20190620200207-3b0461eec859 stdlib@go1.13.5	0.60.0 1.26.9

Open the chart page →

10,831

snapshot-controllerdemocratic-csi

0.3.0

1 of 1 See more

snapshot-controller democratic-csi 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/snapshot-controller :v8.2.1	472fa35a89da	golang.org/x/net@v0.33.0 stdlib@go1.23.6	0.60.0 1.26.9

Open the chart page →

986

developer-operatordeveloper-operator

2.1.2

1 of 1 See more

developer-operator developer-operator 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
registry.gitlab.com/xrow-public/developer-operator/developer-operator-controller :2.1.2	301847adfe16	golang.org/x/net@v0.41.0 stdlib@go1.24.5	0.60.0 1.26.9

Open the chart page →

2,524

kube-bench-metricsdevopstales

0.1.0

1 of 1 See more

kube-bench-metrics devopstales 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
elastisys/kube-bench-metrics :0.1.6	509b94f1da55	stdlib@go1.15.7	1.26.9

Open the chart page →

3,166

kubedashdevopstales

4.0.0

5 of 8 See more

kubedash devopstales 4.0.0

5 of the 8 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/postgres :18.3	a9abf4275f9e	stdlib@go1.24.6	1.26.9
oliver006/redis_exporter :v1.82.0-alpine	da9e89ee4e75	stdlib@go1.26.1	1.26.9
prom/statsd-exporter :v0.22.4	8be660470961	stdlib@go1.17.3	1.26.9
sosedoff/pgweb :latest	a5256d416e2e	golang.org/x/net@v0.47.0 stdlib@go1.24.6	0.60.0 1.26.9
quay.io/prometheuscommunity/postgres-exporter :v0.19.1	e96064f87622	golang.org/x/net@v0.48.0 stdlib@go1.25.7	0.60.0 1.26.9

Open the chart page →

12,914

permission-managerdevopstales

1.8.0

1 of 1 See more

permission-manager devopstales 1.8.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
quay.io/sighup/permission-manager :v1.7.1-rc1	f5e6a5dcee33	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.16.8	0.60.0 1.26.9

Open the chart page →

3,405

trivy-operatordevopstales

2.5.0

1 of 1 See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
devopstales/trivy-operator :2.5	75136aa7a26e	golang.org/x/net@v0.4.0 stdlib@go1.18.10	0.60.0 1.26.9

Open the chart page →

6,573

dnsmasqdevplayer0

0.1.5

1 of 2 See more

dnsmasq devplayer0 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/devplayer0/kubelan :0.2.3	b776dae45d08	golang.org/x/net@v0.0.0-20210614182718-04defd469f4e stdlib@go1.16.5	0.60.0 1.26.9

Open the chart page →

4,542

whoamidevplayer0

0.1.2

1 of 1 See more

whoami devplayer0 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
traefik/whoami :v1.6.1	2c52bb2c8480	stdlib@go1.15.6	1.26.9

Open the chart page →

2,265

calicodevtron

0.1.1

4 of 4 See more

calico devtron 0.1.1

4 of the 4 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
quay.io/devtron/calico-networking :kube-controllers-v3.19.1	2ff71ba65cd7	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.15.2	0.60.0 1.26.9
quay.io/devtron/calico-networking :cni-v3.19.1	51f294c56842	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.15.2	0.60.0 1.26.9
quay.io/devtron/calico-networking :node-v3.19.1	bc4aa22272ef	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.15.2	0.60.0 1.26.9
quay.io/devtron/calico-networking :pod2daemon-flexvol-v3.19.1	c1f36b6e18e0	stdlib@go1.15.2	1.26.9

Open the chart page →

14,907

clairdevtron

0.1.14

1 of 2 See more

clair devtron 0.1.14

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
quay.io/devtron/clair :4.3.6	75fb847ac045	golang.org/x/net@v0.0.0-20210805182204-aaa1db679c0d stdlib@go1.17.6	0.60.0 1.26.9

Open the chart page →

8,075

discord-alertmanagerdevtron-labs

0.10.0

1 of 1 See more

discord-alertmanager devtron-labs 0.10.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
quay.io/devtron/discord-alertmanager :ceceb475-65-352	03586419ca31	stdlib@go1.18.1	1.26.9

Open the chart page →

1,809

dex-serverdex-server

1.19.1

2 of 3 See more

dex-server dex-server 1.19.1

2 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
dexidp/dex :v2.39.1-distroless	43655afd1a8f	golang.org/x/net@v0.24.0 stdlib@go1.21.6	0.60.0 1.26.9
public.ecr.aws/cloudnatix/llmariner/database-creator :1.19.1	62375abc3c56	stdlib@go1.23.12	1.26.9

Open the chart page →

3,357

digispoof-interfacedigispoof-interface

1.0.0

1 of 3 See more

digispoof-interface digispoof-interface 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/digispoof-interface-php :latest	03aba499950f	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.13.10	0.60.0 1.26.9

Open the chart page →

9,890

matomodigitalist-open-cloud-matomo

12.0.21

1 of 3 See more

matomo digitalist-open-cloud-matomo 12.0.21

1 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
hipages/php-fpm_exporter :2.2.0	9b5be9d3d955	stdlib@go1.17.10	1.26.9

Open the chart page →

3,657

directusdirectus-io

2.1.0

3 of 3 See more

directus directus-io 2.1.0

3 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
bitnamilegacy/mysql :9.4.0-debian-12-r1	ec13e229247a	stdlib@go1.24.6	1.26.9
bitnamilegacy/redis :8.2.1-debian-12-r0	25bf63f3caf7	stdlib@go1.25.0	1.26.9
directus/directus :12.0.2	9c8470ea465c	stdlib@go1.23.12	1.26.9

Open the chart page →

9,943

alertmanager-ntfydjjudas21

0.1.2

1 of 1 See more

alertmanager-ntfy djjudas21 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/alexbakker/alertmanager-ntfy :1.0.1	2f4db8064595	golang.org/x/net@v0.41.0 stdlib@go1.24.4	0.60.0 1.26.9

Open the chart page →

1,146

dkim-managerdkim-manager

0.2.0

1 of 1 See more

dkim-manager dkim-manager 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/hsn723/dkim-manager :1.4.0	0312232b31a2	golang.org/x/net@v0.50.0 stdlib@go1.26.0	0.60.0 1.26.9

Open the chart page →

716

myappdl-grafana-webapp

0.1.0

1 of 2 See more

myapp dl-grafana-webapp 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
onkar17/grafana :latest	aef3ebd6e24e	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777 stdlib@go1.16.1	0.60.0 1.26.9

Open the chart page →

3,743

dnation-pingdnationcloud

0.1.9

4 of 5 See more

dnation-ping dnationcloud 0.1.9

4 of the 5 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
grafana/grafana :7.3.5	511bc20bfcd1	golang.org/x/net@v0.0.0-20201022231255-08b38378de70 stdlib@go1.15.5	0.60.0 1.26.9
jimmidyson/configmap-reload :v0.4.0	17d34fd73f9e	stdlib@go1.14.4	1.26.9
prom/blackbox-exporter :v0.18.0	1ffc3f109eb3	golang.org/x/net@v0.0.0-20200602114024-627f9648deb9 stdlib@go1.15.2	0.60.0 1.26.9
prom/prometheus :v2.21.0	d43417c260e5	golang.org/x/net@v0.0.0-20200822124328-c89045814202 stdlib@go1.15.2	0.60.0 1.26.9

Open the chart page →

15,324

docker-in-dockerdocker-in-docker

0.0.3

1 of 2 See more

docker-in-docker docker-in-docker 0.0.3

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/docker :24.0.2-dind	1d148deae16a	golang.org/x/net@v0.8.0 stdlib@go1.20.4	0.60.0 1.26.9

Open the chart page →

3,376

docker-registrydocker-repository

0.1.0

1 of 1 See more

docker-registry docker-repository 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/registry :latest	ddf754342cfc	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

256

dockyarddockyard

0.5.0

1 of 1 See more

dockyard dockyard 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/kgma74/dockyard :0.5.0	15d1d5769e91	golang.org/x/net@v0.29.0 stdlib@go1.22.7	0.60.0 1.26.9

Open the chart page →

2,159

thermitedollarshaveclub

0.1.17

1 of 1 See more

thermite dollarshaveclub 0.1.17

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
dollarshaveclub/thermite :0.0.31	663cbf25fcfe	golang.org/x/net@v0.0.0-20210805182204-aaa1db679c0d stdlib@go1.17.1	0.60.0 1.26.9

Open the chart page →

3,874

domain-lockerdomain-locker

0.3.3

1 of 2 See more

domain-locker domain-locker 0.3.3

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/postgres :15-alpine	f7d23353e1b1	stdlib@go1.24.6	1.26.9

Open the chart page →

1,213

dominodomino

0.1.11

1 of 3 See more

domino domino 0.1.11

1 of the 3 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/postgres :13	4689940c6838	stdlib@go1.24.6	1.26.9

Open the chart page →

10,150

archerydouban

0.4.3

2 of 6 See more

archery douban 0.4.3

2 of the 6 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
hanchuanchuan/goinception :latest	b3c0dd26fb50	golang.org/x/net@v0.23.0 stdlib@go1.22.1	0.60.0 1.26.9
hhyo/archery :v1.9.1	1aa41843419e	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.15.6	0.60.0 1.26.9

Open the chart page →

7,976

karmadouban

1.9.2

1 of 1 See more

karma douban 1.9.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/prymitive/karma :v0.85	d06892218680	golang.org/x/net@v0.0.0-20210503060351-7fd8e65b6420 stdlib@go1.16.3	0.60.0 1.26.9

Open the chart page →

3,362

agent-sandboxdovakiin0

1.0.5

1 of 2 See more

agent-sandbox dovakiin0 1.0.5

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
registry.k8s.io/agent-sandbox/agent-sandbox-controller :v1.0.2	dc700a37ecf4	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

225

seafiledr300481

0.12.1

1 of 1 See more

seafile dr300481 0.12.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
seafileltd/seafile-mc :11.0.12	d0c66e4621bd	stdlib@go1.21.4	1.26.9

Open the chart page →

77,317

dragonfly-stackdragonfly

0.1.2

4 of 7 See more

dragonfly-stack dragonfly 0.1.2

4 of the 7 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
dragonflyoss/client :v0.1.82	edf3e921f4e0	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.60.0 1.26.9
dragonflyoss/manager :v2.1.49	c3ef7f10698d	golang.org/x/net@v0.19.0 stdlib@go1.21.1	0.60.0 1.26.9
dragonflyoss/scheduler :v2.1.49	523785c77787	golang.org/x/net@v0.19.0 stdlib@go1.21.1	0.60.0 1.26.9
ghcr.io/containerd/nydus-snapshotter :v0.9.0	56f8617363b4	golang.org/x/net@v0.8.0 stdlib@go1.18.10	0.60.0 1.26.9

Open the chart page →

22,846

nydus-snapshotterdragonfly

0.0.10

1 of 2 See more

nydus-snapshotter dragonfly 0.0.10

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/containerd/nydus-snapshotter :v0.9.0	56f8617363b4	golang.org/x/net@v0.8.0 stdlib@go1.18.10	0.60.0 1.26.9

Open the chart page →

4,534

rstudiodsri-helm-charts

0.1.28

1 of 1 See more

rstudio dsri-helm-charts 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/maastrichtu-ids/rstudio :latest	981aa4c109e1	stdlib@go1.20.12	1.26.9

Open the chart page →

76,446

gaxyduyet

0.1.1

1 of 1 See more

gaxy duyet 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/duyet/gaxy :latest	31d658a22bd1	stdlib@go1.27.1	1.27.2

Open the chart page →

148

dyff-operatordyff-operator

0.24.22

1 of 1 See more

dyff-operator dyff-operator 0.24.22

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
registry.gitlab.com/dyff/dyff-operator :0.24.22	7f930cdae40d	golang.org/x/net@v0.44.0 stdlib@go1.24.13	0.60.0 1.26.9

Open the chart page →

674

gethdysnix

1.1.2

1 of 1 See more

geth dysnix 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ethereum/client-go :v1.14.8	886ec69b35b0	golang.org/x/net@v0.24.0 stdlib@go1.22.6	0.60.0 1.26.9

Open the chart page →

2,197

jenkinsedu

2.7.1

1 of 2 See more

jenkins edu 2.7.1

1 of the 2 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
jenkins/jenkins :lts	a660310e39ad	golang.org/x/net@v0.57.0 stdlib@go1.27.0	0.60.0 1.27.2

Open the chart page →

4,119

glpieftechcombr-glpi

2.12.0

1 of 5 See more

glpi eftechcombr-glpi 2.12.0

1 of the 5 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
library/mariadb :12.3.2	a02fe89cb597	stdlib@go1.24.6	1.26.9

Open the chart page →

3,801

egagenteginnovations

0.10.0

1 of 1 See more

egagent eginnovations 0.10.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
eginnovations/agent :7.5.4	e4dfe242fe9f	golang.org/x/net@v0.55.0 stdlib@go1.26.4	0.60.0 1.26.9

Open the chart page →

1,802

glideeinstack

0.0.2

1 of 1 See more

glide einstack 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/einstack/glide :0.0.1-alpine	ab3f7d0a1d50	golang.org/x/net@v0.19.0 stdlib@go1.21.6	0.60.0 1.26.9

Open the chart page →

2,001

elaraelara

0.5.2

1 of 1 See more

elara elara 0.5.2

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
ghcr.io/sergeyslonimsky/elara :0.5.2	a410a7ed1ee8	golang.org/x/net@v0.58.0 stdlib@go1.27.0	0.60.0 1.27.2

Open the chart page →

228

elchi-discoveryelchi

1.0.0

1 of 1 See more

elchi-discovery elchi 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
jhonbrownn/elchi-discovery :v1.0.0	8f6551ecc98c	golang.org/x/net@v0.13.0 stdlib@go1.23.1	0.60.0 1.26.9

Open the chart page →

1,189

elchi-stackelchi

2.0.6

4 of 10 See more

elchi-stack elchi 2.0.6

4 of the 10 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
grafana/grafana :12.2.0	74144189b384	golang.org/x/net@v0.43.0 stdlib@go1.24.6	0.60.0 1.26.9
library/mongo :6.0.12	646902910d6a	stdlib@go1.18.2	1.26.9
otel/opentelemetry-collector-contrib :0.89.0	995f17004231	golang.org/x/net@v0.18.0 stdlib@go1.21.4	0.60.0 1.26.9
victoriametrics/victoria-metrics :v1.93.5	77a9815d0640	golang.org/x/net@v0.15.0 stdlib@go1.21.1	0.60.0 1.26.9

Open the chart page →

17,710

navidromeemmas-charts

0.0.6

1 of 1 See more

navidrome emmas-charts 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
deluan/navidrome :0.50.0	2cf4442b0099	golang.org/x/net@v0.18.0 stdlib@go1.21.0	0.60.0 1.26.9

Open the chart page →

2,906

enbuildenbuild

0.0.50

3 of 6 See more

enbuild enbuild 0.0.50

3 of the 6 container images this version deploys carry CVE-2026-78663.

Container image	Digest	Package	Fixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend :1.0.31	c7afac3446d6	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.60.0 1.26.9
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer :1.0.31	0e3cd8c7776d	golang.org/x/net@v0.50.0 stdlib@go1.25.7	0.60.0 1.26.9
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb :4.4.5	cf72810d33f5	stdlib@go1.15.8	1.26.9

Open the chart page →

37,129

Container images carrying it

6,227 by charts deploying them

A fixed version is listed for 3 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/lbi22/trivy-webhook-elasticsearch :v0.1.4	b51b824e4f19	stdlib@go1.22.8	1.26.9	1
ghcr.io/leoquote/tencentcloud-exporter :master	ca51b6bb15dd	stdlib@go1.21.1	1.26.9	1
ghcr.io/leoquote/tencentcloud-info-exporter :main	d523c2c010cd	golang.org/x/net@v0.0.0-20210525063256-abc453219eb5 stdlib@go1.18.3	0.60.0 1.26.9	1
ghcr.io/liangyuanpeng/chirpstack-event-forward :v0.1.2	23dc6274cc4b	golang.org/x/net@v0.0.0-20210813160813-60bc85c4be6d stdlib@go1.17.10	0.60.0 1.26.9	1
ghcr.io/liangyuanpeng/replacer :v1.1.0	0b2a41c2a43e	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.17.7	0.60.0 1.26.9	1
ghcr.io/liangyuanpeng/waitfor :v1.0.0	ca5a98cbed32	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.17.7	0.60.0 1.26.9	1
ghcr.io/linkwarden/linkwarden :v2.16.3	0664c28a039b	stdlib@go1.23.7	1.26.9	1
ghcr.io/linuxoid69/school-bot :v0.3.3	c8872438f1e0	stdlib@go1.23.3	1.26.9	1
ghcr.io/linuxserver/calibre-web :0.6.26	7c0464228f2f	stdlib@go1.17.8	1.26.9	1
ghcr.io/linuxserver/calibre-web :latest	e7debaaec01a	stdlib@go1.17.8	1.26.9	1
ghcr.io/linuxserver/code-server :version-v3.11.1	a385ba5cb161	stdlib@go1.16.4	1.26.9	1
ghcr.io/linuxserver/digikam :version-7.3.0	55b4c7f320ae	golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110 stdlib@go1.16.9	0.60.0 1.26.9	1
ghcr.io/linuxserver/doublecommander :version-0.8.2-1	d92969a929c2	golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110 stdlib@go1.16.9	0.60.0 1.26.9	1
ghcr.io/linuxserver/duplicati :latest	78883c4ea7a3	stdlib@go1.24.9	1.26.9	1
ghcr.io/linuxserver/filezilla :version-3.51.0-r1	5103cdd266ce	golang.org/x/net@v0.0.0-20201224014010-6772e930b67b stdlib@go1.15.12	0.60.0 1.26.9	1
ghcr.io/linuxserver/mstream :version-v5.2.5	22c012bcc43c	golang.org/x/net@v0.0.0-20190827160401-ba9fcec4b297 stdlib@go1.15.5	0.60.0 1.26.9	1
ghcr.io/linuxserver/plex :latest	3f71bd6eb6a4	stdlib@go1.26.7	1.26.9	1
ghcr.io/linuxserver/remmina :version-1.2.0-rcgit.29dfsg-1ubuntu1	05955792e00f	golang.org/x/net@v0.0.0-20211216030914-fe4d6282115f stdlib@go1.17.11	0.60.0 1.26.9	1
ghcr.io/linuxserver/sqlitebrowser :version-3.12.2-02876202105241947ubuntu18.04.1	426e79828c4b	golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023 stdlib@go1.16.12	0.60.0 1.26.9	1
ghcr.io/litesql/ha :latest	14d266f40e00	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
ghcr.io/litesql/pocketbase-ha :latest	80b42258bfe0	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
ghcr.io/lldap/lldap :2025-05-19	3de697c3ba57	stdlib@go1.18.2	1.26.9	1
ghcr.io/llm-d/llm-d-model-service :v0.0.15	8b99a8104a2f	golang.org/x/net@v0.40.0 stdlib@go1.24.3	0.60.0 1.26.9	1
ghcr.io/lloesche/valheim-server :latest	19f55bcf7bb6	stdlib@go1.24.1	1.26.9	1
ghcr.io/loafoe/centcom :v0.267.0	4b26cc8f2b4c	golang.org/x/net@v0.55.0 stdlib@go1.27.1	0.60.0 1.27.2	1
ghcr.io/loafoe/go-hello-world :v2.16.0	22d94845e317	golang.org/x/net@v0.59.0 stdlib@go1.26.0	0.60.0 1.26.9	1
ghcr.io/loafoe/go-ocpp-server :v0.2.1	45bb960674ab	stdlib@go1.21.13	1.26.9	1
ghcr.io/loafoe/mcp-notifier :v0.2.0	ea958b832415	stdlib@go1.26.4	1.26.9	1
ghcr.io/loafoe/mt-mcp-grafana :v0.1.1	2332d9b47475	golang.org/x/net@v0.55.0 stdlib@go1.26.2	0.60.0 1.26.9	1
ghcr.io/loafoe/mt-mcp-proxy :v0.3.0	881e7d8097bc	golang.org/x/net@v0.55.0 stdlib@go1.26.4	0.60.0 1.26.9	1
ghcr.io/loafoe/picoclaw :v0.0.19	42e1b6862913	golang.org/x/net@v0.53.0 stdlib@go1.26.2	0.60.0 1.26.9	1
ghcr.io/loafoe/solgate :v0.0.12	b3256cbc7b68	golang.org/x/net@v0.14.0 stdlib@go1.21.0	0.60.0 1.26.9	1
ghcr.io/lockdep/stackradar-scanner :0.6.0	a90480c17377	golang.org/x/net@v0.49.0 stdlib@go1.25.7	0.60.0 1.26.9	1
ghcr.io/loft-sh/agent :3.2.4	5c109914ff73	golang.org/x/net@v0.6.0 stdlib@go1.18.10	0.60.0 1.26.9	1
ghcr.io/loft-sh/central-hostpath-mapper :0.2.9	fa6dba122171	golang.org/x/net@v0.26.0 stdlib@go1.23.2	0.60.0 1.26.9	1
ghcr.io/loft-sh/devpod-pro :0.0.0-ci.4-do-not-use	5dfa86b6451f	golang.org/x/net@v0.21.0 stdlib@go1.20.10	0.60.0 1.26.9	1
ghcr.io/loft-sh/kubernetes :v1.35.0	90097a08b87c	golang.org/x/net@v0.42.0 stdlib@go1.24.11	0.60.0 1.26.9	1
ghcr.io/loft-sh/license-server :0.6.0	69ce001bb4b0	golang.org/x/net@v0.53.0 stdlib@go1.24.3	0.60.0 1.26.9	1
ghcr.io/loft-sh/loft :0.0.0-ci.14	b69bcdaa8492	golang.org/x/net@v0.14.0 stdlib@go1.20.7	0.60.0 1.26.9	1
ghcr.io/loft-sh/vcluster :0.16.4	84f70425f4dd	golang.org/x/net@v0.13.0 stdlib@go1.20.8	0.60.0 1.26.9	1
ghcr.io/loft-sh/vcluster-control-plane :0.0.0-ci.4-do-not-use	45e744fc623f	golang.org/x/net@v0.21.0 stdlib@go1.22.0	0.60.0 1.26.9	1
ghcr.io/loft-sh/vcluster-hpm :0.2.7	f65f6810ea23	golang.org/x/net@v0.40.0 stdlib@go1.24.2	0.60.0 1.26.9	1
ghcr.io/loft-sh/vcluster-platform :4.12.2	71d869f989e9	golang.org/x/net@v0.52.0 stdlib@go1.26.5	0.60.0 1.26.9	1
ghcr.io/loft-sh/vnode-runtime :0.3.3	b065ec5a5239	golang.org/x/net@v0.46.0 stdlib@go1.24.2	0.60.0 1.26.9	1
ghcr.io/loxilb-io/kube-loxilb :latest	6f65e53e252d	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.60.0 1.26.9	1
ghcr.io/loxilb-io/loxilb :latest	a475b43946b3	golang.org/x/net@v0.55.0 stdlib@go1.22.5	0.60.0 1.26.9	1
ghcr.io/lrstanley/vault-unseal :1.0.1	dd873930b6df	golang.org/x/net@v0.57.0 stdlib@go1.26.5	0.60.0 1.26.9	1
ghcr.io/luckypipewrench/pipelock :3.6.0	66d65eaca81d	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9	1
ghcr.io/luisico/cert-manager-webhook-infoblox-wapi :1.5	ded797477896	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.16.15	0.60.0 1.26.9	1
ghcr.io/lukaszraczylo/jobs-manager-operator :0.1.33	6eef1629571e	stdlib@go1.26.8	1.26.9	1