StackRadar

CVE-2026-78667

High

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
30th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
5,295
of 18,117 indexed, latest versions
Container images
6,105
deployed by those charts
Fix available
1 of 2
affected packages

Lack of limit on size of parsed Range headers in net/http

Carried by container images the latest versions of 5,295 of 18,117 indexed charts deploy, on 6,105 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+212 more1.26.96,105
golang-1.19deb1.19.8-2no fix listed1
OSV records
DEBIAN-CVE-2026-78667GO-2026-6609
Trending
Rank 7 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,295 by stars
ChartLatestAffected imagesRadar Score
ms-hello-webms-hello-test0.1.01 of 1See more

ms-hello-web ms-hello-test 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
irakli/ms-web-hello:latest966a4bfefe27
stdlib@go1.19.2
1.26.9

Open the chart page →

1,457
adguard-homemt1905024.0.122 of 2See more

adguard-home mt190502 4.0.12

2 of the 2 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
adguard/adguardhome:v0.107.737fbf01d73ecb
stdlib@go1.25.7
1.26.9
mikefarah/yq:latest4b3d9475d655
stdlib@go1.27.1
1.26.9

Open the chart page →

1,677
codimdmt1905027.2.21 of 3See more

codimd mt190502 7.2.2

1 of the 3 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/postgres:1874935e722416
stdlib@go1.24.6
1.26.9

Open the chart page →

1,806
commafeedmt1905028.2.01 of 3See more

commafeed mt190502 8.2.0

1 of the 3 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/postgres:18fc973eb97c9f
stdlib@go1.24.6
1.26.9

Open the chart page →

4,306
filestashmt1905024.0.01 of 1See more

filestash mt190502 4.0.0

1 of the 1 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
machines/filestash:latestaff504cd28a8
stdlib@go1.26.8
1.26.9

Open the chart page →

3,780
ghostmt1905028.25.12 of 3See more

ghost mt190502 8.25.1

2 of the 3 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
stdlib@go1.24.6
1.26.9
library/mysql:86ea90827b110
stdlib@go1.24.6
1.26.9

Open the chart page →

6,569
keycloakmt1905021.4.61 of 3See more

keycloak mt190502 1.4.6

1 of the 3 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/postgres:1874935e722416
stdlib@go1.24.6
1.26.9

Open the chart page →

3,324
maddymt1905024.1.21 of 1See more

maddy mt190502 4.1.2

1 of the 1 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
foxcpp/maddy:0.9.2a4b839985b9b
stdlib@go1.23.12
1.26.9

Open the chart page →

1,616
memosmt1905027.3.22 of 3See more

memos mt190502 7.3.2

2 of the 3 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/postgres:1874935e722416
stdlib@go1.24.6
1.26.9
neosmemo/memos:0.26.23eefcc231141
stdlib@go1.25.7
1.26.9

Open the chart page →

3,296
minifluxmt1905021.1.62 of 3See more

miniflux mt190502 1.1.6

2 of the 3 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/postgres:18fc973eb97c9f
stdlib@go1.24.6
1.26.9
miniflux/miniflux:2.2.18a3ca6bbc1f74
stdlib@go1.26.1
1.26.9

Open the chart page →

3,320
nightscoutmt1905021.1.01 of 3See more

nightscout mt190502 1.1.0

1 of the 3 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
stdlib@go1.21.12
1.26.9

Open the chart page →

7,549
open-webuimt1905022.3.101 of 3See more

open-webui mt190502 2.3.10

1 of the 3 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/postgres:1874935e722416
stdlib@go1.24.6
1.26.9

Open the chart page →

1,806
paperless-ngxmt1905027.6.142 of 4See more

paperless-ngx mt190502 7.6.14

2 of the 4 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/postgres:1874935e722416
stdlib@go1.24.6
1.26.9
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
stdlib@go1.24.4
1.26.9

Open the chart page →

14,226
umamimt1905028.1.41 of 3See more

umami mt190502 8.1.4

1 of the 3 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/postgres:1874935e722416
stdlib@go1.24.6
1.26.9

Open the chart page →

4,320
vaultwardenmt1905027.3.41 of 3See more

vaultwarden mt190502 7.3.4

1 of the 3 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/postgres:1874935e722416
stdlib@go1.24.6
1.26.9

Open the chart page →

5,349
vikunjamt1905027.1.22 of 3See more

vikunja mt190502 7.1.2

2 of the 3 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/postgres:1874935e722416
stdlib@go1.24.6
1.26.9
vikunja/vikunja:0.24.6ed1f3ed467fe
stdlib@go1.23.4
1.26.9

Open the chart page →

3,979
mongodbmulti-chart-app0.1.01 of 1See more

mongodb multi-chart-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/mongo:71f995ad6fdb9
stdlib@go1.26.8
1.26.9

Open the chart page →

2,459
my-multi-chart-appmulti-chart-app0.1.01 of 2See more

my-multi-chart-app multi-chart-app 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/mongo:71f995ad6fdb9
stdlib@go1.26.8
1.26.9

Open the chart page →

4,203
multusmultusVerified publisher0.2.02 of 2See more

multus multus 0.2.0

2 of the 2 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
ghcr.io/k8snetworkplumbingwg/multus-cni:v4.1.409fdfb7ce090
stdlib@go1.23.4
1.26.9
ghcr.io/k8snetworkplumbingwg/multus-dynamic-networks-controller:v0.3.72a2bb32c0ea8
stdlib@go1.22.12
1.26.9

Open the chart page →

2,993
devops-demomungari-development-charts1.0.44 of 4See more

devops-demo mungari-development-charts 1.0.4

4 of the 4 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/postgres:latestfc973eb97c9f
stdlib@go1.24.6
1.26.9
ghcr.io/perceptolab/devops-demo-app:0.0.2cdc0658c40fb
stdlib@go1.18.4
1.26.9
quay.io/prometheus/alertmanager:lateste9733bafb1bd
stdlib@go1.26.8
1.26.9
quay.io/prometheus/prometheus:latestefd719c99d83
stdlib@go1.27.1
1.26.9

Open the chart page →

10,651
pagesmuthu-pages1.0.01 of 3See more

pages muthu-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.26.9

Open the chart page →

21,318
approuvezmvisonneau0.1.11 of 1See more

approuvez mvisonneau 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
ghcr.io/mvisonneau/approuvez:v0.1.0441da62e6cb3
stdlib@go1.15.6
1.26.9

Open the chart page →

3,175
unpollermvisonneau0.1.01 of 1See more

unpoller mvisonneau 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
golift/unifi-poller:v2.9.2585a29a06d05
stdlib@go1.21.0
1.26.9

Open the chart page →

1,905
ingress-nginxmxytest4.15.12 of 2See more

ingress-nginx mxytest 4.15.1

2 of the 2 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.15.1594ceea76b01
stdlib@go1.26.1
1.26.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.901038e7de14b
stdlib@go1.26.1
1.26.9

Open the chart page →

2,366
danboorumy0nVerified publisher0.0.21 of 1See more

danbooru my0n 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
stdlib@go1.18
1.26.9

Open the chart page →

105,975
danbooru-stackmy0nVerified publisher0.0.31 of 4See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
stdlib@go1.18
1.26.9

Open the chart page →

105,975
authmyaVerified publisher22.4.31 of 1See more

auth mya 22.4.3

1 of the 1 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
cesanta/docker_auth:1.6.04d16885f3d4c
stdlib@go1.13.7
1.26.9

Open the chart page →

3,632
clickhousemyaVerified publisher0.2403.11 of 1See more

clickhouse mya 0.2403.1

1 of the 1 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:24.2ed9640bfff07
stdlib@go1.19.10
1.26.9

Open the chart page →

4,372
cognativemyaVerified publisher0.2403.33 of 3See more

cognative mya 0.2403.3

3 of the 3 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:24.2ed9640bfff07
stdlib@go1.19.10
1.26.9
grafana/grafana:10.4.0f9811e4e687f
stdlib@go1.21.8
1.26.9
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
stdlib@go1.21.7
1.26.9

Open the chart page →

9,548
giteamyaVerified publisher23.12.51 of 1See more

gitea mya 23.12.5

1 of the 1 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
gitea/gitea:1.21.6ac73e0da341f
stdlib@go1.21.7
1.26.9

Open the chart page →

4,333
redismyaVerified publisher22.4.101 of 2See more

redis mya 22.4.10

1 of the 2 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
quay.io/oliver006/redis_exporter:v1.35.1908dbee5c546
stdlib@go1.17.7
1.26.9

Open the chart page →

1,947
redis-queuemyaVerified publisher22.4.61 of 2See more

redis-queue mya 22.4.6

1 of the 2 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
quay.io/oliver006/redis_exporter:v1.35.1908dbee5c546
stdlib@go1.17.7
1.26.9

Open the chart page →

1,947
redis-raftmyaVerified publisher22.5.41 of 2See more

redis-raft mya 22.5.4

1 of the 2 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
quay.io/oliver006/redis_exporter:v1.35.1908dbee5c546
stdlib@go1.17.7
1.26.9

Open the chart page →

1,947
apachemy-chart-repo0.1.01 of 2See more

apache my-chart-repo 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
bitnami/mongodb:latestad05bb9a19fa
stdlib@go1.26.8
1.26.9

Open the chart page →

2,052
myhelmappmyhelmapp0.1.11 of 1See more

myhelmapp myhelmapp 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
tobirachel/node-project3:v17d9f37154994
stdlib@go1.17.5
1.26.9

Open the chart page →

4,560
my-helm-chartmy-helm-chart0.1.01 of 3See more

my-helm-chart my-helm-chart 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/postgres:latest74935e722416
stdlib@go1.24.6
1.26.9

Open the chart page →

4,721
Practica_4_helmmy-heml-appVerified publisher0.1.03 of 7See more

Practica_4_helm my-heml-app 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
codeurjc/toposervice:v1.09fb4c11e6a49
stdlib@go1.18.10
1.26.9
library/mongo:5.0.6-focal8e70544b6c76
stdlib@go1.16.7
1.26.9
library/mysql:8.0.28fc77d54cacef
stdlib@go1.16.7
1.26.9

Open the chart page →

32,869
grafana-chartmy-personal-grafana0.1.01 of 1See more

grafana-chart my-personal-grafana 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
grafana/grafana:latestb28bae15e219
stdlib@go1.26.7
1.26.9

Open the chart page →

342
influxdbmy-personal-influxdb20.1.01 of 1See more

influxdb my-personal-influxdb2 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/influxdb:2.7b8d940ca9376
stdlib@go1.18.2
1.26.9

Open the chart page →

5,200
phonebook-chartmy-phonebook-chart0.1.01 of 3See more

phonebook-chart my-phonebook-chart 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
stdlib@go1.18.2
1.26.9

Open the chart page →

3,894
mychartmysqlweb0.1.01 of 1See more

mychart mysqlweb 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
qichenxu4pd/mysqlweb:1.2d758d41d9c6b
stdlib@go1.18.2
1.26.9

Open the chart page →

2,021
myweatherhelmmyweather1.3.111 of 7See more

myweatherhelm myweather 1.3.11

1 of the 7 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/rabbitmq:3-managemente582c0bc7766
stdlib@go1.22.2
1.26.9

Open the chart page →

20,281
fargate-sidecar-injectormziyaboVerified publisher0.1.51 of 1See more

fargate-sidecar-injector mziyabo 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
mziyabo/fargate-eks-sidecar-injector:latest3067dce17983
stdlib@go1.19.13
1.26.9

Open the chart page →

2,095
haproxy-ingressn42-gateway0.16.21 of 1See more

haproxy-ingress n42-gateway 0.16.2

1 of the 1 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
quay.io/jcmoraisjr/haproxy-ingress:v0.16.242bcf39842db
stdlib@go1.26.8
1.26.9

Open the chart page →

243
victoria-metrics-singlenaps0.0.61 of 1See more

victoria-metrics-single naps 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
victoriametrics/victoria-metrics:v1.34.7b50d5c0153f9
stdlib@go1.14.1
1.26.9

Open the chart page →

2,409
pagesnarain1.0.01 of 3See more

pages narain 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.26.9

Open the chart page →

21,318
pagesnarasimha-pages1.0.01 of 3See more

pages narasimha-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
stdlib@go1.24.6
1.26.9

Open the chart page →

21,318
traefik-forward-auth-openidnas-helm-chartsVerified publisher1.0.11 of 1See more

traefik-forward-auth-openid nas-helm-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
thomseddon/traefik-forward-auth:latestb364aa6a4117
stdlib@go1.13.15
1.26.9

Open the chart page →

3,441
nats-kafkanatsVerified publisher0.15.41 of 1See more

nats-kafka nats 0.15.4

1 of the 1 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
natsio/nats-kafka:1.4.2bb241956b0dc
stdlib@go1.20
1.26.9

Open the chart page →

2,586
nats-operatornatsVerified publisher0.8.31 of 1See more

nats-operator nats 0.8.3

1 of the 1 container images this version deploys carry CVE-2026-78667.

Container imageDigestPackageFixed in
natsio/nats-operator:0.8.31261dae38389
stdlib@go1.16.10
1.26.9

Open the chart page →

3,464

Container images carrying it

6,105 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
library/postgres:15.186eb0add3b77c
stdlib@go1.24.6
1.26.9
1
library/postgres:17.4-alpine7062a2109c4b
stdlib@go1.18.2
1.26.9
1
library/postgres:12-alpine7c8f48705831
stdlib@go1.18.2
1.26.9
1
library/postgres:157e2070cf6ad0
stdlib@go1.24.6
1.26.9
1
library/postgres:17.2-alpine7e5df973a748
stdlib@go1.18.2
1.26.9
1
library/postgres:15.38775adb39f0d
stdlib@go1.18.2
1.26.9
1
library/postgres:18.6-alpine3.23885cf05d376c
stdlib@go1.24.6
1.26.9
1
library/postgres:18.48ff36f3c6637
stdlib@go1.24.6
1.26.9
1
library/postgres:18.3a9abf4275f9e
stdlib@go1.24.6
1.26.9
1
library/postgres:14bdc3027c1610
stdlib@go1.24.6
1.26.9
1
library/postgres:15c67d80f67f76
stdlib@go1.24.6
1.26.9
1
library/postgres:15c961aa287d86
stdlib@go1.24.6
1.26.9
1
library/postgres:13.12ced3ba927f4c
stdlib@go1.18.2
1.26.9
1
library/postgres:14ceef4a62198b
stdlib@go1.24.6
1.26.9
1
library/postgres:17.10ebba4f4de37f
stdlib@go1.24.6
1.26.9
1
library/postgres:17.6-alpineef257d85f76e
stdlib@go1.24.6
1.26.9
1
library/postgres:14.6f565573d74ae
stdlib@go1.18.2
1.26.9
1
library/postgres:17.5-bookwormfbcea1bd13b6
stdlib@go1.18.2
1.26.9
1
library/rabbitmq:4.3.5078107e03637
stdlib@go1.22.2
1.26.9
1
library/rabbitmq:4.1.8-management19c5ee40801d
stdlib@go1.22.2
1.26.9
1
library/rabbitmq:4.3.6446551b26c0b
stdlib@go1.22.2
1.26.9
1
library/rabbitmq:management6ec83ef56205
stdlib@go1.22.2
1.26.9
1
library/rabbitmq:4.3.6-management751bf4eeaa69
stdlib@go1.22.2
1.26.9
1
library/redis:7.0.4091a7b5de688
stdlib@go1.16.7
1.26.9
1
library/redis:7.0.15352c1fdadc91
stdlib@go1.18.2
1.26.9
1
library/redis:7-bullseye6a5130174e14
stdlib@go1.18.2
1.26.9
1
library/redis:7.2.5-alpine6aaf3f5e6bc8
stdlib@go1.18.2
1.26.9
1
library/redis:6.2.20-alpine77697a75da9f
stdlib@go1.18.2
1.26.9
1
library/redis83edc2b8e9ff
stdlib@go1.18.2
1.26.9
1
library/redis:7.0.1092b8b307ee28
stdlib@go1.18.2
1.26.9
1
library/redis:7.4.1bb142a9c18ac
stdlib@go1.18.2
1.26.9
1
library/redis:7.4.1-alpinec1e88455c852
stdlib@go1.18.2
1.26.9
1
library/redis:7.0-alpinec9d92d840fd0
stdlib@go1.18.2
1.26.9
1
library/redmine:6.1.204ac44a2595b
stdlib@go1.24.6
1.26.9
1
library/registry:latestddf754342cfc
stdlib@go1.26.8
1.26.9
1
library/telegraf:1.20.428e98eece020
stdlib@go1.17.3
1.26.9
1
library/telegraf:1.27507a3eecf809
stdlib@go1.20.7
1.26.9
1
library/telegraf:1.19.0-alpine794079a7f241
stdlib@go1.16.5
1.26.9
1
library/telegraf:1.19-alpineaddb86c0c520
stdlib@go1.16.6
1.26.9
1
library/traefik:v2.11.00a5157f742d2
stdlib@go1.22.0
1.26.9
1
library/traefik:3.3.5104204dadedf
stdlib@go1.23.7
1.26.9
1
library/traefik:v2.10.11489caffaedb
stdlib@go1.20.3
1.26.9
1
library/traefik:2.10.61957e3314f43
stdlib@go1.21.4
1.26.9
1
library/traefik:2.5.62f603f8d3abe
stdlib@go1.17.5
1.26.9
1
library/traefik:v3.6.1334d5089d0b41
stdlib@go1.25.8
1.26.9
1
library/traefik:v3.7.14575fa15b1350
stdlib@go1.26.8
1.26.9
1
library/traefik:v1.7.345d47b7bb2546
stdlib@go1.16.12
1.26.9
1
library/traefik:2.5.47d0228d19042
stdlib@go1.17.3
1.26.9
1
library/traefik:2.7.0-rc2b70710baceeb
stdlib@go1.17.8
1.26.9
1
library/traefik:v2.11b91812c7ee1b
stdlib@go1.26.8
1.26.9
1

syft 1.42.1 · advisories as of 13 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.