StackRadar

CVE-2026-78669

High

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
5,401
of 18,104 indexed, latest versions
Container images
6,250
deployed by those charts
Fix available
2 of 4
affected packages

Excessive CPU consumption from repeated initial window changes in net/http

Carried by container images the latest versions of 5,401 of 18,104 indexed charts deploy, on 6,250 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.13, go1.13.1, go1.13.3, go1.13.4+212 more1.26.9, 1.27.26,223
golang.org/x/netgolangv0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more0.60.05,000
golang-1.19deb1.19.8-2no fix listed1
ingress-nginx-controller-1.15apk1.15.10-r9no fix listed1
OSV records
CGA-w6c4-5355-g6w8DEBIAN-CVE-2026-78669GO-2026-6611
Also known as
CGA-w74x-3c39-v8mc
Trending
Rank 3 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,401 by stars
ChartLatestAffected imagesRadar Score
harborgpg-dev1.18.35 of 8See more

harbor gpg-dev 1.18.3

5 of the 8 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
goharbor/harbor-core:v2.14.3a30e5a8be3d9
golang.org/x/net@v0.47.0
stdlib@go1.24.13
0.60.0
1.26.9
goharbor/harbor-jobservice:v2.14.3e2b0298e894d
golang.org/x/net@v0.47.0
stdlib@go1.24.13
0.60.0
1.26.9
goharbor/harbor-registryctl:v2.14.3ddf6bb429eb6
golang.org/x/net@v0.47.0
stdlib@go1.24.13
0.60.0
1.26.9
goharbor/registry-photon:v2.14.36533fc396cbc
stdlib@go1.24.13
1.26.9
goharbor/trivy-adapter-photon:v2.14.35c6f7162804c
golang.org/x/net@v0.28.0
stdlib@go1.25.7
0.60.0
1.26.9

Open the chart page →

5,473
ingress-nginxgpg-dev4.9.02 of 2See more

ingress-nginx gpg-dev 4.9.0

2 of the 2 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.9.5b3aba22b1da8
golang.org/x/net@v0.17.0
stdlib@go1.21.5
0.60.0
1.26.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0a7943503b45d
golang.org/x/net@v0.16.0
stdlib@go1.21.3
0.60.0
1.26.9

Open the chart page →

3,222
jaegergpg-dev3.3.34 of 5See more

jaeger gpg-dev 3.3.3

4 of the 5 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
jaegertracing/jaeger-agent:1.53.00214a0ef24b1
golang.org/x/net@v0.19.0
stdlib@go1.21.5
0.60.0
1.26.9
jaegertracing/jaeger-cassandra-schema:1.53.0d48d6dab2c65
stdlib@go1.18.2
1.26.9
jaegertracing/jaeger-collector:1.53.07f1269222903
golang.org/x/net@v0.19.0
stdlib@go1.21.5
0.60.0
1.26.9
jaegertracing/jaeger-query:1.53.0049bb0d64ea3
golang.org/x/net@v0.19.0
stdlib@go1.21.5
0.60.0
1.26.9

Open the chart page →

22,255
kube-prometheus-stackgpg-dev84.0.05 of 6See more

kube-prometheus-stack gpg-dev 84.0.0

5 of the 6 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
grafana/grafana:13.0.10f86bada30d6
golang.org/x/net@v0.52.0
stdlib@go1.26.0
0.60.0
1.26.9
ghcr.io/jkroepke/kube-webhook-certgen:1.8.14f6da0256b1b
golang.org/x/net@v0.53.0
stdlib@go1.26.2
0.60.0
1.26.9
quay.io/prometheus-operator/prometheus-operator:v0.90.152a6a92d915e
golang.org/x/net@v0.52.0
stdlib@go1.25.8
0.60.0
1.26.9
quay.io/prometheus/node-exporter:v1.11.10f422f62c15f
golang.org/x/net@v0.52.0
stdlib@go1.26.1
0.60.0
1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.01545919b72e3
golang.org/x/net@v0.48.0
stdlib@go1.25.5
0.60.0
1.26.9

Open the chart page →

5,450
kubernetes-dashboardgpg-dev7.5.04 of 5See more

kubernetes-dashboard gpg-dev 7.5.0

4 of the 5 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
kubernetesui/dashboard-api:1.7.060595892c2cf
golang.org/x/net@v0.25.0
stdlib@go1.22.3
0.60.0
1.26.9
kubernetesui/dashboard-auth:1.1.307135c09e9ff
golang.org/x/net@v0.22.0
stdlib@go1.22.2
0.60.0
1.26.9
kubernetesui/dashboard-metrics-scraper:1.1.17747d363c9fe
golang.org/x/net@v0.21.0
stdlib@go1.22.1
0.60.0
1.26.9
kubernetesui/dashboard-web:1.4.04445b31a2c25
golang.org/x/net@v0.25.0
stdlib@go1.22.3
0.60.0
1.26.9

Open the chart page →

7,915
metrics-servergpg-dev3.12.11 of 1See more

metrics-server gpg-dev 3.12.1

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
registry.k8s.io/metrics-server/metrics-server:v0.7.1db3800085a09
golang.org/x/net@v0.20.0
stdlib@go1.21.8
0.60.0
1.26.9

Open the chart page →

1,539
opentelemetry-demogpg-dev0.33.88 of 27See more

opentelemetry-demo gpg-dev 0.33.8

8 of the 27 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
grafana/grafana:11.3.1fa801ab6e1ae
golang.org/x/net@v0.29.0
stdlib@go1.23.1
0.60.0
1.26.9
jaegertracing/all-in-one:1.53.060e65bfffe1f
golang.org/x/net@v0.19.0
stdlib@go1.21.5
0.60.0
1.26.9
otel/opentelemetry-collector-contrib:0.114.037fa87091cfa
golang.org/x/net@v0.31.0
stdlib@go1.23.3
0.60.0
1.26.9
ghcr.io/open-feature/flagd:v0.11.1a7ea52f87446
golang.org/x/net@v0.27.0
stdlib@go1.22.5
0.60.0
1.26.9
ghcr.io/open-telemetry/demo:1.12.0-productcatalogservice008b9b662289
golang.org/x/net@v0.25.0
stdlib@go1.22.8
0.60.0
1.26.9
ghcr.io/open-telemetry/demo:1.12.0-checkoutservice380eccdc29e9
golang.org/x/net@v0.25.0
stdlib@go1.22.8
0.60.0
1.26.9
ghcr.io/open-telemetry/demo:1.12.0-shippingservicea3ca4c02a5df
golang.org/x/net@v0.19.0
stdlib@go1.21.5
0.60.0
1.26.9
quay.io/prometheus/prometheus:v3.0.03b9b2a15d376
golang.org/x/net@v0.30.0
stdlib@go1.23.3
0.60.0
1.26.9

Open the chart page →

58,558
prometheusgpg-dev29.2.16 of 6See more

prometheus gpg-dev 29.2.1

6 of the 6 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
quay.io/prometheus-operator/prometheus-config-reloader:v0.90.1693faa0b8724
golang.org/x/net@v0.52.0
stdlib@go1.25.8
0.60.0
1.26.9
quay.io/prometheus/alertmanager:v0.32.058e117eabcce
golang.org/x/net@v0.52.0
stdlib@go1.26.2
0.60.0
1.26.9
quay.io/prometheus/node-exporter:v1.11.10f422f62c15f
golang.org/x/net@v0.52.0
stdlib@go1.26.1
0.60.0
1.26.9
quay.io/prometheus/prometheus:v3.11.2cd37346c9745
golang.org/x/net@v0.52.0
stdlib@go1.26.2
0.60.0
1.26.9
quay.io/prometheus/pushgateway:v1.11.249ed9fdf3780
golang.org/x/net@v0.46.0
stdlib@go1.25.3
0.60.0
1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.01545919b72e3
golang.org/x/net@v0.48.0
stdlib@go1.25.5
0.60.0
1.26.9

Open the chart page →

5,703
prometheus-operator-admission-webhookgpg-dev0.18.12 of 2See more

prometheus-operator-admission-webhook gpg-dev 0.18.1

2 of the 2 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
quay.io/prometheus-operator/admission-webhook:v0.79.2d4c97a1b2d67
golang.org/x/net@v0.32.0
stdlib@go1.23.4
0.60.0
1.26.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20221220-controller-v1.5.1-58-g787ea74b64d99688e5573
golang.org/x/net@v0.1.0
stdlib@go1.19.4
0.60.0
1.26.9

Open the chart page →

3,039
thanosgpg-dev0.5.31 of 1See more

thanos gpg-dev 0.5.3

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
thanosio/thanos:v0.41.0cf3e9b292e43
golang.org/x/net@v0.49.0
stdlib@go1.25.7
0.60.0
1.26.9

Open the chart page →

1,008
traefikgpg-dev39.0.81 of 1See more

traefik gpg-dev 39.0.8

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
library/traefik:v3.6.1334d5089d0b41
golang.org/x/net@v0.51.0
stdlib@go1.25.8
0.60.0
1.26.9

Open the chart page →

1,784
velerogpg-dev12.0.01 of 1See more

velero gpg-dev 12.0.0

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
velero/velero:v1.18.0e4d1e79be2ee
golang.org/x/net@v0.47.0
stdlib@go1.25.7
0.60.0
1.26.9

Open the chart page →

2,103
whoami-demogpg-dev0.1.01 of 1See more

whoami-demo gpg-dev 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
containous/whoami:latest7d6a3c8f9147
stdlib@go1.14
1.26.9

Open the chart page →

2,362
spark-standalonegradiant-bigdataVerified publisher0.1.01 of 2See more

spark-standalone gradiant-bigdata 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
prom/graphite-exporter:latestc1a266f63a84
golang.org/x/net@v0.55.0
stdlib@go1.26.5
0.60.0
1.26.9

Open the chart page →

6,523
cloudcost-exportergrafana1.1.151 of 1See more

cloudcost-exporter grafana 1.1.15

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
grafana/cloudcost-exporter:v1.14.01ceccc8e1adc
golang.org/x/net@v0.58.0
stdlib@go1.27.1
0.60.0
1.27.2

Open the chart page →

205
grafana-cloud-onboardinggrafana0.4.75 of 5See more

grafana-cloud-onboarding grafana 0.4.7

5 of the 5 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
grafana/beyla-k8s-cache:253b2f561cb1b
golang.org/x/net@v0.48.0
stdlib@go1.25.3
0.60.0
1.26.9
ghcr.io/grafana/alloy-operator:1.8.1ae85d68749c7
golang.org/x/net@v0.49.0
stdlib@go1.25.8
0.60.0
1.26.9
ghcr.io/grafana/helm-chart-toolbox-kubectl:0.1.1c137478627cc
golang.org/x/net@v0.23.0
stdlib@go1.23.6
0.60.0
1.26.9
quay.io/prometheus/node-exporter:v1.11.10f422f62c15f
golang.org/x/net@v0.52.0
stdlib@go1.26.1
0.60.0
1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.01545919b72e3
golang.org/x/net@v0.48.0
stdlib@go1.25.5
0.60.0
1.26.9

Open the chart page →

7,035
grafana-samplinggrafana1.1.72 of 2See more

grafana-sampling grafana 1.1.7

2 of the 2 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
grafana/alloy:v1.11.38c7256f412fe
golang.org/x/net@v0.43.0
stdlib@go1.24.6
0.60.0
1.26.9
quay.io/prometheus-operator/prometheus-config-reloader:v0.81.0959d47672fbf
golang.org/x/net@v0.37.0
stdlib@go1.23.7
0.60.0
1.26.9

Open the chart page →

4,656
k8s-injection-controllergrafana0.2.11 of 1See more

k8s-injection-controller grafana 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
ghcr.io/grafana/k8s-injection-controller:0.2.0c5bad40655a3
golang.org/x/net@v0.55.0
stdlib@go1.26.5
0.60.0
1.26.9

Open the chart page →

398
mimir-openshift-experimentalgrafana2.1.01 of 4See more

mimir-openshift-experimental grafana 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
grafana/mimir:2.0.080c1a8eb24dd
golang.org/x/net@v0.0.0-20220105145211-5b0dc2dfae98
stdlib@go1.17.8
0.60.0
1.26.9

Open the chart page →

5,314
pyroscope-monitoringgrafana0.1.15 of 6See more

pyroscope-monitoring grafana 0.1.1

5 of the 6 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
grafana/otel-lgtm:0.11.1009d8c3ce4f3a
golang.org/x/net@v0.38.0
stdlib@go1.24.6
0.60.0
1.26.9
ghcr.io/grafana/alloy-operator:1.3.02088dcb22aaa
golang.org/x/net@v0.41.0
stdlib@go1.24.5
0.60.0
1.26.9
ghcr.io/grafana/helm-chart-toolbox-kubectl:0.1.1c137478627cc
golang.org/x/net@v0.23.0
stdlib@go1.23.6
0.60.0
1.26.9
quay.io/prometheus/node-exporter:v1.9.1d00a542e409e
golang.org/x/net@v0.37.0
stdlib@go1.23.7
0.60.0
1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.17.02bbc91556733
golang.org/x/net@v0.41.0
stdlib@go1.24.6
0.60.0
1.26.9

Open the chart page →

11,607
rollout-operatorgrafana0.52.01 of 1See more

rollout-operator grafana 0.52.0

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
grafana/rollout-operator:v0.40.0c49161c368a5
golang.org/x/net@v0.58.0
stdlib@go1.27.1
0.60.0
1.27.2

Open the chart page →

201
snyk-exportergrafana0.1.01 of 1See more

snyk-exporter grafana 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
grafana/snyk_exporter:v1.4.1d3c9093401ca
stdlib@go1.21.0
1.26.9

Open the chart page →

1,227
synthetic-monitoring-agentgrafana-communityVerified publisher1.20.11 of 1See more

synthetic-monitoring-agent grafana-community 1.20.1

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
grafana/synthetic-monitoring-agent:v0.66.1d5f33ade9d66
golang.org/x/net@v0.58.0
stdlib@go1.26.6
0.60.0
1.26.9

Open the chart page →

318
prometheusgrafana-uxadax26.0.16 of 6See more

prometheus grafana-uxadax 26.0.1

6 of the 6 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
prom/prometheus:v3.0.1565ee8650122
golang.org/x/net@v0.30.0
stdlib@go1.23.3
0.60.0
1.26.9
quay.io/prometheus-operator/prometheus-config-reloader:v0.78.2944b2c67345c
golang.org/x/net@v0.30.0
stdlib@go1.23.3
0.60.0
1.26.9
quay.io/prometheus/alertmanager:v0.27.0e13b6ed5cb92
golang.org/x/net@v0.20.0
stdlib@go1.21.7
0.60.0
1.26.9
quay.io/prometheus/node-exporter:v1.8.24032c6d5bfd7
golang.org/x/net@v0.23.0
stdlib@go1.22.5
0.60.0
1.26.9
quay.io/prometheus/pushgateway:v1.10.07a4d0696a24e
golang.org/x/net@v0.28.0
stdlib@go1.23.1
0.60.0
1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.14.037d841299325
golang.org/x/net@v0.29.0
stdlib@go1.23.3
0.60.0
1.26.9

Open the chart page →

8,739
grafregistratiecomponentgrafregistratiecomponent1.0.01 of 3See more

grafregistratiecomponent grafregistratiecomponent 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/grafregistratiecomponent-php:latest35225eaa87ab
golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9
stdlib@go1.13.10
0.60.0
1.26.9

Open the chart page →

9,496
grapple-installergrapple-installer0.3.221 of 1See more

grapple-installer grapple-installer 0.3.22

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
grpl/grapple-cli:0.2.127c00aafee6629
golang.org/x/net@v0.26.0
stdlib@go1.18.10
0.60.0
1.26.9

Open the chart page →

90,831
grayloggraylogVerified publisher1.0.21 of 4See more

graylog graylog 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
library/mongo:8d731d77bfd7a
golang.org/x/net@v0.59.0
stdlib@go1.26.8
0.60.0
1.26.9

Open the chart page →

5,870
armada-executorgresearch0.22.121 of 1See more

armada-executor gresearch 0.22.12

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
gresearch/armada-executor:latest0ba37b0f5a3b
golang.org/x/net@v0.59.0
stdlib@go1.27.1
0.60.0
1.27.2

Open the chart page →

808
armada-lookout-ingestergresearch0.22.121 of 1See more

armada-lookout-ingester gresearch 0.22.12

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
gresearch/armada-lookout-ingester:latestc6fce922dec3
golang.org/x/net@v0.59.0
stdlib@go1.27.1
0.60.0
1.27.2

Open the chart page →

808
armada-lookout-migrationgresearch0.22.121 of 1See more

armada-lookout-migration gresearch 0.22.12

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
gresearch/armada-lookout:latest2e924223c0f7
golang.org/x/net@v0.59.0
stdlib@go1.27.1
0.60.0
1.27.2

Open the chart page →

808
armada-scheduler-migrationgresearch0.22.121 of 1See more

armada-scheduler-migration gresearch 0.22.12

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
gresearch/armada-scheduler:latesta5f8c2d040c0
golang.org/x/net@v0.59.0
stdlib@go1.27.1
0.60.0
1.27.2

Open the chart page →

808
fasttrackmlgresearch0.1.01 of 1See more

fasttrackml gresearch 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
gresearch/fasttrackml:latest16d1228220fc
golang.org/x/net@v0.24.0
stdlib@go1.21.10
0.60.0
1.26.9

Open the chart page →

2,005
siembolgresearch0.1.61 of 4See more

siembol gresearch 0.1.6

1 of the 4 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
alpine/k8s:1.18.16a41efe02a041
golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b
stdlib@go1.15.2
0.60.0
1.26.9

Open the chart page →

16,365
act-runnergringolitoVerified publisher0.2.01 of 1See more

act-runner gringolito 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
gitea/act_runner:0.2.11-dind-rootless6120b1165f3a
golang.org/x/net@v0.27.0
stdlib@go1.22.7
0.60.0
1.26.9

Open the chart page →

3,238
loki-proxygroundcover0.1.11 of 1See more

loki-proxy groundcover 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
public.ecr.aws/groundcovercom/loki-proxy:0.1.1783d550ad813
golang.org/x/net@v0.0.0-20220127200216-cd36cc0744dd
stdlib@go1.17.13
0.60.0
1.26.9

Open the chart page →

3,091
routergroundcover1.13.604 of 7See more

router groundcover 1.13.60

4 of the 7 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
public.ecr.aws/groundcovercom/grafana-groundcover:v0.0.55-grafana11.3.77d261462727d
golang.org/x/net@v0.55.0
stdlib@go1.26.1
0.60.0
1.26.9
public.ecr.aws/groundcovercom/kong/kubernetes-ingress-controller:3.5.3-20260205bf9db911deed
golang.org/x/net@v0.47.0
stdlib@go1.25.7
0.60.0
1.26.9
public.ecr.aws/groundcovercom/postgres:18.1-20260208b7d7910c0bb0
stdlib@go1.25.7
1.26.9
quay.io/groundcover/tools:20260929e8a79ea4cf39
stdlib@go1.24.4
1.26.9

Open the chart page →

8,664
temporalgroundcover1.13.602 of 2See more

temporal groundcover 1.13.60

2 of the 2 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
public.ecr.aws/groundcovercom/temporalio/admin-tools:1.29.7-20260929-1f21c0eb520a9
golang.org/x/net@v0.55.0
stdlib@go1.26.8
0.60.0
1.26.9
public.ecr.aws/groundcovercom/temporalio/server:1.29.6-mini-20260702-170f191d0a80e
golang.org/x/net@v0.53.0
stdlib@go1.26.3
0.60.0
1.26.9

Open the chart page →

2,446
mysqlgroundhog2k3.1.41 of 1See more

mysql groundhog2k 3.1.4

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
library/mysql:9.7.2e2bde46db656
stdlib@go1.24.6
1.26.9

Open the chart page →

880
tailscale-subnet-routergtaylor1.2.11 of 1See more

tailscale-subnet-router gtaylor 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
ghcr.io/tailscale/tailscale:v1.34.1ce1862e6b3a5
golang.org/x/net@v0.1.0
stdlib@go1.19.2-ts3fd24dee31
0.60.0
1.26.9

Open the chart page →

2,722
minifluxhajowielandVerified publisher1.0.01 of 1See more

miniflux hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
ghcr.io/miniflux/miniflux:2.2.83a11ac10969e
golang.org/x/net@v0.39.0
stdlib@go1.24.2
0.60.0
1.26.9

Open the chart page →

1,880
hakoniwahakoniwa0.1.01 of 1See more

hakoniwa hakoniwa 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
ghcr.io/aplulu/hakoniwa:0.1.0accf0b921388
golang.org/x/net@v0.47.0
stdlib@go1.25.5
0.60.0
1.26.9

Open the chart page →

756
docker-authhalkeye0.1.11 of 1See more

docker-auth halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
cesanta/docker_auth:1.6.04d16885f3d4c
golang.org/x/net@v0.0.0-20190813141303-74dc4d7220e7
stdlib@go1.13.7
0.60.0
1.26.9

Open the chart page →

3,624
matrix-media-repohalkeye1.0.51 of 1See more

matrix-media-repo halkeye 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
turt2live/matrix-media-repo:v1.2.8bfbd459f89a5
golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110
stdlib@go1.16.3
0.60.0
1.26.9

Open the chart page →

5,753
mautrix-signalhalkeye0.3.01 of 2See more

mautrix-signal halkeye 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
signald/signald:0.23.2edbff058278c
stdlib@go1.18.10
1.26.9

Open the chart page →

2,394
thunderdome-planning-pokerhalkeye0.1.11 of 1See more

thunderdome-planning-poker halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
stevenweathers/thunderdome-planning-poker:latestc7eb7b10f186
golang.org/x/net@v0.52.0
stdlib@go1.26.4
0.60.0
1.26.9

Open the chart page →

768
whoamihalkeye1.0.11 of 1See more

whoami halkeye 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
containous/whoami:v1.5.07d6a3c8f9147
stdlib@go1.14
1.26.9

Open the chart page →

2,362
hcp-terraform-operatorhashicorpVerified publisher2.12.12 of 2See more

hcp-terraform-operator hashicorp 2.12.1

2 of the 2 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
hashicorp/hcp-terraform-operator:2.12.15a15932f6838
golang.org/x/net@v0.57.0
stdlib@go1.26.5
0.60.0
1.26.9
quay.io/brancz/kube-rbac-proxy:v0.20.1f5fbfec6a2b2
golang.org/x/net@v0.47.0
stdlib@go1.25.4
0.60.0
1.26.9

Open the chart page →

1,385
hatchet-apihatchetOfficialVerified publisher0.20.04 of 4See more

hatchet-api hatchet 0.20.0

4 of the 4 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
library/postgres:latest74935e722416
stdlib@go1.24.6
1.26.9
ghcr.io/hatchet-dev/hatchet/hatchet-admin:v0.110.57c233e606095
golang.org/x/net@v0.59.0
stdlib@go1.26.8
0.60.0
1.26.9
ghcr.io/hatchet-dev/hatchet/hatchet-api:v0.110.5be06a6b88299
golang.org/x/net@v0.59.0
stdlib@go1.26.8
0.60.0
1.26.9
ghcr.io/hatchet-dev/hatchet/hatchet-migrate:v0.110.5b2112d73f37a
stdlib@go1.26.8
1.26.9

Open the chart page →

2,420
hatchet-frontendhatchetOfficialVerified publisher0.20.01 of 1See more

hatchet-frontend hatchet 0.20.0

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
ghcr.io/hatchet-dev/hatchet/hatchet-frontend:v0.110.5136c6a29a81a
stdlib@go1.26.8
1.26.9

Open the chart page →

205
hatchet-hahatchetOfficialVerified publisher0.20.06 of 8See more

hatchet-ha hatchet 0.20.0

6 of the 8 container images this version deploys carry CVE-2026-78669.

Container imageDigestPackageFixed in
library/postgres:latest74935e722416
stdlib@go1.24.6
1.26.9
ghcr.io/hatchet-dev/hatchet/hatchet-admin:v0.110.57c233e606095
golang.org/x/net@v0.59.0
stdlib@go1.26.8
0.60.0
1.26.9
ghcr.io/hatchet-dev/hatchet/hatchet-api:v0.110.5be06a6b88299
golang.org/x/net@v0.59.0
stdlib@go1.26.8
0.60.0
1.26.9
ghcr.io/hatchet-dev/hatchet/hatchet-engine:v0.110.5185c4311d23f
golang.org/x/net@v0.59.0
stdlib@go1.26.8
0.60.0
1.26.9
ghcr.io/hatchet-dev/hatchet/hatchet-frontend:v0.110.5136c6a29a81a
stdlib@go1.26.8
1.26.9
ghcr.io/hatchet-dev/hatchet/hatchet-migrate:v0.110.5b2112d73f37a
stdlib@go1.26.8
1.26.9

Open the chart page →

9,498

Container images carrying it

6,250 by charts deploying them

A fixed version is listed for 2 of the 4 affected packages.

Container imageDigestPackageFixed inUsed by
hashicorp/vault:1.14.0b2177a8bfe85
golang.org/x/net@v0.10.0
stdlib@go1.20.5
0.60.0
1.26.9
1
hashicorp/vault:1.19.0bbb7f98dc67d
golang.org/x/net@v0.35.0
stdlib@go1.23.6
0.60.0
1.26.9
1
hashicorp/vault:latestc2f666266f38
golang.org/x/net@v0.59.0
stdlib@go1.26.8
0.60.0
1.26.9
1
hashicorp/vault:1.8.4dfc3500beb0e
golang.org/x/net@v0.0.0-20210510120150-4163338589ed
stdlib@go1.16.7
0.60.0
1.26.9
1
hashicorp/vault:1.9.2ff9b17b0cefe
golang.org/x/net@v0.0.0-20211020060615-d418f374d309
stdlib@go1.17.5
0.60.0
1.26.9
1
hashicorp/vault-k8s:1.6.2103a2d817a74
golang.org/x/net@v0.35.0
stdlib@go1.23.6
0.60.0
1.26.9
1
hashicorp/vault-k8s:1.2.14500e988b7ce
golang.org/x/net@v0.7.0
stdlib@go1.20.3
0.60.0
1.26.9
1
hashicorp/vault-k8s:0.6.05697b85bc69a
golang.org/x/net@v0.0.0-20190613194153-d28f0bde5980
stdlib@go1.13.5
0.60.0
1.26.9
1
hashicorp/vault-k8s:1.7.2ae3d307658b7
golang.org/x/net@v0.47.0
stdlib@go1.25.5
0.60.0
1.26.9
1
hashicorp/vault-k8s:0.14.0aff47b5ba39c
golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781
stdlib@go1.17.2
0.60.0
1.26.9
1
hashicorp/vault-secrets-operator:1.6.002a79a046037
golang.org/x/net@v0.59.0
stdlib@go1.27.1
0.60.0
1.27.2
1
hashicorp/waypoint:0.11.397d521a27498
golang.org/x/net@v0.1.0
stdlib@go1.19.4
0.60.0
1.26.9
1
hauler/hauler:2.1.13f36bf6bc92d
golang.org/x/net@v0.58.0
stdlib@go1.27.0-X:boringcrypto
0.60.0
1.27.2
1
hazelcast/hazelcast-platform-operator:5.20.0e10ca9d704b1
golang.org/x/net@v0.58.0
stdlib@go1.26.6
0.60.0
1.26.9
1
hbahadorzadeh/cert-manager-webhook-arvan:latestbf9756b3bc47
golang.org/x/net@v0.0.0-20200707034311-ab3426394381
stdlib@go1.15.6
0.60.0
1.26.9
1
headscale/headscale:0.25.1a7a8ae9616bb
golang.org/x/net@v0.34.0
stdlib@go1.23.4
0.60.0
1.26.9
1
headscale/headscale:0.27.1cd37b3001857
golang.org/x/net@v0.46.0
stdlib@go1.25.1
0.60.0
1.26.9
1
helga09/my_sql_shoes:v1.1.1a03657d97897
stdlib@go1.18.2
1.26.9
1
henrygd/beszel:latest6b39a8b64f9b
golang.org/x/net@v0.59.0
stdlib@go1.27.1
0.60.0
1.27.2
1
henrygd/beszel-agent:latestf27b1aa2c684
golang.org/x/net@v0.59.0
stdlib@go1.27.1
0.60.0
1.27.2
1
hetzner/cert-manager-webhook-hetzner:v0.9.0b64db89ba4c1
golang.org/x/net@v0.58.0
stdlib@go1.26.6
0.60.0
1.26.9
1
hetznercloud/hcloud-cloud-controller-manager:v1.16.08c07e6d7a76c
golang.org/x/net@v0.11.0
stdlib@go1.20.5
0.60.0
1.26.9
1
hetznercloud/hcloud-cloud-controller-manager:v1.13.0ed5ee5f83973
golang.org/x/net@v0.0.0-20220225172249-27dd8689420f
stdlib@go1.19
0.60.0
1.26.9
1
hetznercloud/hcloud-csi-driver:1.6.01475d525f9a4
golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7
stdlib@go1.17
0.60.0
1.26.9
1
hetznercloud/hcloud-csi-driver:1.5.141dce5b33644
golang.org/x/net@v0.0.0-20201010224723-4f7140c49acb
stdlib@go1.15.3
0.60.0
1.26.9
1
hetznercloud/hcloud-csi-driver:v2.3.2b7ed90d5fab2
golang.org/x/net@v0.7.0
stdlib@go1.19.7
0.60.0
1.26.9
1
hfoxy4/kubefaas-builder:main-2afc7570bfb65aaad93
golang.org/x/net@v0.26.0
stdlib@go1.21.11
0.60.0
1.26.9
1
hfoxy4/kubefaas-controller:main-2afc7570761fe08f14c
golang.org/x/net@v0.26.0
stdlib@go1.22.4
0.60.0
1.26.9
1
hfoxy4/tapo-prometheus-exporter:v0.1.117e385eef6fc7
stdlib@go1.21.3
1.26.9
1
hhaluk/mocktail:2.0.3350d19360038
stdlib@go1.17.7
1.26.9
1
hhyo/archery:v1.9.11aa41843419e
golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b
stdlib@go1.15.6
0.60.0
1.26.9
1
hibiken/asynqmon:latestac80bcffd2f9
stdlib@go1.18.10
1.26.9
1
hipages/php-fpm_exporter:2.2.09b5be9d3d955
stdlib@go1.17.10
1.26.9
1
hivemq/hivemq-platform-operator:2.2.2a919f990141b
stdlib@go1.26.5
1.26.9
1
hivemq/hivemq-swarm:4.56.08d5f6a6f48b0
stdlib@go1.26.7
1.26.9
1
hiversh/antigravity:0.1.45-microvm0e36d98402bc
golang.org/x/net@v0.56.0
stdlib@go1.26.5
0.60.0
1.26.9
1
hiversh/browser:0.1.45-microvmb5048c6342ce
golang.org/x/net@v0.56.0
stdlib@go1.26.5
0.60.0
1.26.9
1
hiversh/claude:0.1.45-microvm2fbf9f264498
golang.org/x/net@v0.56.0
stdlib@go1.26.5
0.60.0
1.26.9
1
hiversh/codex:0.1.45-microvm4f43130f51e5
golang.org/x/net@v0.56.0
stdlib@go1.26.5
0.60.0
1.26.9
1
hiversh/controller:0.1.45b0b85f8942c7
golang.org/x/net@v0.56.0
stdlib@go1.19.8
0.60.0
1.26.9
1
hiversh/copilot:0.1.45-microvm50c07b84f298
golang.org/x/net@v0.56.0
stdlib@go1.26.5
0.60.0
1.26.9
1
hiversh/node:0.1.45-alpine-microvm836a37641941
golang.org/x/net@v0.56.0
stdlib@go1.26.5
0.60.0
1.26.9
1
hiversh/openclaw:0.1.45-microvm958b7ebb4eb4
golang.org/x/net@v0.56.0
stdlib@go1.19.8
0.60.0
1.26.9
1
hiversh/python:0.1.45-3.13-alpine-microvm63a5ae179a9f
golang.org/x/net@v0.56.0
stdlib@go1.19.8
0.60.0
1.26.9
1
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
golang.org/x/net@v0.0.0-20210913180222-943fd674d43e
stdlib@go1.17.10
0.60.0
1.26.9
1
holiman/nodemonitor:latest5cd609761065
golang.org/x/net@v0.9.0
stdlib@go1.20.3
0.60.0
1.26.9
1
holoinsight/agent:latest5c3994e742f8
golang.org/x/net@v0.5.0
stdlib@go1.22.1
0.60.0
1.26.9
1
holoinsight/otelcontribcol:latest42ba8dc3113c
golang.org/x/net@v0.8.0
stdlib@go1.19
0.60.0
1.26.9
1
homeassistant/home-assistant:2023.10.3021e2afc6e57
stdlib@go1.17.1
1.26.9
1
homeassistant/home-assistant:2022.3.5565751f33794
stdlib@go1.17.1
1.26.9
1

syft 1.42.1 · advisories as of 12 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.