CVE-2026-78669

High

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.006; 46th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,266; of 18,137 indexed, latest versions
Container images: 6,090; deployed by those charts
Fix available: 3 of 5; affected packages

Excessive CPU consumption from repeated initial window changes in net/http

Carried by container images the latest versions of 5,266 of 18,137 indexed charts deploy, on 6,090 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+208 more	1.26.9, 1.27.2	6,023
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more	0.60.0	4,869
golang-1.19deb	1.19.8-2	no fix listed	1
ingress-nginx-controller-1.15apk	1.15.10-r9	no fix listed	1
minioapk	0.20251015.172955-r10	0.20260922.192518-r2	1

OSV records: CGA-9p37-4f4r-46f6 CGA-w6c4-5355-g6w8 DEBIAN-CVE-2026-78669 GO-2026-6611
Also known as: CGA-w74x-3c39-v8mc, CGA-wgrx-6q33-q8q4
Trending: Rank 4 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,266 by stars

Chart

Latest

Affected images

Radar Score

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-78669.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	golang.org/x/net@v0.0.0-20220325170049-de3da57026de stdlib@go1.18.1	0.60.0 1.26.9

Open the chart page →

2,983

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-78669.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.17.8	0.60.0 1.26.9
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.17.9	0.60.0 1.26.9
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	golang.org/x/net@v0.0.0-20210316092652-d523dce5a7f4 stdlib@go1.16	0.60.0 1.26.9
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	golang.org/x/net@v0.0.0-20210316092652-d523dce5a7f4 stdlib@go1.16	0.60.0 1.26.9

Open the chart page →

12,453

nginx-vts-exporterymrs

0.1.2

1 of 1 See more

nginx-vts-exporter ymrs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container image	Digest	Package	Fixed in
sophos/nginx-vts-exporter :latest	f1073556b29b	stdlib@go1.13.6	1.26.9

Open the chart page →

2,469

version-checkerymrs

0.2.3

1 of 1 See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container image	Digest	Package	Fixed in
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.15.2	0.60.0 1.26.9

Open the chart page →

4,257

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-78669.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	b28bae15e219	golang.org/x/net@v0.58.0 stdlib@go1.26.7	0.60.0 1.26.9
quay.io/prometheus/alertmanager :latest	e9733bafb1bd	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9
quay.io/prometheus/prometheus :latest	efd719c99d83	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

863

ical-filter-proxyyungwood

0.3.1

1 of 1 See more

ical-filter-proxy yungwood 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container image	Digest	Package	Fixed in
yungwood/ical-filter-proxy :0.3.1	ddc3f30ab05f	stdlib@go1.26.5	1.26.9

Open the chart page →

259

synergy-wholesale-exporteryungwood

0.1.1

1 of 1 See more

synergy-wholesale-exporter yungwood 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container image	Digest	Package	Fixed in
yungwood/synergy-wholesale-exporter :0.1.1	054dce85989b	stdlib@go1.26.5	1.26.9

Open the chart page →

259

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-78669.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	golang.org/x/net@v0.8.0 stdlib@go1.20.4	0.60.0 1.26.9
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	golang.org/x/net@v0.7.0 stdlib@go1.20.4	0.60.0 1.26.9

Open the chart page →

6,689

zahori-moonzahori

1.0.1

3 of 3 See more

zahori-moon zahori 1.0.1

3 of the 3 container images this version deploys carry CVE-2026-78669.

Container image	Digest	Package	Fixed in
quay.io/aerokube/moon :2.5.1	a8837b00ba1c	golang.org/x/net@v0.7.0 stdlib@go1.20.4	0.60.0 1.26.9
quay.io/aerokube/moon-conf :2.5.1	9ca307b30080	golang.org/x/net@v0.7.0 stdlib@go1.20.4	0.60.0 1.26.9
quay.io/aerokube/moon-ui :2.0.5	89990b146824	golang.org/x/net@v0.11.0 stdlib@go1.20.5	0.60.0 1.26.9

Open the chart page →

5,024

zahori-schedulerzahori

1.0.1

1 of 1 See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-scheduler :1.0.0	47d0979b1184	stdlib@go1.20.5	1.26.9

Open the chart page →

3,118

jenkinszanise-jenkins-helm-chart

0.1.0

1 of 1 See more

jenkins zanise-jenkins-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container image	Digest	Package	Fixed in
jenkins/jenkins :lts	a660310e39ad	golang.org/x/net@v0.57.0 stdlib@go1.27.0	0.60.0 1.27.2

Open the chart page →

2,194

posthogzeet

0.23.2

2 of 9 See more

posthog zeet 0.23.2

2 of the 9 container images this version deploys carry CVE-2026-78669.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	golang.org/x/net@v0.0.0-20210525063256-abc453219eb5 stdlib@go1.17.13	0.60.0 1.26.9
altinity/metrics-exporter :latest	a5206c713de7	golang.org/x/net@v0.56.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

4,829

endlessh-gozekker6

0.4.0

1 of 1 See more

endlessh-go zekker6 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container image	Digest	Package	Fixed in
ghcr.io/shizunge/endlessh-go :2026.0730.0	8826dad32623	stdlib@go1.26.5	1.26.9

Open the chart page →

827

karmazekker6

0.22.0

1 of 1 See more

karma zekker6 0.22.0

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container image	Digest	Package	Fixed in
lmierzwa/karma :v0.133	f5d0a0ff4062	stdlib@go1.27.1	1.27.2

Open the chart page →

148

zookeeper-exporterzookeeper-exporter

0.1.0

1 of 1 See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-78669.

Container image	Digest	Package	Fixed in
dabealu/zookeeper-exporter :latest	86106fec315f	stdlib@go1.14.15	1.26.9

Open the chart page →

2,294

zoo-project-druzoo-project

0.10.9

2 of 6 See more

zoo-project-dru zoo-project 0.10.9

2 of the 6 container images this version deploys carry CVE-2026-78669.

Container image	Digest	Package	Fixed in
library/postgres :18.6-alpine3.24	77f585114c32	stdlib@go1.24.6	1.26.9
zooproject/zoo-project :dru-51e7d55383f24594959b69e58518961c6aa66740	da112e8d03f1	golang.org/x/net@v0.57.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

7,302

Container images carrying it

6,090 by charts deploying them

A fixed version is listed for 3 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
gcr.io/kasten-images/crypto :9.0.7	6c6b6d9af1d4	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
gcr.io/kasten-images/dashboardbff :9.0.7	1a8b1ccfc402	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
gcr.io/kasten-images/events :9.0.7	e7beb79514f9	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
gcr.io/kasten-images/executor :9.0.7	4fe7419cecd9	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
gcr.io/kasten-images/garbagecollector :9.0.7	4dfd4a2dae57	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
gcr.io/kasten-images/gateway :9.0.7	6f14d4acd0c5	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
gcr.io/kasten-images/jobs :9.0.7	a093d080604f	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
gcr.io/kasten-images/kanister :9.0.7	03d05d517803	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
gcr.io/kasten-images/kanister-tools :9.0.7	9778af80396e	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
gcr.io/kasten-images/logging :9.0.7	e41747f4a3c3	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
gcr.io/kasten-images/metering :9.0.7	209e1aaee219	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
gcr.io/kasten-images/prometheus :9.0.7	93bdb766db72	golang.org/x/net@v0.56.0 stdlib@go1.27.1	0.60.0 1.27.2	1
gcr.io/kasten-images/repositories :9.0.7	5c5435aea185	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
gcr.io/kasten-images/restorectl :8.0.14	5a0884f9a90c	golang.org/x/net@v0.47.0 stdlib@go1.25.4	0.60.0 1.26.9	1
gcr.io/kasten-images/state :9.0.7	c4bfd7feb74a	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
gcr.io/kasten-images/upgrade :9.0.7	b2447f8bc553	stdlib@go1.27.1	1.27.2	1
gcr.io/kasten-images/vbrintegrationapi :9.0.7	85e432303eff	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
gcr.io/knative-releases/knative.dev/eventing/cmd/broker/filter	d675f211a40f	golang.org/x/net@v0.30.0 stdlib@go1.22.8	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/eventing/cmd/broker/ingress	ec4b544499ba	golang.org/x/net@v0.30.0 stdlib@go1.22.8	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/eventing/cmd/mtchannel_broker	395f4ff1bd34	golang.org/x/net@v0.30.0 stdlib@go1.22.8	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/net-certmanager/cmd/webhook	873b968f02b5	golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e stdlib@go1.14.2	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/controller :v1.13.1	a5b041ba3c9e	golang.org/x/net@v0.20.0 stdlib@go1.21.5	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/controller	e70bc675f977	golang.org/x/net@v0.30.0 stdlib@go1.22.8	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/controller :v1.2.0	f253b82941c2	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.17.6	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhook	7d76a6d42d13	golang.org/x/net@v0.30.0 stdlib@go1.22.8	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhook :v1.2.0	a705c1ea8e9e	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.17.6	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/net-istio/cmd/webhook :v1.13.1	f066376eee17	golang.org/x/net@v0.20.0 stdlib@go1.21.5	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier	15a601147ef4	golang.org/x/net@v0.39.0 stdlib@go1.24.2	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier	197fbb71d1f1	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.3	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/operator/cmd/operator :v1.22.3	733f21dc06f9	golang.org/x/net@v0.53.0 stdlib@go1.26.4	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/operator/cmd/webhook :v1.22.3	66ae76179a80	golang.org/x/net@v0.53.0 stdlib@go1.26.4	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/operator/cmd/webhook	6c5c90cdf707	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.19.5	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator	08315309da4b	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.3	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator	1e3db4f2eeed	golang.org/x/net@v0.0.0-20200904194848-62affa334b73 stdlib@go1.14.10	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator :v1.13.1	21f8e11a44bf	golang.org/x/net@v0.20.0 stdlib@go1.21.5	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator :v1.2.5	93ff6e693577	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.17.8	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator	a5de0fb75046	golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e stdlib@go1.14.2	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/serving/cmd/activator :v1.10.2	c2994c2b6c2c	golang.org/x/net@v0.7.0 stdlib@go1.20.4	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler :v1.2.5	007820fdb75b	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.17.8	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler	105bdd14ecaa	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.18.3	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler	2ef460356b17	golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e stdlib@go1.14.2	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler :v1.13.1	34796e9f760b	golang.org/x/net@v0.20.0 stdlib@go1.21.5	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler :v1.10.2	8319aa662b49	golang.org/x/net@v0.7.0 stdlib@go1.20.4	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler	db6ceff2aab4	golang.org/x/net@v0.0.0-20200904194848-62affa334b73 stdlib@go1.14.10	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler-hpa :v1.10.2	eb612b929eaa	golang.org/x/net@v0.7.0 stdlib@go1.20.4	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller	30ce73388ae5	golang.org/x/net@v0.0.0-20200324143707-d3edc9973b7e stdlib@go1.14.2	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller :v1.13.1	53d9aa4d2c7a	golang.org/x/net@v0.20.0 stdlib@go1.21.5	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller :v1.2.5	75cfdcfa050a	golang.org/x/net@v0.0.0-20220225172249-27dd8689420f stdlib@go1.17.8	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller :v1.10.2	98a2cc7fd62e	golang.org/x/net@v0.7.0 stdlib@go1.20.4	0.60.0 1.26.9	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller	b2cd45b8a8a4	golang.org/x/net@v0.0.0-20200904194848-62affa334b73 stdlib@go1.14.10	0.60.0 1.26.9	1