CVE-2026-97032

Medium

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026

Severity: Medium; worst across findings
CVSS: 5.5; base score, highest
EPSS: 0.002; 7th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 5,373; of 18,117 indexed, latest versions
Container images: 6,208; deployed by those charts
Fix available: 3 of 5; affected packages

HTTP/2 server crash due to HPACK encoder race in net/http

Carried by container images the latest versions of 5,373 of 18,117 indexed charts deploy, on 6,208 images.

Affected package	Affected versions	Fixed in	Images
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+212 more	1.26.9, 1.27.2	6,150
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+227 more	0.60.0	4,957
golang-1.19deb	1.19.8-2	no fix listed	1
ingress-nginx-controller-1.15apk	1.15.10-r9	no fix listed	1
minioapk	0.20251015.172955-r10	0.20260922.192518-r2	1

OSV records: CGA-354m-9r4m-xqmm CGA-387c-5f4p-4rh4 DEBIAN-CVE-2026-97032 GO-2026-6617
Also known as: CGA-4qpc-rjrp-f4h4, CGA-chcq-vrg9-rm7r
Trending: Rank 11 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

5,373 by stars

Chart

Latest

Affected images

Radar Score

geonetwork-k8sgeonetwork-k8s

4.2.8

2 of 5 See more

geonetwork-k8s geonetwork-k8s 4.2.8

2 of the 5 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
geonetwork/gn-cloud-ogc-api-records-service :4.2.8-0	20c9bb761f67	golang.org/x/net@v0.11.0 stdlib@go1.19.11	0.60.0 1.26.9
postgis/postgis :11-2.5	f479f6c3435e	stdlib@go1.16.7	1.26.9

Open the chart page →

38,273

istiogetindata

1.11.1

2 of 2 See more

istio getindata 1.11.1

2 of the 2 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
gcr.io/istio-release/pilot :1.11.1	c552478f8f11	golang.org/x/net@v0.0.0-20210525063256-abc453219eb5 stdlib@go1.16.7	0.60.0 1.26.9
gcr.io/istio-release/proxyv2 :1.11.1	9538fabe49fd	golang.org/x/net@v0.0.0-20210525063256-abc453219eb5 stdlib@go1.16.7	0.60.0 1.26.9

Open the chart page →

19,693

ghostghost

0.1.0

3 of 4 See more

ghost ghost 0.1.0

3 of the 4 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
cloudflare/cloudflared :latest	9b49eed8f628	golang.org/x/net@v0.58.0 stdlib@go1.26.8	0.60.0 1.26.9
library/ghost :5.79.0	83f7bf209844	stdlib@go1.18.2	1.26.9
litestream/litestream :0.3	c5a1e1b01916	golang.org/x/net@v0.14.0 stdlib@go1.21.3	0.60.0 1.26.9

Open the chart page →

11,261

rabbitmqginger-society

0.1.0

2 of 2 See more

rabbitmq ginger-society 0.1.0

2 of the 2 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
kbudde/rabbitmq-exporter :latest	12f27d6d84e6	stdlib@go1.21.8	1.26.9
library/rabbitmq :4-management	8dd6e3570dda	stdlib@go1.22.2	1.26.9

Open the chart page →

2,345

gitanagitana

1.4.0

1 of 1 See more

gitana gitana 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
ntakashi/gitana :1.4.0	4171ec641120	golang.org/x/net@v0.0.0-20210929161516-d455829e376d stdlib@go1.17.7	0.60.0 1.26.9

Open the chart page →

5,807

github-rate-limits-prometheus-exportergithub-rate-limit-prometheus-exporter

0.2.15

1 of 1 See more

github-rate-limits-prometheus-exporter github-rate-limit-prometheus-exporter 0.2.15

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
ghcr.io/kalgurn/grl-exporter :v3.2.0	bd109b2bda38	stdlib@go1.23.5	1.26.9

Open the chart page →

1,336

gitlab-goproxygitlab-goproxy

0.2.2

1 of 1 See more

gitlab-goproxy gitlab-goproxy 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
ghcr.io/djcass44/gitlab-goproxy :v0.1.8	a43323732181	golang.org/x/net@v0.10.0 stdlib@go1.21.0	0.60.0 1.26.9

Open the chart page →

2,060

gitlab-mr-conformgitlab-mr-conform

0.6.0

1 of 1 See more

gitlab-mr-conform gitlab-mr-conform 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
ghcr.io/chrxmvtik/gitlab-mr-conform :0.6.0	facdb9bf0394	golang.org/x/net@v0.51.0 stdlib@go1.25.9	0.60.0 1.26.9

Open the chart page →

798

apid-helpergkarthiks

0.1.4

1 of 1 See more

apid-helper gkarthiks 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
quay.io/gkarthics/apid-helper :v0.2.3	d7d93debf1f4	golang.org/x/net@v0.11.0 stdlib@go1.19.12	0.60.0 1.26.9

Open the chart page →

3,348

prometheus-container-resource-exportergkarthiks

0.3.1

1 of 1 See more

prometheus-container-resource-exporter gkarthiks 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
gkarthics/container-resource-exporter :latest	6799af333e8a	golang.org/x/net@v0.0.0-20191004110552-13f9640d40b9 stdlib@go1.14.7	0.60.0 1.26.9

Open the chart page →

3,466

prometheus-couchdb-exportergkarthiks

0.1.3

1 of 1 See more

prometheus-couchdb-exporter gkarthiks 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
gesellix/couchdb-prometheus-exporter :v27.2.0	5b891f1fc2b9	stdlib@go1.13.10	1.26.9

Open the chart page →

2,366

glassflow-etlglassflow

0.5.21

11 of 16 See more

glassflow-etl glassflow 0.5.21

11 of the 16 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
bitnami/kubectl :latest	f7f9e4f64d9e	golang.org/x/net@v0.57.0 stdlib@go1.26.8	0.60.0 1.26.9
library/nats :2.12.3-alpine	88fe8e0e09d6	stdlib@go1.25.5	1.26.9
library/postgres :17-alpine	b0f9560a2de0	stdlib@go1.24.6	1.26.9
natsio/nats-box :0.19.2	8031d190c7ee	golang.org/x/net@v0.44.0 stdlib@go1.25.2	0.60.0 1.26.9
natsio/nats-server-config-reloader :0.21.1	10ff229eaf52	stdlib@go1.25.5	1.26.9
natsio/prometheus-nats-exporter :0.17.3	26c826662ac8	stdlib@go1.24.2	1.26.9
otel/opentelemetry-collector-contrib :0.108.0	923eb1cfae32	golang.org/x/net@v0.28.0 stdlib@go1.23.0	0.60.0 1.26.9
ghcr.io/glassflow/glassflow-etl-be :v3.2.0	20f066d0f631	golang.org/x/net@v0.52.0 stdlib@go1.25.0	0.60.0 1.26.9
ghcr.io/glassflow/glassflow-etl-k8s-operator :v3.2.1	e70364e88629	golang.org/x/net@v0.43.0 stdlib@go1.25.0	0.60.0 1.26.9
ghcr.io/glassflow/glassflow-etl-migration :v3.2.0	7db1a1bf3dae	golang.org/x/net@v0.47.0 stdlib@go1.25.4	0.60.0 1.26.9
ghcr.io/glassflow/kafka-kerberos-gateway :latest	2ae01c524a6e	stdlib@go1.21.13	1.26.9

Open the chart page →

17,380

pgbouncerglassflow

0.1.0

1 of 1 See more

pgbouncer glassflow 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
bitnamilegacy/pgbouncer :1.23.1	92356da09704	stdlib@go1.22.10	1.26.9

Open the chart page →

4,006

postgresqlglassflow

0.1.9

1 of 1 See more

postgresql glassflow 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
library/postgres :17-alpine	b0f9560a2de0	stdlib@go1.24.6	1.26.9

Open the chart page →

703

glassflow-operatorglassflow-operator

0.8.5

2 of 3 See more

glassflow-operator glassflow-operator 0.8.5

2 of the 3 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
bitnami/kubectl :latest	f7f9e4f64d9e	golang.org/x/net@v0.57.0 stdlib@go1.26.8	0.60.0 1.26.9
ghcr.io/glassflow/glassflow-etl-k8s-operator :v3.2.1	e70364e88629	golang.org/x/net@v0.43.0 stdlib@go1.25.0	0.60.0 1.26.9

Open the chart page →

1,501

glauthglauth

0.3.17

1 of 2 See more

glauth glauth 0.3.17

1 of the 2 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
ghcr.io/nnstd/glauth :2.5	2e6e09fa77dd	golang.org/x/net@v0.41.0 stdlib@go1.24.5	0.60.0 1.26.9

Open the chart page →

3,454

gliderglider

0.1.5

1 of 1 See more

glider glider 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
nadoo/glider :0.16	38aadefbd607	golang.org/x/net@v0.28.0 stdlib@go1.20.14	0.60.0 1.26.9

Open the chart page →

1,534

glpiglpi-chart

0.1.1

1 of 3 See more

glpi glpi-chart 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
library/mariadb :latest	f1bba652ba57	stdlib@go1.26.7	1.26.9

Open the chart page →

13,115

gnp-stackgnp-stack

0.0.5

11 of 14 See more

gnp-stack gnp-stack 0.0.5

11 of the 14 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
grafana/grafana :12.2.1	35c41e0fd029	golang.org/x/net@v0.45.0 stdlib@go1.25.3	0.60.0 1.26.9
library/nats :2.12.1-alpine	b3f2bd84176a	stdlib@go1.25.3	1.26.9
natsio/nats-box :0.19.2	8031d190c7ee	golang.org/x/net@v0.44.0 stdlib@go1.25.2	0.60.0 1.26.9
natsio/nats-server-config-reloader :0.20.1	47094fcae2f4	stdlib@go1.24.8	1.26.9
natsio/prometheus-nats-exporter :0.17.3	26c826662ac8	stdlib@go1.24.2	1.26.9
rancher/local-path-provisioner :v0.0.32	9289da488b07	golang.org/x/net@v0.38.0 stdlib@go1.24.4	0.60.0 1.26.9
ghcr.io/openconfig/gnmic :0.45.0	d422a9ebd4a2	golang.org/x/net@v0.50.0 stdlib@go1.24.12	0.60.0 1.26.9
quay.io/prometheus-operator/prometheus-operator :v0.85.0	890b3bb05cf4	golang.org/x/net@v0.43.0 stdlib@go1.24.6	0.60.0 1.26.9
quay.io/prometheus/node-exporter :v1.9.1	d00a542e409e	golang.org/x/net@v0.37.0 stdlib@go1.23.7	0.60.0 1.26.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v1.6.3	3d671cf20a35	golang.org/x/net@v0.44.0 stdlib@go1.25.1	0.60.0 1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.17.0	2bbc91556733	golang.org/x/net@v0.41.0 stdlib@go1.24.6	0.60.0 1.26.9

Open the chart page →

18,647

go-app-helmgo-app-helm

0.1.0

1 of 1 See more

go-app-helm go-app-helm 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
manojchaulagain/go-k8s :0.1.0	f237b5f637ae	stdlib@go1.20.1	1.26.9

Open the chart page →

2,874

go-file-servergo-file-server

1.0.0

1 of 2 See more

go-file-server go-file-server 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
goccx/go-file-server :latest	f4b3ebea0303	golang.org/x/net@v0.27.0 stdlib@go1.21.10	0.60.0 1.26.9

Open the chart page →

2,872

gofitgofit

0.0.1

1 of 1 See more

gofit gofit 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
ghcr.io/bamaas/gofit :0.0.1	32b6a174b419	stdlib@go1.22.11	1.26.9

Open the chart page →

1,065

goldpingergoldpinger

1.2.0

1 of 1 See more

goldpinger goldpinger 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
bloomberg/goldpinger :3.11.5	f7c60d319150	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

209

googly-logingoogly-login

0.1.0

1 of 2 See more

googly-login googly-login 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
library/postgres :16	65b16a8b326e	stdlib@go1.24.6	1.26.9

Open the chart page →

1,806

gorsegorse-io

0.4.2

3 of 4 See more

gorse gorse-io 0.4.2

3 of the 4 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
zhenghaoz/gorse-master :0.4.12	033046b432ec	golang.org/x/net@v0.7.0 stdlib@go1.20.1	0.60.0 1.26.9
zhenghaoz/gorse-server :0.4.12	39c565685b01	golang.org/x/net@v0.7.0 stdlib@go1.20.1	0.60.0 1.26.9
zhenghaoz/gorse-worker :0.4.12	f7739f64c9b0	golang.org/x/net@v0.7.0 stdlib@go1.20.1	0.60.0 1.26.9

Open the chart page →

6,830

gosmee-clientgosmee-client

0.1.3

1 of 1 See more

gosmee-client gosmee-client 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
ghcr.io/chmouel/gosmee :v0.32.0	60b8db1f68cc	golang.org/x/net@v0.55.0 stdlib@go1.26.5	0.60.0 1.26.9

Open the chart page →

630

gotwaygotway

0.8.0

1 of 1 See more

gotway gotway 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
ghcr.io/gotway/gotway :v0.0.13	7ed73c1979ee	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.18.3	0.60.0 1.26.9

Open the chart page →

2,811

Governify-Bluejaygovernify

0.1.0

2 of 12 See more

Governify-Bluejay governify 0.1.0

2 of the 12 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
governify/dashboard :latest	e83a17ba5038	golang.org/x/net@v0.0.0-20210726213435-c6fcb2dbf985 stdlib@go1.17	0.60.0 1.26.9
library/mongo :latest	bac22ea7710d	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9

Open the chart page →

24,266

Governify-Falcongovernify

0.1.0

3 of 10 See more

Governify-Falcon governify 0.1.0

3 of the 10 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
governify/dashboard :latest	e83a17ba5038	golang.org/x/net@v0.0.0-20210726213435-c6fcb2dbf985 stdlib@go1.17	0.60.0 1.26.9
library/mongo :latest	bac22ea7710d	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9
quay.io/prometheus/prometheus :latest	efd719c99d83	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

26,687

goweeklygoweekly

2.0.0

1 of 1 See more

goweekly goweekly 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
zufardhiyaulhaq/goweekly :v2.0.0	08dcc130fbea	golang.org/x/net@v0.0.0-20220520000938-2e3eb7b945c2 stdlib@go1.17.12	0.60.0 1.26.9

Open the chart page →

2,126

harborgpg-dev

1.18.3

5 of 8 See more

harbor gpg-dev 1.18.3

5 of the 8 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
goharbor/harbor-core :v2.14.3	a30e5a8be3d9	golang.org/x/net@v0.47.0 stdlib@go1.24.13	0.60.0 1.26.9
goharbor/harbor-jobservice :v2.14.3	e2b0298e894d	golang.org/x/net@v0.47.0 stdlib@go1.24.13	0.60.0 1.26.9
goharbor/harbor-registryctl :v2.14.3	ddf6bb429eb6	golang.org/x/net@v0.47.0 stdlib@go1.24.13	0.60.0 1.26.9
goharbor/registry-photon :v2.14.3	6533fc396cbc	stdlib@go1.24.13	1.26.9
goharbor/trivy-adapter-photon :v2.14.3	5c6f7162804c	golang.org/x/net@v0.28.0 stdlib@go1.25.7	0.60.0 1.26.9

Open the chart page →

5,507

ingress-nginxgpg-dev

4.9.0

2 of 2 See more

ingress-nginx gpg-dev 4.9.0

2 of the 2 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
registry.k8s.io/ingress-nginx/controller :v1.9.5	b3aba22b1da8	golang.org/x/net@v0.17.0 stdlib@go1.21.5	0.60.0 1.26.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v20231011-8b53cabe0	a7943503b45d	golang.org/x/net@v0.16.0 stdlib@go1.21.3	0.60.0 1.26.9

Open the chart page →

3,222

jaegergpg-dev

3.3.3

4 of 5 See more

jaeger gpg-dev 3.3.3

4 of the 5 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-agent :1.53.0	0214a0ef24b1	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.60.0 1.26.9
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	stdlib@go1.18.2	1.26.9
jaegertracing/jaeger-collector :1.53.0	7f1269222903	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.60.0 1.26.9
jaegertracing/jaeger-query :1.53.0	049bb0d64ea3	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.60.0 1.26.9

Open the chart page →

22,255

kube-prometheus-stackgpg-dev

84.0.0

5 of 6 See more

kube-prometheus-stack gpg-dev 84.0.0

5 of the 6 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
grafana/grafana :13.0.1	0f86bada30d6	golang.org/x/net@v0.52.0 stdlib@go1.26.0	0.60.0 1.26.9
ghcr.io/jkroepke/kube-webhook-certgen :1.8.1	4f6da0256b1b	golang.org/x/net@v0.53.0 stdlib@go1.26.2	0.60.0 1.26.9
quay.io/prometheus-operator/prometheus-operator :v0.90.1	52a6a92d915e	golang.org/x/net@v0.52.0 stdlib@go1.25.8	0.60.0 1.26.9
quay.io/prometheus/node-exporter :v1.11.1	0f422f62c15f	golang.org/x/net@v0.52.0 stdlib@go1.26.1	0.60.0 1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.18.0	1545919b72e3	golang.org/x/net@v0.48.0 stdlib@go1.25.5	0.60.0 1.26.9

Open the chart page →

5,450

kubernetes-dashboardgpg-dev

7.5.0

4 of 5 See more

kubernetes-dashboard gpg-dev 7.5.0

4 of the 5 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
kubernetesui/dashboard-api :1.7.0	60595892c2cf	golang.org/x/net@v0.25.0 stdlib@go1.22.3	0.60.0 1.26.9
kubernetesui/dashboard-auth :1.1.3	07135c09e9ff	golang.org/x/net@v0.22.0 stdlib@go1.22.2	0.60.0 1.26.9
kubernetesui/dashboard-metrics-scraper :1.1.1	7747d363c9fe	golang.org/x/net@v0.21.0 stdlib@go1.22.1	0.60.0 1.26.9
kubernetesui/dashboard-web :1.4.0	4445b31a2c25	golang.org/x/net@v0.25.0 stdlib@go1.22.3	0.60.0 1.26.9

Open the chart page →

7,915

metrics-servergpg-dev

3.12.1

1 of 1 See more

metrics-server gpg-dev 3.12.1

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
registry.k8s.io/metrics-server/metrics-server :v0.7.1	db3800085a09	golang.org/x/net@v0.20.0 stdlib@go1.21.8	0.60.0 1.26.9

Open the chart page →

1,539

opentelemetry-demogpg-dev

0.33.8

8 of 27 See more

opentelemetry-demo gpg-dev 0.33.8

8 of the 27 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
grafana/grafana :11.3.1	fa801ab6e1ae	golang.org/x/net@v0.29.0 stdlib@go1.23.1	0.60.0 1.26.9
jaegertracing/all-in-one :1.53.0	60e65bfffe1f	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.60.0 1.26.9
otel/opentelemetry-collector-contrib :0.114.0	37fa87091cfa	golang.org/x/net@v0.31.0 stdlib@go1.23.3	0.60.0 1.26.9
ghcr.io/open-feature/flagd :v0.11.1	a7ea52f87446	golang.org/x/net@v0.27.0 stdlib@go1.22.5	0.60.0 1.26.9
ghcr.io/open-telemetry/demo :1.12.0-productcatalogservice	008b9b662289	golang.org/x/net@v0.25.0 stdlib@go1.22.8	0.60.0 1.26.9
ghcr.io/open-telemetry/demo :1.12.0-checkoutservice	380eccdc29e9	golang.org/x/net@v0.25.0 stdlib@go1.22.8	0.60.0 1.26.9
ghcr.io/open-telemetry/demo :1.12.0-shippingservice	a3ca4c02a5df	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.60.0 1.26.9
quay.io/prometheus/prometheus :v3.0.0	3b9b2a15d376	golang.org/x/net@v0.30.0 stdlib@go1.23.3	0.60.0 1.26.9

Open the chart page →

58,805

prometheusgpg-dev

29.2.1

6 of 6 See more

prometheus gpg-dev 29.2.1

6 of the 6 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
quay.io/prometheus-operator/prometheus-config-reloader :v0.90.1	693faa0b8724	golang.org/x/net@v0.52.0 stdlib@go1.25.8	0.60.0 1.26.9
quay.io/prometheus/alertmanager :v0.32.0	58e117eabcce	golang.org/x/net@v0.52.0 stdlib@go1.26.2	0.60.0 1.26.9
quay.io/prometheus/node-exporter :v1.11.1	0f422f62c15f	golang.org/x/net@v0.52.0 stdlib@go1.26.1	0.60.0 1.26.9
quay.io/prometheus/prometheus :v3.11.2	cd37346c9745	golang.org/x/net@v0.52.0 stdlib@go1.26.2	0.60.0 1.26.9
quay.io/prometheus/pushgateway :v1.11.2	49ed9fdf3780	golang.org/x/net@v0.46.0 stdlib@go1.25.3	0.60.0 1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.18.0	1545919b72e3	golang.org/x/net@v0.48.0 stdlib@go1.25.5	0.60.0 1.26.9

Open the chart page →

5,747

prometheus-operator-admission-webhookgpg-dev

0.18.1

2 of 2 See more

prometheus-operator-admission-webhook gpg-dev 0.18.1

2 of the 2 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
quay.io/prometheus-operator/admission-webhook :v0.79.2	d4c97a1b2d67	golang.org/x/net@v0.32.0 stdlib@go1.23.4	0.60.0 1.26.9
registry.k8s.io/ingress-nginx/kube-webhook-certgen :v20221220-controller-v1.5.1-58-g787ea74b6	4d99688e5573	golang.org/x/net@v0.1.0 stdlib@go1.19.4	0.60.0 1.26.9

Open the chart page →

3,053

thanosgpg-dev

0.5.3

1 of 1 See more

thanos gpg-dev 0.5.3

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
thanosio/thanos :v0.41.0	cf3e9b292e43	golang.org/x/net@v0.49.0 stdlib@go1.25.7	0.60.0 1.26.9

Open the chart page →

1,015

traefikgpg-dev

39.0.8

1 of 1 See more

traefik gpg-dev 39.0.8

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
library/traefik :v3.6.13	34d5089d0b41	golang.org/x/net@v0.51.0 stdlib@go1.25.8	0.60.0 1.26.9

Open the chart page →

1,791

velerogpg-dev

12.0.0

1 of 1 See more

velero gpg-dev 12.0.0

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
velero/velero :v1.18.0	e4d1e79be2ee	golang.org/x/net@v0.47.0 stdlib@go1.25.7	0.60.0 1.26.9

Open the chart page →

2,110

whoami-demogpg-dev

0.1.0

1 of 1 See more

whoami-demo gpg-dev 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
containous/whoami :latest	7d6a3c8f9147	stdlib@go1.14	1.26.9

Open the chart page →

2,369

spark-standalonegradiant-bigdata

0.1.0

1 of 2 See more

spark-standalone gradiant-bigdata 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
prom/graphite-exporter :latest	c1a266f63a84	golang.org/x/net@v0.55.0 stdlib@go1.26.5	0.60.0 1.26.9

Open the chart page →

6,531

cloudcost-exportergrafana

1.1.16

1 of 1 See more

cloudcost-exporter grafana 1.1.16

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
grafana/cloudcost-exporter :v1.15.0	6c7f78bd104e	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2

Open the chart page →

213

grafana-cloud-onboardinggrafana

0.4.7

5 of 5 See more

grafana-cloud-onboarding grafana 0.4.7

5 of the 5 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
grafana/beyla-k8s-cache :2	53b2f561cb1b	golang.org/x/net@v0.48.0 stdlib@go1.25.3	0.60.0 1.26.9
ghcr.io/grafana/alloy-operator :1.8.1	ae85d68749c7	golang.org/x/net@v0.49.0 stdlib@go1.25.8	0.60.0 1.26.9
ghcr.io/grafana/helm-chart-toolbox-kubectl :0.1.1	c137478627cc	golang.org/x/net@v0.23.0 stdlib@go1.23.6	0.60.0 1.26.9
quay.io/prometheus/node-exporter :v1.11.1	0f422f62c15f	golang.org/x/net@v0.52.0 stdlib@go1.26.1	0.60.0 1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.18.0	1545919b72e3	golang.org/x/net@v0.48.0 stdlib@go1.25.5	0.60.0 1.26.9

Open the chart page →

7,070

grafana-samplinggrafana

1.1.7

2 of 2 See more

grafana-sampling grafana 1.1.7

2 of the 2 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
grafana/alloy :v1.11.3	8c7256f412fe	golang.org/x/net@v0.43.0 stdlib@go1.24.6	0.60.0 1.26.9
quay.io/prometheus-operator/prometheus-config-reloader :v0.81.0	959d47672fbf	golang.org/x/net@v0.37.0 stdlib@go1.23.7	0.60.0 1.26.9

Open the chart page →

4,719

k8s-injection-controllergrafana

0.2.1

1 of 1 See more

k8s-injection-controller grafana 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
ghcr.io/grafana/k8s-injection-controller :0.2.0	c5bad40655a3	golang.org/x/net@v0.55.0 stdlib@go1.26.5	0.60.0 1.26.9

Open the chart page →

406

mimir-openshift-experimentalgrafana

2.1.0

1 of 4 See more

mimir-openshift-experimental grafana 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
grafana/mimir :2.0.0	80c1a8eb24dd	golang.org/x/net@v0.0.0-20220105145211-5b0dc2dfae98 stdlib@go1.17.8	0.60.0 1.26.9

Open the chart page →

5,321

pyroscope-monitoringgrafana

0.1.1

5 of 6 See more

pyroscope-monitoring grafana 0.1.1

5 of the 6 container images this version deploys carry CVE-2026-97032.

Container image	Digest	Package	Fixed in
grafana/otel-lgtm :0.11.10	09d8c3ce4f3a	golang.org/x/net@v0.38.0 stdlib@go1.24.6	0.60.0 1.26.9
ghcr.io/grafana/alloy-operator :1.3.0	2088dcb22aaa	golang.org/x/net@v0.41.0 stdlib@go1.24.5	0.60.0 1.26.9
ghcr.io/grafana/helm-chart-toolbox-kubectl :0.1.1	c137478627cc	golang.org/x/net@v0.23.0 stdlib@go1.23.6	0.60.0 1.26.9
quay.io/prometheus/node-exporter :v1.9.1	d00a542e409e	golang.org/x/net@v0.37.0 stdlib@go1.23.7	0.60.0 1.26.9
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.17.0	2bbc91556733	golang.org/x/net@v0.41.0 stdlib@go1.24.6	0.60.0 1.26.9

Open the chart page →

11,642

Container images carrying it

6,208 by charts deploying them

A fixed version is listed for 3 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/linuxserver/doublecommander :version-0.8.2-1	d92969a929c2	golang.org/x/net@v0.0.0-20210226172049-e18ecbb05110 stdlib@go1.16.9	0.60.0 1.26.9	1
ghcr.io/linuxserver/duplicati :latest	78883c4ea7a3	stdlib@go1.24.9	1.26.9	1
ghcr.io/linuxserver/filezilla :version-3.51.0-r1	5103cdd266ce	golang.org/x/net@v0.0.0-20201224014010-6772e930b67b stdlib@go1.15.12	0.60.0 1.26.9	1
ghcr.io/linuxserver/mstream :version-v5.2.5	22c012bcc43c	golang.org/x/net@v0.0.0-20190827160401-ba9fcec4b297 stdlib@go1.15.5	0.60.0 1.26.9	1
ghcr.io/linuxserver/plex :latest	3f71bd6eb6a4	stdlib@go1.26.7	1.26.9	1
ghcr.io/linuxserver/remmina :version-1.2.0-rcgit.29dfsg-1ubuntu1	05955792e00f	golang.org/x/net@v0.0.0-20211216030914-fe4d6282115f stdlib@go1.17.11	0.60.0 1.26.9	1
ghcr.io/linuxserver/sqlitebrowser :version-3.12.2-02876202105241947ubuntu18.04.1	426e79828c4b	golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023 stdlib@go1.16.12	0.60.0 1.26.9	1
ghcr.io/litesql/ha :latest	14d266f40e00	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
ghcr.io/litesql/pocketbase-ha :latest	80b42258bfe0	golang.org/x/net@v0.59.0 stdlib@go1.27.1	0.60.0 1.27.2	1
ghcr.io/lldap/lldap :2025-05-19	3de697c3ba57	stdlib@go1.18.2	1.26.9	1
ghcr.io/llm-d/llm-d-model-service :v0.0.15	8b99a8104a2f	golang.org/x/net@v0.40.0 stdlib@go1.24.3	0.60.0 1.26.9	1
ghcr.io/lloesche/valheim-server :latest	19f55bcf7bb6	stdlib@go1.24.1	1.26.9	1
ghcr.io/loafoe/centcom :v0.267.0	4b26cc8f2b4c	golang.org/x/net@v0.55.0 stdlib@go1.27.1	0.60.0 1.27.2	1
ghcr.io/loafoe/go-hello-world :v2.16.0	22d94845e317	golang.org/x/net@v0.59.0 stdlib@go1.26.0	0.60.0 1.26.9	1
ghcr.io/loafoe/go-ocpp-server :v0.2.1	45bb960674ab	stdlib@go1.21.13	1.26.9	1
ghcr.io/loafoe/mcp-notifier :v0.2.0	ea958b832415	stdlib@go1.26.4	1.26.9	1
ghcr.io/loafoe/mt-mcp-grafana :v0.1.1	2332d9b47475	golang.org/x/net@v0.55.0 stdlib@go1.26.2	0.60.0 1.26.9	1
ghcr.io/loafoe/mt-mcp-proxy :v0.3.0	881e7d8097bc	golang.org/x/net@v0.55.0 stdlib@go1.26.4	0.60.0 1.26.9	1
ghcr.io/loafoe/picoclaw :v0.0.19	42e1b6862913	golang.org/x/net@v0.53.0 stdlib@go1.26.2	0.60.0 1.26.9	1
ghcr.io/loafoe/solgate :v0.0.12	b3256cbc7b68	golang.org/x/net@v0.14.0 stdlib@go1.21.0	0.60.0 1.26.9	1
ghcr.io/lockdep/stackradar-scanner :0.6.0	a90480c17377	golang.org/x/net@v0.49.0 stdlib@go1.25.7	0.60.0 1.26.9	1
ghcr.io/loft-sh/agent :3.2.4	5c109914ff73	golang.org/x/net@v0.6.0 stdlib@go1.18.10	0.60.0 1.26.9	1
ghcr.io/loft-sh/central-hostpath-mapper :0.2.9	fa6dba122171	golang.org/x/net@v0.26.0 stdlib@go1.23.2	0.60.0 1.26.9	1
ghcr.io/loft-sh/devpod-pro :0.0.0-ci.4-do-not-use	5dfa86b6451f	golang.org/x/net@v0.21.0 stdlib@go1.20.10	0.60.0 1.26.9	1
ghcr.io/loft-sh/kubernetes :v1.35.0	90097a08b87c	golang.org/x/net@v0.42.0 stdlib@go1.24.11	0.60.0 1.26.9	1
ghcr.io/loft-sh/license-server :0.6.0	69ce001bb4b0	golang.org/x/net@v0.53.0 stdlib@go1.24.3	0.60.0 1.26.9	1
ghcr.io/loft-sh/loft :0.0.0-ci.14	b69bcdaa8492	golang.org/x/net@v0.14.0 stdlib@go1.20.7	0.60.0 1.26.9	1
ghcr.io/loft-sh/vcluster :0.16.4	84f70425f4dd	golang.org/x/net@v0.13.0 stdlib@go1.20.8	0.60.0 1.26.9	1
ghcr.io/loft-sh/vcluster-control-plane :0.0.0-ci.4-do-not-use	45e744fc623f	golang.org/x/net@v0.21.0 stdlib@go1.22.0	0.60.0 1.26.9	1
ghcr.io/loft-sh/vcluster-hpm :0.2.7	f65f6810ea23	golang.org/x/net@v0.40.0 stdlib@go1.24.2	0.60.0 1.26.9	1
ghcr.io/loft-sh/vcluster-platform :4.12.2	71d869f989e9	golang.org/x/net@v0.52.0 stdlib@go1.26.5	0.60.0 1.26.9	1
ghcr.io/loft-sh/vnode-runtime :0.3.3	b065ec5a5239	golang.org/x/net@v0.46.0 stdlib@go1.24.2	0.60.0 1.26.9	1
ghcr.io/loxilb-io/kube-loxilb :latest	6f65e53e252d	golang.org/x/net@v0.38.0 stdlib@go1.23.12	0.60.0 1.26.9	1
ghcr.io/loxilb-io/loxilb :latest	a475b43946b3	golang.org/x/net@v0.55.0 stdlib@go1.22.5	0.60.0 1.26.9	1
ghcr.io/lrstanley/vault-unseal :1.0.1	dd873930b6df	golang.org/x/net@v0.57.0 stdlib@go1.26.5	0.60.0 1.26.9	1
ghcr.io/luckypipewrench/pipelock :3.6.0	66d65eaca81d	golang.org/x/net@v0.59.0 stdlib@go1.26.8	0.60.0 1.26.9	1
ghcr.io/luisico/cert-manager-webhook-infoblox-wapi :1.5	ded797477896	golang.org/x/net@v0.0.0-20210224082022-3d97a244fca7 stdlib@go1.16.15	0.60.0 1.26.9	1
ghcr.io/lukaszraczylo/jobs-manager-operator :0.1.34	d90d4477464c	stdlib@go1.26.8	1.26.9	1
ghcr.io/lukaszraczylo/kubemirror :0.10.25	3f444aa0d88b	stdlib@go1.26.8	1.26.9	1
ghcr.io/lukaszraczylo/kubernetes-images-sync-operator :0.5.73	c218de9248cb	stdlib@go1.26.8	1.26.9	1
ghcr.io/lumovi/lumovi :1.21.0	947088240bb5	golang.org/x/net@v0.57.0 stdlib@go1.27.1	0.60.0 1.27.2	1
ghcr.io/luzifer/cert-manager-desec-webhook :v1.0.1	fa1f6b2e9a6e	golang.org/x/net@v0.26.0 stdlib@go1.23.4	0.60.0 1.26.9	1
ghcr.io/luzifer/ots :v1.22.0	1a62eb026ff5	stdlib@go1.27.1	1.27.2	1
ghcr.io/luzilla/dnsbl_exporter :v0.7.0-rc3	d9767232a55e	golang.org/x/net@v0.20.0 stdlib@go1.20.14	0.60.0 1.26.9	1
ghcr.io/luzilla/dnsbl_exporter :v0.12.0	ecba7360ff12	golang.org/x/net@v0.53.0 stdlib@go1.25.0	0.60.0 1.26.9	1
ghcr.io/m0nsterrr/as212510.net :v4.0.5	76a06f6a8371	stdlib@go1.27.1	1.27.2	1
ghcr.io/m0nsterrr/cert-manager-webhook-infomaniak :v0.1.6	5b7373bc3664	golang.org/x/net@v0.58.0 stdlib@go1.27.1	0.60.0 1.27.2	1
ghcr.io/m9sweeper/trawler :1.6.0	df917c5a7e54	golang.org/x/net@v0.19.0 stdlib@go1.21.5	0.60.0 1.26.9	1
ghcr.io/maastrichtu-ids/rstudio :latest	981aa4c109e1	stdlib@go1.20.12	1.26.9	1
ghcr.io/madduck-tech/loomwatch :1.15.9	8f08e7c84910	stdlib@go1.25.14	1.26.9	1