VDB
GO-2026-6611
GO-2026-6611
PUBLISHED
CVSS 8.699999809265137 HIGH
Record from OSV · Published October 8, 2026
Excessive CPU consumption from repeated initial window changes in net/http
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| tfsec | Chainguard | 1.28.14-r53 |
| dapr-fips-1.17 | Chainguard | 1.17.16-r0 |
| malcontent | Wolfi | 1.27.1-r1 |
| terraform-1.15 | Chainguard | 1.15.9-r9 |
| cadvisor | Wolfi | 0.60.6-r3 |
| crossplane-provider-aws-appintegrations | Chainguard | 2.9.0-r1 |
| kapp-controller-fips | Chainguard | 0.60.9-r2 |
| trillian-fips | Chainguard | 1.8.0-r1 |
| datadog-agent-fips-7.78 | Chainguard | 7.78.4-r20 |
| gcp-compute-persistent-disk-csi-driver-1.23 | Chainguard | 1.23.7-r2 |
| coder-2.32 | Chainguard | 2.32.10-r14 |
| crossplane-function-kcl-fips | Chainguard | 0.12.3-r3 |
88 more packages have a fixed version. See every fix in Lookup.
Risk scores
CVSS 4.0
8.699999809265137
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | tfsec | 0 |
| chainguard | dapr-fips-1.17 | 0 |
| wolfi | cadvisor | 0 |
| chainguard | wait-for-port | * |
| chainguard | crossplane-provider-aws-appintegrations | 0 |
| chainguard | kapp-controller-fips | 0 |
| chainguard | datadog-agent-fips-7.78 | 0 |
| chainguard | gcp-compute-persistent-disk-csi-driver-1.23 | 0 |
| chainguard | coder-2.32 | 0 |
| chainguard | crossplane-function-kcl-fips | 0 |
| chainguard | thanos-receive-controller-fips | 0 |
| chainguard | crossplane-function-go-templating-0.11 | 0 |
| chainguard | rekor-fips | * |
| wolfi | multus-cni | 0 |
| wolfi | k3s-1.35 | 0 |
| wolfi | swagger | * |
| chainguard | newrelic-infrastructure-agent-fips | * |
| chainguard | k3s-1.34 | 0 |
| chainguard | prometheus-operator | 0 |
| chainguard | chrony_exporter | * |
…and 3718 more
Timeline
- Oct 8, 2026 CVE Published
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GO-2026-6611
vulnetix vdb fixes GO-2026-6611Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GO-2026-6611/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart