clowder2 1.9.7 Helm chart

Name: clowder2 Helm chart 1.9.7: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

ncsa

Scored 14 Sept 2026

Open Source Data Management for Long Tail Data. Clowder is a customizable and scalable data management framework to support any data format and multiple research domains.

Version 1.9.7 9 months agoapp version 2.0.0-beta.4 1Artifact Hub

clowder2 1.9.7 deploys 12 container images: bitnamilegacy/minio, bitnamilegacy/mongodb, clowder/clowder2-backend, clowder/clowder2-frontend and 8 more. Across them, 3,298 findings — 14 critical, 33 high — 12 on CISA KEV. The highest contribution is GHSA-f58c-gq56-vjjf in tika-core 2.7.0, fixed in 3.2.2.

Radar Score

37,37314334692,779

3,298 findings over 12 of 12 images measured

KEV ×12 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

12 images

Image	Tag	Vulnerabilities	Radar Score
bitnamilegacy/minio	2023.12.23	0226180	2,291
bitnamilegacy/mongodb	5.0.10	1631206	2,886
clowder/clowder2-backend	2.0.0-beta.4	0246243	3,250
clowder/clowder2-frontend	2.0.0-beta.4	012074	1,091
clowder/clowder2-heartbeat	2.0.0-beta.4	0246243	3,250
clowder/clowder2-messages	2.0.0-beta.4	0246243	3,250
bitnamilegacy/os-shell×4	12-debian-12-r16	3662308	4,456
bitnamilegacy/elasticsearch×8	8.12.2	7695538	7,598
bitnamilegacy/postgresql	15.5.0	2025125	1,897
library/busybox	1.28	0000	0
bitnamilegacy/keycloak	20.0.5	1357454	5,465
bitnamilegacy/rabbitmq	3.10.8	0315165	1,939

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Low findings

1,214 distinct across the version’s images

Low: findings whose contribution to the Radar Score is 1–14. Show every band

Severity	Advisory	Package	Fixed in
Low	ALPINE-CVE-2025-69420	openssl@3.5.4-r0	3.5.5-r0
Low	DEBIAN-CVE-2025-69420	openssl@3.0.17-1~deb12u3	3.0.18-1~deb12u2
Low	BIT-java-2025-50106	java@17.0.6-10-4	1.8.0
Low	BIT-java-2025-50106	Java@17.0.10-13-2	1.8.0
Low	DEBIAN-CVE-2026-57433	perl@5.36.0-7+deb12u3	no fix listed
Low	PYSEC-2026-2132	click@8.1.7	8.3.3
Low	GHSA-xfrj-6vvc-3xm2	xmlsec@2.2.3	2.2.6
Low	BIT-java-2025-21587	java@17.0.6-10-4	1.8.0
Low	BIT-java-2025-21587	Java@17.0.10-13-2	1.8.0
Low	BIT-minio-2026-33419	MinIO@2023.12.23-1	2026.03.17
Low	BIT-minio-2026-33419	minio@2023.12.23-1	2026.03.17
Low	GHSA-jv87-32hw-hh99	github.com/minio/minio@v0.0.0-20231223071911-496027b589c2	no fix listed
Low	BIT-java-2025-50059	java@17.0.6-10-4	11.0.28
Low	BIT-java-2025-50059	Java@17.0.10-13-2	11.0.28
Low	BIT-java-2024-20932	Java@17.0.10-13-2	17.0.10
Low	BIT-java-2024-20932	java@17.0.6-10-4	17.0.10
Low	GHSA-9493-h29p-rfm2	github.com/opencontainers/runc@v1.1.0	1.2.8
Low	ALPINE-CVE-2026-27135	nghttp2@1.65.0-r0	1.68.1
Low	DEBIAN-CVE-2026-27135	nghttp2@1.52.0-1+deb12u1	1.52.0-1+deb12u3
Low	GHSA-9342-92gg-6v29	jakarta.mail@1.6.5	1.6.8
Low	DEBIAN-CVE-2026-13221	perl@5.36.0-7+deb12u3	no fix listed
Low	GHSA-63vm-454h-vhhq	pyasn1@0.6.1	0.6.2
Low	DEBIAN-CVE-2026-42496	perl@5.36.0-7+deb12u3	no fix listed
Low	ALPINE-CVE-2026-33636	libpng@1.6.47-r0	1.6.56-r0
Low	DEBIAN-CVE-2026-33636	libpng1.6@1.6.39-2	1.6.39-2+deb12u4
Low	GHSA-cxrx-q234-m22m	quarkus-http-core@4.1.9	5.3.4
Low	GHSA-3pxv-7cmr-fjr4	log4j-core@2.12.4	2.25.4
Low	BIT-minio-2026-33322	MinIO@2023.12.23-1	2026.03.17
Low	BIT-minio-2026-33322	minio@2023.12.23-1	2026.03.17
Low	GHSA-5cx5-wh4m-82fh	github.com/minio/minio@v0.0.0-20231223071911-496027b589c2	no fix listed
Low	GHSA-527x-5wrf-22m2	github.com/coredns/coredns@v1.11.1	1.14.0
Low	DEBIAN-CVE-2024-56406	perl@5.36.0-7+deb12u1	5.36.0-7+deb12u2
Low	GHSA-89gr-r52h-f8rx	golang.org/x/crypto@v0.17.0	0.52.0
Low	GHSA-6g7g-w4f8-9c9x	github.com/buger/jsonparser@v1.1.1	1.1.2
Low	DEBIAN-CVE-2024-37370	krb5@1.20.1-2+deb12u1	1.20.1-2+deb12u2
Low	BIT-java-2023-21967	java@17.0.6-10-4	1.8.0
Low	BIT-postgresql-2026-14662	PostgreSQL@15.5.0-42	14.24.0
Low	BIT-postgresql-2026-14662	postgresql@15.5.0-42	14.24.0
Low	GHSA-p5mv-gj8j-xqgf	keycloak-saml-core@20.0.5	26.6.2
Low	GHSA-pp6c-gr5w-3c5g	python-multipart@0.0.6	0.0.27
Low	GHSA-37gf-gmxv-74wv	keycloak-services@20.0.5	26.4.9
Low	GHSA-jppx-rxg9-jmrx	golang.org/x/crypto@v0.17.0	0.52.0
Low	BIT-postgresql-2026-6478	postgresql@15.5.0-42	14.23.0
Low	BIT-postgresql-2026-6478	PostgreSQL@15.5.0-42	14.23.0
Low	ALPINE-CVE-2026-14456	openssl@3.5.4-r0	3.5.8-r0
Low	GHSA-mh63-6h87-95cp	github.com/golang-jwt/jwt/v4@v4.5.0	4.5.2
Low	GHSA-5rxp-2rhr-qwqv	keycloak-services@20.0.5	22.0.12
Low	GHSA-57rv-r2g8-2cj3	netty-codec-http@4.1.86.Final	4.1.133.Final
Low	GHSA-v4mm-q8fv-r2w5	wildfly-elytron-realm-token@1.20.1.Final	no fix listed
Low	GO-2021-0263	stdlib@go1.16.7	1.16.10

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
1.9.7latest	9 months ago	2.0.0-beta.4	14334692,779	37,373

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/ncsa/clowder2.svg)](https://charts.stackradar.io/charts/ncsa/clowder2)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.