StackRadar

CVE-2026-107280

Medium

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.003
16th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
30
of 18,117 indexed, latest versions
Container images
36
deployed by those charts
Fix available
1 of 1
affected package

AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk

Carried by container images the latest versions of 30 of 18,117 indexed charts deploy, on 36 images.

Affected packageAffected versionsFixed inImages
async-http-clientmaven2.0.37, 2.5.3, 2.7.0, 2.10.1+7 more2.16.1, 3.0.1336
OSV records
GHSA-f9m8-cv68-674w

Charts affected

30 by stars
ChartLatestAffected imagesRadar Score
milvusmilvus4.0.311 of 5See more

milvus milvus 4.0.31

1 of the 5 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.8.2d538416d5afe
async-http-client@2.12.1
2.16.1

Open the chart page →

176,271
milvusmilvus-helm5.0.311 of 4See more

milvus milvus-helm 5.0.31

1 of the 4 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
apachepulsar/pulsar:3.0.79c9947de139d
async-http-client@2.12.1
2.16.1

Open the chart page →

15,298
druiddruid-helmVerified publisher37.0.21 of 3See more

druid druid-helm 37.0.2

1 of the 3 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
apache/druid:37.0.00116fb802786
async-http-client@3.0.2
3.0.13

Open the chart page →

4,412
druidwiremindVerified publisher1.22.11 of 3See more

druid wiremind 1.22.1

1 of the 3 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
apache/druid:29.0.10cef139b6bf1
async-http-client@2.5.3
2.16.1

Open the chart page →

8,438
hivebigdata-chartsVerified publisher0.1.81 of 1See more

hive bigdata-charts 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
5200710/hive:3.1.3-postgresql-metastoree34ab066d2ed
async-http-client@2.0.37
2.16.1

Open the chart page →

7,536
hive-metastoreheva-helm-chartsVerified publisher0.2.01 of 2See more

hive-metastore heva-helm-charts 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
sslhep/hive-metastore:3.1.39e80af083079
async-http-client@2.0.37
2.16.1

Open the chart page →

7,679
thingsboard-clusterthingsboard-cluster-bettaVerified publisher0.2.261 of 6See more

thingsboard-cluster thingsboard-cluster-betta 0.2.26

1 of the 6 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
thingsboard/tb-node:3.6.0f40a542832c4
async-http-client@2.12.1
2.16.1

Open the chart page →

18,086
pulsarapache-pulsar-helm-chart-repo1.0.321 of 2See more

pulsar apache-pulsar-helm-chart-repo 1.0.32

1 of the 2 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.6.14db6ff0b4045
async-http-client@2.12.1
2.16.1

Open the chart page →

8,154
cp-schema-registrycp-schema-registryVerified publisher1.0.01 of 1See more

cp-schema-registry cp-schema-registry 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
ghcr.io/devops-ia/cp-schema-registry:8.1.1-msk-iam-auth2.3.530d1a445acc7
async-http-client@2.12.4
2.16.1

Open the chart page →

2,630
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
treskon/portrait:DEV-latest88e813f22347
async-http-client@2.10.4
2.16.1

Open the chart page →

37,281
james-komposeappscodeVerified publisher0.1.01 of 4See more

james-kompose appscode 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
ghcr.io/appscode/inbox-server:MailetGroup4a2824296412
async-http-client@2.12.1
2.16.1

Open the chart page →

19,759
bluerange-serverbluerangeOfficialVerified publisher1.4.01 of 1See more

bluerange-server bluerange 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
bluerange/bluerange:26.2.0503577ef9143
async-http-client@2.12.1
2.16.1

Open the chart page →

2,163
pulsarcnieg1.0.82 of 2See more

pulsar cnieg 1.0.8

2 of the 2 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.6.14db6ff0b4045
async-http-client@2.12.1
2.16.1
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
async-http-client@2.7.0
2.16.1

Open the chart page →

18,566
cp-helm-chartscp-helm-charts0.6.16 of 8See more

cp-helm-charts cp-helm-charts 0.6.1

6 of the 8 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
confluentinc/cp-enterprise-control-center:6.1.0f2975d507a2a
async-http-client@2.10.1
2.16.1
confluentinc/cp-enterprise-kafka:6.1.08f1544df1f48
async-http-client@2.10.1
2.16.1
confluentinc/cp-kafka-connect:6.1.04bc70a83ca6f
async-http-client@2.10.1
2.16.1
confluentinc/cp-kafka-rest:6.1.0b0b7aa26254a
async-http-client@2.10.1
2.16.1
confluentinc/cp-ksqldb-server:6.1.0ee403d5b9090
async-http-client@2.10.1
2.16.1
confluentinc/cp-schema-registry:6.1.0b651d4b6185a
async-http-client@2.10.1
2.16.1

Open the chart page →

62,191
kafka-connectdasmeta1.0.21 of 3See more

kafka-connect dasmeta 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
confluentinc/cp-schema-registry:latest482d3048b3f6
async-http-client@3.0.10
3.0.13

Open the chart page →

634
druidhelmforgeVerified publisher1.3.61 of 4See more

druid helmforge 1.3.6

1 of the 4 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
apache/druid:37.0.00116fb802786
async-http-client@3.0.2
3.0.13

Open the chart page →

10,181
ikigaiikigai-chartVerified publisher0.0.91 of 58See more

ikigai ikigai-chart 0.0.9

1 of the 58 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
dremio/dremio-oss:24.1.080ed2e3b7c43
async-http-client@2.7.0
2.16.1

Open the chart page →

117,700
pinotinseefrlab0.2.01 of 2See more

pinot inseefrlab 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
apachepinot/pinot:latest-jdk110018bb04ced7
async-http-client@2.12.3
2.16.1

Open the chart page →

12,291
miot-modulithmicroboxlabs0.6.01 of 1See more

miot-modulith microboxlabs 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-srv:latest2256cf19a093
async-http-client@2.12.4
2.16.1

Open the chart page →

1,780
pulsarv2milvus-helm2.7.81 of 4See more

pulsarv2 milvus-helm 2.7.8

1 of the 4 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
async-http-client@2.7.0
2.16.1

Open the chart page →

18,647
chirpstackmosquitto-helm-chart0.5.01 of 8See more

chirpstack mosquitto-helm-chart 0.5.0

1 of the 8 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.9.0d056c89b7131
async-http-client@2.12.1
2.16.1

Open the chart page →

105,374
pulsarmosquitto-helm-chart0.2.01 of 1See more

pulsar mosquitto-helm-chart 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.10.03b262ab7a7d9
async-http-client@2.12.1
2.16.1

Open the chart page →

16,786
pulsarolehrgfVerified publisher0.0.51 of 2See more

pulsar olehrgf 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
apachepulsar/pulsar:3.1.016f9fdab3fa6
async-http-client@2.12.1
2.16.1

Open the chart page →

10,177
radar-cp-ksql-serverradar-baseVerified publisher0.0.21 of 2See more

radar-cp-ksql-server radar-base 0.0.2

1 of the 2 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
confluentinc/cp-ksqldb-server:7.6.08ec46c27982f
async-http-client@2.12.3
2.16.1

Open the chart page →

6,129
javareact-java0.1.01 of 1See more

java react-java 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
project2team4/react:latest3ff031a08887
async-http-client@2.12.3
2.16.1

Open the chart page →

16,634
shenyushenyu0.6.31 of 2See more

shenyu shenyu 0.6.3

1 of the 2 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
apache/shenyu-bootstrap:2.5.11bd5756f6273
async-http-client@2.12.1
2.16.1

Open the chart page →

9,228
sn-consolestreamnative1.13.01 of 1See more

sn-console streamnative 1.13.0

1 of the 1 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
streamnative/private-cloud-console:v2.3.27-all91e54375e154
async-http-client@2.12.4
2.16.1

Open the chart page →

2,219
thingsboardthingsboardVerified publisher0.1.34 of 12See more

thingsboard thingsboard 0.1.3

4 of the 12 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
thingsboard/tb-coap-transport:3.4.1bd45a09d85d9
async-http-client@2.10.5
2.16.1
thingsboard/tb-http-transport:3.4.1a06f53c5e2da
async-http-client@2.10.5
2.16.1
thingsboard/tb-mqtt-transport:3.4.1030f316ce301
async-http-client@2.10.5
2.16.1
thingsboard/tb-node:3.4.1645f43b688f7
async-http-client@2.10.5
2.16.1

Open the chart page →

29,874
canal-serverxxl-job-adminVerified publisher0.1.21 of 2See more

canal-server xxl-job-admin 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
ghcr.io/dellnoantechnp/canal-server:v1.1.6af724c855f65
async-http-client@2.12.1
2.16.1

Open the chart page →

6,159
zahori-processzahoriVerified publisher1.0.11 of 1See more

zahori-process zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-107280.

Container imageDigestPackageFixed in
zahoriaut/zahori-process:0.1.13351f8a220ed7
async-http-client@2.12.3
2.16.1

Open the chart page →

3,760

Container images carrying it

36 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
apache/druid:37.0.00116fb802786
async-http-client@3.0.2
3.0.13
2
apachepulsar/pulsar:2.6.14db6ff0b4045
async-http-client@2.12.1
2.16.1
2
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
async-http-client@2.7.0
2.16.1
2
5200710/hive:3.1.3-postgresql-metastoree34ab066d2ed
async-http-client@2.0.37
2.16.1
1
apache/druid:29.0.10cef139b6bf1
async-http-client@2.5.3
2.16.1
1
apachepinot/pinot:latest-jdk110018bb04ced7
async-http-client@2.12.3
2.16.1
1
apachepulsar/pulsar:3.1.016f9fdab3fa6
async-http-client@2.12.1
2.16.1
1
apachepulsar/pulsar:2.10.03b262ab7a7d9
async-http-client@2.12.1
2.16.1
1
apachepulsar/pulsar:3.0.79c9947de139d
async-http-client@2.12.1
2.16.1
1
apachepulsar/pulsar:2.9.0d056c89b7131
async-http-client@2.12.1
2.16.1
1
apachepulsar/pulsar:2.8.2d538416d5afe
async-http-client@2.12.1
2.16.1
1
apache/shenyu-bootstrap:2.5.11bd5756f6273
async-http-client@2.12.1
2.16.1
1
bluerange/bluerange:26.2.0503577ef9143
async-http-client@2.12.1
2.16.1
1
confluentinc/cp-enterprise-control-center:6.1.0f2975d507a2a
async-http-client@2.10.1
2.16.1
1
confluentinc/cp-enterprise-kafka:6.1.08f1544df1f48
async-http-client@2.10.1
2.16.1
1
confluentinc/cp-kafka-connect:6.1.04bc70a83ca6f
async-http-client@2.10.1
2.16.1
1
confluentinc/cp-kafka-rest:6.1.0b0b7aa26254a
async-http-client@2.10.1
2.16.1
1
confluentinc/cp-ksqldb-server:7.6.08ec46c27982f
async-http-client@2.12.3
2.16.1
1
confluentinc/cp-ksqldb-server:6.1.0ee403d5b9090
async-http-client@2.10.1
2.16.1
1
confluentinc/cp-schema-registry:latest482d3048b3f6
async-http-client@3.0.10
3.0.13
1
confluentinc/cp-schema-registry:6.1.0b651d4b6185a
async-http-client@2.10.1
2.16.1
1
dremio/dremio-oss:24.1.080ed2e3b7c43
async-http-client@2.7.0
2.16.1
1
project2team4/react:latest3ff031a08887
async-http-client@2.12.3
2.16.1
1
sslhep/hive-metastore:3.1.39e80af083079
async-http-client@2.0.37
2.16.1
1
streamnative/private-cloud-console:v2.3.27-all91e54375e154
async-http-client@2.12.4
2.16.1
1
thingsboard/tb-coap-transport:3.4.1bd45a09d85d9
async-http-client@2.10.5
2.16.1
1
thingsboard/tb-http-transport:3.4.1a06f53c5e2da
async-http-client@2.10.5
2.16.1
1
thingsboard/tb-mqtt-transport:3.4.1030f316ce301
async-http-client@2.10.5
2.16.1
1
thingsboard/tb-node:3.4.1645f43b688f7
async-http-client@2.10.5
2.16.1
1
thingsboard/tb-node:3.6.0f40a542832c4
async-http-client@2.12.1
2.16.1
1
treskon/portrait:DEV-latest88e813f22347
async-http-client@2.10.4
2.16.1
1
zahoriaut/zahori-process:0.1.13351f8a220ed7
async-http-client@2.12.3
2.16.1
1
ghcr.io/appscode/inbox-server:MailetGroup4a2824296412
async-http-client@2.12.1
2.16.1
1
ghcr.io/dellnoantechnp/canal-server:v1.1.6af724c855f65
async-http-client@2.12.1
2.16.1
1
ghcr.io/devops-ia/cp-schema-registry:8.1.1-msk-iam-auth2.3.530d1a445acc7
async-http-client@2.12.4
2.16.1
1
ghcr.io/microboxlabs/miot-srv:latest2256cf19a093
async-http-client@2.12.4
2.16.1
1

syft 1.42.1 · advisories as of 14 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.