StackRadar

CVE-2026-1605

High

Advisory

Published 5 Mar 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.007
50th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
24
of 17,781 indexed, latest versions
Container images
19
deployed by those charts
Fix available
1 of 1
affected package

The Eclipse Jetty Server Artifact has a Gzip request memory leak

Carried by container images the latest versions of 24 of 17,781 indexed charts deploy, on 19 images.

Affected packageAffected versionsFixed inImages
jetty-servermaven12.0.9, 12.0.11, 12.0.12, 12.0.15+8 more12.0.32, 12.1.619
OSV records
GHSA-xxh7-fcf3-rj7f

Charts affected

24 by stars
ChartLatestAffected imagesRadar Score
hazelcasthazelcastVerified publisher5.10.21 of 2See more

hazelcast hazelcast 5.10.2

1 of the 2 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
hazelcast/management-center:5.5.2991ddb27c251
jetty-server@12.0.12
12.0.32

Open the chart page →

2,634
kafka-chartsoldevelo-kafka-chart32.4.41 of 1See more

kafka-chart soldevelo-kafka-chart 32.4.4

1 of the 1 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
soldevelo/kafka:4.0.0-debian-12-r0cfdc08c2f577
jetty-server@12.0.15
12.0.32

Open the chart page →

2,355
cp-schema-registrycp-schema-registryVerified publisher1.0.01 of 1See more

cp-schema-registry cp-schema-registry 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
ghcr.io/devops-ia/cp-schema-registry:8.1.1-msk-iam-auth2.3.530d1a445acc7
jetty-server@12.0.25
12.0.32

Open the chart page →

1,864
kokukokuVerified publisher1.0.01 of 7See more

koku koku 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
public.ecr.aws/v0r6c2e2/trino:latestc265156b00d1
jetty-server@12.0.16
12.0.32

Open the chart page →

12,019
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
library/neo4j:2026.02.25ab4ab0358cf
jetty-server@12.0.25
12.0.32

Open the chart page →

8,158
resurfaceresurfaceioVerified publisher3.9.01 of 3See more

resurface resurfaceio 3.9.0

1 of the 3 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
resurfaceio/resurface:3.7.84d5cda2f64109
jetty-server@12.0.16
12.0.32

Open the chart page →

7,432
signserver-cesignserverOfficialVerified publisher2.3.51 of 1See more

signserver-ce signserver 2.3.5

1 of the 1 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
keyfactor/signserver-ce:7.3.2798fbbe00283
jetty-server@12.0.15
12.0.32

Open the chart page →

2,406
active-mqactivemq-helm-chartVerified publisher1.8.21 of 3See more

active-mq activemq-helm-chart 1.8.2

1 of the 3 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
apache/activemq-artemis:2.44.00305c26f19ed
jetty-server@12.1.3
12.1.6

Open the chart page →

3,188
akto-hybrid-redactakto1.44.41 of 5See more

akto-hybrid-redact akto 1.44.4

1 of the 5 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.1-1-ubi9d20bd62f0182
jetty-server@12.0.25
12.0.32

Open the chart page →

4,777
akto-mini-runtime-shaakto0.7.231 of 3See more

akto-mini-runtime-sha akto 0.7.23

1 of the 3 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafkadigest-pinnedd20bd62f0182
jetty-server@12.0.25
12.0.32

Open the chart page →

3,217
akto-mrs-runtime-combinedakto0.0.21 of 2See more

akto-mrs-runtime-combined akto 0.0.2

1 of the 2 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.0-1-ubi99026dbbf280d
jetty-server@12.0.25
12.0.32

Open the chart page →

1,826
inbox-serverappscodeVerified publisher2025.12.251 of 1See more

inbox-server appscode 2025.12.25

1 of the 1 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
ghcr.io/appscode/inbox-server:postgres-latest536358d7b17e
jetty-server@12.0.20
12.0.32

Open the chart page →

3,963
inbox-server-distributedappscodeVerified publisher2025.12.251 of 4See more

inbox-server-distributed appscode 2025.12.25

1 of the 4 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
ghcr.io/appscode/inbox-server:latest536358d7b17e
jetty-server@12.0.20
12.0.32

Open the chart page →

15,573
kafkacagriekinVerified publisher0.2.01 of 2See more

kafka cagriekin 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
apache/kafka:4.1.0bff074a5d005
jetty-server@12.0.22
12.0.32

Open the chart page →

2,398
clusterfactoryclusterfactory0.2.01 of 5See more

clusterfactory clusterfactory 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
jenkins/jenkins:2.541.3-jdk21c4098086090c
jetty-server@12.1.5
12.1.6

Open the chart page →

7,168
gitea-jenkinsclusterfactory0.1.11 of 5See more

gitea-jenkins clusterfactory 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
jenkins/jenkins:2.541.3-jdk21c4098086090c
jetty-server@12.1.5
12.1.6

Open the chart page →

5,238
cc-spring-appgridgainVerified publisher1.0.61 of 1See more

cc-spring-app gridgain 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
gridgain/cloud-connector:2025.5.15ab838d7d3cb
jetty-server@12.0.31
12.0.32

Open the chart page →

1,691
jenainseefrlab3.1.01 of 1See more

jena inseefrlab 3.1.0

1 of the 1 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
stain/jena-fuseki:latestb1d0c96f19ad
jetty-server@12.0.11
12.0.32

Open the chart page →

1,262
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
vespaengine/vespa:8.526.1569b160f58211
jetty-server@12.0.21
12.0.32

Open the chart page →

6,338
trinopresto-loadbalancer0.2.101 of 2See more

trino presto-loadbalancer 0.2.10

1 of the 2 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
trinodb/trino:4796af989b0846d
jetty-server@12.1.5
12.1.6

Open the chart page →

2,264
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
trinodb/trino:45038c6f24ab1a4
jetty-server@12.0.9
12.0.32

Open the chart page →

21,211
radar-kafkaradar-baseVerified publisher0.4.11 of 2See more

radar-kafka radar-base 0.4.1

1 of the 2 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.46.0ac434a48ac2b
jetty-server@12.0.16
12.0.32

Open the chart page →

4,219
strimzi-kafka-operatorradar-baseVerified publisher0.46.01 of 1See more

strimzi-kafka-operator radar-base 0.46.0

1 of the 1 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.46.0ac434a48ac2b
jetty-server@12.0.16
12.0.32

Open the chart page →

1,951
hazelcastwenerme5.10.21 of 2See more

hazelcast wenerme 5.10.2

1 of the 2 container images this version deploys carry CVE-2026-1605.

Container imageDigestPackageFixed in
hazelcast/management-center:5.5.2991ddb27c251
jetty-server@12.0.12
12.0.32

Open the chart page →

2,634

Container images carrying it

19 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
hazelcast/management-center:5.5.2991ddb27c251
jetty-server@12.0.12
12.0.32
2
jenkins/jenkins:2.541.3-jdk21c4098086090c
jetty-server@12.1.5
12.1.6
2
ghcr.io/appscode/inbox-server:latest:postgres-latest536358d7b17e
jetty-server@12.0.20
12.0.32
2
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.1-1-ubi9d20bd62f0182
jetty-server@12.0.25
12.0.32
2
quay.io/strimzi/operator:0.46.0ac434a48ac2b
jetty-server@12.0.16
12.0.32
2
apache/activemq-artemis:2.44.00305c26f19ed
jetty-server@12.1.3
12.1.6
1
apache/kafka:4.1.0bff074a5d005
jetty-server@12.0.22
12.0.32
1
gridgain/cloud-connector:2025.5.15ab838d7d3cb
jetty-server@12.0.31
12.0.32
1
keyfactor/signserver-ce:7.3.2798fbbe00283
jetty-server@12.0.15
12.0.32
1
library/neo4j:2026.02.25ab4ab0358cf
jetty-server@12.0.25
12.0.32
1
resurfaceio/resurface:3.7.84d5cda2f64109
jetty-server@12.0.16
12.0.32
1
soldevelo/kafka:4.0.0-debian-12-r0cfdc08c2f577
jetty-server@12.0.15
12.0.32
1
stain/jena-fuseki:latestb1d0c96f19ad
jetty-server@12.0.11
12.0.32
1
trinodb/trino:45038c6f24ab1a4
jetty-server@12.0.9
12.0.32
1
trinodb/trino:4796af989b0846d
jetty-server@12.1.5
12.1.6
1
vespaengine/vespa:8.526.1569b160f58211
jetty-server@12.0.21
12.0.32
1
ghcr.io/devops-ia/cp-schema-registry:8.1.1-msk-iam-auth2.3.530d1a445acc7
jetty-server@12.0.25
12.0.32
1
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.0-1-ubi99026dbbf280d
jetty-server@12.0.25
12.0.32
1
public.ecr.aws/v0r6c2e2/trino:latestc265156b00d1
jetty-server@12.0.16
12.0.32
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.