StackRadar

CVE-2026-2332

High

Advisory

Published 14 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.4
base score, highest
EPSS
0.013
69th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
257
of 17,781 indexed, latest versions
Container images
236
deployed by those charts
Fix available
1 of 1
affected package

Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Carried by container images the latest versions of 257 of 17,781 indexed charts deploy, on 236 images.

Affected packageAffected versionsFixed inImages
jetty-httpmaven9.4.0.v20161208, 9.4.5.v20170502, 9.4.6.v20170531, 9.4.7.v20170914+69 more9.4.60, 10.0.28, 11.0.29, 12.0.33+1 more236
OSV records
GHSA-355h-qmc2-wpwf

Charts affected

257 by stars
ChartLatestAffected imagesRadar Score
zookeepertwomartensVerified publisher0.2.21 of 1See more

zookeeper twomartens 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
confluentinc/cp-zookeeper:latest7610a50b13e7
jetty-http@9.4.57.v20241219
9.4.60

Open the chart page →

1,733
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
apache/tika:2.9.2.1-fullae0b86d3c4d0
jetty-http@9.4.54.v20240208
9.4.60

Open the chart page →

45,239
ubooquityvhdirkVerified publisher0.1.31 of 1See more

ubooquity vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
linuxserver/ubooquity:2.1.2-ls369932d6759112
jetty-http@9.4.0.v20161208
9.4.60

Open the chart page →

4,303
queryservicewbstack0.2.11 of 1See more

queryservice wbstack 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
ghcr.io/wbstack/queryservice:0.3.6_0.6b83b5b81d4b6
jetty-http@9.4.12.v20180830
9.4.60

Open the chart page →

4,649
queryservice-updaterwbstack0.3.01 of 1See more

queryservice-updater wbstack 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
ghcr.io/wbstack/queryservice-updater:0.3.84_3.97525a57ac3f1
jetty-http@9.4.12.v20180830
9.4.60

Open the chart page →

3,176
drillwearefrank1.3.62 of 3See more

drill wearefrank 1.3.6

2 of the 3 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
apache/drill:1.21.11f96558fd292
jetty-http@9.4.41.v20210516
9.4.60
bitnamilegacy/zookeeper:3.9.0-debian-11-r1110ed1ea3c8d1
jetty-http@9.4.51.v20230217
9.4.60

Open the chart page →

9,397
hazelcastwenerme5.10.21 of 2See more

hazelcast wenerme 5.10.2

1 of the 2 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
hazelcast/management-center:5.5.2991ddb27c251
jetty-http@12.0.12
12.0.33

Open the chart page →

2,634

Container images carrying it

236 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
confluentinc/cp-zookeeper:7.5.10bec03c1f3ce
jetty-http@9.4.51.v20230217
9.4.60
1
confluentinc/cp-zookeeper:7.8.0-3-ubi85ca5f3269814
jetty-http@9.4.56.v20240826
9.4.60
1
confluentinc/cp-zookeeper:6.1.078c190f4472c
jetty-http@9.4.33.v20201020
9.4.60
1
consensys/teku:25.4.1bf6ecd2ea716
jetty-http@11.0.25
11.0.29
1
craigwillis/c2metadata-bd:latestae317d7e4724
jetty-http@9.4.32.v20200930
9.4.60
1
dniel/api-posts:master45a667852f2a
jetty-http@9.4.25.v20191220
9.4.60
1
dremio/dremio-oss:24.1.080ed2e3b7c43
jetty-http@9.4.51.v20230217
9.4.60
1
duck1123/me.untethr.nostr-relay:0.2.1119fc5d4cbfb
jetty-http@9.4.44.v20210927
9.4.60
1
dzikoysk/reposilite:3.5.264128c2d7a6ba
jetty-http@11.0.25
11.0.29
1
easypi/openrefine:3.7.0d2950a36a576
jetty-http@9.4.48.v20220622
9.4.60
1
farberg/apache-knox-docker:1.6.14b4a22487394
jetty-http@9.4.34.v20201102
9.4.60
1
fimperato/sparkvid-api:1.0.5-RELEASE604012b77841
jetty-http@9.4.40.v20210413
9.4.60
1
folioci/mod-agreements:latest29c3f233a498
jetty-http@9.4.39.v20210325
9.4.60
1
folioci/mod-licenses:latestcfd6109bf477
jetty-http@9.4.39.v20210325
9.4.60
1
folioci/mod-oa:latestae3b069d4ba5
jetty-http@9.4.39.v20210325
9.4.60
1
folioci/mod-serials-management:latest571fa1ffe8c9
jetty-http@9.4.39.v20210325
9.4.60
1
folioci/mod-service-interaction:latestf53c327a48e8
jetty-http@9.4.39.v20210325
9.4.60
1
fonoster/routr:1.0.0-rc52ca65af17cbc
jetty-http@9.4.18.v20190429
9.4.60
1
fonoster/routr-edgeport:2.13.6d08a8a574a50
jetty-http@11.0.13
11.0.29
1
fonoster/routr-requester:2.13.6e0c823506eb2
jetty-http@11.0.13
11.0.29
1
frankescobar/allure-docker-service:2.21.08a4d7e9308de
jetty-http@9.4.49.v20220914
9.4.60
1
frankescobar/allure-docker-service:2.19.0cafa03b94dac
jetty-http@9.4.43.v20210629
9.4.60
1
gchq/accumulo:2.0.1c460bb587d6d
jetty-http@9.4.43.v20210629
9.4.60
1
geonetwork/gn-cloud-ogc-api-records-service:4.2.8-020c9bb761f67
jetty-http@9.4.11.v20180605
9.4.60
1
gocd/gocd-server:v19.3.02da45cb09d57
jetty-http@9.4.14.v20181114
9.4.60
1
gocd/gocd-server:v26.1.0720d1012b93f
jetty-http@10.0.26
10.0.28
1
gradiant/hdfs:3.2.2e3bf364fe713
jetty-http@9.4.20.v20190813
9.4.60
1
gradiant/jmxproxy:3.4.045eceb1bc55c
jetty-http@9.4.8.v20171121
9.4.60
1
graylog/graylog-enterprise:7.1.88a1f641cd7aa
jetty-http@9.4.57.v20241219
9.4.60
1
gridgain/cloud-connector:2025.5.15ab838d7d3cb
jetty-http@12.0.31
12.0.33
1
gridgain/community:8.9.11d32d182a0e6a
jetty-http@9.4.53.v20231009
9.4.60
1
gridgain/gridgain9:9.1.1895018390077b
jetty-http@9.4.58.v20250814
9.4.60
1
gurolakman/oam:4.0.0ed8fd2062548
jetty-http@11.0.24
11.0.29
1
gurolakman/smsf-configuration:1.0.49abb3882bcbd
jetty-http@9.4.45.v20220203
9.4.60
1
gurolakman/smsf-momt:1.0.4ce23b20a8a17
jetty-http@9.4.45.v20220203
9.4.60
1
gurolakman/smsf-registration:1.0.4b22e746edd5d
jetty-http@9.4.45.v20220203
9.4.60
1
gurolakman/ussigw-configuration:1.0.4bf18525c5ad9
jetty-http@9.4.45.v20220203
9.4.60
1
gurolakman/ussigw-core:1.0.48739565c3ea2
jetty-http@9.4.45.v20220203
9.4.60
1
hazelcast/hazelcast-jet:4.5.3a825ecbe9fda
jetty-http@9.4.43.v20210629
9.4.60
1
hazelcast/management-center:5.3.2f9d34300d330
jetty-http@10.0.15
10.0.28
1
hivemq/hivemq4:dns-4.5.144d194450d48e
jetty-http@9.4.44.v20210927
9.4.60
1
iamdorsah/bastillion:v0.1db83a0254d81
jetty-http@9.4.45.v20220203
9.4.60
1
ibmcom/icp-sert-bats:3.2.0b558f2b444ae
jetty-http@9.4.11.v20180605
9.4.60
1
jenkinsci/jenkins:2.67a1f33f004659
jetty-http@9.4.5.v20170502
9.4.60
1
jenkins/jenkins:2.462.2-jdk1795313257a8cd
jetty-http@10.0.20
10.0.28
1
jenkins/jenkins:2.440.3-jdk17de4fea113221
jetty-http@10.0.20
10.0.28
1
jhidalgo3/spring-echo-example:lateste08733191ea0
jetty-http@9.4.35.v20201120
9.4.60
1
jingking/geonetwork-hnap:4.2.843e74ab234e1
jetty-http@9.4.18.v20190429
9.4.60
1
kafkace/kafka:v3.7.1-63ba8d27adc206bf5a4
jetty-http@9.4.54.v20240208
9.4.60
1
kafkakraft/kafka-connect:3.7.0062d697db7e5
jetty-http@9.4.53.v20231009
9.4.60
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.