StackRadar

CVE-2026-2332

High

Advisory

Published 14 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.4
base score, highest
EPSS
0.013
69th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
257
of 17,781 indexed, latest versions
Container images
236
deployed by those charts
Fix available
1 of 1
affected package

Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Carried by container images the latest versions of 257 of 17,781 indexed charts deploy, on 236 images.

Affected packageAffected versionsFixed inImages
jetty-httpmaven9.4.0.v20161208, 9.4.5.v20170502, 9.4.6.v20170531, 9.4.7.v20170914+69 more9.4.60, 10.0.28, 11.0.29, 12.0.33+1 more236
OSV records
GHSA-355h-qmc2-wpwf

Charts affected

257 by stars
ChartLatestAffected imagesRadar Score
trinotrino1.42.21 of 1See more

trino trino 1.42.2

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
trinodb/trino:4801565e8cac299
jetty-http@11.0.26
11.0.29

Open the chart page →

1,309
milvusmilvus4.0.311 of 5See more

milvus milvus 4.0.31

1 of the 5 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.8.2d538416d5afe
jetty-http@9.4.43.v20210629
9.4.60

Open the chart page →

32,259
signozsignoz0.141.11 of 5See more

signoz signoz 0.141.1

1 of the 5 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
signoz/zookeeper:3.7.1fcc4a3288154
jetty-http@9.4.43.v20210629
9.4.60

Open the chart page →

7,568
plantumlstevehipwellVerified publisher3.49.01 of 1See more

plantuml stevehipwell 3.49.0

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
plantuml/plantuml-server:jetty-v1.2026.85f6f99ec2fc1
jetty-http@12.1.6
12.1.7

Open the chart page →

1,869
gocdgocdOfficialVerified publisher2.18.11 of 2See more

gocd gocd 2.18.1

1 of the 2 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
gocd/gocd-server:v26.1.0720d1012b93f
jetty-http@10.0.26
10.0.28

Open the chart page →

1,362
dependency-trackevryfs-ossVerified publisher1.5.51 of 3See more

dependency-track evryfs-oss 1.5.5

1 of the 3 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
dependencytrack/apiserver:4.6.3485ac0952c02
jetty-http@10.0.12
10.0.28

Open the chart page →

2,503
prometheus-cloudwatch-exporterprometheus-communityVerified publisher0.28.21 of 1See more

prometheus-cloudwatch-exporter prometheus-community 0.28.2

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
prom/cloudwatch-exporter:v0.16.071c2e988af06
jetty-http@11.0.22
11.0.29

Open the chart page →

3,382
milvusmilvus-helm5.0.271 of 4See more

milvus milvus-helm 5.0.27

1 of the 4 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
apachepulsar/pulsar:3.0.79c9947de139d
jetty-http@9.4.54.v20240208
9.4.60

Open the chart page →

10,670
bitbucketatlassian-data-centerVerified publisher2.0.151 of 1See more

bitbucket atlassian-data-center 2.0.15

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
atlassian/bitbucket:10.2.705933f2b1cfd
jetty-http@9.4.57.v20241219
9.4.60

Open the chart page →

1,444
zookeepercloudpirates-zookeeperVerified publisher0.13.111 of 1See more

zookeeper cloudpirates-zookeeper 0.13.11

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
library/zookeeper:3.9.5cab8944a33a1
jetty-http@9.4.58.v20250814
9.4.60

Open the chart page →

2,924
polarisapache-polarisOfficialVerified publisher1.3.0-incubating1 of 1See more

polaris apache-polaris 1.3.0-incubating

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
apache/polaris:lateste66366e783f1
jetty-http@9.4.56.v20240826
9.4.60

Open the chart page →

455
druiddruid-helmVerified publisher37.0.21 of 3See more

druid druid-helm 37.0.2

1 of the 3 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
apache/druid:37.0.00116fb802786
jetty-http@9.4.43.v20210629
9.4.60

Open the chart page →

3,812
kafkakubelauncherVerified publisher0.1.261 of 1See more

kafka kubelauncher 0.1.26

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/kafkadigest-pinned43e1085cd0a8
jetty-http@9.4.56.v20240826
9.4.60

Open the chart page →

1,360
zookeeperkubelauncherVerified publisher0.2.111 of 1See more

zookeeper kubelauncher 0.2.11

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/zookeeperdigest-pinned7826e9caa461
jetty-http@9.4.56.v20240826
9.4.60

Open the chart page →

989
neo4jneo4j-helm4.3.2-11 of 1See more

neo4j neo4j-helm 4.3.2-1

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
library/neo4j:4.3.2-enterprise56a9453c4064
jetty-http@9.4.42.v20210604
9.4.60

Open the chart page →

2,640
metabasedeliveryheroVerified publisher0.14.41 of 1See more

metabase deliveryhero 0.14.4

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
metabase/metabase:v0.45.21fb334ce4820
jetty-http@9.4.48.v20220622
9.4.60

Open the chart page →

2,572
hdfsgaffer2.2.11 of 2See more

hdfs gaffer 2.2.1

1 of the 2 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
gchq/hdfs:3.3.35ec58edbb2db
jetty-http@9.4.43.v20210629
9.4.60

Open the chart page →

5,357
kafkakafka18.0.11 of 1See more

kafka kafka 18.0.1

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
kafkace/kafka:v3.7.1-63ba8d27adc206bf5a4
jetty-http@9.4.54.v20240208
9.4.60

Open the chart page →

3,395
microcksmicrocksOfficialVerified publisher0.8.0-helm-3.kube-1.171 of 5See more

microcks microcks 0.8.0-helm-3.kube-1.17

1 of the 5 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
microcks/microcks:0.8.0e3a3e0c67b09
jetty-http@9.4.12.v20180830
9.4.60

Open the chart page →

10,732
solrpreferred-aiVerified publisher3.2.01 of 3See more

solr preferred-ai 3.2.0

1 of the 3 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
library/solr:8.7.0d124efd81fbb
jetty-http@9.4.27.v20200227
9.4.60

Open the chart page →

6,048
puppetserverpuppetserver9.5.22 of 5See more

puppetserver puppetserver 9.5.2

2 of the 5 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
ghcr.io/voxpupuli/container-puppetdb:7.18.0-v1.5.0a56dfe91f5b1
jetty-http@9.4.53.v20231009
9.4.60
ghcr.io/voxpupuli/container-puppetserver:7.17.0-v1.5.0916746209ac5
jetty-http@9.4.53.v20231009
9.4.60

Open the chart page →

14,184
selenium3selenium31.2.41 of 1See more

selenium3 selenium3 1.2.4

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
selenium/hub:3.141.5902f251d48d5f
jetty-http@9.4.12.v20180830
9.4.60

Open the chart page →

11,782
hadoopbigdata-chartsVerified publisher1.0.11 of 2See more

hadoop bigdata-charts 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
5200710/hadoop:3.2.3-java8092d3088a5fb
jetty-http@9.4.48.v20220622
9.4.60

Open the chart page →

12,111
grayloggraylog2OfficialVerified publisher2.0.01 of 2See more

graylog graylog2 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
graylog/graylog-enterprise:7.1.88a1f641cd7aa
jetty-http@9.4.57.v20241219
9.4.60

Open the chart page →

1,500
druidwiremindVerified publisher1.22.11 of 3See more

druid wiremind 1.22.1

1 of the 3 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
apache/druid:29.0.10cef139b6bf1
jetty-http@9.4.51.v20230217
9.4.60

Open the chart page →

7,930
openhabhelmforgeVerified publisher1.2.01 of 1See more

openhab helmforge 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
openhab/openhab:5.2.1bfd4a60e90da
jetty-http@9.4.58.v20250814
9.4.60

Open the chart page →

3,641
scm-managerscm-manager3.12.11 of 1See more

scm-manager scm-manager 3.12.1

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
scmmanager/scm-manager:3.12.1bfb766050f34
jetty-http@11.0.26
11.0.29

Open the chart page →

649
reposilitevolker-raschekVerified publisher1.0.01 of 1See more

reposilite volker-raschek 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
dzikoysk/reposilite:3.5.264128c2d7a6ba
jetty-http@11.0.25
11.0.29

Open the chart page →

2,957
hivebigdata-chartsVerified publisher0.1.81 of 1See more

hive bigdata-charts 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
5200710/hive:3.1.3-postgresql-metastoree34ab066d2ed
jetty-http@9.4.40.v20210413
9.4.60

Open the chart page →

7,166
cmak-operatorcmak-operatorVerified publisher2.2.21 of 3See more

cmak-operator cmak-operator 2.2.2

1 of the 3 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
library/zookeeper:3.6.180ad2170ad62
jetty-http@9.4.24.v20191120
9.4.60

Open the chart page →

4,605
codetogethercodetogether1.4.251 of 1See more

codetogether codetogether 1.4.25

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
codetogether/codetogether:latest4348c8a38752
jetty-http@9.4.55.v20240627
9.4.60

Open the chart page →

7,450
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
library/couchdb:3.4.22817ad50b5c5
jetty-http@11.0.23
11.0.29

Open the chart page →

17,404
hdfsdmwm-bigdataVerified publisher1.0.11 of 2See more

hdfs dmwm-bigdata 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
gradiant/hdfs:3.2.2e3bf364fe713
jetty-http@9.4.20.v20190813
9.4.60

Open the chart page →

7,948
flyte-binaryflyte2.0.481 of 4See more

flyte-binary flyte 2.0.48

1 of the 4 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
jetty-http@9.4.57.v20241219
9.4.60

Open the chart page →

4,641
hazelcasthazelcastVerified publisher5.10.21 of 2See more

hazelcast hazelcast 5.10.2

1 of the 2 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
hazelcast/management-center:5.5.2991ddb27c251
jetty-http@12.0.12
12.0.33

Open the chart page →

2,634
me-untethr-nostr-relaykronkltdVerified publisher0.1.41 of 1See more

me-untethr-nostr-relay kronkltd 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
duck1123/me.untethr.nostr-relay:0.2.1119fc5d4cbfb
jetty-http@9.4.44.v20210927
9.4.60

Open the chart page →

2,072
skywalkingkubesphere-testVerified publisher3.1.01 of 4See more

skywalking kubesphere-test 3.1.0

1 of the 4 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
apache/skywalking-oap-server:8.1.0-es7641237e0299b
jetty-http@9.4.28.v20200408
9.4.60

Open the chart page →

18,042
kafka-chartsoldevelo-kafka-chart32.4.41 of 1See more

kafka-chart soldevelo-kafka-chart 32.4.4

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
soldevelo/kafka:4.0.0-debian-12-r0cfdc08c2f577
jetty-http@12.0.15
12.0.33

Open the chart page →

2,355
thingsboard-clusterthingsboard-cluster-bettaVerified publisher0.2.262 of 6See more

thingsboard-cluster thingsboard-cluster-betta 0.2.26

2 of the 6 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
bitnamilegacy/kafka:3.5.0-debian-11-r08657bb93a581
jetty-http@9.4.51.v20230217
9.4.60
bitnamilegacy/zookeeper:3.9.0-debian-11-r1110ed1ea3c8d1
jetty-http@9.4.51.v20230217
9.4.60

Open the chart page →

14,566
activemq-artemisactivemq-artemis-helm0.3.61 of 1See more

activemq-artemis activemq-artemis-helm 0.3.6

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
vromero/activemq-artemis:2.16.0408d6a46b153
jetty-http@9.4.27.v20200227
9.4.60

Open the chart page →

4,419
paperless-ngxadnoctemVerified publisher0.4.21 of 5See more

paperless-ngx adnoctem 0.4.2

1 of the 5 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
apache/tika:2.9.0.092d055a84e9e
jetty-http@9.4.51.v20230217
9.4.60

Open the chart page →

19,691
clearml-servingallegroaiVerified publisher1.6.22 of 9See more

clearml-serving allegroai 1.6.2

2 of the 9 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
bitnamilegacy/kafka:3.4.0-debian-11-r6ac64829e45b3
jetty-http@9.4.48.v20220622
9.4.60
bitnamilegacy/zookeeper:3.8.1-debian-11-r6dba59d740e13
jetty-http@9.4.49.v20220914
9.4.60

Open the chart page →

17,877
tikaapache-tika3.2.21 of 1See more

tika apache-tika 3.2.2

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
apache/tika:3.2.2.0-fullffab324253ed
jetty-http@11.0.25
11.0.29

Open the chart page →

437
soarv113assist-iot-cybersecurity-monitoring-soar0.1.32 of 5See more

soarv113 assist-iot-cybersecurity-monitoring-soar 0.1.3

2 of the 5 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_ir-ctx:latestae8b3d72eb5d
jetty-http@9.4.39.v20210325
9.4.60
assistiot/cybersecurity-monitoring_ir-thv:latestc8b6c7eaa0cd
jetty-http@9.4.43.v20210629
9.4.60

Open the chart page →

17,896
ignitecloudnativeapp1.0.01 of 1See more

ignite cloudnativeapp 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
apacheignite/ignite:2.7.0d7deab68b8fa
jetty-http@9.4.11.v20180605
9.4.60

Open the chart page →

7,891
cp-schema-registrycp-schema-registryVerified publisher1.0.01 of 1See more

cp-schema-registry cp-schema-registry 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
ghcr.io/devops-ia/cp-schema-registry:8.1.1-msk-iam-auth2.3.530d1a445acc7
jetty-http@12.0.25
12.0.33

Open the chart page →

1,864
nifid4nVerified publisher2.0.01 of 5See more

nifi d4n 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
apache/nifi-registry:1.26.07cdfd8deec92
jetty-http@9.4.54.v20240208
9.4.60

Open the chart page →

5,398
wiremockdeliveryheroVerified publisher1.4.61 of 2See more

wiremock deliveryhero 1.4.6

1 of the 2 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
rodolpheche/wiremock:2.26.03be08a386092
jetty-http@9.4.20.v20190813
9.4.60

Open the chart page →

2,140
nifi-registrydysnixVerified publisher1.1.51 of 2See more

nifi-registry dysnix 1.1.5

1 of the 2 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
apache/nifi-registry:0.8.0974efa2f21da
jetty-http@9.4.19.v20190610
9.4.60

Open the chart page →

6,531
enavenav-service-architectureVerified publisher0.0.71 of 10See more

enav enav-service-architecture 0.0.7

1 of the 10 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
apache/kafka:3.9.0fbc7d7c428e3
jetty-http@9.4.56.v20240826
9.4.60

Open the chart page →

15,860

Container images carrying it

236 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
trinodb/trino:4815b5e0a97f599
jetty-http@11.0.26
11.0.29
1
trinodb/trino:4796af989b0846d
jetty-http@11.0.26
11.0.29
1
trinodb/trino:405ee80ab5eeab2
jetty-http@9.4.49.v20220914
9.4.60
1
verapdf/rest:v1.30.2341359ac6af5
jetty-http@10.0.26
10.0.28
1
vespaengine/vespa:8.526.1569b160f58211
jetty-http@12.0.21
12.0.33
1
voltha/voltha-onos:5.1.8e038acb950d3
jetty-http@9.4.43.v20210629
9.4.60
1
vromero/activemq-artemis:2.16.0408d6a46b153
jetty-http@9.4.27.v20200227
9.4.60
1
wistefan/mvf:lateste0887302b2d8
jetty-http@9.4.48.v20220622
9.4.60
1
ghcr.io/appscode/inbox-server:MailetGroup4a2824296412
jetty-http@9.4.48.v20220622
9.4.60
1
ghcr.io/devops-ia/cp-schema-registry:8.1.1-msk-iam-auth2.3.530d1a445acc7
jetty-http@12.0.25
12.0.33
1
ghcr.io/devops-ia/kafka-cruise-control:jdk17-cc2.5.146-iam2.3.8e310642de2e2
jetty-http@9.4.56.v20240826
9.4.60
1
ghcr.io/fleeksoft/hbase/hbase-base:2.4.13.2c144bdd688d7
jetty-http@9.4.46.v20220331
9.4.60
1
ghcr.io/fleeksoft/hbase/hdfs:3.3.3.2ac62269785ac
jetty-http@9.4.43.v20210629
9.4.60
1
ghcr.io/jenkins-x/nexus:0.1.378caf5289fe73
jetty-http@9.4.30.v20200611
9.4.60
1
ghcr.io/jens-maus/raspberrymatic:3.83.6.202508244b22b4f407c4
jetty-http@9.4.7.v20170914
9.4.60
1
ghcr.io/kenchrcum/tika:3.3.0-full708446bc6783
jetty-http@11.0.26
11.0.29
1
ghcr.io/kubeflow/spark-operator/controller:2.2.1865ff4da5686
jetty-http@9.4.56.v20240826
9.4.60
1
ghcr.io/kubelauncher/kafka43e1085cd0a8
jetty-http@9.4.56.v20240826
9.4.60
1
ghcr.io/kubelauncher/zookeeper7826e9caa461
jetty-http@9.4.56.v20240826
9.4.60
1
ghcr.io/melodyyangaws/hive-metastore:3.0.0e949b0f733f0
jetty-http@9.4.43.v20210629
9.4.60
1
ghcr.io/openccu/openccu:3.89.8.20260719b2de2ff6e8e0
jetty-http@9.4.7.v20170914
9.4.60
1
ghcr.io/open-telemetry/demo:1.12.0-kafka071a788162e8
jetty-http@9.4.53.v20231009
9.4.60
1
ghcr.io/punchplatform/punchline-java:8.1.1d46ce7b96482
jetty-http@9.4.43.v20210629
9.4.60
1
ghcr.io/voxpupuli/container-puppetdb:7.18.0-v1.5.0a56dfe91f5b1
jetty-http@9.4.53.v20231009
9.4.60
1
ghcr.io/voxpupuli/container-puppetserver:7.17.0-v1.5.0916746209ac5
jetty-http@9.4.53.v20231009
9.4.60
1
ghcr.io/voxpupuli/puppetserver:8.7.0-main63873f3f698e
jetty-http@10.0.20
10.0.28
1
ghcr.io/wbstack/queryservice:0.3.6_0.6b83b5b81d4b6
jetty-http@9.4.12.v20180830
9.4.60
1
ghcr.io/wbstack/queryservice-updater:0.3.84_3.97525a57ac3f1
jetty-http@9.4.12.v20180830
9.4.60
1
public.ecr.aws/aktosecurity/akto-api-security-testing-db-layer:1.59.3_local8cdcb7e83f9f
jetty-http@9.4.44.v20210927
9.4.60
1
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.0-1-ubi99026dbbf280d
jetty-http@12.0.25
12.0.33
1
public.ecr.aws/v0r6c2e2/hive-metastore:latest794b3bff9510
jetty-http@9.4.51.v20230217
9.4.60
1
public.ecr.aws/v0r6c2e2/trino:latestc265156b00d1
jetty-http@12.0.16
12.0.33
1
quay.io/fiware/waltid:1.14.1-SNAPSHOT93889c3d8a34
jetty-http@9.4.48.v20220622
9.4.60
1
quay.io/newrelic/synthetics-minion:2.2.2198c26e1b8f70
jetty-http@9.4.11.v20180605
9.4.60
1
quay.io/strimzi/operator:0.45.158c727cd2e68
jetty-http@9.4.57.v20241219
9.4.60
1
quay.io/strimzi/operator:0.36.1e9e03b31007c
jetty-http@9.4.51.v20230217
9.4.60
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.