StackRadar

CVE-2026-2332

High

Advisory

Published 14 Apr 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.4
base score, highest
EPSS
0.013
69th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
260
of 17,787 indexed, latest versions
Container images
239
deployed by those charts
Fix available
1 of 1
affected package

Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Carried by container images the latest versions of 260 of 17,787 indexed charts deploy, on 239 images.

Affected packageAffected versionsFixed inImages
jetty-httpmaven9.4.0.v20161208, 9.4.5.v20170502, 9.4.6.v20170531, 9.4.7.v20170914+69 more9.4.60, 10.0.28, 11.0.29, 12.0.33+1 more239
OSV records
GHSA-355h-qmc2-wpwf

Charts affected

260 by stars
ChartLatestAffected imagesRadar Score
hadoop-deploymenttejaswita-hadoop-helmchart1.0.01 of 1See more

hadoop-deployment tejaswita-hadoop-helmchart 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
apache/hadoop:3af361b20bec0
jetty-http@9.4.51.v20230217
9.4.60

Open the chart page →

4,239
clickhousetemp-charts0.7.11 of 3See more

clickhouse temp-charts 0.7.1

1 of the 3 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
library/zookeeper:3.6.180ad2170ad62
jetty-http@9.4.24.v20191120
9.4.60

Open the chart page →

8,705
tikatikaVerified publisher0.3.01 of 1See more

tika tika 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
ghcr.io/kenchrcum/tika:3.3.0-full708446bc6783
jetty-http@11.0.26
11.0.29

Open the chart page →

1,826
zookeepertwomartensVerified publisher0.2.21 of 1See more

zookeeper twomartens 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
confluentinc/cp-zookeeper:latest7610a50b13e7
jetty-http@9.4.57.v20241219
9.4.60

Open the chart page →

1,733
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
apache/tika:2.9.2.1-fullae0b86d3c4d0
jetty-http@9.4.54.v20240208
9.4.60

Open the chart page →

45,392
ubooquityvhdirkVerified publisher0.1.31 of 1See more

ubooquity vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
linuxserver/ubooquity:2.1.2-ls369932d6759112
jetty-http@9.4.0.v20161208
9.4.60

Open the chart page →

4,302
queryservicewbstack0.2.11 of 1See more

queryservice wbstack 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
ghcr.io/wbstack/queryservice:0.3.6_0.6b83b5b81d4b6
jetty-http@9.4.12.v20180830
9.4.60

Open the chart page →

4,649
queryservice-updaterwbstack0.3.01 of 1See more

queryservice-updater wbstack 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
ghcr.io/wbstack/queryservice-updater:0.3.84_3.97525a57ac3f1
jetty-http@9.4.12.v20180830
9.4.60

Open the chart page →

3,176
drillwearefrank1.3.62 of 3See more

drill wearefrank 1.3.6

2 of the 3 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
apache/drill:1.21.11f96558fd292
jetty-http@9.4.41.v20210516
9.4.60
bitnamilegacy/zookeeper:3.9.0-debian-11-r1110ed1ea3c8d1
jetty-http@9.4.51.v20230217
9.4.60

Open the chart page →

9,399
hazelcastwenerme5.10.31 of 2See more

hazelcast wenerme 5.10.3

1 of the 2 container images this version deploys carry CVE-2026-2332.

Container imageDigestPackageFixed in
hazelcast/management-center:5.5.20095e0320623
jetty-http@12.0.12
12.0.33

Open the chart page →

2,623

Container images carrying it

239 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
wurstmeister/kafka:latest2d4bbf9cc83d
jetty-http@9.4.43.v20210629
9.4.60
7
library/zookeeper:3.5.5b7a76ec06f68
jetty-http@9.4.17.v20190418
9.4.60
6
solsson/kafka:latest41e5d8f6f290
jetty-http@9.4.48.v20220622
9.4.60
5
quay.io/strimzi/operator:0.37.052f376e64b9b
jetty-http@9.4.51.v20230217
9.4.60
4
gchq/hdfs:3.3.35ec58edbb2db
jetty-http@9.4.43.v20210629
9.4.60
3
library/solr:8.11.18c5f7881cebb
jetty-http@9.4.44.v20210927
9.4.60
3
selenium/hub:3.141.5902f251d48d5f
jetty-http@9.4.12.v20180830
9.4.60
3
signoz/zookeeper:3.7.1fcc4a3288154
jetty-http@9.4.43.v20210629
9.4.60
3
apache/druid:37.0.00116fb802786
jetty-http@9.4.43.v20210629
9.4.60
2
apache/nifi-registry:1.26.07cdfd8deec92
jetty-http@9.4.54.v20240208
9.4.60
2
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
jetty-http@9.4.10.v20180503
9.4.60
2
apache/tika:2.9.2.1-fullae0b86d3c4d0
jetty-http@9.4.54.v20240208
9.4.60
2
bitnamilegacy/zookeeper:3.9.0-debian-11-r1110ed1ea3c8d1
jetty-http@9.4.51.v20230217
9.4.60
2
confluentinc/cp-kafka:6.2.11-1-ubi8ac776fad95a5
jetty-http@9.4.51.v20230217
9.4.60
2
confluentinc/cp-zookeeper:latest7610a50b13e7
jetty-http@9.4.57.v20241219
9.4.60
2
confluentinc/cp-zookeeper:6.2.11-1-ubi8cae577096489
jetty-http@9.4.51.v20230217
9.4.60
2
datagrok/grok_connect:latestf5876d3aebb8
jetty-http@9.4.58.v20250814
9.4.60
2
dependencytrack/apiserver:4.6.3485ac0952c02
jetty-http@10.0.12
10.0.28
2
hazelcast/management-center:5.5.20095e0320623
jetty-http@12.0.12
12.0.33
2
jenkins/jenkins:2.426.1-jdk11b470bcdc4ecd
jetty-http@10.0.17
10.0.28
2
jenkins/jenkins:2.541.3-jdk21c4098086090c
jetty-http@12.1.5
12.1.7
2
library/neo4j:5.20.052d3dec8d455
jetty-http@10.0.20
10.0.28
2
library/neo4j:4.3.2-enterprise56a9453c4064
jetty-http@9.4.42.v20210604
9.4.60
2
library/zookeeper:3.6.180ad2170ad62
jetty-http@9.4.24.v20191120
9.4.60
2
library/zookeeper:3.9.5f258365d4882
jetty-http@9.4.58.v20250814
9.4.60
2
linuxserver/ubooquity:2.1.2-ls369932d6759112
jetty-http@9.4.0.v20161208
9.4.60
2
mbentley/omada-controller:4.3f4e682274bed
jetty-http@9.4.15.v20190215
9.4.60
2
metabase/metabase:v0.45.21fb334ce4820
jetty-http@9.4.48.v20220622
9.4.60
2
rodolpheche/wiremock:2.26.03be08a386092
jetty-http@9.4.20.v20190813
9.4.60
2
ghcr.io/appscode/inbox-server:latest:postgres-latest536358d7b17e
jetty-http@12.0.20
12.0.33
2
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
jetty-http@9.4.57.v20241219
9.4.60
2
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.1-1-ubi9d20bd62f0182
jetty-http@12.0.25
12.0.33
2
quay.io/strimzi/operator:0.39.002f6f143fc6d
jetty-http@9.4.53.v20231009
9.4.60
2
quay.io/strimzi/operator:0.46.0ac434a48ac2b
jetty-http@12.0.16
12.0.33
2
1dev/server:11.9.0cd5b12fe5471
jetty-http@9.4.54.v20240208
9.4.60
1
5200710/hadoop:3.2.3-java8092d3088a5fb
jetty-http@9.4.48.v20220622
9.4.60
1
5200710/hive:3.1.3-postgresql-metastoree34ab066d2ed
jetty-http@9.4.40.v20210413
9.4.60
1
ahmetfurkandemir/iceberg-rest-fixture-postgresql:1.10.0142231a0b8b7
jetty-http@11.0.26
11.0.29
1
aktosecurity/data-ingestion-service213aded7adc5
jetty-http@9.4.58.v20250814
9.4.60
1
aktosecurity/data-ingestion-service:1.4.946ed5bcb04b2
jetty-http@9.4.58.v20250814
9.4.60
1
alfresco/alfresco-activemq:5.18.7-jre17-rockylinux85472f88d9b0b
jetty-http@9.4.57.v20241219
9.4.60
1
amazon/dynamodb-local:1.20.01ed00881c937
jetty-http@9.4.48.v20220622
9.4.60
1
anguda/ant-media:2.5c435285fc241
jetty-http@9.4.11.v20180605
9.4.60
1
apache/activemq-artemis:2.44.00305c26f19ed
jetty-http@12.1.3
12.1.7
1
apache/activemq-artemis:2.37.0bae523439ee3
jetty-http@10.0.22
10.0.28
1
apache/bookkeeper:4.14.5a7d9970c148f
jetty-http@9.4.43.v20210629
9.4.60
1
apache/drill:1.21.11f96558fd292
jetty-http@9.4.41.v20210516
9.4.60
1
apache/druid:29.0.10cef139b6bf1
jetty-http@9.4.51.v20230217
9.4.60
1
apache/gravitino-iceberg-rest:1.3.080136ae753ee
jetty-http@9.4.51.v20230217
9.4.60
1
apache/hadoop:3af361b20bec0
jetty-http@9.4.51.v20230217
9.4.60
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.