CVE-2026-23865
MediumAdvisory
Published 2 Mar 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.001
- 4th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 147
- of 17,781 indexed, latest versions
- Container images
- 133
- deployed by those charts
- Fix available
- 8 of 8
- affected packages
The matching OSV records carry no description.
Carried by container images the latest versions of 147 of 17,781 indexed charts deploy, on 133 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| freetypedeb | 2.13.2+dfsg-1build3, 2.13.3+dfsg-1, 2.13.3+dfsg-1build1 | 2.13.2+dfsg-1ubuntu0.1, 2.13.3+dfsg-1+deb13u1, 2.13.3+dfsg-1ubuntu0.1 | 73 |
| openjdk-8deb | 8u151-b12-0ubuntu0.16.04.2, 8u171-b11-0ubuntu0.16.04.1, 8u191-b12-2ubuntu0.16.04.1, 8u212-b03-0ubuntu1.18.04.1+11 more | 8u492-ga~us2-0ubuntu1~16.04.1, 8u492-ga~us2-0ubuntu1~18.04.1, 8u492-ga~us2-0ubuntu1~20.04.1, 8u492-ga~us2-0ubuntu1~22.04.1+1 more | 22 |
| javabitnami | 11.0.15-150, 11.0.18-10-1, 11.0.18-10-2, 11.0.20-8-3+12 more | 11.0.31 | 16 |
| openjdk-ltsdeb | 11.0.3+7-1ubuntu2~18.04.1, 11.0.8+10-0ubuntu1~18.04.1, 11.0.11+9-0ubuntu2~20.04, 11.0.13+8-0ubuntu1~20.04+6 more | 11.0.31+11-1ubuntu1~18.04.2, 11.0.31+11-1ubuntu1~20.04.2, 11.0.31+11-1ubuntu1~24.04.2 | 16 |
| openjdk-17deb | 17.0.3+7-0ubuntu0.20.04.1, 17.0.8+7-1~22.04, 17.0.9+9-1~20.04, 17.0.10+7-1~22.04.1+3 more | 17.0.19+10-1~20.04.2, 17.0.19+10-1~22.04.2, 17.0.19+10-1~24.04.2 | 8 |
| Javabitnami | 11.0.20-8, 11.0.21-10, 17.0.8-7, 17.0.10-13-1+2 more | 11.0.31 | 7 |
| jrebitnami | 17.0.16-12-0, 17.0.19-11-2, 21.0.8-12-0, 21.0.9-15-0 | 11.0.31 | 4 |
| openjdk-21deb | 21.0.5+11-1ubuntu1~24.04, 21.0.7+6~us1-0ubuntu1~24.04, 21.0.11~8ea-1 | 21.0.11+10-1~24.04.2, 21.0.11+10-1~26.04.2 | 4 |
- OSV records
- BIT-java-2026-23865BIT-jre-2026-23865DEBIAN-CVE-2026-23865UBUNTU-CVE-2026-23865
- Also known as
- BIT-java-min-2026-23865, DSA-6168-1, USN-8086-1, USN-8327-1, USN-8328-1, USN-8330-1, USN-8331-1
Charts affected
147 by stars
Container images carrying it
133 by charts deploying them
A fixed version is listed for 8 of the 8 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| hyperledger/ | 4ce6f43ded2e | openjdk-8 | 8u492-ga~us2-0ubuntu1~16.04.1 | 4 |
| hyperledger/ | f6c724592abf | openjdk-8 | 8u492-ga~us2-0ubuntu1~16.04.1 | 4 |
| gchq/ | 5ec58edbb2db | freetype openjdk-8 | 2.13.2+dfsg-1ubuntu0.1 8u492-ga~us2-0ubuntu1~24.04.1 | 3 |
| guacamole/ | f344085e618b | freetype | 2.13.2+dfsg-1ubuntu0.1 | 3 |
| jacobalberty/ | 896c0ab82d33 | openjdk-17 | 17.0.19+10-1~20.04.2 | 3 |
| selenium/ | 02f251d48d5f | openjdk-8 | 8u492-ga~us2-0ubuntu1~20.04.1 | 3 |
| signoz/ | fcc4a3288154 | java Java | 11.0.31 11.0.31 | 3 |
| apache/ | 319cd8a81ed1 | freetype | 2.13.2+dfsg-1ubuntu0.1 | 2 |
| apache/ | ae0b86d3c4d0 | freetype openjdk-17 | 2.13.2+dfsg-1ubuntu0.1 17.0.19+10-1~24.04.2 | 2 |
| bitnamilegacy/ | 00176a47afa0 | java | 11.0.31 | 2 |
| bitnamilegacy/ | 10ed1ea3c8d1 | java Java | 11.0.31 11.0.31 | 2 |
| hookiesolutions/ | 0629694246ba | openjdk-lts | 11.0.31+11-1ubuntu1~20.04.2 | 2 |
| hyperledger/ | a674d35eec9a | openjdk-17 | 17.0.19+10-1~20.04.2 | 2 |
| jenkins/ | c4098086090c | freetype | 2.13.3+dfsg-1+deb13u1 | 2 |
| kurento/ | 03c0d34d0828 | freetype | 2.13.2+dfsg-1ubuntu0.1 | 2 |
| library/ | 9dd288848f44 | freetype | 2.13.3+dfsg-1+deb13u1 | 2 |
| library/ | 30bff39330d1 | freetype | 2.13.3+dfsg-1+deb13u1 | 2 |
| mbentley/ | f4e682274bed | openjdk-8 | 8u492-ga~us2-0ubuntu1~18.04.1 | 2 |
| opendatacube/ | 668cbb41473c | freetype | 2.13.2+dfsg-1ubuntu0.1 | 2 |
| ghcr.io/ | 82d0b161161d | freetype openjdk-21 | 2.13.2+dfsg-1ubuntu0.1 21.0.11+10-1~24.04.2 | 2 |
| 1dev/ | cd5b12fe5471 | freetype openjdk-lts | 2.13.2+dfsg-1ubuntu0.1 11.0.31+11-1ubuntu1~24.04.2 | 1 |
| 5200710/ | 092d3088a5fb | openjdk-8 | 8u492-ga~us2-0ubuntu1~20.04.1 | 1 |
| adorsys/ | 85be7a45a94c | freetype | 2.13.2+dfsg-1ubuntu0.1 | 1 |
| adorsys/ | eb49a2dcbbb8 | freetype | 2.13.2+dfsg-1ubuntu0.1 | 1 |
| aktosecurity/ | 213aded7adc5 | freetype | 2.13.2+dfsg-1ubuntu0.1 | 1 |
| andrewgaul/ | 7dc1d34174a5 | freetype | 2.13.2+dfsg-1ubuntu0.1 | 1 |
| anguda/ | c435285fc241 | openjdk-lts | 11.0.31+11-1ubuntu1~20.04.2 | 1 |
| apache/ | 0305c26f19ed | freetype | 2.13.2+dfsg-1ubuntu0.1 | 1 |
| apache/ | bae523439ee3 | freetype | 2.13.2+dfsg-1ubuntu0.1 | 1 |
| apache/ | 75d48a62748f | freetype | 2.13.2+dfsg-1ubuntu0.1 | 1 |
| apache/ | a2bab1be574c | freetype | 2.13.2+dfsg-1ubuntu0.1 | 1 |
| apachepulsar/ | 3b262ab7a7d9 | openjdk-lts | 11.0.31+11-1ubuntu1~20.04.2 | 1 |
| apachepulsar/ | d056c89b7131 | openjdk-lts | 11.0.31+11-1ubuntu1~20.04.2 | 1 |
| apachepulsar/ | d538416d5afe | openjdk-lts | 11.0.31+11-1ubuntu1~20.04.2 | 1 |
| apache/ | 434d8398f996 | freetype | 2.13.2+dfsg-1ubuntu0.1 | 1 |
| apache/ | 90b7fa1dc018 | openjdk-21 | 21.0.11+10-1~26.04.2 | 1 |
| apache/ | 92d055a84e9e | openjdk-17 | 17.0.19+10-1~22.04.2 | 1 |
| atlassian/ | 64a75aa4ec4e | freetype | 2.13.2+dfsg-1ubuntu0.1 | 1 |
| bitnami/ | 9cc4a173c69e | jre | 11.0.31 | 1 |
| bitnamilegacy/ | 2b7a217999a1 | java | 11.0.31 | 1 |
| bitnamilegacy/ | 15d4647fd491 | java Java | 11.0.31 11.0.31 | 1 |
| bitnamilegacy/ | 9cfd2df1294d | java Java | 11.0.31 11.0.31 | 1 |
| bitnamilegacy/ | e6f6ddcce2f1 | java | 11.0.31 | 1 |
| bitnamilegacy/ | 8657bb93a581 | java | 11.0.31 | 1 |
| bitnamilegacy/ | ac64829e45b3 | java | 11.0.31 | 1 |
| bitnamilegacy/ | b6e381ffd6ae | java | 11.0.31 | 1 |
| bitnamilegacy/ | cb04e49e6eb1 | java | 11.0.31 | 1 |
| bitnamilegacy/ | cc599cbd15ff | java Java | 11.0.31 11.0.31 | 1 |
| bitnamilegacy/ | da3df0976a9f | jre | 11.0.31 | 1 |
| bitnamilegacy/ | d8440eb6b290 | java | 11.0.31 | 1 |