CVE-2026-2673

High

Advisory

Published 13 Mar 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.004; 37th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 552; of 17,781 indexed, latest versions
Container images: 559; deployed by those charts
Fix available: 2 of 3; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 552 of 17,781 indexed charts deploy, on 559 images.

Affected package	Affected versions	Fixed in	Images
opensslapk	3.2.0-r0, 3.3.1-r4, 3.3.2-r0, 3.3.2-r2+9 more	3.5.6-r0, 3.6.1-r3	430
openssldeb	3.5.1-1, 3.5.1-1+deb13u1, 3.5.3-1ubuntu2, 3.5.4-1~deb13u1+2 more	3.5.3-1ubuntu3.3, 3.5.5-1~deb13u2	124
nodejsdeb	16.14.2-deb-1nodesource1, 16.18.0-deb-1nodesource1, 20.11.1-1nodesource1, 20.15.0-1nodesource1+1 more	no fix listed	5

OSV records: CGA-67j4-8hm8-w6gr ALPINE-CVE-2026-2673 DEBIAN-CVE-2026-2673 UBUNTU-CVE-2026-2673
Also known as: CGA-cjvr-gj7w-mw5f, CGA-g6w5-5h7c-xmc7, CGA-jrm8-5h8q-3f9c, CGA-pr4f-6gqh-h4cw, CGA-r4h6-4294-rmgg, USN-8155-1

Charts affected

552 by stars

Chart

Latest

Affected images

Radar Score

language-toolzekker6

1.12.1

1 of 2 See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-2673.

Container image	Digest	Package	Fixed in
erikvl87/languagetool :6.7-dockerupdate-3	e1ea6a975388	openssl@3.5.5-r0	3.5.6-r0

Open the chart page →

1,571

zipkinzipkin

0.5.0

1 of 1 See more

zipkin zipkin 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-2673.

Container image	Digest	Package	Fixed in
openzipkin/zipkin-slim :3.6.0	a69e1057df36	openssl@3.5.5-r0	3.5.6-r0

Open the chart page →

1,159

Container images carrying it

559 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/kiwigrid/k8s-sidecar :2.5.0	a6b3f707f883	openssl@3.5.4-r0	3.5.6-r0	13
curlimages/curl :8.17.0	935d9100e9ba	openssl@3.5.4-r0	3.5.6-r0	6
alpine/kubectl :1.34.1	8413f8890d19	openssl@3.5.4-r0	3.5.6-r0	5
library/memcached :1.6.39-alpine	c8503d4491ed	openssl@3.5.4-r0	3.5.6-r0	5
registry.k8s.io/ingress-nginx/controller :v1.15.1	594ceea76b01	openssl@3.5.5-r0	3.5.6-r0	5
artifacthub/postgres :latest	4fd34fa635cc	openssl@3.5.1-1	3.5.5-1~deb13u2	4
cloudflare/cloudflared :2026.3.0	6b599ca3e974	openssl@3.5.4-1~deb13u2	3.5.5-1~deb13u2	4
library/postgres :13	4689940c6838	openssl@3.5.1-1+deb13u1	3.5.5-1~deb13u2	4
library/rabbitmq :3.13-management-alpine :3-management-alpine	606d8c0d6b3c	openssl@3.5.4-r0	3.5.6-r0	4
natsio/nats-server-config-reloader :0.23.0	64cb6c858e79	openssl@3.5.5-r0	3.5.6-r0	4
valkey/valkey :9.0.2	930b41430fb7	openssl@3.5.4-1~deb13u2	3.5.5-1~deb13u2	4
curlimages/curl :8.18.0	d94d07ba9e7d	openssl@3.5.4-r0	3.5.6-r0	3
jaegertracing/all-in-one :latest	ab6f1a1f0fb4	openssl@3.5.4-r0	3.5.6-r0	3
library/nats :2.10-alpine	b83efabe3e7d	openssl@3.5.5-r0	3.5.6-r0	3
natsio/nats-box :0.19.2	8031d190c7ee	openssl@3.5.4-r0	3.5.6-r0	3
ghcr.io/dexidp/dex :v2.45.1	8499afd690c4	openssl@3.5.5-r0	3.5.6-r0	3
quay.io/jupyterhub/configurable-http-proxy :5.2.0	522738d5285e	openssl@3.5.5-r0	3.5.6-r0	3
alpine/k8s :1.32.12	048f8d9c8cc7	openssl@3.5.5-r0	3.5.6-r0	2
alpine/kubectl :1.35.2	ec8f734b0a10	openssl@3.5.5-r0	3.5.6-r0	2
apecloud/apecloud-mcp :0.1.0	94041b080510	openssl@3.5.0-r0	3.5.6-r0	2
clamav/clamav :1.4.3_base	629a3050df6a	openssl@3.5.5-r0	3.5.6-r0	2
clickhouse/clickhouse-server :25.7-alpine	258d43821508	openssl@3.5.4-r0	3.5.6-r0	2
curlimages/curl :8.15.0	4026b29997dc	openssl@3.5.1-r0	3.5.6-r0	2
fireflyiii/core :version-6.5.9	fe4ecec4c2ba	openssl@3.5.5-1~deb13u1	3.5.5-1~deb13u2	2
fireflyiii/data-importer :version-2.2.3	ab52bf932546	openssl@3.5.5-1~deb13u1	3.5.5-1~deb13u2	2
grafana/grafana :12.3.1	2175aaa91c96	openssl@3.5.4-r0	3.5.6-r0	2
grafana/grafana :12.3.3	9e1e77ade304	openssl@3.5.5-r0	3.5.6-r0	2
grafana/grafana :12.4.1	e932bd6ed0e0	openssl@3.5.5-r0	3.5.6-r0	2
helmforge/kubectl :1.35.3	c3f97e954c47	openssl@3.5.5-r0	3.5.6-r0	2
ilum/ui :6.7.3	998937726679	openssl@3.5.5-r0	3.5.6-r0	2
jenkins/jenkins :2.541.3-jdk21	c4098086090c	openssl@3.5.5-1~deb13u1	3.5.5-1~deb13u2	2
kiwigrid/k8s-sidecar :1.30.9	8c06e1ba643a	openssl@3.5.1-r0	3.5.6-r0	2
library/nginx :1.29.4	9dd288848f44	openssl@3.5.4-1~deb13u2	3.5.5-1~deb13u2	2
library/postgres :18.1	1090bc3a8ccf	openssl@3.5.4-1~deb13u2	3.5.5-1~deb13u2	2
library/postgres :18.0	6f3e42ad37de	openssl@3.5.1-1+deb13u1	3.5.5-1~deb13u2	2
library/postgres :13-alpine	fb9065b6e3e2	openssl@3.5.4-r0	3.5.6-r0	2
library/wordpress :6.8.3-apache :6.8-apache	30bff39330d1	openssl@3.5.4-1~deb13u1	3.5.5-1~deb13u2	2
mesosphere/kubectl :v1.35.0-alpine	ea01a9387771	openssl@3.5.4-r0	3.5.6-r0	2
mojaloop/reporting-events-processor-svc :v3.5.1	1e0d24d28512	openssl@3.5.1-r0	3.5.6-r0	2
mojaloop/security-role-perm-operator-svc :v3.0.2	12af60892c75	openssl@3.5.4-r0	3.5.6-r0	2
natsio/nats-server-config-reloader :0.21.1	10ff229eaf52	openssl@3.5.4-r0	3.5.6-r0	2
rancher/local-path-provisioner :v0.0.35	34ff0847cc47	openssl@3.5.5-r0	3.5.6-r0	2
timberio/vector :0.51.1-alpine	2d16ae87ec39	openssl@3.5.4-r0	3.5.6-r0	2
tzahi12345/youtubedl-material :4.3.2 :latest	2f943d584711	nodejs@16.14.2-deb-1nodesource1	no fix listed	2
valkey/valkey :7.2.11-alpine	10328d00120d	openssl@3.5.5-r0	3.5.6-r0	2
valkey/valkey :9.0.1	546304417fea	openssl@3.5.4-1~deb13u1	3.5.5-1~deb13u2	2
valkey/valkey :8.1.4	81db6d39e1bb	openssl@3.5.1-1+deb13u1	3.5.5-1~deb13u2	2
ghcr.io/appscode/license-proxyserver :v0.1.1	e192ad567e0b	openssl@3.5.5-r0	3.5.6-r0	2
ghcr.io/appscode/service-provider :v0.0.2	f6e481386d70	openssl@3.5.4-r0	3.5.6-r0	2
ghcr.io/astriaorg/astria-geth :latest	4249e403225a	openssl@3.5.0-r0	3.5.6-r0	2