CVE-2026-27135

High

Advisory

Published 18 Mar 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.008; 54th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,451; of 17,790 indexed, latest versions
Container images: 1,503; deployed by those charts
Fix available: 3 of 3; affected packages

Red Hat Security Advisory: nghttp2 security update

Carried by container images the latest versions of 1,451 of 17,790 indexed charts deploy, on 1,503 images.

Affected package	Affected versions	Fixed in	Images
nghttp2deb	1.30.0-1ubuntu1, 1.40.0-1build1, 1.40.0-1ubuntu0.1, 1.40.0-1ubuntu0.2+11 more	1.30.0-1ubuntu1+esm3, 1.40.0-1ubuntu0.3+esm1, 1.43.0-1ubuntu0.3, 1.52.0-1+deb12u3+3 more	935
nghttp2rpm	1.33.0-1.el8, 1.33.0-1.el8_0.1, 1.33.0-3.el8_2.1, 1.33.0-3.el8_2.2+13 more	0:1.33.0-6.el8_10.2, 0:1.43.0-6.el9_7.1, 0:1.64.0-2.el10_1.1, 1.64.0-150700.3.3.1+1 more	322
nghttp2apk	1.57.0-r0, 1.64.0-r0, 1.65.0-r0, 1.68.0-r0	1.68.1	246

OSV records: ALPINE-CVE-2026-27135 DEBIAN-CVE-2026-27135 RHSA-2026:7666 RHSA-2026:7667 RHSA-2026:7668 RLSA-2026:7667 RLSA-2026:7668 UBUNTU-CVE-2026-27135 openSUSE-SU-2026:10437-1 SUSE-SU-2026:1074-1
Also known as: RHSA-2026:8538, RHSA-2026:8539, RHSA-2026:8540, RHSA-2026:8541, RHSA-2026:8545, RHSA-2026:8547, RHSA-2026:8548, USN-8233-1

Charts affected

1,451 by stars

Chart

Latest

Affected images

Radar Score

language-toolzekker6

1.12.1

1 of 2 See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-27135.

Container image	Digest	Package	Fixed in
erikvl87/languagetool :6.7-dockerupdate-3	e1ea6a975388	nghttp2@1.68.0-r0	1.68.1

Open the chart page →

1,571

Container images carrying it

1,503 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
library/mongo :5.0.32-focal	3b6c281e1c08	nghttp2@1.40.0-1ubuntu0.3	1.40.0-1ubuntu0.3+esm1	1
library/mongo :4.4-bionic	3d0e6df9fd5b	nghttp2@1.30.0-1ubuntu1	1.30.0-1ubuntu1+esm3	1
library/mongo :5.0.14-focal	50cae5081ab4	nghttp2@1.40.0-1build1	1.40.0-1ubuntu0.3+esm1	1
library/mongo :6.0.12	646902910d6a	nghttp2@1.43.0-1ubuntu0.1	1.43.0-1ubuntu0.3	1
library/mongo :4.2	699d652ed674	nghttp2@1.30.0-1ubuntu1	1.30.0-1ubuntu1+esm3	1
library/mongo :4.2.1	6ca49afbcb2b	nghttp2@1.30.0-1ubuntu1	1.30.0-1ubuntu1+esm3	1
library/mongo :6.0.2	71a63fc2438e	nghttp2@1.40.0-1build1	1.40.0-1ubuntu0.3+esm1	1
library/mongo :5.0.21	7c81758cb295	nghttp2@1.40.0-1ubuntu0.1	1.40.0-1ubuntu0.3+esm1	1
library/mongo :7.0.28-jammy	88785f6f665a	nghttp2@1.43.0-1ubuntu0.2	1.43.0-1ubuntu0.3	1
library/mongo :4.2.21-bionic	9cb28f7291d9	nghttp2@1.30.0-1ubuntu1	1.30.0-1ubuntu1+esm3	1
library/mongo :7.0.12	ae1cf99fa7bf	nghttp2@1.43.0-1ubuntu0.2	1.43.0-1ubuntu0.3	1
library/mongo :4.4.18	d23ec07162ca	nghttp2@1.40.0-1build1	1.40.0-1ubuntu0.3+esm1	1
library/mongo :8.0.11	dca8d11fe467	nghttp2@1.59.0-1ubuntu0.2	1.59.0-1ubuntu0.3	1
library/nextcloud :31.0.6-apache	588609d76b21	nghttp2@1.52.0-1+deb12u2	1.52.0-1+deb12u3	1
library/nextcloud :31.0.10-apache	b7faa1653c39	nghttp2@1.64.0-1.1	1.64.0-1.1+deb13u1	1
library/nginx :1.27.4	09369da6b103	nghttp2@1.52.0-1+deb12u2	1.52.0-1+deb12u3	1
library/nginx :1.29	1881968aff6f	nghttp2@1.64.0-1.1	1.64.0-1.1+deb13u1	1
library/nginx :1.29.8-alpine	5616878291a2	nghttp2@1.68.0-r0	1.68.1	1
library/nginx :1.27-alpine	65645c7bb6a0	nghttp2@1.64.0-r0	1.68.1	1
library/nginx :1.27	6784fb0834aa	nghttp2@1.52.0-1+deb12u2	1.52.0-1+deb12u3	1
library/nginx :1.25.1	67f9a4f10d14	nghttp2@1.52.0-1	1.52.0-1+deb12u3	1
library/nginx :1.25.4	9ff236ed47fe	nghttp2@1.52.0-1+deb12u1	1.52.0-1+deb12u3	1
library/nginx :1.28-alpine	a8b39bd9cf0f	nghttp2@1.68.0-r0	1.68.1	1
library/nginx :1.29.3-alpine	b3c656d55d7a	nghttp2@1.65.0-r0	1.68.1	1
library/nginx :1.27.3	fb197595ebe7	nghttp2@1.52.0-1+deb12u2	1.52.0-1+deb12u3	1
library/node :20	8f693eaa7e0a	nghttp2@1.52.0-1+deb12u2	1.52.0-1+deb12u3	1
library/php :8.5.2-fpm-alpine3.22	a2482c398d60	nghttp2@1.65.0-r0	1.68.1	1
library/postgres :18.3-alpine	54451ecb8ab3	nghttp2@1.68.0-r0	1.68.1	1
library/python :3.8	d41127070014	nghttp2@1.52.0-1+deb12u1	1.52.0-1+deb12u3	1
library/python :3.9	da5aee29682d	nghttp2@1.64.0-1.1	1.64.0-1.1+deb13u1	1
library/sonarqube :10.7.0-community	0842dcd4c8f8	nghttp2@1.43.0-1ubuntu0.2	1.43.0-1ubuntu0.3	1
library/sonarqube :10.0.0-community	ef9723cf4fe4	nghttp2@1.43.0-1build3	1.43.0-1ubuntu0.3	1
library/telegraf :1.27	507a3eecf809	nghttp2@1.52.0-1+deb12u1	1.52.0-1+deb12u3	1
library/wordpress :6.4.3-apache	8ae66efb09a2	nghttp2@1.52.0-1+deb12u1	1.52.0-1+deb12u3	1
library/wordpress :php8.1-apache	f73396626d2f	nghttp2@1.64.0-1.1	1.64.0-1.1+deb13u1	1
library/zookeeper :3.8-temurin	55d1e5b2e601	nghttp2@1.43.0-1build3	1.43.0-1ubuntu0.3	1
library/zookeeper :3.9.4	dfa9ba46d14b	nghttp2@1.43.0-1ubuntu0.2	1.43.0-1ubuntu0.3	1
linkstackorg/linkstack :latest	1c8b05399ee4	nghttp2@1.65.0-r0	1.68.1	1
linuxserver/calibre :version-v5.21.0	a847b5b2d860	nghttp2@1.30.0-1ubuntu1	1.30.0-1ubuntu1+esm3	1
linuxserver/calibre-web :0.6.24	241009026e6f	nghttp2@1.59.0-1ubuntu0.2	1.59.0-1ubuntu0.3	1
linuxserver/calibre-web :version-0.6.12	938810eca3d3	nghttp2@1.40.0-1build1	1.40.0-1ubuntu0.3+esm1	1
linuxserver/cloud9 :latest	45c5fe102ff3	nghttp2@1.30.0-1ubuntu1	1.30.0-1ubuntu1+esm3	1
linuxserver/code-server :4.10.1	a5e43a05ae79	nghttp2@1.43.0-1build3	1.43.0-1ubuntu0.3	1
linuxserver/codimd :latest	b801bbcf6386	nghttp2@1.30.0-1ubuntu1	1.30.0-1ubuntu1+esm3	1
linuxserver/deluge :libtorrentv1-2.2.0-ls40	052eac68ccc0	nghttp2@1.64.0-r0	1.68.1	1
linuxserver/deluge :18.04.1	0ac871624394	nghttp2@1.30.0-1ubuntu1	1.30.0-1ubuntu1+esm3	1
linuxserver/deluge :version-2.0.3-2201906121747ubuntu18.04.1	2ce561a95e7b	nghttp2@1.30.0-1ubuntu1	1.30.0-1ubuntu1+esm3	1
linuxserver/foldingathome :7.6.21	9a997426d71e	nghttp2@1.59.0-1ubuntu0.1	1.59.0-1ubuntu0.3	1
linuxserver/jellyfin :10.7.7	2427dde159a2	nghttp2@1.40.0-1build1	1.40.0-1ubuntu0.3+esm1	1
linuxserver/lazylibrarian :version-1152df82	f93d2560e233	nghttp2@1.30.0-1ubuntu1	1.30.0-1ubuntu1+esm3	1