StackRadar

CVE-2026-27135

High

Advisory

Published 18 Mar 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.008
54th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,447
of 17,792 indexed, latest versions
Container images
1,495
deployed by those charts
Fix available
3 of 3
affected packages

Red Hat Security Advisory: nghttp2 security update

Carried by container images the latest versions of 1,447 of 17,792 indexed charts deploy, on 1,495 images.

Affected packageAffected versionsFixed inImages
nghttp2deb1.30.0-1ubuntu1, 1.40.0-1build1, 1.40.0-1ubuntu0.1, 1.40.0-1ubuntu0.2+11 more1.30.0-1ubuntu1+esm3, 1.40.0-1ubuntu0.3+esm1, 1.43.0-1ubuntu0.3, 1.52.0-1+deb12u3+3 more931
nghttp2rpm1.33.0-1.el8, 1.33.0-1.el8_0.1, 1.33.0-3.el8_2.1, 1.33.0-3.el8_2.2+13 more0:1.33.0-6.el8_10.2, 0:1.43.0-6.el9_7.1, 0:1.64.0-2.el10_1.1, 1.64.0-150700.3.3.1+1 more321
nghttp2apk1.57.0-r0, 1.64.0-r0, 1.65.0-r0, 1.68.0-r01.68.1243
OSV records
ALPINE-CVE-2026-27135DEBIAN-CVE-2026-27135RHSA-2026:7666RHSA-2026:7667RHSA-2026:7668RLSA-2026:7667RLSA-2026:7668UBUNTU-CVE-2026-27135openSUSE-SU-2026:10437-1SUSE-SU-2026:1074-1
Also known as
RHSA-2026:8538, RHSA-2026:8539, RHSA-2026:8540, RHSA-2026:8541, RHSA-2026:8545, RHSA-2026:8547, RHSA-2026:8548, USN-8233-1

Charts affected

1,447 by stars
ChartLatestAffected imagesRadar Score

Container images carrying it

1,495 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
moreillon/api-proxy:latestd7d4a5463525
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
1
moreillon/camera-viewer:lateste418cc694bd5
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
1
moreillon/food-manager:lateste8fd856e593d
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
1
moreillon/group-manager:latest3caa8f710ee0
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
1
moreillon/group-manager-front:latest5f0a38498271
nghttp2@1.64.0-1.1
1.64.0-1.1+deb13u1
1
moreillon/user-manager-front:v5.1.06597e6b98d21
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
1
moreillon/user-manager-mongoose:v5.0.1d2ee0423b797
nghttp2@1.52.0-1
1.52.0-1+deb12u3
1
mrasif/mrasif.in:v4.6.0375a1ed8fdc0
nghttp2@1.68.0-r0
1.68.1
1
mshanley80/httpbin2022:latest5b189a70c0fb
nghttp2@1.40.0-1build1
1.40.0-1ubuntu0.3+esm1
1
muhammedgamal/fp23:latest74b4cd69b6fa
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
1
murtazashah46/helmfile:latest4d11726cf803
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
1
mvance/unbound:1.20.04bf67b567f39
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
1
mvance/unbound:1.22.076906da36d18
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
1
n8nio/n8n:1.115.1ed16e560c40e
nghttp2@1.65.0-r0
1.68.1
1
nacos/nacos-server:v3.0.20e951a1d07bb
nghttp2@1.65.0-r0
1.68.1
1
nacos/nacos-server:v3.0.130a39cb0c54d
nghttp2@1.64.0-r0
1.68.1
1
natsio/nats-box:0.18.0abdc9f9f0120
nghttp2@1.65.0-r0
1.68.1
1
netapp/trident-protect-utils:v1.0.058b9fac358bd
nghttp2@1.65.0-r0
1.68.1
1
netboxcommunity/netbox:v3.2.83d652dca5351
nghttp2@1.43.0-1build3
1.43.0-1ubuntu0.3
1
netrisai/controller-web-service-frontend:4.6.0-0138c5074f55ae5
nghttp2@1.68.0-r0
1.68.1
1
networktocode/nautobot:3.0-py3.13ed484336b1ad
nghttp2@1.64.0-1.1
1.64.0-1.1+deb13u1
1
newrelic/newrelic-agent-control-cli:0.48.01a448492b55a
nghttp2@1.64.0-1.1
1.64.0-1.1+deb13u1
1
nginxdemos/hello:plain-text751bf8933179
nghttp2@1.65.0-r0
1.68.1
1
nginxdemos/hello:0.4b28d1e16c676
nghttp2@1.65.0-r0
1.68.1
1
nginxinc/nginx-unprivileged:1.27.4-alpine62a904036bfc
nghttp2@1.64.0-r0
1.68.1
1
nginxinc/nginx-unprivileged:1.29.0-alpine3.2282dcf28da5a8
nghttp2@1.65.0-r0
1.68.1
1
nginxinc/nginx-unprivileged:1.29.5c5b989ebc150
nghttp2@1.64.0-1.1
1.64.0-1.1+deb13u1
1
nginxinc/nginx-unprivileged:mainline-alpinee93571f3d083
nghttp2@1.68.0-r0
1.68.1
1
nirmalnaveen/supermario:latest8541a39162f3
nghttp2@1.52.0-1
1.52.0-1+deb12u3
1
nocodb/nocodb:0.301.5d9516f0bf546
nghttp2@1.64.0-r0
1.68.1
1
nodered/node-red:4.1.2216e7403aab9
nghttp2@1.65.0-r0
1.68.1
1
novosga/novosga:latest34b9acbe6e51
nghttp2@1.68.0-r0
1.68.1
1
obolnetwork/helios:e10e753cb7e97d39d46
nghttp2@1.59.0-1ubuntu0.2
1.59.0-1ubuntu0.3
1
octoboxio/octobox:latestd909041c46eb
nghttp2@1.68.0-r0
1.68.1
1
offchainlabs/nitro-node:v3.7.6-c0fe95e9f779fa84b7b
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
1
offchainlabs/nitro-node:v3.1.0-7d1d84ce95865866129
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
1
oled01/automx2:2025.1.105d3e398e675
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
1
oled01/db-backup:0.1.06302fd2b5333
nghttp2@1.43.0-1build3
1.43.0-1ubuntu0.3
1
olvid/bot-daemon:2.0.1e0e6b165d879
nghttp2@1.59.0-1ubuntu0.2
1.59.0-1ubuntu0.3
1
omecproject/c3po-hssdb:master-latest28a90cc26716
nghttp2@1.40.0-1build1
1.40.0-1ubuntu0.3+esm1
1
omecproject/cdn-antmedia:1.0.0b4ae7d0d6b74
nghttp2@1.30.0-1ubuntu1
1.30.0-1ubuntu1+esm3
1
onosproject/onos:2.2.144914a8d4b3f
nghttp2@1.30.0-1ubuntu1
1.30.0-1ubuntu1+esm3
1
opea/chatqna:1.038c51b791efa
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
1
opea/codegen:1.058f91683892d
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
1
opea/codegen-ui:1.02bee4eb66f3e
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
1
opea/codetrans:1.0e2436483b73d
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
1
opea/codetrans-ui:1.03ef121f34610
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
1
opea/docsum:1.03eaa91849512
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
1
opea/docsum-ui:1.07f854e9bffaf
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
1
opea/speecht5:1.0249afad3d268
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
1

syft 1.42.1 · advisories as of 16 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.