StackRadar

CVE-2026-27135

High

Advisory

Published 18 Mar 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.008
54th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,447
of 17,792 indexed, latest versions
Container images
1,495
deployed by those charts
Fix available
3 of 3
affected packages

Red Hat Security Advisory: nghttp2 security update

Carried by container images the latest versions of 1,447 of 17,792 indexed charts deploy, on 1,495 images.

Affected packageAffected versionsFixed inImages
nghttp2deb1.30.0-1ubuntu1, 1.40.0-1build1, 1.40.0-1ubuntu0.1, 1.40.0-1ubuntu0.2+11 more1.30.0-1ubuntu1+esm3, 1.40.0-1ubuntu0.3+esm1, 1.43.0-1ubuntu0.3, 1.52.0-1+deb12u3+3 more931
nghttp2rpm1.33.0-1.el8, 1.33.0-1.el8_0.1, 1.33.0-3.el8_2.1, 1.33.0-3.el8_2.2+13 more0:1.33.0-6.el8_10.2, 0:1.43.0-6.el9_7.1, 0:1.64.0-2.el10_1.1, 1.64.0-150700.3.3.1+1 more321
nghttp2apk1.57.0-r0, 1.64.0-r0, 1.65.0-r0, 1.68.0-r01.68.1243
OSV records
ALPINE-CVE-2026-27135DEBIAN-CVE-2026-27135RHSA-2026:7666RHSA-2026:7667RHSA-2026:7668RLSA-2026:7667RLSA-2026:7668UBUNTU-CVE-2026-27135openSUSE-SU-2026:10437-1SUSE-SU-2026:1074-1
Also known as
RHSA-2026:8538, RHSA-2026:8539, RHSA-2026:8540, RHSA-2026:8541, RHSA-2026:8545, RHSA-2026:8547, RHSA-2026:8548, USN-8233-1

Charts affected

1,447 by stars
ChartLatestAffected imagesRadar Score

Container images carrying it

1,495 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
supabase/realtime:v2.33.8d207e6e23ad3
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
1
supabase/studio:20241021-9f9b08326d8070c55e9
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
1
svcosti/cidrapp:latest8428d87bc5d0
nghttp2@1.64.0-r0
1.68.1
1
svtechnmaa/svtech_debuger:v1.0.3a934ffd63d25
nghttp2@1.43.0-1ubuntu0.2
1.43.0-1ubuntu0.3
1
svtechnmaa/svtech_grafana:v1.2.21d71314424aa
nghttp2@1.40.0-1ubuntu0.1
1.40.0-1ubuntu0.3+esm1
1
svtechnmaa/svtech_maxscale:v1.0.3410a25b51f9f
nghttp2@1.43.0-1ubuntu0.1
1.43.0-1ubuntu0.3
1
svtechnmaa/svtech_nagvis:v1.2.118394b08e6c3
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
1
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
nghttp2@1.40.0-1ubuntu0.1
1.40.0-1ubuntu0.3+esm1
1
sysnet4admin/colosseum-cms:loge74b43c7f492
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
1
sysnet4admin/colosseum-prm:log5802bfcd7fed
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
1
teknas09/bird-pod:latest12a1fa85c4aa
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
1
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
nghttp2@1.65.0-r0
1.68.1
1
temporalio/admin-tools:1.28cfde8170c92f
nghttp2@1.68.0-r0
1.68.1
1
temporalio/auto-setup:1.29.15b3502a3b685
nghttp2@1.65.0-r0
1.68.1
1
temporalio/auto-setup:1.27.2b44cbfeb43db
nghttp2@1.64.0-r0
1.68.1
1
temporalio/server:1.29.1c1e3326b2ce1
nghttp2@1.65.0-r0
1.68.1
1
temporalio/ui:2.44.00b36e00aad30
nghttp2@1.65.0-r0
1.68.1
1
temporalio/ui:2.39.0b768f87f18b5
nghttp2@1.64.0-r0
1.68.1
1
theradius/loggia:0.463ba348546ec
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
1
thijsvanloef/palworld-server-docker:v2.7.1401d3eb5c053
nghttp2@1.64.0-1.1
1.64.0-1.1+deb13u1
1
thijsvanloef/palworld-server-docker:v2.5.0b4ac9ee22483
nghttp2@1.64.0-1.1
1.64.0-1.1+deb13u1
1
thmmniii/fbs-core:v1.27.15438517d9fc2
nghttp2@1.43.0-1build3
1.43.0-1ubuntu0.3
1
thongngo3301/stakefish:latesta341af5976e3
nghttp2@1.52.0-1
1.52.0-1+deb12u3
1
timescale/timescaledb-ha:pg15-latesta8e3322e1cf9
nghttp2@1.43.0-1build3
1.43.0-1ubuntu0.3
1
timescale/timescaledb-ha:pg14.6-ts2.9.1-p1cdb9ae118899
nghttp2@1.43.0-1build3
1.43.0-1ubuntu0.3
1
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
nghttp2@1.43.0-1ubuntu0.2
1.43.0-1ubuntu0.3
1
timescale/timescaledb-ha:pg14-ts2.6-latested719c0cd19d
nghttp2@1.43.0-1build3
1.43.0-1ubuntu0.3
1
tinymediamanager/tinymediamanager:5.3.22b34dc85099e
nghttp2@1.64.0-1.1
1.64.0-1.1+deb13u1
1
tombursch/kitchenowl-backend:v0.7.8b48e4ab727cd
nghttp2@1.64.0-1.1
1.64.0-1.1+deb13u1
1
tombursch/kitchenowl-web:v0.7.8517f808eee66
nghttp2@1.68.0-r0
1.68.1
1
tomsquest/docker-radicale:3.6.1.0a594c624c5a6
nghttp2@1.68.0-r0
1.68.1
1
treskon/portrait-web-setup:DEV-latesta475d80e4ecf
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
1
trinodb/trino:4801565e8cac299
nghttp2@1.64.0-2.el10
0:1.64.0-2.el10_1.1
1
trinodb/trino:45038c6f24ab1a4
nghttp2@1.43.0-5.el9_4.3
0:1.43.0-6.el9_7.1
1
trinodb/trino:4796af989b0846d
nghttp2@1.64.0-2.el10
0:1.64.0-2.el10_1.1
1
trinodb/trino:405ee80ab5eeab2
nghttp2@1.43.0-1build3
1.43.0-1ubuntu0.3
1
trueosiris/vrising:latest9356f98ad561
nghttp2@1.43.0-1ubuntu0.2
1.43.0-1ubuntu0.3
1
twentycrm/twenty-postgres-spilo:latest2f78405a78be
nghttp2@1.43.0-1ubuntu0.1
1.43.0-1ubuntu0.3
1
ubuntu/bind9:9.16-20.04_beta5ee73f44e5d0
nghttp2@1.40.0-1ubuntu0.3
1.40.0-1ubuntu0.3+esm1
1
udhos/apiping:1.5.041ab9bae6f3b
nghttp2@1.65.0-r0
1.68.1
1
udhos/gateboard:1.12.53acc0e7599bf
nghttp2@1.65.0-r0
1.68.1
1
udhos/gateboard-discovery:1.9.55567c9363c4c
nghttp2@1.65.0-r0
1.68.1
1
udhos/mongoping:1.3.103b08b63f524
nghttp2@1.64.0-r0
1.68.1
1
udhos/rabbitping:1.3.0474c467bbf42
nghttp2@1.64.0-r0
1.68.1
1
udhos/redis-enforce-expire:1.0.0615b6a7d742e
nghttp2@1.68.0-r0
1.68.1
1
udhos/secrets:1.0.6daa2b4eaac09
nghttp2@1.64.0-r0
1.68.1
1
udhos/token-server:1.0.9728013f2fac1
nghttp2@1.65.0-r0
1.68.1
1
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
1
vabene1111/recipes:2.3.50f8d061895e9
nghttp2@1.65.0-r0
1.68.1
1
vaultwarden/server:1.35.443498a94b22f
nghttp2@1.64.0-1.1
1.64.0-1.1+deb13u1
1

syft 1.42.1 · advisories as of 16 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.