StackRadar

CVE-2026-27135

High

Advisory

Published 18 Mar 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.008
54th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,451
of 17,790 indexed, latest versions
Container images
1,503
deployed by those charts
Fix available
3 of 3
affected packages

Red Hat Security Advisory: nghttp2 security update

Carried by container images the latest versions of 1,451 of 17,790 indexed charts deploy, on 1,503 images.

Affected packageAffected versionsFixed inImages
nghttp2deb1.30.0-1ubuntu1, 1.40.0-1build1, 1.40.0-1ubuntu0.1, 1.40.0-1ubuntu0.2+11 more1.30.0-1ubuntu1+esm3, 1.40.0-1ubuntu0.3+esm1, 1.43.0-1ubuntu0.3, 1.52.0-1+deb12u3+3 more935
nghttp2rpm1.33.0-1.el8, 1.33.0-1.el8_0.1, 1.33.0-3.el8_2.1, 1.33.0-3.el8_2.2+13 more0:1.33.0-6.el8_10.2, 0:1.43.0-6.el9_7.1, 0:1.64.0-2.el10_1.1, 1.64.0-150700.3.3.1+1 more322
nghttp2apk1.57.0-r0, 1.64.0-r0, 1.65.0-r0, 1.68.0-r01.68.1246
OSV records
ALPINE-CVE-2026-27135DEBIAN-CVE-2026-27135RHSA-2026:7666RHSA-2026:7667RHSA-2026:7668RLSA-2026:7667RLSA-2026:7668UBUNTU-CVE-2026-27135openSUSE-SU-2026:10437-1SUSE-SU-2026:1074-1
Also known as
RHSA-2026:8538, RHSA-2026:8539, RHSA-2026:8540, RHSA-2026:8541, RHSA-2026:8545, RHSA-2026:8547, RHSA-2026:8548, USN-8233-1

Charts affected

1,451 by stars
ChartLatestAffected imagesRadar Score
language-toolzekker6Verified publisher1.12.11 of 2See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-27135.

Container imageDigestPackageFixed in
erikvl87/languagetool:6.7-dockerupdate-3e1ea6a975388
nghttp2@1.68.0-r0
1.68.1

Open the chart page →

1,571

Container images carrying it

1,503 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
library/phpmyadmin:5.2.16e75aa8f767c
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
2
library/python:3.7eedf63967cdb
nghttp2@1.52.0-1
1.52.0-1+deb12u3
2
library/wordpress:6.8.3-apache:6.8-apache30bff39330d1
nghttp2@1.64.0-1.1
1.64.0-1.1+deb13u1
2
louislam/uptime-kuma:2.3.29aeb4e51d038
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
2
mesosphere/kubeaddons-catalog:v0.11.4073db43d0b8b
nghttp2@1.40.0-1build1
1.40.0-1ubuntu0.3+esm1
2
mesosphere/kubectl:v1.35.0-alpineea01a9387771
nghttp2@1.65.0-r0
1.68.1
2
minio/operator:v4.3.754393e03f3b2
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.2
2
moreillon/group-manager-front:v3.3.1c9f85db3baa5
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
2
moreillon/user-manager:v5.0.2e1c9bfab5c16
nghttp2@1.52.0-1
1.52.0-1+deb12u3
2
moreillon/user-manager-front:v5.0.3b067dbbbb6af
nghttp2@1.52.0-1
1.52.0-1+deb12u3
2
nginxinc/nginx-unprivileged:1.27-alpine65e3e85dbaed
nghttp2@1.64.0-r0
1.68.1
2
obsidiandynamics/kafdrop:3.30.05337c9e0e2de
nghttp2@1.40.0-1build1
1.40.0-1ubuntu0.3+esm1
2
opencloudeu/web-extensions:unzip-1.0.01691ad6612a3
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
2
opencloudeu/web-extensions:draw-io-1.0.027cb9b952f0d
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
2
opencloudeu/web-extensions:external-sites-1.0.05b176baa3694
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
2
opencloudeu/web-extensions:importer-1.0.06e8b2df6c5a4
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
2
opencloudeu/web-extensions:progress-bars-1.0.082f888a34440
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
2
opencloudeu/web-extensions:json-viewer-1.0.0e0ac35a9576e
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
2
opendatacube/ows:latest668cbb41473c
nghttp2@1.59.0-1ubuntu0.1
1.59.0-1ubuntu0.3
2
piomin/sample-spring-kotlin-microservice:1.1871f784dd6bc
nghttp2@1.43.0-1build3
1.43.0-1ubuntu0.3
2
qichenxu4pd/pythonexample:1.0f3a8502bc21b
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
2
quickwit/quickwit:v0.8.2363ff56ce456
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
2
rajnandan1/kener:3.2.1930407afca731
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
2
stakater/stakater-nordmart-review:1.0.35954d2be66e95
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.2
2
streamnative/apache-pulsar-grafana-dashboard-k8s:0.1.20e6d7aa3ef32
nghttp2@1.40.0-1ubuntu0.3
1.40.0-1ubuntu0.3+esm1
2
svtechnmaa/svtech_debuger:v1.0.0b2987abe57d3
nghttp2@1.43.0-1build3
1.43.0-1ubuntu0.3
2
tzahi12345/youtubedl-material:4.3.2:latest2f943d584711
nghttp2@1.43.0-1build3
1.43.0-1ubuntu0.3
2
uffizzi/controller:latest0344805f267b
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
2
uselagoon/docker-host:v3.6.12c89ed939b8b
nghttp2@1.64.0-r0
1.68.1
2
vdiogov/glpi-conteiner:latest6945f84f0058
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
2
wolveix/satisfactory-server:latest:v1.9.10e103700ae6ae
nghttp2@1.43.0-1ubuntu0.2
1.43.0-1ubuntu0.3
2
zabbix/zabbix-agent:ubuntu-6.4-latest349b924472a7
nghttp2@1.59.0-1ubuntu0.1
1.59.0-1ubuntu0.3
2
ghcr.io/appscode/inbox-server:latest:postgres-latest536358d7b17e
nghttp2@1.43.0-1ubuntu0.2
1.43.0-1ubuntu0.3
2
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
nghttp2@1.59.0-1ubuntu0.2
1.59.0-1ubuntu0.3
2
ghcr.io/codingducksrl/laravel:8.15be52524664c
nghttp2@1.43.0-1build3
1.43.0-1ubuntu0.3
2
ghcr.io/cross-seed/cross-seed:6.13.381afafdd96a5
nghttp2@1.65.0-r0
1.68.1
2
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
nghttp2@1.43.0-1build3
1.43.0-1ubuntu0.3
2
ghcr.io/flaresolverr/flaresolverr:v3.4.67962759d99d7
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
2
ghcr.io/games-on-whales/retroarch:1.0.0103fbcec2314
nghttp2@1.40.0-1build1
1.40.0-1ubuntu0.3+esm1
2
ghcr.io/google/fleetspeak:v0.1.17cd264d33efd4
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
2
ghcr.io/grafana/helm-chart-toolbox-kubectl:0.1.1c137478627cc
nghttp2@1.65.0-r0
1.68.1
2
ghcr.io/home-operations/readarr:0.4.18:0.4.18.28058f7551205fbd
nghttp2@1.65.0-r0
1.68.1
2
ghcr.io/linuxserver/openvpn-as:version-2.8.6-916f8e7d-ubuntu184ee0764310e7
nghttp2@1.30.0-1ubuntu1
1.30.0-1ubuntu1+esm3
2
ghcr.io/nginxinc/nginx-s3-gateway/nginx-oss-s3-gateway:unprivileged-oss:unprivileged-oss-202503313db8145349a3
nghttp2@1.52.0-1+deb12u1
1.52.0-1+deb12u3
2
ghcr.io/salaboy/fmtok8s-frontend:v0.1.103fd01b4f56e
nghttp2@1.43.0-1build3
1.43.0-1ubuntu0.3
2
ghcr.io/smarter-project/home-ha-mock:main95ee018cf558
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
2
ghcr.io/smarter-project/hydra/isolated-vm:main4457b79b24cd
nghttp2@1.52.0-1+deb12u2
1.52.0-1+deb12u3
2
mcr.microsoft.com/azure-sql-edge:latest902628a8be89
nghttp2@1.40.0-1ubuntu0.1
1.40.0-1ubuntu0.3+esm1
2
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.1-1-ubi9d20bd62f0182
nghttp2@1.43.0-6.el9
0:1.43.0-6.el9_7.1
2
quay.io/argoproj/argocd:v2.14.115fc69e31c755
nghttp2@1.59.0-1ubuntu0.2
1.59.0-1ubuntu0.3
2

syft 1.42.1 · advisories as of 16 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.