StackRadar

CVE-2026-27135

High

Advisory

Published 18 Mar 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.008
54th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,450
of 17,803 indexed, latest versions
Container images
1,500
deployed by those charts
Fix available
3 of 3
affected packages

Red Hat Security Advisory: nghttp2 security update

Carried by container images the latest versions of 1,450 of 17,803 indexed charts deploy, on 1,500 images.

Affected packageAffected versionsFixed inImages
nghttp2deb1.30.0-1ubuntu1, 1.40.0-1build1, 1.40.0-1ubuntu0.1, 1.40.0-1ubuntu0.2+11 more1.30.0-1ubuntu1+esm3, 1.40.0-1ubuntu0.3+esm1, 1.43.0-1ubuntu0.3, 1.52.0-1+deb12u3+3 more933
nghttp2rpm1.33.0-1.el8, 1.33.0-1.el8_0.1, 1.33.0-3.el8_2.1, 1.33.0-3.el8_2.2+13 more0:1.33.0-6.el8_10.2, 0:1.43.0-6.el9_7.1, 0:1.64.0-2.el10_1.1, 1.64.0-150700.3.3.1+1 more321
nghttp2apk1.57.0-r0, 1.64.0-r0, 1.65.0-r0, 1.68.0-r01.68.1246
OSV records
ALPINE-CVE-2026-27135DEBIAN-CVE-2026-27135RHSA-2026:7666RHSA-2026:7667RHSA-2026:7668RLSA-2026:7667RLSA-2026:7668UBUNTU-CVE-2026-27135openSUSE-SU-2026:10437-1SUSE-SU-2026:1074-1
Also known as
RHSA-2026:8538, RHSA-2026:8539, RHSA-2026:8540, RHSA-2026:8541, RHSA-2026:8545, RHSA-2026:8547, RHSA-2026:8548, USN-8233-1

Charts affected

1,450 by stars
ChartLatestAffected imagesRadar Score

Container images carrying it

1,500 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/microcks/microcks-operator:0.0.1196d1054d4a61
nghttp2@1.43.0-6.el9
0:1.43.0-6.el9_7.1
1
quay.io/minio/directpv:v4.0.84560083eb77d
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.2
1
quay.io/minio/mc:RELEASE.2022-10-20T23-26-33Z50ee58bc9770
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.2
1
quay.io/minio/mc:RELEASE.2022-09-16T09-16-47Z546a8b52d7b0
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.2
1
quay.io/minio/minio:RELEASE.2022-09-17T00-09-45Zc3d20bc2ea08
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.2
1
quay.io/minio/minio:RELEASE.2022-10-24T18-35-07Zd853057f2800
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.2
1
quay.io/mittwald/brudi-operator:v0.2.3edb322094359
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.2
1
quay.io/mongodb/mongodb-enterprise-operator-ubi:1.33.0b05101723412
nghttp2@1.43.0-6.el9
0:1.43.0-6.el9_7.1
1
quay.io/mongodb/mongodb-kubernetes-operator:0.3.0107a7c73af59
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.2
1
quay.io/mongodb/mongodb-kubernetes-operator:0.9.05ee4bd681085
nghttp2@1.33.0-6.el8_10.1
0:1.33.0-6.el8_10.2
1
quay.io/open-cluster-management/kueue-addon:v0.1.47f728514fead
nghttp2@1.43.0-6.el9
0:1.43.0-6.el9_7.1
1
quay.io/openshift/origin-cli:4.66722d5041b47
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.2
1
quay.io/openshift/origin-console:4.10.00bbe8b451fa3
nghttp2@1.33.0-3.el8_2.2
0:1.33.0-6.el8_10.2
1
quay.io/openshift/origin-jenkins-agent-base:latestc241c971aef8
nghttp2@1.33.0-4.el8_6.1
0:1.33.0-6.el8_10.2
1
quay.io/opsmxpublic/opa:opa-sidecar-v1.03dcbf3caa454
nghttp2@1.65.0-r0
1.68.1
1
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
nghttp2@1.33.0-6.el8_10.1
0:1.33.0-6.el8_10.2
1
quay.io/opsmxpublic/ubi8-oes-audit-client:isd-spin-2025.10.01-cb1bfce-20251126103732a5b1887eab
nghttp2@1.33.0-6.el8_10.1
0:1.33.0-6.el8_10.2
1
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
nghttp2@1.33.0-6.el8_10.1
0:1.33.0-6.el8_10.2
1
quay.io/opsmxpublic/ubi8-oes-datascience:isd-spin-2025.10.01-af26a30d4-202511261054d8f66f4117fe
nghttp2@1.64.0-1.1
1.64.0-1.1+deb13u1
1
quay.io/opsmxpublic/ubi8-oes-db:v3.0.089ee6493af89
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.2
1
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
nghttp2@1.33.0-6.el8_10.1
0:1.33.0-6.el8_10.2
1
quay.io/opsmxpublic/ubi8-oes-ui:isd-spin-2025.10.01-e6f6f01-2025121006405d934bb66884
nghttp2@1.33.0-6.el8_10.1
0:1.33.0-6.el8_10.2
1
quay.io/projectquay/clair:4.9.023329c3368e4
nghttp2@1.33.0-6.el8_10.1
0:1.33.0-6.el8_10.2
1
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
nghttp2@1.43.0-5.el9_3.1
0:1.43.0-6.el9_7.1
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
nghttp2@1.43.0-5.el9
0:1.43.0-6.el9_7.1
1
quay.io/redhat-cop/cert-utils-operator:v1.3.120290e7b2800a
nghttp2@1.33.0-5.el8_9
0:1.33.0-6.el8_10.2
1
quay.io/redhat-cop/patch-operator:v0.1.11030ade9b9428
nghttp2@1.43.0-5.el9_3.1
0:1.43.0-6.el9_7.1
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.2
1
quay.io/seamware/consent-facade:0.0.14be844c750c7e
nghttp2@1.33.0-6.el8_10.1
0:1.33.0-6.el8_10.2
1
quay.io/sshaaf/keycloak-mcp-server:0.4.0b7e9cba72f8a
nghttp2@1.43.0-6.el9
0:1.43.0-6.el9_7.1
1
quay.io/strimzi/operator:0.45.158c727cd2e68
nghttp2@1.43.0-6.el9
0:1.43.0-6.el9_7.1
1
quay.io/strimzi/operator:0.36.1e9e03b31007c
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.2
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.2
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
nghttp2@1.52.0-1
1.52.0-1+deb12u3
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-frontend:1.0.3166353ce9bf98
nghttp2@1.64.0-1.1
1.64.0-1.1+deb13u1
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb:4.4.5cf72810d33f5
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.2
1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator:0.5.136b19b72120e
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.2
1
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
nghttp2@1.40.0-1build1
1.40.0-1ubuntu0.3+esm1
1
registry.gitlab.com/purelb/purelb/allocator:v0.0.0-106-ipv6-lbip-052cedab9d1fcb78f529
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.2
1
registry.gitlab.com/shortlink-org/shortlink/bff:latestf2194e526915
nghttp2@1.68.0-r0
1.68.1
1
registry.gitlab.com/shortlink-org/shortlink/link:latest86d87291ffd4
nghttp2@1.68.0-r0
1.68.1
1
registry.gitlab.com/technostructures/posca/posca:latesta693021686ca
nghttp2@1.68.0-r0
1.68.1
1
registry.gitlab.com/xrow-public/developer-operator/developer-operator-controller:2.1.2301847adfe16
nghttp2@1.43.0-6.el9
0:1.43.0-6.el9_7.1
1
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
nghttp2@1.43.0-6.el9
0:1.43.0-6.el9_7.1
1
registry.gitlab.com/xrow-public/helm-mssql/mssql:1.10.3f923d842bc47
nghttp2@1.64.0-2.el10
0:1.64.0-2.el10_1.1
1
registry.k8s.io/git-sync/git-sync:v4.5.00e64aedb0d0a
nghttp2@1.64.0-1.1
1.64.0-1.1+deb13u1
1
registry.k8s.io/git-sync/git-sync:v4.1.0fd9722fd02e3
nghttp2@1.52.0-1
1.52.0-1+deb12u3
1
registry.k8s.io/ingress-nginx/controller:v1.13.21f7eaeb01933
nghttp2@1.65.0-r0
1.68.1
1
registry.k8s.io/ingress-nginx/controller:v1.13.137e489b22ac7
nghttp2@1.65.0-r0
1.68.1
1
registry.k8s.io/ingress-nginx/controller:v1.12.0e6b8de175acd
nghttp2@1.64.0-r0
1.68.1
1

syft 1.42.1 · advisories as of 18 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.