CVE-2026-28387

High

Advisory

Published 7 Apr 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.1; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,303; of 17,821 indexed, latest versions
Container images: 2,562; deployed by those charts
Fix available: 3 of 4; affected packages

CVE-2026-28387 affecting package openssl for versions less than 3.3.7-2

Carried by container images the latest versions of 2,303 of 17,821 indexed charts deploy, on 2,562 images.

Affected package	Affected versions	Fixed in	Images
openssldeb	1.1.0g-2ubuntu4.1, 1.1.0g-2ubuntu4.3, 1.1.1-1ubuntu2.1~18.04.4, 1.1.1-1ubuntu2.1~18.04.5+81 more	1.1.1-1ubuntu2.1~18.04.23+esm8, 1.1.1f-1ubuntu2.24+esm3, 3.0.2-0ubuntu1.23, 3.0.13-0ubuntu3.9+3 more	1,633
opensslapk	3.1.4-r2, 3.2.0-r0, 3.3.0-r2, 3.3.1-r0+22 more	3.3.7-r0, 3.5.6-r0, 3.6.2-r0	919
nodejsdeb	4.2.6~dfsg-1ubuntu4.1, 7.10.1-2nodesource1~xenial1, 8.9.4-1nodesource1, 8.10.0~dfsg-2ubuntu0.4+13 more	no fix listed	22
opensslrpm	3.3.5-1.azl3, 3.3.5-3.azl3, 3.3.5-5.azl3	3.3.7-2	5

OSV records: ALPINE-CVE-2026-28387 CGA-2m6v-xf35-w7r6 CGA-35qm-vc7p-cgg6 DEBIAN-CVE-2026-28387 UBUNTU-CVE-2026-28387 AZL-81947 ECHO-6fc6-4872-7ea8
Also known as: CGA-778p-whh3-f9cv, CGA-w98m-q38h-wxww, USN-8155-1, USN-8155-2

Charts affected

2,303 by stars

Chart

Latest

Affected images

Radar Score

zipkinzipkin

0.5.0

1 of 1 See more

zipkin zipkin 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-28387.

Container image	Digest	Package	Fixed in
openzipkin/zipkin-slim :3.6.0	a69e1057df36	openssl@3.5.5-r0	3.5.6-r0

Open the chart page →

1,191

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-28387.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	openssl@1.1.1-1ubuntu2.1~18.04.14	1.1.1-1ubuntu2.1~18.04.23+esm8
yandex/clickhouse-server :21.3.20	4eccfffb01d7	openssl@1.1.1f-1ubuntu2.10	1.1.1f-1ubuntu2.24+esm3

Open the chart page →

9,297

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-28387.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	openssl@3.0.2-0ubuntu1.26	no fix listed

Open the chart page →

7,966

Container images carrying it

2,562 by charts deploying them

A fixed version is listed for 3 of the 4 affected packages.

Container image	Digest	Package	Fixed in	Used by
testinprod/op-erigon :latest	0a125bd77a2d	openssl@3.0.17-1~deb12u3	3.0.19-1~deb12u2	2
timberio/vector :0.51.1-alpine	2d16ae87ec39	openssl@3.5.4-r0	3.5.6-r0	2
tzahi12345/youtubedl-material :4.3.2 :latest	2f943d584711	nodejs@16.14.2-deb-1nodesource1 openssl@3.0.2-0ubuntu1.9	no fix listed 3.0.2-0ubuntu1.23	2
uffizzi/controller :latest	0344805f267b	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	2
uselagoon/docker-host :v3.6.1	2c89ed939b8b	openssl@3.3.3-r0	3.3.7-r0	2
valkey/valkey :7.2.11-alpine	10328d00120d	openssl@3.5.5-r0	3.5.6-r0	2
valkey/valkey :9.0.1	546304417fea	openssl@3.5.4-1~deb13u1	3.5.5-1~deb13u2	2
valkey/valkey :8.1.4	81db6d39e1bb	openssl@3.5.1-1+deb13u1	3.5.5-1~deb13u2	2
vdiogov/glpi-conteiner :latest	6945f84f0058	openssl@3.0.13-1~deb12u1	3.0.19-1~deb12u2	2
wolveix/satisfactory-server :latest :v1.9.10	e103700ae6ae	openssl@3.0.2-0ubuntu1.19	3.0.2-0ubuntu1.23	2
zabbix/zabbix-agent :ubuntu-6.4-latest	349b924472a7	openssl@3.0.13-0ubuntu3.4	3.0.13-0ubuntu3.9	2
ghcr.io/appscode/inbox-server :latest :postgres-latest	536358d7b17e	openssl@3.0.2-0ubuntu1.20	3.0.2-0ubuntu1.23	2
ghcr.io/appscode/service-provider :v0.0.2	f6e481386d70	openssl@3.5.4-r0	3.5.6-r0	2
ghcr.io/astriaorg/astria-geth :latest	4249e403225a	openssl@3.5.0-r0	3.5.6-r0	2
ghcr.io/astriaorg/conductor :latest	3ea8164b0eae	openssl@3.0.17-1~deb12u2	3.0.19-1~deb12u2	2
ghcr.io/bryopsida/k8s-dev-pod :main	82d0b161161d	openssl@3.0.13-0ubuntu3.5	3.0.13-0ubuntu3.9	2
ghcr.io/celestiaorg/celestia-node :v0.27.5-mocha	4768ea1c5fd2	openssl@3.3.1-r3	3.3.7-r0	2
ghcr.io/codingducksrl/laravel :8.1	5be52524664c	nodejs@16.18.0-deb-1nodesource1 openssl@3.0.2-0ubuntu1.6	no fix listed 3.0.2-0ubuntu1.23	2
ghcr.io/cosmos/gaia :v25.1.0	f115777d1112	openssl@3.5.0-r0	3.5.6-r0	2
ghcr.io/cross-seed/cross-seed :6.13.3	81afafdd96a5	openssl@3.5.1-r0	3.5.6-r0	2
ghcr.io/danbooru/danbooru :9cab67c0ac72a8c52289302c519715ceec2372d9	5f545698e907	openssl@3.0.2-0ubuntu1.6	3.0.2-0ubuntu1.23	2
ghcr.io/flaresolverr/flaresolverr :v3.4.6	7962759d99d7	openssl@3.0.17-1~deb12u3	3.0.19-1~deb12u2	2
ghcr.io/games-on-whales/pulseaudio :1.0.0	f34f98405c10	openssl@1.1.1f-1ubuntu2.8	1.1.1f-1ubuntu2.24+esm3	2
ghcr.io/games-on-whales/retroarch :1.0.0	103fbcec2314	openssl@1.1.1f-1ubuntu2.8	1.1.1f-1ubuntu2.24+esm3	2
ghcr.io/games-on-whales/steam :1.0.0	9b6105be7ad0	openssl@1.1.1f-1ubuntu2.8	1.1.1f-1ubuntu2.24+esm3	2
ghcr.io/google/fleetspeak :v0.1.17	cd264d33efd4	openssl@3.0.13-1~deb12u1	3.0.19-1~deb12u2	2
ghcr.io/grafana/helm-chart-toolbox-kubectl :0.1.1	c137478627cc	openssl@3.5.1-r0	3.5.6-r0	2
ghcr.io/home-operations/readarr :0.4.18 :0.4.18.2805	8f7551205fbd	openssl@3.5.0-r0	3.5.6-r0	2
ghcr.io/immich-app/postgres :14-vectorchord0.4.3-pgvectors0.2.0	bcf63357191b	openssl@3.0.17-1~deb12u2	3.0.19-1~deb12u2	2
ghcr.io/kiwigrid/k8s-sidecar :1.29.1	42002d66ddb3	openssl@3.3.2-r4	3.3.7-r0	2
ghcr.io/kluster-manager/cluster-auth :v0.5.1	fba6fb872281	openssl@3.5.5-r0	3.5.6-r0	2
ghcr.io/linuxserver/openvpn-as :version-2.8.6-916f8e7d-ubuntu18	4ee0764310e7	openssl@1.1.1-1ubuntu2.1~18.04.6	1.1.1-1ubuntu2.1~18.04.23+esm8	2
ghcr.io/nginxinc/nginx-s3-gateway/nginx-oss-s3-gateway :unprivileged-oss :unprivileged-oss-20250331	3db8145349a3	openssl@3.0.14-1~deb12u2	3.0.19-1~deb12u2	2
ghcr.io/nucleuscloud/neosync/api :0.5.41	e2abb798f29f	openssl@3.0.16-1~deb12u1	3.0.19-1~deb12u2	2
ghcr.io/nucleuscloud/neosync/app :0.5.41	ca31ec35b829	openssl@3.5.0-r0	3.5.6-r0	2
ghcr.io/nucleuscloud/neosync/worker :0.5.41	96f42450c5b1	openssl@3.0.16-1~deb12u1	3.0.19-1~deb12u2	2
ghcr.io/postgresml/pgcat :main	245f9d2f5f5b	openssl@3.0.11-1~deb12u2	3.0.19-1~deb12u2	2
ghcr.io/postgresml/pgcat :v1.2.0	627761f6dcbc	openssl@3.0.13-1~deb12u1	3.0.19-1~deb12u2	2
ghcr.io/rss3-network/agentdata :0.1.0	fd8d3e6e4cdf	openssl@3.0.15-1~deb12u1	3.0.19-1~deb12u2	2
ghcr.io/salaboy/fmtok8s-agenda-service :v0.0.1-native	6c5efe150958	openssl@1.1.1-1ubuntu2.1~18.04.21	1.1.1-1ubuntu2.1~18.04.23+esm8	2
ghcr.io/salaboy/fmtok8s-c4p-service :v0.0.1-native	3f7cc45fd20b	openssl@1.1.1-1ubuntu2.1~18.04.21	1.1.1-1ubuntu2.1~18.04.23+esm8	2
ghcr.io/salaboy/fmtok8s-frontend :v0.1.1	03fd01b4f56e	openssl@3.0.2-0ubuntu1.2	3.0.2-0ubuntu1.23	2
ghcr.io/smarter-project/home-ha-mock :main	95ee018cf558	openssl@3.0.15-1~deb12u1	3.0.19-1~deb12u2	2
ghcr.io/smarter-project/hydra/isolated-vm :main	4457b79b24cd	openssl@3.0.18-1~deb12u2	3.0.19-1~deb12u2	2
ghcr.io/wg-easy/wg-easy :14	5f26407fd2ed	openssl@3.5.0-r0	3.5.6-r0	2
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	openssl@1.1.1f-1ubuntu2.19	1.1.1f-1ubuntu2.24+esm3	2
public.ecr.aws/cloudnatix/llmariner/model-manager-loader :1.27.0	26ac7263a823	openssl@3.5.1-1	3.5.5-1~deb13u2	2
quay.io/argoproj/argocd :v2.14.11	5fc69e31c755	openssl@3.0.13-0ubuntu3.5	3.0.13-0ubuntu3.9	2
quay.io/curl/curl :8.16.0	b17b13321678	openssl@3.5.2-r0	3.5.6-r0	2
quay.io/frrouting/frr :10.4.3	8745af1f9bbb	openssl@3.5.5-r0	3.5.6-r0	2