CVE-2026-28755

Medium

Advisory

Published 24 Mar 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.4; base score, highest
EPSS: 0.001; 3rd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 12; of 17,781 indexed, latest versions
Container images: 12; deployed by those charts
Fix available: 4 of 4; affected packages

NGINX ngx_stream_ssl_module vulnerability

Carried by container images the latest versions of 12 of 17,781 indexed charts deploy, on 12 images.

Affected package	Affected versions	Fixed in	Images
nginxapk	1.28.0-r3, 1.28.1-r1, 1.28.2-r1	1.28.3-r0	7
nginxdeb	1.24.0-2ubuntu7.1, 1.24.0-2ubuntu7.5	1.24.0-2ubuntu7.7	2
nginx-mainlineapk	1.27.4-r0, 1.27.4-r2	1.29.7-r0	2
nginxbitnami	1.28.0-0	1.28.3	1

OSV records: ALPINE-CVE-2026-28755 BIT-nginx-2026-28755 CGA-mxj8-2635-78w6 UBUNTU-CVE-2026-28755
Also known as: BIT-nginx-gateway-2026-28755, CGA-x79f-gwx5-3g4c, USN-8210-1

Charts affected

12 by stars

Chart

Latest

Affected images

Radar Score

zabbixzabbix-community

7.1.0

1 of 5 See more

zabbix zabbix-community 7.1.0

1 of the 5 container images this version deploys carry CVE-2026-28755.

Container image	Digest	Package	Fixed in
zabbix/zabbix-web-nginx-pgsql :ubuntu-7.0.23	7d4d58086515	nginx@1.24.0-2ubuntu7.5	1.24.0-2ubuntu7.7

Open the chart page →

13,664

dbrepodbrepo

1.13.3

1 of 25 See more

dbrepo dbrepo 1.13.3

1 of the 25 container images this version deploys carry CVE-2026-28755.

Container image	Digest	Package	Fixed in
bitnamilegacy/nginx :1.28.0-debian-12-r0	eaf9066e86f6	nginx@1.28.0-0	1.28.3

Open the chart page →

52,635

zabbix-server-mysqlfermosit

3.0.2

1 of 4 See more

zabbix-server-mysql fermosit 3.0.2

1 of the 4 container images this version deploys carry CVE-2026-28755.

Container image	Digest	Package	Fixed in
zabbix/zabbix-web-nginx-mysql :ubuntu-6.4-latest	0e5f69c4c54e	nginx@1.24.0-2ubuntu7.1	1.24.0-2ubuntu7.7

Open the chart page →

12,840

label-studioinseefrlab

2.3.1

1 of 3 See more

label-studio inseefrlab 2.3.1

1 of the 3 container images this version deploys carry CVE-2026-28755.

Container image	Digest	Package	Fixed in
heartexlabs/label-studio :latest	aa461572e8f9	nginx@1.28.2-r1	1.28.3-r0

Open the chart page →

3,157

docker-mailservermailserver

0.2.65

1 of 9 See more

docker-mailserver mailserver 0.2.65

1 of the 9 container images this version deploys carry CVE-2026-28755.

Container image	Digest	Package	Fixed in
jeboehm/mailserver-web :5.0.92	9da13edf5aa8	nginx@1.28.0-r3	1.28.3-r0

Open the chart page →

10,897

outscale-s3-exploreroutscale-s3-explorer

0.1.4

1 of 1 See more

outscale-s3-explorer outscale-s3-explorer 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-28755.

Container image	Digest	Package	Fixed in
ghcr.io/solucteam/outscale-s3-explorer :v1.0.0	9665c3e71889	nginx@1.28.0-r3	1.28.3-r0

Open the chart page →

1,811

kubecostradar-base

1.0.0

1 of 7 See more

kubecost radar-base 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-28755.

Container image	Digest	Package	Fixed in
gcr.io/kubecost1/frontend :prod-2.6.3	a535f7de024b	nginx-mainline@1.27.4-r0	1.29.7-r0

Open the chart page →

9,355

tandoorrtomik-helm-charts

0.0.1

1 of 1 See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-28755.

Container image	Digest	Package	Fixed in
vabene1111/recipes :2.3.5	0f8d061895e9	nginx@1.28.0-r3	1.28.3-r0

Open the chart page →

4,499

synapse-adminschoenwald

1.0.1

1 of 1 See more

synapse-admin schoenwald 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-28755.

Container image	Digest	Package	Fixed in
awesometechnologies/synapse-admin :0.11.4	a1c1f4662875	nginx@1.28.2-r1	1.28.3-r0

Open the chart page →

1,802

tabixsinextra

0.2.2

1 of 1 See more

tabix sinextra 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-28755.

Container image	Digest	Package	Fixed in
ghcr.io/sergelogvinov/tabix :22.05.17	a6e3e996a4ae	nginx@1.28.0-r3	1.28.3-r0

Open the chart page →

1,249

cost-analyzersoftonic

2.5.5

1 of 6 See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2026-28755.

Container image	Digest	Package	Fixed in
gcr.io/kubecost1/frontend :prod-2.5.5	991c1465c658	nginx-mainline@1.27.4-r2	1.29.7-r0

Open the chart page →

7,901

mrasiftech-thinker

1.0.4

1 of 1 See more

mrasif tech-thinker 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-28755.

Container image	Digest	Package	Fixed in
mrasif/mrasif.in :v4.6.0	375a1ed8fdc0	nginx@1.28.1-r1	1.28.3-r0

Open the chart page →

2,043

Container images carrying it

12 by charts deploying them

A fixed version is listed for 4 of the 4 affected packages.

Container image	Digest	Package	Fixed in	Used by
awesometechnologies/synapse-admin :0.11.4	a1c1f4662875	nginx@1.28.2-r1	1.28.3-r0	1
bitnamilegacy/nginx :1.28.0-debian-12-r0	eaf9066e86f6	nginx@1.28.0-0	1.28.3	1
heartexlabs/label-studio :latest	aa461572e8f9	nginx@1.28.2-r1	1.28.3-r0	1
jeboehm/mailserver-web :5.0.92	9da13edf5aa8	nginx@1.28.0-r3	1.28.3-r0	1
mrasif/mrasif.in :v4.6.0	375a1ed8fdc0	nginx@1.28.1-r1	1.28.3-r0	1
vabene1111/recipes :2.3.5	0f8d061895e9	nginx@1.28.0-r3	1.28.3-r0	1
zabbix/zabbix-web-nginx-mysql :ubuntu-6.4-latest	0e5f69c4c54e	nginx@1.24.0-2ubuntu7.1	1.24.0-2ubuntu7.7	1
zabbix/zabbix-web-nginx-pgsql :ubuntu-7.0.23	7d4d58086515	nginx@1.24.0-2ubuntu7.5	1.24.0-2ubuntu7.7	1
gcr.io/kubecost1/frontend :prod-2.5.5	991c1465c658	nginx-mainline@1.27.4-r2	1.29.7-r0	1
gcr.io/kubecost1/frontend :prod-2.6.3	a535f7de024b	nginx-mainline@1.27.4-r0	1.29.7-r0	1
ghcr.io/sergelogvinov/tabix :22.05.17	a6e3e996a4ae	nginx@1.28.0-r3	1.28.3-r0	1
ghcr.io/solucteam/outscale-s3-explorer :v1.0.0	9665c3e71889	nginx@1.28.0-r3	1.28.3-r0	1