StackRadarChart IndexLive demo

CVE-2026-33871

High

Advisory

Published 26 Mar 2026In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 8.7; base score, highest
EPSS: 0.011; 64th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 315; of 17,781 indexed, latest versions
Container images: 364; deployed by those charts
Fix available: 1 of 1; affected package

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

Carried by container images the latest versions of 315 of 17,781 indexed charts deploy, on 364 images.

Affected package	Affected versions	Fixed in	Images
netty-codec-http2maven	4.1.12.Final, 4.1.19.Final, 4.1.22.Final, 4.1.24.Final+75 more	4.1.132.Final, 4.2.11.Final	364

OSV records: GHSA-w9fj-cfpg-grvv

Charts affected

315 by stars

Chart

Latest

Affected images

Radar Score

1 of 3 See more

hermes touk 0.6.0

1 of the 3 container images this version deploys carry CVE-2026-33871.

Container image	Digest	Package	Fixed in
apicurio/apicurio-registry-kafkasql :2.1.0.Final	a97d67487532	netty-codec-http2@4.1.49.Final	4.1.132.Final

Open the chart page →

12,455

opencloudunxwares

1 of 13 See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-33871.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :26.1.4	044a457e0498	netty-codec-http2@4.1.118.Final	4.1.132.Final

Open the chart page →

45,239

wazuhwazuh-helm-eks

1 of 6 See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-33871.

Container image	Digest	Package	Fixed in
wazuh/wazuh-indexer :4.14.4	9c344d2b1757	netty-codec-http2@4.1.125.Final	4.1.132.Final

Open the chart page →

5,484

webhookiewebhookie

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-33871.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	netty-codec-http2@4.1.73.Final	4.1.132.Final

Open the chart page →

14,364

webhookie-allwebhookie

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-33871.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	netty-codec-http2@4.1.73.Final	4.1.132.Final

Open the chart page →

28,605

hazelcastwenerme

1 of 2 See more

hazelcast wenerme 5.10.2

1 of the 2 container images this version deploys carry CVE-2026-33871.

Container image	Digest	Package	Fixed in
hazelcast/hazelcast :5.5.0	5dd5d31c7a06	netty-codec-http2@4.1.111.Final	4.1.132.Final

Open the chart page →

2,634

elasticsearchwiremind

1 of 1 See more

elasticsearch wiremind 8.19.0

1 of the 1 container images this version deploys carry CVE-2026-33871.

Container image	Digest	Package	Fixed in
library/elasticsearch :8.19.12	89729a95066a	netty-codec-http2@4.1.130.Final	4.1.132.Final

Open the chart page →

2,191

keycloakwiremind

1 of 2 See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2026-33871.

Container image	Digest	Package	Fixed in
ghcr.io/wiremind/bitnami/keycloak :26.5.0-debian-12-r3	8622ea9e43c0	netty-codec-http2@4.1.128.Final	4.1.132.Final

Open the chart page →

7,624

apicurio-registry-sqlwitcom-gmbh

1 of 1 See more

apicurio-registry-sql witcom-gmbh 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-33871.

Container image	Digest	Package	Fixed in
apicurio/apicurio-registry-jpa :1.3.2.Final	44eeddd3562c	netty-codec-http2@4.1.49.Final	4.1.132.Final

Open the chart page →

3,424

opendistro-eswitcom-gmbh

1 of 3 See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2026-33871.

Container image	Digest	Package	Fixed in
amazon/opendistro-for-elasticsearch :1.13.3	2acfa1dcc5f8	netty-codec-http2@4.1.45.Final	4.1.132.Final

Open the chart page →

5,806

ygdrassil-monitoringygdrassil

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-33871.

Container image	Digest	Package	Fixed in
opensearchproject/opensearch :2.18.0	7f6fa1efee8f	netty-codec-http2@4.1.108.Final	4.1.132.Final

Open the chart page →

9,381

zahori-processzahori

1 of 1 See more

zahori-process zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-33871.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-process :0.1.13	351f8a220ed7	netty-codec-http2@4.1.94.Final	4.1.132.Final

Open the chart page →

3,480

zahori-serverzahori

1 of 2 See more

zahori-server zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-33871.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-server :0.1.17	b2de13916f3e	netty-codec-http2@4.1.87.Final	4.1.132.Final

Open the chart page →

5,846

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-33871.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	netty-codec-http2@4.1.82.Final	4.1.132.Final

Open the chart page →

6,016

zipkinzipkin

1 of 1 See more

zipkin zipkin 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-33871.

Container image	Digest	Package	Fixed in
openzipkin/zipkin-slim :3.6.0	a69e1057df36	netty-codec-http2@4.2.10.Final	4.2.11.Final

Open the chart page →

1,159

Container images carrying it

364 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
quay.io/keycloak/keycloak :26.5.6	8d44614c7479	netty-codec-http2@4.1.130.Final	4.1.132.Final	1
quay.io/keycloak/keycloak :26.4	9409c59bdfb6	netty-codec-http2@4.1.128.Final	4.1.132.Final	1
quay.io/keycloak/keycloak :26.0.6	a93d22e13b86	netty-codec-http2@4.1.111.Final	4.1.132.Final	1
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	netty-codec-http2@4.1.82.Final	4.1.132.Final	1
quay.io/keycloak/keycloak-operator :20.0.2	b1710745fa64	netty-codec-http2@4.1.82.Final	4.1.132.Final	1
quay.io/maximilianopizarro/neuralbank-backend :latest	a53899fcfc01	netty-codec-http2@4.1.127.Final	4.1.132.Final	1
quay.io/maximilianopizarro/showroom-docs-mcp :latest	1a6eff92827a	netty-codec-http2@4.1.130.Final	4.1.132.Final	1
quay.io/microcks/microcks-operator :0.0.11	96d1054d4a61	netty-codec-http2@4.1.128.Final	4.1.132.Final	1
quay.io/opsmxpublic/ubi8-gate :isd-spin-2025.10.01-5c720954-202511260810	2b3554029737	netty-codec-http2@4.1.94.Final	4.1.132.Final	1
quay.io/opsmxpublic/ubi8-oes-autopilot :isd-spin-2025.10.01-af26a30d4-202511261054	58bd0bcf72f9	netty-codec-http2@4.1.105.Final	4.1.132.Final	1
quay.io/seamware/consent-facade :0.0.14	be844c750c7e	netty-codec-http2@4.1.115.Final	4.1.132.Final	1
quay.io/strimzi/operator :0.45.1	58c727cd2e68	netty-codec-http2@4.1.118.Final	4.1.132.Final	1
quay.io/strimzi/operator :0.36.1	e9e03b31007c	netty-codec-http2@4.1.94.Final	4.1.132.Final	1
quay.io/wi_stefan/dss-validation-service :0.0.1	8e928db29ee1	netty-codec-http2@4.1.115.Final	4.1.132.Final	1