StackRadar

CVE-2026-34477

Medium

Advisory

Published 10 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.004
35th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
238
of 17,781 indexed, latest versions
Container images
226
deployed by those charts
Fix available
1 of 1
affected package

Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration

Carried by container images the latest versions of 238 of 17,781 indexed charts deploy, on 226 images.

Affected packageAffected versionsFixed inImages
log4j-coremaven2.12.1, 2.12.4, 2.13.0, 2.13.2+26 more2.25.4226
OSV records
GHSA-6hg6-v5c8-fphq

Charts affected

238 by stars
ChartLatestAffected imagesRadar Score
metabasemetabase-helmVerified publisher2.7.11 of 1See more

metabase metabase-helm 2.7.1

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
metabase/metabase:v0.46.09ebdc664a6b2
log4j-core@2.17.1
2.25.4

Open the chart page →

2,221
clowder2ncsaVerified publisher1.9.71 of 12See more

clowder2 ncsa 1.9.7

1 of the 12 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:8.12.215d4647fd491
log4j-core@2.12.4
2.25.4

Open the chart page →

37,373
openccuopenccuVerified publisher3.89.81 of 1See more

openccu openccu 3.89.8

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
ghcr.io/openccu/openccu:3.89.8.20260719b2de2ff6e8e0
log4j-core@2.25.2
2.25.4

Open the chart page →

1,916
data-prepperopensearch-project-helm-chartsVerified publisher0.3.11 of 1See more

data-prepper opensearch-project-helm-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
opensearchproject/data-prepper:2.8.057c25fa01d3c
log4j-core@2.23.1
2.25.4

Open the chart page →

1,692
portraitportraitVerified publisher0.2.132 of 8See more

portrait portrait 0.2.13

2 of the 8 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
library/elasticsearch:7.17.0332c6d416808
log4j-core@2.17.1
2.25.4
treskon/portrait:DEV-latest88e813f22347
log4j-core@2.23.1
2.25.4

Open the chart page →

31,844
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
library/neo4j:2026.02.25ab4ab0358cf
log4j-core@2.25.3
2.25.4

Open the chart page →

8,158
resurfaceresurfaceioVerified publisher3.9.01 of 3See more

resurface resurfaceio 3.9.0

1 of the 3 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
resurfaceio/resurface:3.7.84d5cda2f64109
log4j-core@2.24.3
2.25.4

Open the chart page →

7,432
elasticsearchromanow-helm-chartsVerified publisher1.7.11 of 2See more

elasticsearch romanow-helm-charts 1.7.1

1 of the 2 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
library/elasticsearch:7.17.8fdc73b3249c1
log4j-core@2.17.1
2.25.4

Open the chart page →

6,045
logstashromanow-helm-chartsVerified publisher1.5.01 of 1See more

logstash romanow-helm-charts 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
library/logstash:7.17.817a4f64e9cf5
log4j-core@2.17.1
2.25.4

Open the chart page →

7,529
signserver-cesignserverOfficialVerified publisher2.3.51 of 1See more

signserver-ce signserver 2.3.5

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
keyfactor/signserver-ce:7.3.2798fbbe00283
log4j-core@2.20.0
2.25.4

Open the chart page →

2,406
ocean-metric-exporterspot1.1.11 of 1See more

ocean-metric-exporter spot 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
gcr.io/spotinst-artifacts/spot-ocean-metric-exporter:1.0.5ae57b62291aa
log4j-core@2.24.3
2.25.4

Open the chart page →

1,482
ckanstatcan0.0.351 of 8See more

ckan statcan 0.0.35

1 of the 8 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
library/solr:8.11.18c5f7881cebb
log4j-core@2.16.0
2.25.4

Open the chart page →

24,930
wavefront-adapter-for-istiowavefront0.1.41 of 2See more

wavefront-adapter-for-istio wavefront 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
wavefronthq/proxy:9.2d1064d28f6eb
log4j-core@2.12.1
2.25.4

Open the chart page →

15,970
spark-operatorwikimedia2.2.71 of 1See more

spark-operator wikimedia 2.2.7

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
ghcr.io/kubeflow/spark-operator/controller:2.2.1865ff4da5686
log4j-core@2.20.0
2.25.4

Open the chart page →

7,835
active-mqactivemq-helm-chartVerified publisher1.8.21 of 3See more

active-mq activemq-helm-chart 1.8.2

1 of the 3 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
apache/activemq-artemis:2.44.00305c26f19ed
log4j-core@2.25.2
2.25.4

Open the chart page →

3,188
migrationadeptia-automate-migration5.2.91 of 1See more

migration adeptia-automate-migration 5.2.9

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
adeptiainc/adeptia-connect-migration:5.2.98607f4f29732
log4j-core@2.25.3
2.25.4

Open the chart page →

395
airbyte-api-serverairbyteVerified publisher0.293.41 of 1See more

airbyte-api-server airbyte 0.293.4

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
airbyte/airbyte-api-server:0.63.8e1c5e7cfec8a
log4j-core@2.23.1
2.25.4

Open the chart page →

854
airbyte-cronairbyteVerified publisher0.40.371 of 1See more

airbyte-cron airbyte 0.40.37

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
airbyte/cron:0.40.17caf4f551c546
log4j-core@2.17.2
2.25.4

Open the chart page →

1,413
akto-hybrid-redactakto1.44.41 of 5See more

akto-hybrid-redact akto 1.44.4

1 of the 5 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.1-1-ubi9d20bd62f0182
log4j-core@2.24.3
2.25.4

Open the chart page →

4,777
akto-mini-runtime-shaakto0.7.231 of 3See more

akto-mini-runtime-sha akto 0.7.23

1 of the 3 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafkadigest-pinnedd20bd62f0182
log4j-core@2.24.3
2.25.4

Open the chart page →

3,217
akto-mrs-runtime-combinedakto0.0.21 of 2See more

akto-mrs-runtime-combined akto 0.0.2

1 of the 2 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.0-1-ubi99026dbbf280d
log4j-core@2.24.3
2.25.4

Open the chart page →

1,826
akto-regional-setupakto1.3.11 of 9See more

akto-regional-setup akto 1.3.1

1 of the 9 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-threat-detection:1.16.2a47eb6cc17ea
log4j-core@2.24.2
2.25.4

Open the chart page →

7,603
akto-threat-clientakto0.2.01 of 2See more

akto-threat-client akto 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-threat-detection:latest3f103ce347ce
log4j-core@2.24.2
2.25.4

Open the chart page →

1,523
data-ingestion-serviceakto0.1.61 of 1See more

data-ingestion-service akto 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
aktosecurity/data-ingestion-servicedigest-pinned213aded7adc5
log4j-core@2.24.2
2.25.4

Open the chart page →

3,442
mautrix-signalalexanderbadel0.1.11 of 2See more

mautrix-signal alexanderbadel 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
signald/signald:0.18.20ffad7ccc2eb
log4j-core@2.17.1
2.25.4

Open the chart page →

2,099
zunivers-ninjaalexpressoVerified publisher1.31.21 of 2See more

zunivers-ninja alexpresso 1.31.2

1 of the 2 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
library/neo4j:5.18.18f01f7bb053e
log4j-core@2.20.0
2.25.4

Open the chart page →

1,165
amorphieamorphie0.1.23 of 18See more

amorphie amorphie 0.1.2

3 of the 18 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
camunda/zeebe:8.4.5ab5abc09e407
log4j-core@2.22.1
2.25.4
hazelcast/hazelcast:5.3.18fe26efde8e1
log4j-core@2.20.0
2.25.4
hazelcast/management-center:5.3.2f9d34300d330
log4j-core@2.17.2
2.25.4

Open the chart page →

28,131
omada-controllerandrelote-k8sVerified publisher4.5.01 of 1See more

omada-controller andrelote-k8s 4.5.0

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
mbentley/omada-controller:4.3f4e682274bed
log4j-core@2.23.1
2.25.4

Open the chart page →

11,553
inbox-server-distributedappscodeVerified publisher2025.12.251 of 4See more

inbox-server-distributed appscode 2025.12.25

1 of the 4 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.1.04254021a8c71
log4j-core@2.17.1
2.25.4

Open the chart page →

15,573
james-komposeappscodeVerified publisher0.1.02 of 4See more

james-kompose appscode 0.1.0

2 of the 4 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.1.04254021a8c71
log4j-core@2.17.1
2.25.4
ghcr.io/appscode/inbox-server:MailetGroup4a2824296412
log4j-core@2.20.0
2.25.4

Open the chart page →

16,975
arlas-aiasarlas-stackVerified publisher28.8.01 of 22See more

arlas-aias arlas-stack 28.8.0

1 of the 22 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:9.0.1-debian-12-r0e6f6ddcce2f1
log4j-core@2.12.4
2.25.4

Open the chart page →

40,238
automatedconfigurationassist-iot-automated-configuration1.0.01 of 5See more

automatedconfiguration assist-iot-automated-configuration 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
assistiot/automated_configuration:latest23f195a7a26a
log4j-core@2.17.1
2.25.4

Open the chart page →

14,728
sdn-controllerassist-iot-sdn-controller2.4.01 of 1See more

sdn-controller assist-iot-sdn-controller 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
assistiot/sdn_controller:2.4.0ea254b6d8a31
log4j-core@2.17.0
2.25.4

Open the chart page →

7,936
dashboard-pui9assist-iot-tactile-dashboard0.2.01 of 3See more

dashboard-pui9 assist-iot-tactile-dashboard 0.2.0

1 of the 3 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
assistiot/tacticle_dashboard:api-lateste4414cb72dc4
log4j-core@2.17.2
2.25.4

Open the chart page →

4,145
opendistro-esbeeinventor1.15.11 of 3See more

opendistro-es beeinventor 1.15.1

1 of the 3 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch:1.13.32acfa1dcc5f8
log4j-core@2.13.0
2.25.4

Open the chart page →

5,806
firehoseblip-firehoseVerified publisher0.0.181 of 11See more

firehose blip-firehose 0.0.18

1 of the 11 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
obsidiandynamics/kafdrop:3.30.05337c9e0e2de
log4j-core@2.17.2
2.25.4

Open the chart page →

13,459
kafkacagriekinVerified publisher0.2.01 of 2See more

kafka cagriekin 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
apache/kafka:4.1.0bff074a5d005
log4j-core@2.24.3
2.25.4

Open the chart page →

2,398
opensearch-singlenodecaptnbpVerified publisher1.0.91 of 2See more

opensearch-singlenode captnbp 1.0.9

1 of the 2 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.15.01963b3ece46d
log4j-core@2.21.0
2.25.4

Open the chart page →

1,073
metabasecasemark2.16.111 of 1See more

metabase casemark 2.16.11

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
cmosborn/metabase-arm64:0.50.286ec0a8878ad2
log4j-core@2.23.1
2.25.4

Open the chart page →

1,215
castlemockcnieg2.0.11 of 1See more

castlemock cnieg 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
castlemock/castlemock:latestb7f3f1527ba9
log4j-core@2.24.3
2.25.4

Open the chart page →

4,578
sumo-besu-genesisconsensys0.1.751 of 1See more

sumo-besu-genesis consensys 0.1.75

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
hyperledger/besu:22.4-openjdk-latesta674d35eec9a
log4j-core@2.17.2
2.25.4

Open the chart page →

7,963
sumo-besu-nodeconsensys0.1.751 of 4See more

sumo-besu-node consensys 0.1.75

1 of the 4 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
hyperledger/besu:22.4-openjdk-latesta674d35eec9a
log4j-core@2.17.2
2.25.4

Open the chart page →

7,963
dshackledysnixVerified publisher0.1.11 of 2See more

dshackle dysnix 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
emeraldpay/dshackle:0.12ac2a4bc66ab6
log4j-core@2.17.0
2.25.4

Open the chart page →

2,237
egeria-baseegeria-charts4.3.01 of 5See more

egeria-base egeria-charts 4.3.0

1 of the 5 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.37.052f376e64b9b
log4j-core@2.17.2
2.25.4

Open the chart page →

4,046
egeria-ctsegeria-charts4.3.01 of 3See more

egeria-cts egeria-charts 4.3.0

1 of the 3 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.37.052f376e64b9b
log4j-core@2.17.2
2.25.4

Open the chart page →

4,033
egeria-ptsegeria-charts4.3.01 of 3See more

egeria-pts egeria-charts 4.3.0

1 of the 3 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.37.052f376e64b9b
log4j-core@2.17.2
2.25.4

Open the chart page →

4,033
odpi-egeria-labegeria-charts4.3.01 of 4See more

odpi-egeria-lab egeria-charts 4.3.0

1 of the 4 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.37.052f376e64b9b
log4j-core@2.17.2
2.25.4

Open the chart page →

4,033
elk-stackelk-stack-test1.0.21 of 9See more

elk-stack elk-stack-test 1.0.2

1 of the 9 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
library/logstash:9.1.233eae14f0867
log4j-core@2.17.2
2.25.4

Open the chart page →

2,942
elasticsearch-umbrellaempathyco0.8.121 of 3See more

elasticsearch-umbrella empathyco 0.8.12

1 of the 3 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
empathyco/elasticsearch:7.17.2-memlock03e724e41eeb
log4j-core@2.17.1
2.25.4

Open the chart page →

10,564
dshackleethereum-helm-chartsVerified publisher0.1.91 of 2See more

dshackle ethereum-helm-charts 0.1.9

1 of the 2 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
emeraldpay/dshackle:0.14.0126f0ae0b388
log4j-core@2.17.0
2.25.4

Open the chart page →

2,021

Container images carrying it

226 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
folioci/mod-ncip:latest8ed83674352b
log4j-core@2.20.0
2.25.4
1
folioci/mod-oai-pmh:latest5cd5ef063f2a
log4j-core@2.24.3
2.25.4
1
folioci/mod-patron:latest5f213acfe2f8
log4j-core@2.24.3
2.25.4
1
folioci/mod-patron-blocks:latestde7318069a67
log4j-core@2.24.3
2.25.4
1
folioci/mod-pubsub:latest0a4fa4ad5d72
log4j-core@2.24.0
2.25.4
1
folioci/mod-rtac:latestc959b2d6142f
log4j-core@2.24.3
2.25.4
1
folioci/mod-sender:latestd88a675dddf0
log4j-core@2.25.2
2.25.4
1
folioci/mod-template-engine:latestd105c585da30
log4j-core@2.24.3
2.25.4
1
folioci/mod-users-bl:latest4e2d96c9340d
log4j-core@2.25.2
2.25.4
1
fonoster/routr-edgeport:2.13.6d08a8a574a50
log4j-core@2.22.0
2.25.4
1
fonoster/routr-requester:2.13.6e0c823506eb2
log4j-core@2.22.0
2.25.4
1
geonetwork/gn-cloud-ogc-api-records-service:4.2.8-020c9bb761f67
log4j-core@2.13.3
2.25.4
1
geonode/geoserver:2.28.4-latest81b1d431b7e9
log4j-core@2.25.3
2.25.4
1
graylog/graylog:6.1.1019de1aff48c2
log4j-core@2.24.1
2.25.4
1
gridgain/cloud-connector:2025.5.15ab838d7d3cb
log4j-core@2.25.3
2.25.4
1
gridgain/community:8.9.11d32d182a0e6a
log4j-core@2.20.0
2.25.4
1
gurolakman/smsf-configuration:1.0.49abb3882bcbd
log4j-core@2.17.2
2.25.4
1
gurolakman/smsf-dispatcher:1.0.46537e8ed8de8
log4j-core@2.17.2
2.25.4
1
gurolakman/smsf-momt:1.0.4ce23b20a8a17
log4j-core@2.17.2
2.25.4
1
gurolakman/smsf-registration:1.0.4b22e746edd5d
log4j-core@2.17.2
2.25.4
1
hazelcast/hazelcast:5.3.18fe26efde8e1
log4j-core@2.20.0
2.25.4
1
hazelcast/hazelcast-jet:4.5.3a825ecbe9fda
log4j-core@2.17.0
2.25.4
1
hazelcast/management-center:5.3.2f9d34300d330
log4j-core@2.17.2
2.25.4
1
hmediade/printserver:latest481a552c8e1c
log4j-core@2.17.2
2.25.4
1
iamdorsah/bastillion:v0.1db83a0254d81
log4j-core@2.17.1
2.25.4
1
jacobalberty/unifi:v7.1.664a3616625dda
log4j-core@2.17.2
2.25.4
1
jingking/geonetwork-hnap:4.2.843e74ab234e1
log4j-core@2.17.2
2.25.4
1
just1not2/streama:1.10.48a2305192dec
log4j-core@2.17.1
2.25.4
1
kafkakraft/kafka-connect:3.7.0062d697db7e5
log4j-core@2.20.0
2.25.4
1
keyfactor/signserver-ce:7.3.2798fbbe00283
log4j-core@2.20.0
2.25.4
1
library/crate:4.7.0c7984a05e15b
log4j-core@2.17.1
2.25.4
1
library/elasticsearch:8.17.32cc40b15dff8
log4j-core@2.19.0
2.25.4
1
library/elasticsearch:8.15.0310b9fc03b06
log4j-core@2.12.4
2.25.4
1
library/elasticsearch:7.17.0332c6d416808
log4j-core@2.17.1
2.25.4
1
library/elasticsearch:7.17.1588c2ec10c7f2
log4j-core@2.17.1
2.25.4
1
library/elasticsearch:7.17.8fdc73b3249c1
log4j-core@2.17.1
2.25.4
1
library/flink:1.11.2-scala_2.121fe4fb22a2a5
log4j-core@2.12.1
2.25.4
1
library/flink:1.14.6-scala_2.122461f02672b3
log4j-core@2.17.1
2.25.4
1
library/logstash:7.17.817a4f64e9cf5
log4j-core@2.17.1
2.25.4
1
library/logstash:9.1.233eae14f0867
log4j-core@2.17.2
2.25.4
1
library/neo4j:4.2.4348e3f56faa2
log4j-core@2.14.0
2.25.4
1
library/neo4j:2026.02.25ab4ab0358cf
log4j-core@2.25.3
2.25.4
1
library/neo4j:5.18.18f01f7bb053e
log4j-core@2.20.0
2.25.4
1
library/solr:8.7.0d124efd81fbb
log4j-core@2.13.2
2.25.4
1
library/sonarqube:10.7.0-community0842dcd4c8f8
log4j-core@2.19.0
2.25.4
1
library/sonarqube:8.9-communityeb2f0be32efd
log4j-core@2.17.0
2.25.4
1
library/sonarqube:10.0.0-communityef9723cf4fe4
log4j-core@2.19.0
2.25.4
1
library/storm:2.4.0bd5d420506d6
log4j-core@2.17.1
2.25.4
1
linuxserver/unifi-controller:7.3.83ab105cc50322
log4j-core@2.17.2
2.25.4
1
liukunup/jmeter:5.59c079617a81b
log4j-core@2.17.2
2.25.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.