StackRadar

CVE-2026-34477

Medium

Advisory

Published 10 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.004
35th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
238
of 17,781 indexed, latest versions
Container images
226
deployed by those charts
Fix available
1 of 1
affected package

Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration

Carried by container images the latest versions of 238 of 17,781 indexed charts deploy, on 226 images.

Affected packageAffected versionsFixed inImages
log4j-coremaven2.12.1, 2.12.4, 2.13.0, 2.13.2+26 more2.25.4226
OSV records
GHSA-6hg6-v5c8-fphq

Charts affected

238 by stars
ChartLatestAffected imagesRadar Score
metabasemetabase-helmVerified publisher2.7.11 of 1See more

metabase metabase-helm 2.7.1

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
metabase/metabase:v0.46.09ebdc664a6b2
log4j-core@2.17.1
2.25.4

Open the chart page →

2,221
clowder2ncsaVerified publisher1.9.71 of 12See more

clowder2 ncsa 1.9.7

1 of the 12 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:8.12.215d4647fd491
log4j-core@2.12.4
2.25.4

Open the chart page →

37,373
openccuopenccuVerified publisher3.89.81 of 1See more

openccu openccu 3.89.8

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
ghcr.io/openccu/openccu:3.89.8.20260719b2de2ff6e8e0
log4j-core@2.25.2
2.25.4

Open the chart page →

1,916
data-prepperopensearch-project-helm-chartsVerified publisher0.3.11 of 1See more

data-prepper opensearch-project-helm-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
opensearchproject/data-prepper:2.8.057c25fa01d3c
log4j-core@2.23.1
2.25.4

Open the chart page →

1,692
portraitportraitVerified publisher0.2.132 of 8See more

portrait portrait 0.2.13

2 of the 8 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
library/elasticsearch:7.17.0332c6d416808
log4j-core@2.17.1
2.25.4
treskon/portrait:DEV-latest88e813f22347
log4j-core@2.23.1
2.25.4

Open the chart page →

31,844
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
library/neo4j:2026.02.25ab4ab0358cf
log4j-core@2.25.3
2.25.4

Open the chart page →

8,158
resurfaceresurfaceioVerified publisher3.9.01 of 3See more

resurface resurfaceio 3.9.0

1 of the 3 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
resurfaceio/resurface:3.7.84d5cda2f64109
log4j-core@2.24.3
2.25.4

Open the chart page →

7,432
elasticsearchromanow-helm-chartsVerified publisher1.7.11 of 2See more

elasticsearch romanow-helm-charts 1.7.1

1 of the 2 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
library/elasticsearch:7.17.8fdc73b3249c1
log4j-core@2.17.1
2.25.4

Open the chart page →

6,045
logstashromanow-helm-chartsVerified publisher1.5.01 of 1See more

logstash romanow-helm-charts 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
library/logstash:7.17.817a4f64e9cf5
log4j-core@2.17.1
2.25.4

Open the chart page →

7,529
signserver-cesignserverOfficialVerified publisher2.3.51 of 1See more

signserver-ce signserver 2.3.5

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
keyfactor/signserver-ce:7.3.2798fbbe00283
log4j-core@2.20.0
2.25.4

Open the chart page →

2,406
ocean-metric-exporterspot1.1.11 of 1See more

ocean-metric-exporter spot 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
gcr.io/spotinst-artifacts/spot-ocean-metric-exporter:1.0.5ae57b62291aa
log4j-core@2.24.3
2.25.4

Open the chart page →

1,482
ckanstatcan0.0.351 of 8See more

ckan statcan 0.0.35

1 of the 8 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
library/solr:8.11.18c5f7881cebb
log4j-core@2.16.0
2.25.4

Open the chart page →

24,930
wavefront-adapter-for-istiowavefront0.1.41 of 2See more

wavefront-adapter-for-istio wavefront 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
wavefronthq/proxy:9.2d1064d28f6eb
log4j-core@2.12.1
2.25.4

Open the chart page →

15,970
spark-operatorwikimedia2.2.71 of 1See more

spark-operator wikimedia 2.2.7

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
ghcr.io/kubeflow/spark-operator/controller:2.2.1865ff4da5686
log4j-core@2.20.0
2.25.4

Open the chart page →

7,835
active-mqactivemq-helm-chartVerified publisher1.8.21 of 3See more

active-mq activemq-helm-chart 1.8.2

1 of the 3 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
apache/activemq-artemis:2.44.00305c26f19ed
log4j-core@2.25.2
2.25.4

Open the chart page →

3,188
migrationadeptia-automate-migration5.2.91 of 1See more

migration adeptia-automate-migration 5.2.9

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
adeptiainc/adeptia-connect-migration:5.2.98607f4f29732
log4j-core@2.25.3
2.25.4

Open the chart page →

395
airbyte-api-serverairbyteVerified publisher0.293.41 of 1See more

airbyte-api-server airbyte 0.293.4

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
airbyte/airbyte-api-server:0.63.8e1c5e7cfec8a
log4j-core@2.23.1
2.25.4

Open the chart page →

854
airbyte-cronairbyteVerified publisher0.40.371 of 1See more

airbyte-cron airbyte 0.40.37

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
airbyte/cron:0.40.17caf4f551c546
log4j-core@2.17.2
2.25.4

Open the chart page →

1,413
akto-hybrid-redactakto1.44.41 of 5See more

akto-hybrid-redact akto 1.44.4

1 of the 5 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.1-1-ubi9d20bd62f0182
log4j-core@2.24.3
2.25.4

Open the chart page →

4,777
akto-mini-runtime-shaakto0.7.231 of 3See more

akto-mini-runtime-sha akto 0.7.23

1 of the 3 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafkadigest-pinnedd20bd62f0182
log4j-core@2.24.3
2.25.4

Open the chart page →

3,217
akto-mrs-runtime-combinedakto0.0.21 of 2See more

akto-mrs-runtime-combined akto 0.0.2

1 of the 2 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.0-1-ubi99026dbbf280d
log4j-core@2.24.3
2.25.4

Open the chart page →

1,826
akto-regional-setupakto1.3.11 of 9See more

akto-regional-setup akto 1.3.1

1 of the 9 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-threat-detection:1.16.2a47eb6cc17ea
log4j-core@2.24.2
2.25.4

Open the chart page →

7,603
akto-threat-clientakto0.2.01 of 2See more

akto-threat-client akto 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-threat-detection:latest3f103ce347ce
log4j-core@2.24.2
2.25.4

Open the chart page →

1,523
data-ingestion-serviceakto0.1.61 of 1See more

data-ingestion-service akto 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
aktosecurity/data-ingestion-servicedigest-pinned213aded7adc5
log4j-core@2.24.2
2.25.4

Open the chart page →

3,442
mautrix-signalalexanderbadel0.1.11 of 2See more

mautrix-signal alexanderbadel 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
signald/signald:0.18.20ffad7ccc2eb
log4j-core@2.17.1
2.25.4

Open the chart page →

2,099
zunivers-ninjaalexpressoVerified publisher1.31.21 of 2See more

zunivers-ninja alexpresso 1.31.2

1 of the 2 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
library/neo4j:5.18.18f01f7bb053e
log4j-core@2.20.0
2.25.4

Open the chart page →

1,165
amorphieamorphie0.1.23 of 18See more

amorphie amorphie 0.1.2

3 of the 18 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
camunda/zeebe:8.4.5ab5abc09e407
log4j-core@2.22.1
2.25.4
hazelcast/hazelcast:5.3.18fe26efde8e1
log4j-core@2.20.0
2.25.4
hazelcast/management-center:5.3.2f9d34300d330
log4j-core@2.17.2
2.25.4

Open the chart page →

28,131
omada-controllerandrelote-k8sVerified publisher4.5.01 of 1See more

omada-controller andrelote-k8s 4.5.0

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
mbentley/omada-controller:4.3f4e682274bed
log4j-core@2.23.1
2.25.4

Open the chart page →

11,553
inbox-server-distributedappscodeVerified publisher2025.12.251 of 4See more

inbox-server-distributed appscode 2025.12.25

1 of the 4 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.1.04254021a8c71
log4j-core@2.17.1
2.25.4

Open the chart page →

15,573
james-komposeappscodeVerified publisher0.1.02 of 4See more

james-kompose appscode 0.1.0

2 of the 4 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.1.04254021a8c71
log4j-core@2.17.1
2.25.4
ghcr.io/appscode/inbox-server:MailetGroup4a2824296412
log4j-core@2.20.0
2.25.4

Open the chart page →

16,975
arlas-aiasarlas-stackVerified publisher28.8.01 of 22See more

arlas-aias arlas-stack 28.8.0

1 of the 22 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:9.0.1-debian-12-r0e6f6ddcce2f1
log4j-core@2.12.4
2.25.4

Open the chart page →

40,238
automatedconfigurationassist-iot-automated-configuration1.0.01 of 5See more

automatedconfiguration assist-iot-automated-configuration 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
assistiot/automated_configuration:latest23f195a7a26a
log4j-core@2.17.1
2.25.4

Open the chart page →

14,728
sdn-controllerassist-iot-sdn-controller2.4.01 of 1See more

sdn-controller assist-iot-sdn-controller 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
assistiot/sdn_controller:2.4.0ea254b6d8a31
log4j-core@2.17.0
2.25.4

Open the chart page →

7,936
dashboard-pui9assist-iot-tactile-dashboard0.2.01 of 3See more

dashboard-pui9 assist-iot-tactile-dashboard 0.2.0

1 of the 3 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
assistiot/tacticle_dashboard:api-lateste4414cb72dc4
log4j-core@2.17.2
2.25.4

Open the chart page →

4,145
opendistro-esbeeinventor1.15.11 of 3See more

opendistro-es beeinventor 1.15.1

1 of the 3 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch:1.13.32acfa1dcc5f8
log4j-core@2.13.0
2.25.4

Open the chart page →

5,806
firehoseblip-firehoseVerified publisher0.0.181 of 11See more

firehose blip-firehose 0.0.18

1 of the 11 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
obsidiandynamics/kafdrop:3.30.05337c9e0e2de
log4j-core@2.17.2
2.25.4

Open the chart page →

13,459
kafkacagriekinVerified publisher0.2.01 of 2See more

kafka cagriekin 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
apache/kafka:4.1.0bff074a5d005
log4j-core@2.24.3
2.25.4

Open the chart page →

2,398
opensearch-singlenodecaptnbpVerified publisher1.0.91 of 2See more

opensearch-singlenode captnbp 1.0.9

1 of the 2 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.15.01963b3ece46d
log4j-core@2.21.0
2.25.4

Open the chart page →

1,073
metabasecasemark2.16.111 of 1See more

metabase casemark 2.16.11

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
cmosborn/metabase-arm64:0.50.286ec0a8878ad2
log4j-core@2.23.1
2.25.4

Open the chart page →

1,215
castlemockcnieg2.0.11 of 1See more

castlemock cnieg 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
castlemock/castlemock:latestb7f3f1527ba9
log4j-core@2.24.3
2.25.4

Open the chart page →

4,578
sumo-besu-genesisconsensys0.1.751 of 1See more

sumo-besu-genesis consensys 0.1.75

1 of the 1 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
hyperledger/besu:22.4-openjdk-latesta674d35eec9a
log4j-core@2.17.2
2.25.4

Open the chart page →

7,963
sumo-besu-nodeconsensys0.1.751 of 4See more

sumo-besu-node consensys 0.1.75

1 of the 4 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
hyperledger/besu:22.4-openjdk-latesta674d35eec9a
log4j-core@2.17.2
2.25.4

Open the chart page →

7,963
dshackledysnixVerified publisher0.1.11 of 2See more

dshackle dysnix 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
emeraldpay/dshackle:0.12ac2a4bc66ab6
log4j-core@2.17.0
2.25.4

Open the chart page →

2,237
egeria-baseegeria-charts4.3.01 of 5See more

egeria-base egeria-charts 4.3.0

1 of the 5 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.37.052f376e64b9b
log4j-core@2.17.2
2.25.4

Open the chart page →

4,046
egeria-ctsegeria-charts4.3.01 of 3See more

egeria-cts egeria-charts 4.3.0

1 of the 3 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.37.052f376e64b9b
log4j-core@2.17.2
2.25.4

Open the chart page →

4,033
egeria-ptsegeria-charts4.3.01 of 3See more

egeria-pts egeria-charts 4.3.0

1 of the 3 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.37.052f376e64b9b
log4j-core@2.17.2
2.25.4

Open the chart page →

4,033
odpi-egeria-labegeria-charts4.3.01 of 4See more

odpi-egeria-lab egeria-charts 4.3.0

1 of the 4 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.37.052f376e64b9b
log4j-core@2.17.2
2.25.4

Open the chart page →

4,033
elk-stackelk-stack-test1.0.21 of 9See more

elk-stack elk-stack-test 1.0.2

1 of the 9 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
library/logstash:9.1.233eae14f0867
log4j-core@2.17.2
2.25.4

Open the chart page →

2,942
elasticsearch-umbrellaempathyco0.8.121 of 3See more

elasticsearch-umbrella empathyco 0.8.12

1 of the 3 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
empathyco/elasticsearch:7.17.2-memlock03e724e41eeb
log4j-core@2.17.1
2.25.4

Open the chart page →

10,564
dshackleethereum-helm-chartsVerified publisher0.1.91 of 2See more

dshackle ethereum-helm-charts 0.1.9

1 of the 2 container images this version deploys carry CVE-2026-34477.

Container imageDigestPackageFixed in
emeraldpay/dshackle:0.14.0126f0ae0b388
log4j-core@2.17.0
2.25.4

Open the chart page →

2,021

Container images carrying it

226 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/jens-maus/raspberrymatic:3.83.6.202508244b22b4f407c4
log4j-core@2.17.2
2.25.4
1
ghcr.io/joffreybvn/k8s-geyser:0.0.247f36880072e
log4j-core@2.20.0
2.25.4
1
ghcr.io/kenchrcum/tika:3.3.0-full708446bc6783
log4j-core@2.25.3
2.25.4
1
ghcr.io/kubeflow/spark-operator/controller:2.2.1865ff4da5686
log4j-core@2.20.0
2.25.4
1
ghcr.io/melodyyangaws/hive-metastore:3.0.0e949b0f733f0
log4j-core@2.17.2
2.25.4
1
ghcr.io/openccu/openccu:3.89.8.20260719b2de2ff6e8e0
log4j-core@2.25.2
2.25.4
1
ghcr.io/open-telemetry/demo:1.12.0-frauddetectionservice77cefdab4d5c
log4j-core@2.21.1
2.25.4
1
ghcr.io/open-telemetry/demo:1.12.0-adservicea59e5eead495
log4j-core@2.23.1
2.25.4
1
ghcr.io/punchplatform/punchline-java:8.1.1d46ce7b96482
log4j-core@2.17.1
2.25.4
1
ghcr.io/radar-base/radar-app-config/radar-app-config:0.6.24431db7b486b
log4j-core@2.23.1
2.25.4
1
ghcr.io/radar-base/radar-data-dashboard-backend/radar-data-dashboard-backend:0.2.4d1e55350923c
log4j-core@2.21.0
2.25.4
1
ghcr.io/radar-base/radar-gateway/radar-gateway:0.9.4219d894aa7a6
log4j-core@2.23.1
2.25.4
1
ghcr.io/radar-base/radar-output-restructure/radar-output-restructure:3.0.67fb9c70e96a4
log4j-core@2.21.0
2.25.4
1
ghcr.io/radar-base/radar-schemas/radar-schemas-tools:0.8.16c442e8bfe6b4
log4j-core@2.20.0
2.25.4
1
ghcr.io/radar-base/radar-upload-source-connector/radar-upload-connect-backend:0.6.46a04b43b8d9a
log4j-core@2.21.1
2.25.4
1
public.ecr.aws/aktosecurity/akto-threat-detection:latest3f103ce347ce
log4j-core@2.24.2
2.25.4
1
public.ecr.aws/aktosecurity/akto-threat-detection:1.16.2a47eb6cc17ea
log4j-core@2.24.2
2.25.4
1
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.0-1-ubi99026dbbf280d
log4j-core@2.24.3
2.25.4
1
public.ecr.aws/aws-containers/retail-store-sample-cart:1.3.05d767569c976
log4j-core@2.24.3
2.25.4
1
public.ecr.aws/aws-containers/retail-store-sample-orders:1.3.0e85f034bcf48
log4j-core@2.24.3
2.25.4
1
public.ecr.aws/aws-containers/retail-store-sample-ui:1.3.0ce3f2e935eb3
log4j-core@2.24.3
2.25.4
1
public.ecr.aws/v0r6c2e2/hive-metastore:latest794b3bff9510
log4j-core@2.17.1
2.25.4
1
quay.io/newrelic/synthetics-minion:2.2.2198c26e1b8f70
log4j-core@2.12.1
2.25.4
1
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
log4j-core@3.0.0-beta3
no fix listed
1
quay.io/strimzi/operator:0.45.158c727cd2e68
log4j-core@2.17.2
2.25.4
1
quay.io/strimzi/operator:0.36.1e9e03b31007c
log4j-core@2.17.2
2.25.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.