CVE-2026-35189

Medium

Advisory

Published 29 Sept 2026In the index since 30 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.003; 17th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,955; of 17,988 indexed, latest versions
Container images: 2,998; deployed by those charts
Fix available: 3 of 5; affected packages

CVE-2026-35189 affecting package openssl 3.3.7-6

Carried by container images the latest versions of 2,955 of 17,988 indexed charts deploy, on 2,998 images.

Affected package	Affected versions	Fixed in	Images
openssldeb	1.0.1f-1ubuntu2.5, 1.0.1f-1ubuntu2.8, 1.0.1f-1ubuntu2.25, 1.0.1f-1ubuntu2.27+123 more	1.0.1f-1ubuntu2.27+esm17, 1.0.2g-1ubuntu4.20+esm19, 1.1.1-1ubuntu2.1~18.04.23+esm11, 1.1.1f-1ubuntu2.24+esm6+4 more	2,690
opensslapk	3.3.1-r3, 3.3.2-r4, 3.3.2-r5, 3.3.3-r0+5 more	3.3.7-r2	297
nodejsdeb	4.2.6~dfsg-1ubuntu4.1, 7.10.1-2nodesource1~xenial1, 8.9.4-1nodesource1, 8.10.0~dfsg-2ubuntu0.4+14 more	no fix listed	23
openssl1.0deb	1.0.2n-1ubuntu5.3, 1.0.2n-1ubuntu5.4, 1.0.2n-1ubuntu5.6, 1.0.2n-1ubuntu5.7+5 more	1.0.2n-1ubuntu5.13+esm7	22
opensslrpm	3.3.5-1.azl3, 3.3.5-3.azl3, 3.3.5-5.azl3, 3.3.7-4.azl3	no fix listed	11

OSV records: ALPINE-CVE-2026-35189 AZL-105564 DEBIAN-CVE-2026-35189 ECHO-312d-f531-8c85 UBUNTU-CVE-2026-35189
Also known as: USN-8847-1, USN-8847-2
Trending: Rank 6 in indexed charts, since 30 Sept 2026. See the ranking →

Charts affected

2,955 by stars

Chart

Latest

Affected images

Radar Score

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-35189.

Container image	Digest	Package	Fixed in
library/nginx :latest	abe47724e466	openssl@3.5.7-1~deb13u2	3.5.7-1~deb13u3

Open the chart page →

1,859

sockpuppetbrowserzekker6

0.1.0

1 of 1 See more

sockpuppetbrowser zekker6 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-35189.

Container image	Digest	Package	Fixed in
dgtlmoon/sockpuppetbrowser :latest	1d8f72d2ce20	openssl@3.0.20-1~deb12u2	no fix listed

Open the chart page →

5,004

zimagizimagi

2.7.17

1 of 6 See more

zimagi zimagi 2.7.17

1 of the 6 container images this version deploys carry CVE-2026-35189.

Container image	Digest	Package	Fixed in
qdrant/qdrant :v1.15.3	31407c0e8e32	openssl@3.0.17-1~deb12u2	no fix listed

Open the chart page →

2,120

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-35189.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	openssl@1.1.1-1ubuntu2.1~18.04.14	1.1.1-1ubuntu2.1~18.04.23+esm11
yandex/clickhouse-server :21.3.20	4eccfffb01d7	openssl@1.1.1f-1ubuntu2.10	1.1.1f-1ubuntu2.24+esm6

Open the chart page →

9,697

zoo-project-druzoo-project

0.10.8

1 of 6 See more

zoo-project-dru zoo-project 0.10.8

1 of the 6 container images this version deploys carry CVE-2026-35189.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-51e7d55383f24594959b69e58518961c6aa66740	da112e8d03f1	openssl@3.0.2-0ubuntu1.30	no fix listed

Open the chart page →

6,754

Container images carrying it

2,998 by charts deploying them

A fixed version is listed for 3 of the 5 affected packages.

No deployed image carries CVE-2026-35189.