CVE-2026-42583

High

Advisory

Published 7 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.005; 39th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 453; of 17,787 indexed, latest versions
Container images: 513; deployed by those charts
Fix available: 2 of 2; affected packages

Netty Lz4FrameDecoder is vulnerable to resource exhaustion

Carried by container images the latest versions of 453 of 17,787 indexed charts deploy, on 513 images.

Affected package	Affected versions	Fixed in	Images
netty-codecmaven	4.0.23.Final, 4.0.27.Final, 4.0.36.Final, 4.0.37.Final+89 more	4.1.133.Final	453
netty-codec-compressionmaven	4.2.0.Final, 4.2.1.Final, 4.2.4.Final, 4.2.5.Final+5 more	4.2.13.Final	65

OSV records: GHSA-mj4r-2hfc-f8p6

Charts affected

453 by stars

Chart

Latest

Affected images

Radar Score

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-42583.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	netty-codec@4.1.82.Final	4.1.133.Final

Open the chart page →

6,016

language-toolzekker6

1.12.1

1 of 2 See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-42583.

Container image	Digest	Package	Fixed in
erikvl87/languagetool :6.7-dockerupdate-3	e1ea6a975388	netty-codec@4.1.118.Final	4.1.133.Final

Open the chart page →

1,571

zipkinzipkin

0.5.0

1 of 1 See more

zipkin zipkin 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-42583.

Container image	Digest	Package	Fixed in
openzipkin/zipkin-slim :3.6.0	a69e1057df36	netty-codec-compression@4.2.10.Final	4.2.13.Final

Open the chart page →

1,159

Container images carrying it

513 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/radar-base/radar-output-restructure/radar-output-restructure :3.0.6	7fb9c70e96a4	netty-codec-compression@4.2.10.Final	4.2.13.Final	1
ghcr.io/star-whale/server :0.6.15	8368359c8dd0	netty-codec@4.1.86.Final	4.1.133.Final	1
ghcr.io/stirling-tools/stirling-pdf :2.14.3	3b3670fce70b	netty-codec-compression@4.2.12.Final	4.2.13.Final	1
ghcr.io/szpadel/languagetool-server :6.5	68fdab22b2a9	netty-codec@4.1.104.Final	4.1.133.Final	1
ghcr.io/wiremind/bitnami/keycloak :26.5.0-debian-12-r3	8622ea9e43c0	netty-codec@4.1.128.Final	4.1.133.Final	1
ghcr.io/wundergraph/cosmo/keycloak :0.13.0	b37408461b9b	netty-codec@4.1.130.Final	4.1.133.Final	1
public.ecr.aws/aws-containers/retail-store-sample-cart :1.3.0	5d767569c976	netty-codec@4.1.124.Final	4.1.133.Final	1
public.ecr.aws/aws-containers/retail-store-sample-orders :1.3.0	e85f034bcf48	netty-codec@4.1.124.Final	4.1.133.Final	1
public.ecr.aws/aws-containers/retail-store-sample-ui :1.3.0	ce3f2e935eb3	netty-codec@4.1.124.Final	4.1.133.Final	1
public.ecr.aws/v0r6c2e2/hive-metastore :latest	794b3bff9510	netty-codec@4.1.89.Final	4.1.133.Final	1
public.ecr.aws/v0r6c2e2/trino :latest	c265156b00d1	netty-codec@4.1.117.Final	4.1.133.Final	1
quay.io/apicurio/apicurio-registry-kube-sync :1.0.1	70ef31840269	netty-codec@4.1.68.Final	4.1.133.Final	1
quay.io/apicurio/apicurio-registry-mem :2.5.8.Final	3b036692d546	netty-codec@4.1.100.Final	4.1.133.Final	1
quay.io/deployhub/ms-ui :svccat-v11.0.815-g717581	f5dedbc31e6f	netty-codec@4.1.127.Final	4.1.133.Final	1
quay.io/evryfs/spring-boot-admin :2.7.10	60950ef63764	netty-codec@4.1.86.Final	4.1.133.Final	1
quay.io/fiware/apollo :0.0.10	55330b1b60c1	netty-codec@4.1.77.Final	4.1.133.Final	1
quay.io/fiware/canis-major :1.5.15	bb40472e4ff5	netty-codec@4.1.73.Final	4.1.133.Final	1
quay.io/fiware/contract-management :3.3.12	2bcfcf874451	netty-codec@4.1.115.Final	4.1.133.Final	1
quay.io/fiware/credentials-config-service :3.4.3	f2fbced76da8	netty-codec-compression@4.2.9.Final	4.2.13.Final	1
quay.io/fiware/endpoint-configuration-service :0.4.3	0dc38a87b844	netty-codec@4.1.69.Final	4.1.133.Final	1
quay.io/fiware/tmforum-account :1.18.0	6b25aac03414	netty-codec@4.1.91.Final	4.1.133.Final	1
quay.io/fiware/tmforum-agreement :1.18.0	81e7025dc16d	netty-codec@4.1.91.Final	4.1.133.Final	1
quay.io/fiware/tmforum-customer-bill-management :1.18.0	dee901f1f75d	netty-codec@4.1.91.Final	4.1.133.Final	1
quay.io/fiware/tmforum-customer-management :1.18.0	d3519cebecd0	netty-codec@4.1.91.Final	4.1.133.Final	1
quay.io/fiware/tmforum-party-catalog :1.18.0	7d6969a7393a	netty-codec@4.1.91.Final	4.1.133.Final	1
quay.io/fiware/tmforum-party-role :1.18.0	52db89f17863	netty-codec@4.1.91.Final	4.1.133.Final	1
quay.io/fiware/tmforum-product-catalog :1.18.0	e409338726da	netty-codec@4.1.91.Final	4.1.133.Final	1
quay.io/fiware/tmforum-product-inventory :1.18.0	3a5d6dd30f1d	netty-codec@4.1.91.Final	4.1.133.Final	1
quay.io/fiware/tmforum-product-ordering-management :1.18.0	42c81c291f6f	netty-codec@4.1.91.Final	4.1.133.Final	1
quay.io/fiware/tmforum-quote :1.18.0	d9ca3a334352	netty-codec@4.1.91.Final	4.1.133.Final	1
quay.io/fiware/tmforum-resource-catalog :1.18.0	b0d853627c59	netty-codec@4.1.91.Final	4.1.133.Final	1
quay.io/fiware/tmforum-resource-function-activation :1.18.0	62a5acb63fd1	netty-codec@4.1.91.Final	4.1.133.Final	1
quay.io/fiware/tmforum-resource-inventory :1.18.0	553b4a47730b	netty-codec@4.1.91.Final	4.1.133.Final	1
quay.io/fiware/tmforum-resource-order-management :1.18.0	dd1778ad6203	netty-codec@4.1.91.Final	4.1.133.Final	1
quay.io/fiware/tmforum-service-catalog :1.18.0	74b0fad9e155	netty-codec@4.1.91.Final	4.1.133.Final	1
quay.io/fiware/tmforum-service-inventory :1.18.0	4be54e8cb5c0	netty-codec@4.1.91.Final	4.1.133.Final	1
quay.io/fiware/tmforum-service-order-management :1.18.0	d2091785d544	netty-codec@4.1.91.Final	4.1.133.Final	1
quay.io/fiware/tmforum-software-management :1.18.0	1b74a2f7ba67	netty-codec@4.1.91.Final	4.1.133.Final	1
quay.io/fiware/tmforum-usage-management :1.18.0	42f190c42926	netty-codec@4.1.91.Final	4.1.133.Final	1
quay.io/fiware/trusted-issuers-list :0.9.1	3c886ce5c056	netty-codec-compression@4.2.9.Final	4.2.13.Final	1
quay.io/fiware/trusted-issuers-registry :0.11.1	a8a9ec461034	netty-codec@4.1.100.Final	4.1.133.Final	1
quay.io/keycloak/keycloak :26.0	09a381c715ab	netty-codec@4.1.111.Final	4.1.133.Final	1
quay.io/keycloak/keycloak :26.0.7	4388e2379b7e	netty-codec@4.1.111.Final	4.1.133.Final	1
quay.io/keycloak/keycloak :24.0.3	4d6f22991266	netty-codec@4.1.107.Final	4.1.133.Final	1
quay.io/keycloak/keycloak :23.0.3	4f72a5b0c076	netty-codec@4.1.100.Final	4.1.133.Final	1
quay.io/keycloak/keycloak :26.3.3	6a7217a100bd	netty-codec@4.1.124.Final	4.1.133.Final	1
quay.io/keycloak/keycloak :20.0.1	8830f76112b6	netty-codec@4.1.82.Final	4.1.133.Final	1
quay.io/keycloak/keycloak :26.5.6	8d44614c7479	netty-codec@4.1.130.Final	4.1.133.Final	1
quay.io/keycloak/keycloak :26.4	9409c59bdfb6	netty-codec@4.1.128.Final	4.1.133.Final	1
quay.io/keycloak/keycloak :26.0.6	a93d22e13b86	netty-codec@4.1.111.Final	4.1.133.Final	1