CVE-2026-42583

High

Advisory

Published 7 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.005; 39th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 453; of 17,781 indexed, latest versions
Container images: 513; deployed by those charts
Fix available: 2 of 2; affected packages

Netty Lz4FrameDecoder is vulnerable to resource exhaustion

Carried by container images the latest versions of 453 of 17,781 indexed charts deploy, on 513 images.

Affected package	Affected versions	Fixed in	Images
netty-codecmaven	4.0.23.Final, 4.0.27.Final, 4.0.36.Final, 4.0.37.Final+89 more	4.1.133.Final	453
netty-codec-compressionmaven	4.2.0.Final, 4.2.1.Final, 4.2.4.Final, 4.2.5.Final+5 more	4.2.13.Final	66

OSV records: GHSA-mj4r-2hfc-f8p6

Charts affected

453 by stars

Chart

Latest

Affected images

Radar Score

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-42583.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	netty-codec@4.1.82.Final	4.1.133.Final

Open the chart page →

6,016

language-toolzekker6

1.12.1

1 of 2 See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-42583.

Container image	Digest	Package	Fixed in
erikvl87/languagetool :6.7-dockerupdate-3	e1ea6a975388	netty-codec@4.1.118.Final	4.1.133.Final

Open the chart page →

1,571

zipkinzipkin

0.5.0

1 of 1 See more

zipkin zipkin 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-42583.

Container image	Digest	Package	Fixed in
openzipkin/zipkin-slim :3.6.0	a69e1057df36	netty-codec-compression@4.2.10.Final	4.2.13.Final

Open the chart page →

1,159

Container images carrying it

513 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
apachepulsar/pulsar :2.10.0	3b262ab7a7d9	netty-codec@4.1.74.Final	4.1.133.Final	1
apachepulsar/pulsar :2.6.1	4db6ff0b4045	netty-codec@4.1.48.Final	4.1.133.Final	1
apachepulsar/pulsar :3.0.7	9c9947de139d	netty-codec@4.1.113.Final	4.1.133.Final	1
apachepulsar/pulsar :2.9.0	d056c89b7131	netty-codec@4.1.68.Final	4.1.133.Final	1
apachepulsar/pulsar :2.8.2	d538416d5afe	netty-codec@4.1.72.Final	4.1.133.Final	1
apache/ranger :2.7.0	76c176e8a0e4	netty-codec@4.1.108.Final	4.1.133.Final	1
apache/rocketmq-exporter :0.0.2	c8fb51195444	netty-codec@4.1.91.Final	4.1.133.Final	1
apache/shenyu-admin :2.5.1	e2be712fc4f4	netty-codec@4.1.38.Final	4.1.133.Final	1
apache/shenyu-bootstrap :2.5.1	1bd5756f6273	netty-codec@4.1.38.Final	4.1.133.Final	1
apache/skywalking-oap-server :9.2.0	133d35d2c263	netty-codec@4.1.77.Final	4.1.133.Final	1
apache/skywalking-oap-server :8.1.0-es7	641237e0299b	netty-codec@4.1.42.Final	4.1.133.Final	1
apache/skywalking-oap-server :8.9.1	b4ec8c18d079	netty-codec@4.1.68.Final	4.1.133.Final	1
apache/skywalking-ui :9.2.0	295f1dc87d98	netty-codec@4.1.77.Final	4.1.133.Final	1
apache/skywalking-ui :8.1.0	67d50e4deff4	netty-codec@4.0.27.Final	4.1.133.Final	1
apache/skywalking-ui :8.9.1	80530f0308a5	netty-codec@4.1.63.Final	4.1.133.Final	1
apicurio/apicurio-registry-jpa :1.3.2.Final	44eeddd3562c	netty-codec@4.1.49.Final	4.1.133.Final	1
apicurio/apicurio-registry-kafkasql :2.1.0.Final	a97d67487532	netty-codec@4.1.49.Final	4.1.133.Final	1
apicurio/apicurio-studio-api :0.2.62.Final	302d202ed149	netty-codec@4.1.86.Final	4.1.133.Final	1
apicurio/apicurio-studio-ui :0.2.62.Final	349c845270c2	netty-codec@4.1.86.Final	4.1.133.Final	1
apicurio/apicurio-studio-ws :0.2.62.Final	27a91978a388	netty-codec@4.1.86.Final	4.1.133.Final	1
apimap/api :v1.8.11	ae2b3ab00177	netty-codec@4.1.82.Final	4.1.133.Final	1
arturisimo/planner :v1.0	fff9de644941	netty-codec@4.1.70.Final	4.1.133.Final	1
assistiot/cybersecurity-monitoring_id-elk :latest	ba1d85ec3739	netty-codec@4.1.45.Final	4.1.133.Final	1
assistiot/cybersecurity-monitoring_ir-elk :latest	4228b7a8ef40	netty-codec@4.1.49.Final	4.1.133.Final	1
assistiot/cybersecurity-monitoring_ir-thv :latest	c8b6c7eaa0cd	netty-codec@4.0.56.Final	4.1.133.Final	1
assistiot/identity-manager_kc :latest	0df4b4fa899a	netty-codec@4.1.76.Final	4.1.133.Final	1
assistiot/sdn_controller :2.4.0	ea254b6d8a31	netty-codec@4.1.35.Final	4.1.133.Final	1
athou/commafeed :6.2.0-postgresql	5e388351df1a	netty-codec@4.1.130.Final	4.1.133.Final	1
atlassian/confluence-server :7.10.0	3b9222ab32ef	netty-codec@4.1.33.Final	4.1.133.Final	1
atomix/atomix :3.1.12	7738ff4f5c63	netty-codec@4.1.27.Final	4.1.133.Final	1
bitnamilegacy/elasticsearch :8.12.2	15d4647fd491	netty-codec@4.1.94.Final	4.1.133.Final	1
bitnamilegacy/elasticsearch :8.12.1-debian-11-r2	9cfd2df1294d	netty-codec@4.1.94.Final	4.1.133.Final	1
bitnamilegacy/elasticsearch :9.0.1-debian-12-r0	e6f6ddcce2f1	netty-codec@4.1.118.Final	4.1.133.Final	1
bitnamilegacy/kafka :3.5.0-debian-11-r0	8657bb93a581	netty-codec@4.1.92.Final	4.1.133.Final	1
bitnamilegacy/kafka :3.4.0-debian-11-r6	ac64829e45b3	netty-codec@4.1.78.Final	4.1.133.Final	1
bitnamilegacy/kafka :2.8.1-debian-11-r7	b6e381ffd6ae	netty-codec@4.1.62.Final	4.1.133.Final	1
bitnamilegacy/keycloak :20.0.5	cb04e49e6eb1	netty-codec@4.1.86.Final	4.1.133.Final	1
bitnamilegacy/keycloak :24.0.4	cc599cbd15ff	netty-codec@4.1.108.Final	4.1.133.Final	1
bitnamilegacy/keycloak :26.3.3-debian-12-r0	da3df0976a9f	netty-codec@4.1.124.Final	4.1.133.Final	1
bitnamilegacy/opensearch :2.18.0-debian-12-r0	d8440eb6b290	netty-codec@4.1.114.Final	4.1.133.Final	1
bitnamilegacy/zookeeper :3.7.2-debian-11-r5	cbf54314c401	netty-codec@4.1.94.Final	4.1.133.Final	1
bitnamilegacy/zookeeper :3.8.1-debian-11-r6	dba59d740e13	netty-codec@4.1.86.Final	4.1.133.Final	1
bivas/presto :0.196	05545994f806	netty-codec@4.0.37.Final	4.1.133.Final	1
bluerange/bluerange :26.1.3	07c8f73b55df	netty-codec@4.1.119.Final	4.1.133.Final	1
camunda/zeebe :8.4.5	ab5abc09e407	netty-codec@4.1.107.Final	4.1.133.Final	1
cbioportal/cbioportal :6.4.1-web-shenandoah	08debbd2dbf9	netty-codec@4.1.127.Final	4.1.133.Final	1
choerodon/event-store-service :0.8.0	3c94c97f6f69	netty-codec@4.0.27.Final	4.1.133.Final	1
ckan/ckan-solr :2.11-solr9	ef8e5d3e6be1	netty-codec@4.1.114.Final	4.1.133.Final	1
conductoross/conductor :3.31.0	9fba127693e6	netty-codec@4.1.119.Final	4.1.133.Final	1
confluentinc/cp-enterprise-control-center :6.1.0	f2975d507a2a	netty-codec@4.1.50.Final	4.1.133.Final	1