CVE-2026-42583

High

Advisory

Published 7 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.005; 39th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 453; of 17,781 indexed, latest versions
Container images: 513; deployed by those charts
Fix available: 2 of 2; affected packages

Netty Lz4FrameDecoder is vulnerable to resource exhaustion

Carried by container images the latest versions of 453 of 17,781 indexed charts deploy, on 513 images.

Affected package	Affected versions	Fixed in	Images
netty-codecmaven	4.0.23.Final, 4.0.27.Final, 4.0.36.Final, 4.0.37.Final+89 more	4.1.133.Final	453
netty-codec-compressionmaven	4.2.0.Final, 4.2.1.Final, 4.2.4.Final, 4.2.5.Final+5 more	4.2.13.Final	66

OSV records: GHSA-mj4r-2hfc-f8p6

Charts affected

453 by stars

Chart

Latest

Affected images

Radar Score

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-42583.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	netty-codec@4.1.82.Final	4.1.133.Final

Open the chart page →

6,016

language-toolzekker6

1.12.1

1 of 2 See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-42583.

Container image	Digest	Package	Fixed in
erikvl87/languagetool :6.7-dockerupdate-3	e1ea6a975388	netty-codec@4.1.118.Final	4.1.133.Final

Open the chart page →

1,571

zipkinzipkin

0.5.0

1 of 1 See more

zipkin zipkin 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-42583.

Container image	Digest	Package	Fixed in
openzipkin/zipkin-slim :3.6.0	a69e1057df36	netty-codec-compression@4.2.10.Final	4.2.13.Final

Open the chart page →

1,159

Container images carrying it

513 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
gridgain/gridgain9 :9.1.18	95018390077b	netty-codec-compression@4.2.10.Final	4.2.13.Final	1
gurolakman/smsf-configuration :1.0.4	9abb3882bcbd	netty-codec@4.1.75.Final	4.1.133.Final	1
gurolakman/smsf-dispatcher :1.0.4	6537e8ed8de8	netty-codec@4.1.75.Final	4.1.133.Final	1
gurolakman/smsf-momt :1.0.4	ce23b20a8a17	netty-codec@4.1.75.Final	4.1.133.Final	1
gurolakman/smsf-registration :1.0.4	b22e746edd5d	netty-codec@4.1.75.Final	4.1.133.Final	1
gurolakman/ussigw-configuration :1.0.4	bf18525c5ad9	netty-codec@4.1.75.Final	4.1.133.Final	1
gurolakman/ussigw-core :1.0.4	8739565c3ea2	netty-codec@4.1.75.Final	4.1.133.Final	1
hazelcast/hazelcast :5.3.1	8fe26efde8e1	netty-codec@4.1.91.Final	4.1.133.Final	1
hazelcast/hazelcast :latest	f086bf0ecb23	netty-codec@4.1.132.Final	4.1.133.Final	1
hazelcast/hazelcast-jet :4.5.3	a825ecbe9fda	netty-codec@4.1.51.Final	4.1.133.Final	1
hivemq/hivemq4 :dns-4.5.14	4d194450d48e	netty-codec@4.1.63.Final	4.1.133.Final	1
hivemq/hivemq-edge :2026.13	aba306d1f089	netty-codec@4.1.131.Final	4.1.133.Final	1
hivemq/hivemq-operator :4.7.10	241d6a8e1963	netty-codec@4.1.77.Final	4.1.133.Final	1
huertaslopez/i.huertas.2021-v.martinp.2021-planner :2.0.0	e2c18bd65472	netty-codec@4.1.70.Final	4.1.133.Final	1
hugohg34/planner :0.0.2	171f61e8d7e2	netty-codec@4.1.70.Final	4.1.133.Final	1
hugohg34/toposervice :0.0.2	812a03b3f274	netty-codec@4.1.70.Final	4.1.133.Final	1
ibmcom/bai-elasticsearch-dev :19.0.2	5441dba2fa00	netty-codec@4.1.32.Final	4.1.133.Final	1
kafkace/kafka :v3.7.1-63ba8d2	7adc206bf5a4	netty-codec@4.1.110.Final	4.1.133.Final	1
kafkakraft/kafka-connect :3.7.0	062d697db7e5	netty-codec@4.1.100.Final	4.1.133.Final	1
kafkakraft/kafka-controller :3.7.0	f261ad288fce	netty-codec@4.1.100.Final	4.1.133.Final	1
kafkakraft/kafkakraft :3.7.0	2e4b593b878b	netty-codec@4.1.100.Final	4.1.133.Final	1
keyfactor/signserver-ce :7.3.2	798fbbe00283	netty-codec@4.1.116.Final	4.1.133.Final	1
krontechnology/aapm-agent :1.1.0	7feef7d2ab42	netty-codec@4.1.54.Final	4.1.133.Final	1
kubebb/gateway-api :v5.6.0	4d062f20309c	netty-codec@4.1.82.Final	4.1.133.Final	1
ladeit/ladeit :latest	962b665ffe82	netty-codec@4.1.31.Final	4.1.133.Final	1
lavandadelpatio/torznab-atomohd :latest	214eaef5444c	netty-codec@4.1.90.Final	4.1.133.Final	1
library/crate :4.7.0	c7984a05e15b	netty-codec@4.1.73.Final	4.1.133.Final	1
library/elasticsearch :8.17.3	2cc40b15dff8	netty-codec@4.1.118.Final	4.1.133.Final	1
library/elasticsearch :8.15.0	310b9fc03b06	netty-codec@4.1.109.Final	4.1.133.Final	1
library/elasticsearch :7.17.0	332c6d416808	netty-codec@4.1.66.Final	4.1.133.Final	1
library/elasticsearch :7.17.15	88c2ec10c7f2	netty-codec@4.1.94.Final	4.1.133.Final	1
library/elasticsearch :7.17.8	fdc73b3249c1	netty-codec@4.1.66.Final	4.1.133.Final	1
library/flink :1.11.2-scala_2.12	1fe4fb22a2a5	netty-codec@4.1.34.Final	4.1.133.Final	1
library/logstash :9.1.2	33eae14f0867	netty-codec@4.1.118.Final	4.1.133.Final	1
library/neo4j :4.2.4	348e3f56faa2	netty-codec@4.1.59.Final	4.1.133.Final	1
library/neo4j :2026.02.2	5ab4ab0358cf	netty-codec-compression@4.2.9.Final	4.2.13.Final	1
library/neo4j :5.18.1	8f01f7bb053e	netty-codec@4.1.106.Final	4.1.133.Final	1
library/neo4j :3.4.5-enterprise	a1ba477fa412	netty-codec@4.1.22.Final	4.1.133.Final	1
library/solr :8.7.0	d124efd81fbb	netty-codec@4.1.50.Final	4.1.133.Final	1
library/sonarqube :10.7.0-community	0842dcd4c8f8	netty-codec@4.1.107.Final	4.1.133.Final	1
library/sonarqube :6.7.6-community	0ae5169e3d0f	netty-codec@4.1.13.Final	4.1.133.Final	1
library/sonarqube :9.1.0-datacenter-search	7e43ff493a47	netty-codec@4.1.49.Final	4.1.133.Final	1
library/sonarqube :8.9.2-community	88cd63154d4b	netty-codec@4.1.49.Final	4.1.133.Final	1
library/sonarqube :8.2-community	a246bc64207e	netty-codec@4.1.32.Final	4.1.133.Final	1
library/sonarqube :9.1.0-datacenter-app	a9bc5a3a1fc3	netty-codec@4.1.49.Final	4.1.133.Final	1
library/sonarqube :8.9-community	eb2f0be32efd	netty-codec@4.1.66.Final	4.1.133.Final	1
library/sonarqube :10.0.0-community	ef9723cf4fe4	netty-codec@4.1.84.Final	4.1.133.Final	1
library/storm :2.4.0	bd5d420506d6	netty-codec@4.1.30.Final	4.1.133.Final	1
library/zookeeper :3.6.2	4c8a6d3b2338	netty-codec@4.1.50.Final	4.1.133.Final	1
library/zookeeper :3.8-temurin	55d1e5b2e601	netty-codec@4.1.94.Final	4.1.133.Final	1