CVE-2026-42583

High

Advisory

Published 7 May 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.005; 39th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 453; of 17,781 indexed, latest versions
Container images: 513; deployed by those charts
Fix available: 2 of 2; affected packages

Netty Lz4FrameDecoder is vulnerable to resource exhaustion

Carried by container images the latest versions of 453 of 17,781 indexed charts deploy, on 513 images.

Affected package	Affected versions	Fixed in	Images
netty-codecmaven	4.0.23.Final, 4.0.27.Final, 4.0.36.Final, 4.0.37.Final+89 more	4.1.133.Final	453
netty-codec-compressionmaven	4.2.0.Final, 4.2.1.Final, 4.2.4.Final, 4.2.5.Final+5 more	4.2.13.Final	66

OSV records: GHSA-mj4r-2hfc-f8p6

Charts affected

453 by stars

Chart

Latest

Affected images

Radar Score

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-42583.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	netty-codec@4.1.82.Final	4.1.133.Final

Open the chart page →

6,016

language-toolzekker6

1.12.1

1 of 2 See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-42583.

Container image	Digest	Package	Fixed in
erikvl87/languagetool :6.7-dockerupdate-3	e1ea6a975388	netty-codec@4.1.118.Final	4.1.133.Final

Open the chart page →

1,571

zipkinzipkin

0.5.0

1 of 1 See more

zipkin zipkin 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-42583.

Container image	Digest	Package	Fixed in
openzipkin/zipkin-slim :3.6.0	a69e1057df36	netty-codec-compression@4.2.10.Final	4.2.13.Final

Open the chart page →

1,159

Container images carrying it

513 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
wazuh/wazuh-indexer :4.14.4	9c344d2b1757	netty-codec@4.1.125.Final	4.1.133.Final	1
wazuh/wazuh-indexer :4.11.1	a7a2076b167e	netty-codec@4.1.108.Final	4.1.133.Final	1
wazuh/wazuh-indexer :4.14.3	b149b30da686	netty-codec@4.1.125.Final	4.1.133.Final	1
xeotek/kadeck :6.3.4	39a3b37a17c5	netty-codec@4.1.108.Final	4.1.133.Final	1
xeotek/kadeck :4.2.9	4c6b04d9ce55	netty-codec@4.1.70.Final	4.1.133.Final	1
xuxueli/xxl-job-admin :2.4.0	640093c35fd6	netty-codec@4.1.89.Final	4.1.133.Final	1
yuzutech/kroki :0.17.0	192b7b27c857	netty-codec@4.1.74.Final	4.1.133.Final	1
zahoriaut/zahori-process :0.1.13	351f8a220ed7	netty-codec@4.1.94.Final	4.1.133.Final	1
zahoriaut/zahori-server :0.1.17	b2de13916f3e	netty-codec@4.1.87.Final	4.1.133.Final	1
zammad/zammad-docker-compose :zammad-elasticsearch-4.1.0-31	8274d75a51fc	netty-codec@4.1.49.Final	4.1.133.Final	1
zbalogh/reservation-api-server :1.0.9	7c247e399a1f	netty-codec@4.1.82.Final	4.1.133.Final	1
gcr.io/spinnaker-marketplace/halyard :1.32.0	0ee5f968d2ab	netty-codec@4.1.45.Final	4.1.133.Final	1
ghcr.io/appscode/inbox-server :MailetGroup	4a2824296412	netty-codec@4.1.94.Final	4.1.133.Final	1
ghcr.io/camunda-community-hub/zeebe-simple-monitor :2.6.2	d9d796a1b846	netty-codec@4.1.104.Final	4.1.133.Final	1
ghcr.io/curium-rocks/mitre-siphon :main	503c00321502	netty-codec@4.1.92.Final	4.1.133.Final	1
ghcr.io/damap-org/damap-backend :5.0.0	f3d0c7d35498	netty-codec@4.1.108.Final	4.1.133.Final	1
ghcr.io/data-fair/elasticsearch :7.17.1	aa45adaf59a7	netty-codec@4.1.66.Final	4.1.133.Final	1
ghcr.io/devops-ia/cp-schema-registry :8.1.1-msk-iam-auth2.3.5	30d1a445acc7	netty-codec@4.1.126.Final	4.1.133.Final	1
ghcr.io/devops-ia/kafka-cruise-control :jdk17-cc2.5.146-iam2.3.8	e310642de2e2	netty-codec@4.1.118.Final	4.1.133.Final	1
ghcr.io/eshepelyuk/dckr/cmak-3.0.0.6 :1.2.0	90a34412c6b5	netty-codec@4.1.45.Final	4.1.133.Final	1
ghcr.io/fleeksoft/hbase/hbase-base :2.4.13.2	c144bdd688d7	netty-codec@4.1.45.Final	4.1.133.Final	1
ghcr.io/fleeksoft/hbase/hdfs :3.3.3.2	ac62269785ac	netty-codec@4.1.50.Final	4.1.133.Final	1
ghcr.io/gla-rad/enav-api-gateway :latest	8f4345c77dda	netty-codec-compression@4.2.12.Final	4.2.13.Final	1
ghcr.io/gla-rad/enav-aton-admin-service :latest	cf85570b1324	netty-codec-compression@4.2.12.Final	4.2.13.Final	1
ghcr.io/gla-rad/enav-aton-service :latest	3be878690629	netty-codec-compression@4.2.12.Final	4.2.13.Final	1
ghcr.io/gla-rad/enav-aton-service-client :latest	f1629ac5f9ec	netty-codec-compression@4.2.12.Final	4.2.13.Final	1
ghcr.io/gla-rad/enav-ckeeper :latest	415323ef112b	netty-codec-compression@4.2.12.Final	4.2.13.Final	1
ghcr.io/gla-rad/enav-eureka :latest	05002092c621	netty-codec-compression@4.2.12.Final	4.2.13.Final	1
ghcr.io/gla-rad/enav-msg-broker :latest	6fe372e4e481	netty-codec-compression@4.2.12.Final	4.2.13.Final	1
ghcr.io/gregperlinli/certvault :2.12.0	a7d0cc9e260a	netty-codec@4.1.128.Final	4.1.133.Final	1
ghcr.io/jens-maus/raspberrymatic :3.83.6.20250824	4b22b4f407c4	netty-codec@4.1.67.Final	4.1.133.Final	1
ghcr.io/joffreybvn/k8s-geyser :0.0.2	47f36880072e	netty-codec@4.1.101.Final	4.1.133.Final	1
ghcr.io/kafbat/kafka-ui :v1.2.0	185da4ad3e88	netty-codec@4.1.118.Final	4.1.133.Final	1
ghcr.io/komputing/fauceth :release	4ab8fa4143b4	netty-codec@4.1.69.Final	4.1.133.Final	1
ghcr.io/kubeflow/spark-operator/controller :2.2.1	865ff4da5686	netty-codec@4.1.96.Final	4.1.133.Final	1
ghcr.io/kubelauncher/cassandra	b66aba320083	netty-codec@4.1.130.Final	4.1.133.Final	1
ghcr.io/kubelauncher/kafka	43e1085cd0a8	netty-codec@4.1.111.Final	4.1.133.Final	1
ghcr.io/kubelauncher/zookeeper	7826e9caa461	netty-codec@4.1.113.Final	4.1.133.Final	1
ghcr.io/kvaps/linstor-controller :v1.14.0	00ce11c31087	netty-codec@4.1.51.Final	4.1.133.Final	1
ghcr.io/kvaps/linstor-satellite :v1.14.0	a573fb9bc809	netty-codec@4.1.51.Final	4.1.133.Final	1
ghcr.io/melodyyangaws/hive-metastore :3.0.0	e949b0f733f0	netty-codec@4.1.61.Final	4.1.133.Final	1
ghcr.io/microboxlabs/miot-calendar :latest-jvm	7157cdc0bf5b	netty-codec@4.1.130.Final	4.1.133.Final	1
ghcr.io/navikt/mock-oauth2-server :2.1.10	65d4ed47ce09	netty-codec@4.1.112.Final	4.1.133.Final	1
ghcr.io/openccu/openccu :3.89.8.20260719	b2de2ff6e8e0	netty-codec@4.1.67.Final netty-codec-compression@4.2.5.Final	4.1.133.Final 4.2.13.Final	1
ghcr.io/open-telemetry/demo :1.12.0-kafka	071a788162e8	netty-codec@4.1.100.Final	4.1.133.Final	1
ghcr.io/open-telemetry/demo :1.12.0-frauddetectionservice	77cefdab4d5c	netty-codec@4.1.100.Final	4.1.133.Final	1
ghcr.io/open-telemetry/demo :1.12.0-adservice	a59e5eead495	netty-codec@4.1.100.Final	4.1.133.Final	1
ghcr.io/privacyengineering/hawk-service :latest	bfedf47bb5e0	netty-codec@4.1.101.Final	4.1.133.Final	1
ghcr.io/projectnessie/nessie :0.92.1	9efe3c74d55f	netty-codec@4.1.108.Final	4.1.133.Final	1
ghcr.io/punchplatform/punchline-java :8.1.1	d46ce7b96482	netty-codec@4.1.77.Final	4.1.133.Final	1