StackRadar

CVE-2026-47890

Critical

Advisory

Published 27 Aug 2026In the index since 8 Oct 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
85
of 18,053 indexed, latest versions
Container images
102
deployed by those charts
Fix available
2 of 2
affected packages

Spring Framework Server Sent Event stream corruption while rendering fragments

Carried by container images the latest versions of 85 of 18,053 indexed charts deploy, on 102 images.

Affected packageAffected versionsFixed inImages
spring-webmvcmaven6.2.0, 6.2.1, 6.2.2, 6.2.5+15 more7.0.993
spring-webfluxmaven6.2.0, 6.2.2, 6.2.3, 6.2.6+9 more7.0.934
OSV records
GHSA-j9f9-w8pj-32f8

Charts affected

85 by stars
ChartLatestAffected imagesRadar Score
mod-inn-reachfolio-org0.1.71 of 1See more

mod-inn-reach folio-org 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
folioci/mod-inn-reach:latestcc8584e43382
spring-webmvc@7.0.8
7.0.9

Open the chart page →

513
mod-password-validatorfolio-org0.1.341 of 1See more

mod-password-validator folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
folioci/mod-password-validator:latestb31d75f2bf7b
spring-webmvc@7.0.8
7.0.9

Open the chart page →

395
mod-remote-storagefolio-org0.1.321 of 1See more

mod-remote-storage folio-org 0.1.32

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
folioci/mod-remote-storage:latest4f12177123dc
spring-webmvc@7.0.8
7.0.9

Open the chart page →

572
mod-tagsfolio-org0.1.341 of 1See more

mod-tags folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
folioci/mod-tags:latest6e8beeb70272
spring-webmvc@7.0.8
7.0.9

Open the chart page →

343
cc-spring-appgridgainVerified publisher1.0.61 of 1See more

cc-spring-app gridgain 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
gridgain/cloud-connector:2025.5.15ab838d7d3cb
spring-webflux@6.2.15
spring-webmvc@6.2.15
no fix listed
no fix listed

Open the chart page →

1,984
hello-world-apihello-world-api0.0.51 of 1See more

hello-world-api hello-world-api 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
fabioformosa/hello-world-api:latest063873af085c
spring-webmvc@6.2.5
no fix listed

Open the chart page →

1,555
alfiohelmforgeVerified publisher1.2.121 of 3See more

alfio helmforge 1.2.12

1 of the 3 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
alfio/alf.io:2.0-M5-26060c836a081446
spring-webmvc@6.2.18
no fix listed

Open the chart page →

2,310
booklorehelmforgeVerified publisher2.0.21 of 3See more

booklore helmforge 2.0.2

1 of the 3 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
ghcr.io/booklore-app/booklore:v2.3.1d3d3af34bc2c
spring-webmvc@7.0.8
7.0.9

Open the chart page →

2,416
komgahelmforgeVerified publisher1.4.161 of 1See more

komga helmforge 1.4.16

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
gotson/komga:1.27.19cf102f5fb78
spring-webflux@6.2.19
spring-webmvc@6.2.19
no fix listed
no fix listed

Open the chart page →

36,012
openaevhelm-openbasVerified publisher2.0.111 of 7See more

openaev helm-openbas 2.0.11

1 of the 7 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
openaev/platform:3.261005.0eaf26c4106a1
spring-webflux@6.2.19
spring-webmvc@6.2.19
no fix listed
no fix listed

Open the chart page →

21,120
appswitcher-serverit-at-mOfficialVerified publisher2.0.21 of 1See more

appswitcher-server it-at-m 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/appswitcher-server:1.3.010006bc0f309
spring-webmvc@6.2.6
no fix listed

Open the chart page →

4,528
daveit-at-mOfficialVerified publisher0.2.187 of 9See more

dave it-at-m 0.2.18

7 of the 9 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/dave-admin-portal/dave-adminportal:10.0.0cbff8141302f
spring-webflux@6.2.19
no fix listed
ghcr.io/it-at-m/dave-backend/dave-backend:10.0.0f66413e62afc
spring-webflux@6.2.19
spring-webmvc@6.2.19
no fix listed
no fix listed
ghcr.io/it-at-m/dave-document-storage/dave-document-storage:10.0.09c7fc07330c9
spring-webflux@6.2.19
spring-webmvc@6.2.19
no fix listed
no fix listed
ghcr.io/it-at-m/dave-eai/dave-eai:10.0.0fd93e0d125b3
spring-webmvc@6.2.19
no fix listed
ghcr.io/it-at-m/dave-frontend/dave-frontend:10.0.0a49fdb8d6f1b
spring-webflux@6.2.19
no fix listed
ghcr.io/it-at-m/dave-geodata-eai/dave-geodata-eai:10.0.06a3fe3136856
spring-webflux@6.2.19
spring-webmvc@6.2.19
no fix listed
no fix listed
ghcr.io/it-at-m/dave-selfservice-portal/dave-selfserviceportal:10.0.0d352df1b94b6
spring-webflux@6.2.19
no fix listed

Open the chart page →

15,089
kf-app-eaiit-at-mOfficialVerified publisher0.1.71 of 1See more

kf-app-eai it-at-m 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/kf-app-eai:1.0.65de339b3d537
spring-webmvc@6.2.10
no fix listed

Open the chart page →

2,254
zammad-ldap-syncit-at-mVerified publisher0.6.51 of 1See more

zammad-ldap-sync it-at-m 0.6.5

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/zammad-ldap-sync:dev10de22c8cbce
spring-webmvc@6.2.1
no fix listed

Open the chart page →

1,585
proxerajfwenisch0.12.201 of 1See more

proxera jfwenisch 0.12.20

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
ghcr.io/wenisch-tech/proxera:0.12.205ac0e9f6b42f
spring-webmvc@7.0.8
7.0.9

Open the chart page →

343
k8sforjavak8sforjava0.1.01 of 1See more

k8sforjava k8sforjava 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
vincentgwzhang/k8sforjava:latesta9139f2cd98f
spring-webmvc@6.2.1
no fix listed

Open the chart page →

1,635
aapm-servicekron-pam-aapm-helmcharts1.2.91 of 1See more

aapm-service kron-pam-aapm-helmcharts 1.2.9

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
krontechnology/aapm-service:1.2.3b964408930a5
spring-webmvc@6.2.18
no fix listed

Open the chart page →

3,025
kron-aapm-agentkron-pam-aapm-helmcharts1.2.61 of 1See more

kron-aapm-agent kron-pam-aapm-helmcharts 1.2.6

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
krontechnology/aapm-agent:1.8.508e04ea66dfd
spring-webmvc@6.2.18
no fix listed

Open the chart page →

3,129
komgalinkding0.2.31 of 1See more

komga linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
gotson/komga:1.22.0ba892ab3e082
spring-webflux@6.2.0
spring-webmvc@6.2.0
no fix listed
no fix listed

Open the chart page →

4,095
nacosnacos-yunyeVerified publisher1.0.31 of 1See more

nacos nacos-yunye 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
nacos/nacos-server:v3.0.130a39cb0c54d
spring-webmvc@6.2.5
no fix listed

Open the chart page →

2,242
onyxiaonyxia11.8.21 of 2See more

onyxia onyxia 11.8.2

1 of the 2 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
inseefrlab/onyxia-api:v4.12.0b377aec3ead1
spring-webflux@6.2.18
spring-webmvc@6.2.18
no fix listed
no fix listed

Open the chart page →

4,944
cp-cmfopenshift2.4.31 of 1See more

cp-cmf openshift 2.4.3

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
confluentinc/cp-cmf:2.4.3c7617bf49a1b
spring-webmvc@6.2.19
no fix listed

Open the chart page →

98
fineractopenshift0.1.11 of 4See more

fineract openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
apache/fineract:1.12.1a83cf1980609
spring-webmvc@6.2.5
no fix listed

Open the chart page →

8,669
operatonoperatonVerified publisher1.0.51 of 1See more

operaton operaton 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
operaton/operaton:1.0.0-beta-4b35867ffe4d8
spring-webmvc@6.2.5
no fix listed

Open the chart page →

2,410
unifiqaoruVerified publisher1.1.61 of 2See more

unifi qaoru 1.1.6

1 of the 2 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
linuxserver/unifi-network-application:10.6.106-ls1485d288401f8bc
spring-webmvc@6.2.18
no fix listed

Open the chart page →

3,812
komgarubxkubeVerified publisher0.1.51 of 1See more

komga rubxkube 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
gotson/komga:1.28.1d8f772dce7b3
spring-webflux@6.2.19
spring-webmvc@6.2.19
no fix listed
no fix listed

Open the chart page →

24,589
stirling-pdfrubxkubeVerified publisher0.1.21 of 1See more

stirling-pdf rubxkube 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
ghcr.io/stirling-tools/stirling-pdf:2.14.33b3670fce70b
spring-webmvc@7.0.7
7.0.9

Open the chart page →

7,228
retail-store-sample-cart-chartstacksimplifyVerified publisher1.0.01 of 1See more

retail-store-sample-cart-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-cart:1.3.05d767569c976
spring-webmvc@6.2.10
no fix listed

Open the chart page →

1,254
retail-store-sample-orders-chartstacksimplifyVerified publisher2.0.01 of 1See more

retail-store-sample-orders-chart stacksimplify 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-orders:1.3.0e85f034bcf48
spring-webmvc@6.2.10
no fix listed

Open the chart page →

1,466
retail-store-sample-ui-chartstacksimplifyVerified publisher1.0.01 of 1See more

retail-store-sample-ui-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-ui:1.3.0ce3f2e935eb3
spring-webflux@6.2.10
no fix listed

Open the chart page →

1,030
sn-consolestreamnative1.13.01 of 1See more

sn-console streamnative 1.13.0

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
streamnative/private-cloud-console:v2.3.27-all91e54375e154
spring-webmvc@6.2.10
no fix listed

Open the chart page →

2,148
tekton-ci-environment-injectortekton-ci-environment-injectorVerified publisher0.2.41 of 1See more

tekton-ci-environment-injector tekton-ci-environment-injector 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
quay.io/poundex/tekton-ci-environment-injector:0.2.46dd65f22949c
spring-webflux@7.0.8
7.0.9

Open the chart page →

694
tekton-stash-and-cachetekton-stash-and-cacheVerified publisher0.2.21 of 1See more

tekton-stash-and-cache tekton-stash-and-cache 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
quay.io/poundex/tekton-stash-and-cache:0.2.2e854423caa09
spring-webflux@7.0.8
7.0.9

Open the chart page →

1,590
timetabletwomartensVerified publisher0.2.01 of 1See more

timetable twomartens 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
2martens/timetable:latestbd1ba6ab84c9
spring-webmvc@6.2.11
no fix listed

Open the chart page →

1,760
wahlrechttwomartensVerified publisher0.3.01 of 1See more

wahlrecht twomartens 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
2martens/wahlrecht:latestba2c3040dab0
spring-webmvc@6.2.9
no fix listed

Open the chart page →

1,921

Container images carrying it

102 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
krontechnology/aapm-agent:1.8.508e04ea66dfd
spring-webmvc@6.2.18
no fix listed
1
krontechnology/aapm-service:1.2.3b964408930a5
spring-webmvc@6.2.18
no fix listed
1
linuxserver/unifi-network-application:10.6.106-ls1485d288401f8bc
spring-webmvc@6.2.18
no fix listed
1
nacos/nacos-server:v3.0.20e951a1d07bb
spring-webmvc@6.2.5
no fix listed
1
nacos/nacos-server:v3.0.130a39cb0c54d
spring-webmvc@6.2.5
no fix listed
1
openaev/platform:3.261005.0eaf26c4106a1
spring-webflux@6.2.19
spring-webmvc@6.2.19
no fix listed
no fix listed
1
operaton/operaton:1.0.0-beta-4b35867ffe4d8
spring-webmvc@6.2.5
no fix listed
1
razzy10/product-service:latest702e411956db
spring-webmvc@6.2.10
no fix listed
1
reportportal/service-api:5.15.4bf193091525a
spring-webmvc@6.2.19
no fix listed
1
reportportal/service-authorization:5.15.16a954407b417
spring-webmvc@6.2.19
no fix listed
1
reportportal/service-jobs:5.15.299d27d58d6b4
spring-webmvc@6.2.18
no fix listed
1
siakhooi/query:1.0.0f1f4b5b1b870
spring-webmvc@7.0.6
7.0.9
1
streamnative/private-cloud-console:v2.3.27-all91e54375e154
spring-webmvc@6.2.10
no fix listed
1
structurizr/onpremises:2025.11.094b5ffb5119c8
spring-webmvc@6.2.7
no fix listed
1
sysnet4admin/colosseum-agg:logbc25b152d88e
spring-webmvc@6.2.1
no fix listed
1
thingsboard/tbmq-integration-executor:2.4.0b5a9c1addf80
spring-webflux@6.2.19
spring-webmvc@6.2.19
no fix listed
no fix listed
1
thingsboard/tbmq-node:2.4.070661025dba5
spring-webflux@6.2.19
spring-webmvc@6.2.19
no fix listed
no fix listed
1
thingsboard/tb-postgres:latest2d17e4e36edc
spring-webflux@6.2.11
spring-webmvc@6.2.11
no fix listed
no fix listed
1
vincentgwzhang/k8sforjava:latesta9139f2cd98f
spring-webmvc@6.2.1
no fix listed
1
gcr.io/spotinst-artifacts/spot-ocean-metric-exporter:1.0.5ae57b62291aa
spring-webmvc@6.2.10
no fix listed
1
ghcr.io/axelixlabs/axelix:1.1.0449dc880bbfb
spring-webmvc@7.0.8
7.0.9
1
ghcr.io/booklore-app/booklore:v2.3.1d3d3af34bc2c
spring-webmvc@7.0.8
7.0.9
1
ghcr.io/bysamio/casepack-api:0.32.067aa72b00d0a
spring-webmvc@6.2.19
no fix listed
1
ghcr.io/gla-rad/enav-api-gateway:latest8f4345c77dda
spring-webflux@7.0.6
7.0.9
1
ghcr.io/gla-rad/enav-aton-admin-service:latest8b963221a007
spring-webflux@7.0.7
spring-webmvc@7.0.7
7.0.9
7.0.9
1
ghcr.io/gla-rad/enav-aton-service:latest3ffe10cd9cef
spring-webflux@7.0.7
spring-webmvc@7.0.7
7.0.9
7.0.9
1
ghcr.io/gla-rad/enav-eureka:latest05002092c621
spring-webflux@7.0.6
spring-webmvc@7.0.6
7.0.9
7.0.9
1
ghcr.io/gla-rad/enav-msg-broker:latest5c0966fa0257
spring-webflux@7.0.6
spring-webmvc@7.0.6
7.0.9
7.0.9
1
ghcr.io/gla-rad/enav-vdes-controller:latesta66c35016a11
spring-webmvc@7.0.6
7.0.9
1
ghcr.io/gregperlinli/certvault:2.12.0a7d0cc9e260a
spring-webmvc@6.2.14
no fix listed
1
ghcr.io/it-at-m/appswitcher-server:1.3.010006bc0f309
spring-webmvc@6.2.6
no fix listed
1
ghcr.io/it-at-m/dave-admin-portal/dave-adminportal:10.0.0cbff8141302f
spring-webflux@6.2.19
no fix listed
1
ghcr.io/it-at-m/dave-backend/dave-backend:10.0.0f66413e62afc
spring-webflux@6.2.19
spring-webmvc@6.2.19
no fix listed
no fix listed
1
ghcr.io/it-at-m/dave-document-storage/dave-document-storage:10.0.09c7fc07330c9
spring-webflux@6.2.19
spring-webmvc@6.2.19
no fix listed
no fix listed
1
ghcr.io/it-at-m/dave-eai/dave-eai:10.0.0fd93e0d125b3
spring-webmvc@6.2.19
no fix listed
1
ghcr.io/it-at-m/dave-frontend/dave-frontend:10.0.0a49fdb8d6f1b
spring-webflux@6.2.19
no fix listed
1
ghcr.io/it-at-m/dave-geodata-eai/dave-geodata-eai:10.0.06a3fe3136856
spring-webflux@6.2.19
spring-webmvc@6.2.19
no fix listed
no fix listed
1
ghcr.io/it-at-m/dave-selfservice-portal/dave-selfserviceportal:10.0.0d352df1b94b6
spring-webflux@6.2.19
no fix listed
1
ghcr.io/it-at-m/kf-app-eai:1.0.65de339b3d537
spring-webmvc@6.2.10
no fix listed
1
ghcr.io/it-at-m/zammad-ldap-sync:dev10de22c8cbce
spring-webmvc@6.2.1
no fix listed
1
ghcr.io/itobey/fddb-exporter:2.4.1a824933e0f87
spring-webmvc@7.0.8
7.0.9
1
ghcr.io/jfwenisch/ipfix-generator:latesta1b05567dbf6
spring-webmvc@6.2.18
no fix listed
1
ghcr.io/kafbat/kafka-ui:v1.2.0185da4ad3e88
spring-webflux@6.2.3
no fix listed
1
ghcr.io/stirling-tools/stirling-pdf:2.14.33b3670fce70b
spring-webmvc@7.0.7
7.0.9
1
ghcr.io/streamvisor/streamvisor:4.1.40bc598b2ac9a
spring-webmvc@6.2.18
no fix listed
1
ghcr.io/thm-mni-ii/fbs-identity-service:v2.0.711b619dcd155
spring-webmvc@6.2.18
no fix listed
1
ghcr.io/wenisch-tech/proxera:0.12.205ac0e9f6b42f
spring-webmvc@7.0.8
7.0.9
1
public.ecr.aws/aws-containers/retail-store-sample-cart:1.3.05d767569c976
spring-webmvc@6.2.10
no fix listed
1
public.ecr.aws/aws-containers/retail-store-sample-orders:1.3.0e85f034bcf48
spring-webmvc@6.2.10
no fix listed
1
public.ecr.aws/aws-containers/retail-store-sample-ui:1.3.0ce3f2e935eb3
spring-webflux@6.2.10
no fix listed
1

syft 1.42.1 · advisories as of 8 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.