StackRadar

CVE-2026-47890

Critical

Advisory

Published 27 Aug 2026In the index since 8 Oct 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
85
of 18,053 indexed, latest versions
Container images
102
deployed by those charts
Fix available
2 of 2
affected packages

Spring Framework Server Sent Event stream corruption while rendering fragments

Carried by container images the latest versions of 85 of 18,053 indexed charts deploy, on 102 images.

Affected packageAffected versionsFixed inImages
spring-webmvcmaven6.2.0, 6.2.1, 6.2.2, 6.2.5+15 more7.0.993
spring-webfluxmaven6.2.0, 6.2.2, 6.2.3, 6.2.6+9 more7.0.934
OSV records
GHSA-j9f9-w8pj-32f8

Charts affected

85 by stars
ChartLatestAffected imagesRadar Score
kafka-uikafka-uiVerified publisher1.6.51 of 1See more

kafka-ui kafka-ui 1.6.5

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
ghcr.io/kafbat/kafka-ui:v1.5.07cda86a33344
spring-webflux@6.2.17
no fix listed

Open the chart page →

950
jiraatlassian-data-centerVerified publisher2.0.171 of 2See more

jira atlassian-data-center 2.0.17

1 of the 2 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
atlassian/jira-software:11.3.120850cf22b851
spring-webmvc@6.2.19
no fix listed

Open the chart page →

1,392
datahubdatahubVerified publisher1.1.61 of 4See more

datahub datahub 1.1.6

1 of the 4 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
acryldata/datahub-upgrade:v1.7.0.1c3db54d8fb94
spring-webmvc@7.0.8
7.0.9

Open the chart page →

1,579
nacosygqygq2Verified publisher2.1.101 of 4See more

nacos ygqygq2 2.1.10

1 of the 4 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
nacos/nacos-server:v3.0.20e951a1d07bb
spring-webmvc@6.2.5
no fix listed

Open the chart page →

6,914
rocketmqrocketmq12.6.01 of 2See more

rocketmq rocketmq 12.6.0

1 of the 2 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
apacherocketmq/rocketmq-dashboard:2.1.0ce78506bd6fe
spring-webmvc@6.2.6
no fix listed

Open the chart page →

6,973
bitbucketatlassian-data-centerVerified publisher2.0.171 of 1See more

bitbucket atlassian-data-center 2.0.17

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
atlassian/bitbucket:10.2.85aed3d8cb4bc
spring-webmvc@6.2.19
no fix listed

Open the chart page →

36,151
tbmq-clustertbmq-helm-chartOfficialVerified publisher2.3.02 of 3See more

tbmq-cluster tbmq-helm-chart 2.3.0

2 of the 3 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
thingsboard/tbmq-integration-executor:2.4.0b5a9c1addf80
spring-webflux@6.2.19
spring-webmvc@6.2.19
no fix listed
no fix listed
thingsboard/tbmq-node:2.4.070661025dba5
spring-webflux@6.2.19
spring-webmvc@6.2.19
no fix listed
no fix listed

Open the chart page →

3,961
crowdatlassian-data-centerVerified publisher2.0.171 of 2See more

crowd atlassian-data-center 2.0.17

1 of the 2 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
atlassian/crowd:7.2.4c7c8e2423952
spring-webmvc@6.2.19
no fix listed

Open the chart page →

1,474
bambooatlassian-data-centerVerified publisher2.0.171 of 2See more

bamboo atlassian-data-center 2.0.17

1 of the 2 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
atlassian/bamboo:12.1.12eb98d6fbeee7
spring-webmvc@6.2.19
no fix listed

Open the chart page →

36,867
axelixaxelixVerified publisher1.1.11 of 1See more

axelix axelix 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
ghcr.io/axelixlabs/axelix:1.1.0449dc880bbfb
spring-webmvc@7.0.8
7.0.9

Open the chart page →

196
hertzbeathertzbeatOfficialVerified publisher1.8.12 of 4See more

hertzbeat hertzbeat 1.8.1

2 of the 4 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
apache/hertzbeat:1.8.075d48a62748f
spring-webflux@6.2.2
spring-webmvc@6.2.2
no fix listed
no fix listed
apache/hertzbeat-collector:1.8.0a2bab1be574c
spring-webmvc@6.2.2
no fix listed

Open the chart page →

16,409
geoservercloudcamptocamp23.0.17 of 7See more

geoservercloud camptocamp2 3.0.1

7 of the 7 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
geoservercloud/geoserver-cloud-gateway:3.0.1.1de0b20bd2a43
spring-webmvc@7.0.8
7.0.9
geoservercloud/geoserver-cloud-gwc:3.0.1.1b04ed89b5d2b
spring-webflux@7.0.8
spring-webmvc@7.0.8
7.0.9
7.0.9
geoservercloud/geoserver-cloud-rest:3.0.1.1318254b52f96
spring-webflux@7.0.8
spring-webmvc@7.0.8
7.0.9
7.0.9
geoservercloud/geoserver-cloud-wcs:3.0.1.14f077124f591
spring-webflux@7.0.8
spring-webmvc@7.0.8
7.0.9
7.0.9
geoservercloud/geoserver-cloud-webui:3.0.1.14f91e3048ac8
spring-webflux@7.0.8
spring-webmvc@7.0.8
7.0.9
7.0.9
geoservercloud/geoserver-cloud-wfs:3.0.1.1299f0d6232d1
spring-webflux@7.0.8
spring-webmvc@7.0.8
7.0.9
7.0.9
geoservercloud/geoserver-cloud-wms:3.0.1.15164f687ce4d
spring-webflux@7.0.8
spring-webmvc@7.0.8
7.0.9
7.0.9

Open the chart page →

14,787
thingsboardcetic0.1.21 of 2See more

thingsboard cetic 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
thingsboard/tb-postgres:latest2d17e4e36edc
spring-webflux@6.2.11
spring-webmvc@6.2.11
no fix listed
no fix listed

Open the chart page →

5,982
nacosgujunxiang0.1.51 of 1See more

nacos gujunxiang 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
nacos/nacos-server:latest1c191c30c8cd
spring-webmvc@6.2.18
no fix listed

Open the chart page →

2,451
rocketmq-clusterrocketmq12.6.01 of 2See more

rocketmq-cluster rocketmq 12.6.0

1 of the 2 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
apacherocketmq/rocketmq-dashboard:2.1.0ce78506bd6fe
spring-webmvc@6.2.6
no fix listed

Open the chart page →

6,973
feedbacksystemthm-mni-iiVerified publisher0.48.21 of 14See more

feedbacksystem thm-mni-ii 0.48.2

1 of the 14 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
ghcr.io/thm-mni-ii/fbs-identity-service:v2.0.711b619dcd155
spring-webmvc@6.2.18
no fix listed

Open the chart page →

27,978
structurizrvirtualrootVerified publisher0.5.01 of 1See more

structurizr virtualroot 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
structurizr/onpremises:2025.11.094b5ffb5119c8
spring-webmvc@6.2.7
no fix listed

Open the chart page →

5,013
migrationadeptia-connect-migrationVerified publisher4.8.11 of 1See more

migration adeptia-connect-migration 4.8.1

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
adeptiainc/adeptia-connect-migration:4.8.1f1087da3da0b
spring-webmvc@6.2.17
no fix listed

Open the chart page →

733
nacosbytectl0.1.61 of 1See more

nacos bytectl 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
nacos/nacos-server:latest1c191c30c8cd
spring-webmvc@6.2.18
no fix listed

Open the chart page →

2,451
cbioportalcbioportalOfficialVerified publisher1.1.01 of 1See more

cbioportal cbioportal 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
cbioportal/cbioportal:6.4.1-web-shenandoah08debbd2dbf9
spring-webmvc@6.2.11
no fix listed

Open the chart page →

4,221
cert-vaultcert-vaultOfficialVerified publisher2.12.01 of 7See more

cert-vault cert-vault 2.12.0

1 of the 7 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
ghcr.io/gregperlinli/certvault:2.12.0a7d0cc9e260a
spring-webmvc@6.2.14
no fix listed

Open the chart page →

18,310
enavenav-service-architectureVerified publisher0.0.76 of 10See more

enav enav-service-architecture 0.0.7

6 of the 10 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
ghcr.io/gla-rad/enav-api-gateway:latest8f4345c77dda
spring-webflux@7.0.6
7.0.9
ghcr.io/gla-rad/enav-aton-admin-service:latest8b963221a007
spring-webflux@7.0.7
spring-webmvc@7.0.7
7.0.9
7.0.9
ghcr.io/gla-rad/enav-aton-service:latest3ffe10cd9cef
spring-webflux@7.0.7
spring-webmvc@7.0.7
7.0.9
7.0.9
ghcr.io/gla-rad/enav-eureka:latest05002092c621
spring-webflux@7.0.6
spring-webmvc@7.0.6
7.0.9
7.0.9
ghcr.io/gla-rad/enav-msg-broker:latest5c0966fa0257
spring-webflux@7.0.6
spring-webmvc@7.0.6
7.0.9
7.0.9
ghcr.io/gla-rad/enav-vdes-controller:latesta66c35016a11
spring-webmvc@7.0.6
7.0.9

Open the chart page →

12,625
scoolderudikaVerified publisher0.3.01 of 1See more

scoold erudika 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
erudikaltd/scoold:1.66.0949c56b57e8f
spring-webmvc@7.0.3
7.0.9

Open the chart page →

1,836
amgraviteeioVerified publisher4.12.81 of 3See more

am graviteeio 4.12.8

1 of the 3 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
graviteeio/am-management-api:4.12.849d0188a58ae
spring-webmvc@6.2.19
no fix listed

Open the chart page →

2,271
ipfix-generatorjfwenisch0.3.16-feature-helm-package.01 of 1See more

ipfix-generator jfwenisch 0.3.16-feature-helm-package.0

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
ghcr.io/jfwenisch/ipfix-generator:latesta1b05567dbf6
spring-webmvc@6.2.18
no fix listed

Open the chart page →

865
mcpmcp-chartsVerified publisher0.0.231 of 7See more

mcp mcp-charts 0.0.23

1 of the 7 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
glarad/mc-service-registry:latest7b02b9e7f1ef
spring-webflux@7.0.8
spring-webmvc@7.0.8
7.0.9
7.0.9

Open the chart page →

8,420
reportportalreportportal-ioOfficialVerified publisher26.8.123 of 15See more

reportportal reportportal-io 26.8.12

3 of the 15 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
reportportal/service-api:5.15.4bf193091525a
spring-webmvc@6.2.19
no fix listed
reportportal/service-authorization:5.15.16a954407b417
spring-webmvc@6.2.19
no fix listed
reportportal/service-jobs:5.15.299d27d58d6b4
spring-webmvc@6.2.18
no fix listed

Open the chart page →

15,439
querysiakhooiVerified publisher1.0.01 of 1See more

query siakhooi 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
siakhooi/query:1.0.0f1f4b5b1b870
spring-webmvc@7.0.6
7.0.9

Open the chart page →

2,029
ocean-metric-exporterspot1.1.11 of 1See more

ocean-metric-exporter spot 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
gcr.io/spotinst-artifacts/spot-ocean-metric-exporter:1.0.5ae57b62291aa
spring-webmvc@6.2.10
no fix listed

Open the chart page →

1,681
streamvisorstreamvisorVerified publisher4.1.61 of 1See more

streamvisor streamvisor 4.1.6

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
ghcr.io/streamvisor/streamvisor:4.1.40bc598b2ac9a
spring-webmvc@6.2.18
no fix listed

Open the chart page →

3,269
migrationadeptia-automate-migration5.2.91 of 1See more

migration adeptia-automate-migration 5.2.9

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
adeptiainc/adeptia-connect-migration:5.2.98607f4f29732
spring-webmvc@6.2.15
no fix listed

Open the chart page →

673
kafka-uiappscodeVerified publisher2026.3.301 of 1See more

kafka-ui appscode 2026.3.30

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
ghcr.io/kafbat/kafka-ui:v1.5.07cda86a33344
spring-webflux@6.2.17
no fix listed

Open the chart page →

950
bluerange-serverbluerangeOfficialVerified publisher1.4.01 of 1See more

bluerange-server bluerange 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
bluerange/bluerange:26.2.0503577ef9143
spring-webflux@6.2.6
spring-webmvc@6.2.6
no fix listed
no fix listed

Open the chart page →

2,059
colosseumbook-k8sinfra-v21.0.181 of 5See more

colosseum book-k8sinfra-v2 1.0.18

1 of the 5 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-agg:logbc25b152d88e
spring-webmvc@6.2.1
no fix listed

Open the chart page →

30,411
casepack-apibysamioVerified publisher0.32.01 of 1See more

casepack-api bysamio 0.32.0

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
ghcr.io/bysamio/casepack-api:0.32.067aa72b00d0a
spring-webmvc@6.2.19
no fix listed

Open the chart page →

194
dara-chartsdara-charts0.1.01 of 2See more

dara-charts dara-charts 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
razzy10/product-service:latest702e411956db
spring-webmvc@6.2.10
no fix listed

Open the chart page →

3,779
db2restdb2rest0.2.01 of 1See more

db2rest db2rest 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
kdhrubo/db2rest:lateste20610ff81b0
spring-webmvc@6.2.10
no fix listed

Open the chart page →

1,095
dial-admindialVerified publisher0.19.01 of 3See more

dial-admin dial 0.19.0

1 of the 3 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
epam/ai-dial-admin-backend:0.21.08b91130e3731
spring-webmvc@6.2.19
no fix listed

Open the chart page →

4,250
kafka-uidoubanVerified publisher1.5.21 of 1See more

kafka-ui douban 1.5.2

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
ghcr.io/kafbat/kafka-ui:v1.2.0185da4ad3e88
spring-webflux@6.2.3
no fix listed

Open the chart page →

1,474
fddb-exporterfddb-exporterVerified publisher2.4.31 of 1See more

fddb-exporter fddb-exporter 2.4.3

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
ghcr.io/itobey/fddb-exporter:2.4.1a824933e0f87
spring-webmvc@7.0.8
7.0.9

Open the chart page →

664
fineractfineract-openshift0.1.11 of 4See more

fineract fineract-openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
apache/fineract:1.12.1a83cf1980609
spring-webmvc@6.2.5
no fix listed

Open the chart page →

8,669
edge-caiasoftfolio-org0.1.321 of 1See more

edge-caiasoft folio-org 0.1.32

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
folioci/edge-caiasoft:latestc3cfa89eee2f
spring-webmvc@7.0.8
7.0.9

Open the chart page →

526
edge-dematicfolio-org0.1.331 of 1See more

edge-dematic folio-org 0.1.33

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
folioci/edge-dematic:latest48c9b1d180d4
spring-webmvc@7.0.8
7.0.9

Open the chart page →

526
edge-inn-reachfolio-org0.1.41 of 1See more

edge-inn-reach folio-org 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
folioci/edge-inn-reach:latestc64e4d9dd3fc
spring-webmvc@7.0.8
7.0.9

Open the chart page →

526
edge-rtacfolio-org0.1.281 of 1See more

edge-rtac folio-org 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
folioci/edge-rtac:latest15ef73b1abd0
spring-webmvc@7.0.5
7.0.9

Open the chart page →

1,265
mod-calendarfolio-org0.1.341 of 1See more

mod-calendar folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
folioci/mod-calendar:latest22f65982efd7
spring-webmvc@7.0.8
7.0.9

Open the chart page →

416
mod-data-exportfolio-org0.1.401 of 1See more

mod-data-export folio-org 0.1.40

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
folioci/mod-data-export:latest0cc86bf09755
spring-webmvc@7.0.3
7.0.9

Open the chart page →

1,425
mod-data-export-springfolio-org0.1.41 of 1See more

mod-data-export-spring folio-org 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
folioci/mod-data-export-spring:latestf1d7caf4544b
spring-webmvc@7.0.3
7.0.9

Open the chart page →

1,258
mod-data-export-workerfolio-org0.1.151 of 1See more

mod-data-export-worker folio-org 0.1.15

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
folioci/mod-data-export-worker:latest1ad1811c9b37
spring-webmvc@7.0.3
7.0.9

Open the chart page →

1,244
mod-ebsconetfolio-org0.1.31 of 1See more

mod-ebsconet folio-org 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-47890.

Container imageDigestPackageFixed in
folioci/mod-ebsconet:latest3ae8cb99daa3
spring-webmvc@7.0.3
7.0.9

Open the chart page →

1,210

Container images carrying it

102 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/poundex/tekton-ci-environment-injector:0.2.46dd65f22949c
spring-webflux@7.0.8
7.0.9
1
quay.io/poundex/tekton-stash-and-cache:0.2.2e854423caa09
spring-webflux@7.0.8
7.0.9
1

syft 1.42.1 · advisories as of 8 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.