StackRadar

CVE-2026-49975

High

Advisory

Published 3 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.343
98th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
81
of 17,781 indexed, latest versions
Container images
80
deployed by those charts
Fix available
7 of 7
affected packages

Apache HTTP Server: mod_http2 denial of service

Carried by container images the latest versions of 81 of 17,781 indexed charts deploy, on 80 images.

Affected packageAffected versionsFixed inImages
apache2deb2.4.41-4ubuntu3.11, 2.4.41-4ubuntu3.12, 2.4.41-4ubuntu3.14, 2.4.41-4ubuntu3.17+14 more2.4.41-4ubuntu3.23+esm5, 2.4.52-1ubuntu4.21, 2.4.58-1ubuntu8.13, 2.4.67-1~deb12u3+1 more39
nginxapk1.26.2-r4, 1.26.3-r0, 1.28.0-r3, 1.28.1-r1+4 more1.26.3-r1, 1.28.3-r314
nginxdeb1.4.6-1ubuntu3.8ppa1, 1.18.0-0ubuntu1.2, 1.18.0-0ubuntu1.3, 1.18.0-0ubuntu1.4+6 more1.4.6-1ubuntu3.9+esm8, 1.18.0-0ubuntu1.7+esm3, 1.18.0-6ubuntu14.15, 1.24.0-2ubuntu7.1213
mod_http2rpm1.15.7-10.module+el8.10.0+23369+11a81384.4, 2.0.26-2.el9_4, 2.0.26-5.el90:1.15.7-10.module+el8.10.0+24368+ad388a0c.6, 0:2.0.26-6.el9_8.16
apachebitnami2.4.54-157, 2.4.65-1, 2.4.68-1, 2.4.68-82.4.684
apache2apk2.4.62-r0, 2.4.63-r4, 2.4.66-r0, 2.4.67-r02.4.68-r04
httpdrpm2.4.37-43.module+el8.5.0+13806+b30d9eec.1, 2.4.37-56.module+el8.8.0+18758+b3a9c8da.6, 2.4.37-65.module+el8.10.0+23815+1b5e1c66.70:2.4.37-65.module+el8.10.0+24281+ea10630c.83
OSV records
ALPINE-CVE-2026-49975BIT-apache-2026-49975DEBIAN-CVE-2026-49975RHSA-2026:25057RHSA-2026:25090UBUNTU-CVE-2026-49975
Also known as
USN-8384-1, USN-8398-1, USN-8398-2, USN-8398-3, USN-8398-4, USN-8571-1

Charts affected

81 by stars
ChartLatestAffected imagesRadar Score
neurofaceneurofaceVerified publisher1.4.21 of 3See more

neuroface neuroface 1.4.2

1 of the 3 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
mod_http2@2.0.26-5.el9
0:2.0.26-6.el9_8.1

Open the chart page →

7,310
nexus-tasksnexus-tasks2.0.01 of 5See more

nexus-tasks nexus-tasks 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
nginx@1.28.3-r0
1.28.3-r3

Open the chart page →

3,798
nfl-walletnfl-walletVerified publisher0.1.31 of 4See more

nfl-wallet nfl-wallet 0.1.3

1 of the 4 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/nfl-wallet-webapp:1.0.13fead5702be7
httpd@2.4.37-65.module+el8.10.0+23815+1b5e1c66.7
mod_http2@1.15.7-10.module+el8.10.0+23369+11a81384.4
0:2.4.37-65.module+el8.10.0+24281+ea10630c.8
0:1.15.7-10.module+el8.10.0+24368+ad388a0c.6

Open the chart page →

13,041
nominatimnominatim-chart1.3.01 of 3See more

nominatim nominatim-chart 1.3.0

1 of the 3 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
mediagis/nominatim:3.7c15e941485ef
apache2@2.4.41-4ubuntu3.12
2.4.41-4ubuntu3.23+esm5

Open the chart page →

22,658
chatbot-ai-sampleopenshift0.1.62 of 4See more

chatbot-ai-sample openshift 0.1.6

2 of the 4 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
quay.io/ai-lab/llamacpp_python:latest70d138997acd
mod_http2@2.0.26-2.el9_4
0:2.0.26-6.el9_8.1
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
mod_http2@2.0.26-2.el9_4
0:2.0.26-6.el9_8.1

Open the chart page →

18,922
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.01 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

1 of the 40 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
ghcr.io/openrelik/openrelik-ui:latest7f91594d5eb3
nginx@1.28.3-r1
1.28.3-r3

Open the chart page →

71,208
outscale-s3-exploreroutscale-s3-explorer0.1.41 of 1See more

outscale-s3-explorer outscale-s3-explorer 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
ghcr.io/solucteam/outscale-s3-explorer:v1.0.09665c3e71889
nginx@1.28.0-r3
1.28.3-r3

Open the chart page →

1,811
matomopetbattle11.0.11 of 2See more

matomo petbattle 11.0.1

1 of the 2 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
bitnamilegacy/matomo:5.3.2-debian-12-r13f02c000c54b1
apache@2.4.65-1
2.4.68

Open the chart page →

11,061
seafilephybros-helm-charts4.0.11 of 1See more

seafile phybros-helm-charts 4.0.1

1 of the 1 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:9.0.97ac833196f60
nginx@1.18.0-0ubuntu1.3
1.18.0-0ubuntu1.7+esm3

Open the chart page →

22,084
podnat-state-storepodnat-controller0.3.21 of 1See more

podnat-state-store podnat-controller 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
dgraziotin/nginx-webdav-nononsense:1.23.138f2de42bed0
apache2@2.4.41-4ubuntu3.12
2.4.41-4ubuntu3.23+esm5

Open the chart page →

9,167
rhbk-neurofacerhbk-neurofaceVerified publisher1.0.01 of 4See more

rhbk-neuroface rhbk-neuroface 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
mod_http2@2.0.26-5.el9
0:2.0.26-6.el9_8.1

Open the chart page →

3,781
wallosrm3lVerified publisher0.1.01 of 1See more

wallos rm3l 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
ghcr.io/ellite/wallos:2.46.09ce55520e7bd
nginx@1.26.2-r4
1.26.3-r1

Open the chart page →

1,529
tandoorrtomik-helm-chartsVerified publisher0.0.11 of 1See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
vabene1111/recipes:2.3.50f8d061895e9
nginx@1.28.0-r3
1.28.3-r3

Open the chart page →

4,499
nextcloudsb-helm-charts0.4.01 of 2See more

nextcloud sb-helm-charts 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
library/nextcloud:31.0.10-apacheb7faa1653c39
apache2@2.4.65-2
2.4.67-1~deb13u3

Open the chart page →

9,755
phpmyadminsb-helm-charts0.3.01 of 1See more

phpmyadmin sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
library/phpmyadmin:5.2.16e75aa8f767c
apache2@2.4.62-1~deb12u2
2.4.67-1~deb12u3

Open the chart page →

5,315
wordpresssb-helm-charts0.4.01 of 2See more

wordpress sb-helm-charts 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
library/wordpress:6.4.3-apache8ae66efb09a2
apache2@2.4.57-2
2.4.67-1~deb12u3

Open the chart page →

13,510
snipeitschmitzis6.1.01 of 2See more

snipeit schmitzis 6.1.0

1 of the 2 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
snipe/snipe-it:v8.3.1141ebf2386fe
apache2@2.4.58-1ubuntu8.8
2.4.58-1ubuntu8.13

Open the chart page →

6,094
synapse-adminschoenwald1.0.11 of 1See more

synapse-admin schoenwald 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
awesometechnologies/synapse-admin:0.11.4a1c1f4662875
nginx@1.28.2-r1
1.28.3-r3

Open the chart page →

1,802
restic-serverschoolguys-helmcharts0.3.11 of 1See more

restic-server schoolguys-helmcharts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
restic/rest-server:0.14.0d2aff06f47eb
apache2@2.4.63-r4
2.4.68-r0

Open the chart page →

2,257
typo3schoolguys-helmcharts0.4.21 of 1See more

typo3 schoolguys-helmcharts 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
registry.gitlab.com/school_guy/docker-typo3:13.4.30-197d868ed76185d7270d
apache2@2.4.67-1~deb12u2
2.4.67-1~deb12u3

Open the chart page →

4,836
tabixsinextraVerified publisher0.2.21 of 1See more

tabix sinextra 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
ghcr.io/sergelogvinov/tabix:22.05.17a6e3e996a4ae
nginx@1.28.0-r3
1.28.3-r3

Open the chart page →

1,249
testing-multitoolsomeblackmagic0.1.21 of 1See more

testing-multitool someblackmagic 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
someblackmagic/k8s-testing-multitool:v0.1.06eca64b6b440
apache2@2.4.41-4ubuntu3.11
2.4.41-4ubuntu3.23+esm5

Open the chart page →

30,687
workshop-operatorstakaterVerified publisher0.0.381 of 2See more

workshop-operator stakater 0.0.38

1 of the 2 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
stakater/workshop-operator:v0.0.3897bf456cc97c
httpd@2.4.37-43.module+el8.5.0+13806+b30d9eec.1
0:2.4.37-65.module+el8.10.0+24281+ea10630c.8

Open the chart page →

6,671
nagvissvtech-public-helm-charts1.0.01 of 1See more

nagvis svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
svtechnmaa/svtech_nagvis:v1.2.118394b08e6c3
apache2@2.4.57-2
2.4.67-1~deb12u3

Open the chart page →

9,102
rundecksvtech-public-helm-charts1.0.01 of 2See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
svtechnmaa/svtech_rundeck:v1.2.26e368ace0977
apache2@2.4.41-4ubuntu3.17
2.4.41-4ubuntu3.23+esm5

Open the chart page →

18,756
mrasiftech-thinker1.0.41 of 1See more

mrasif tech-thinker 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
mrasif/mrasif.in:v4.6.0375a1ed8fdc0
nginx@1.28.1-r1
1.28.3-r3

Open the chart page →

2,043
tensor_apptensor-app0.2.22 of 3See more

tensor_app tensor-app 0.2.2

2 of the 3 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
xeladock/mysql_dns:latest4baf531453f1
nginx@1.18.0-6ubuntu14
1.18.0-6ubuntu14.15
xeladock/nginx2:latestc259a67b1dff
nginx@1.18.0-6ubuntu14
1.18.0-6ubuntu14.15

Open the chart page →

17,461
nextcloudth-chartsVerified publisher0.4.01 of 1See more

nextcloud th-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
library/nextcloud:31.0.6-apache588609d76b21
apache2@2.4.62-1~deb12u2
2.4.67-1~deb12u3

Open the chart page →

10,086
owncloudth-chartsVerified publisher0.2.11 of 1See more

owncloud th-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
owncloud/server:10.15.051d9b74fc2a8
apache2@2.4.41-4ubuntu3.21
2.4.41-4ubuntu3.23+esm5

Open the chart page →

10,006
orchestra-login-portaltremolo2.3.971 of 1See more

orchestra-login-portal tremolo 2.3.97

1 of the 1 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
ghcr.io/openunison/openunison-k8s-react:1.0.2afb3e9282952
nginx@1.18.0-6ubuntu14.7
1.18.0-6ubuntu14.15

Open the chart page →

2,956
web-dvwaweb-dvwa1.16.01 of 2See more

web-dvwa web-dvwa 1.16.0

1 of the 2 container images this version deploys carry CVE-2026-49975.

Container imageDigestPackageFixed in
gulacedia/web-dvwa-new:v367b467d961ca
apache2@2.4.57-2
2.4.67-1~deb12u3

Open the chart page →

10,001

Container images carrying it

80 by charts deploying them

A fixed version is listed for 7 of the 7 affected packages.

Container imageDigestPackageFixed inUsed by
library/phpmyadmin:5.2.16e75aa8f767c
apache2@2.4.62-1~deb12u2
2.4.67-1~deb12u3
2
library/wordpress:6.8.3-apache:6.8-apache30bff39330d1
apache2@2.4.65-2
2.4.67-1~deb13u3
2
vdiogov/glpi-conteiner:latest6945f84f0058
apache2@2.4.61-1~deb12u1
2.4.67-1~deb12u3
2
yzhou442/equiz:latesta3f7ca69e28d
apache@2.4.54-157
2.4.68
2
akaunting/akaunting:3.0.1552811b36ec3a
apache2@2.4.57-2
2.4.67-1~deb12u3
1
awesometechnologies/synapse-admin:0.11.4a1c1f4662875
nginx@1.28.2-r1
1.28.3-r3
1
bitnamilegacy/matomo:5.3.2-debian-12-r13f02c000c54b1
apache@2.4.65-1
2.4.68
1
bitnami/wordpress:latest8448af086f92
apache@2.4.68-8
2.4.68
1
cloudtooling/moodle:5.2.3f4f04e0fc401
apache@2.4.68-1
2.4.68
1
dgraziotin/nginx-webdav-nononsense:1.23.138f2de42bed0
apache2@2.4.41-4ubuntu3.12
2.4.41-4ubuntu3.23+esm5
1
dokuwiki/dokuwiki:2025-05-14af08ecfdda239
apache2@2.4.65-2
2.4.67-1~deb13u3
1
dolibarr/dolibarr:22.0.47ad88fc9b13c
apache2@2.4.67-1~deb12u2
2.4.67-1~deb12u3
1
domainmod/domainmod:4.23.04017bfe4c597
apache2@2.4.57-2
2.4.67-1~deb12u3
1
dragonflyoss/client:v0.1.82edf3e921f4e0
apache2@2.4.59-1~deb12u1
2.4.67-1~deb12u3
1
extrim/perlite:1.5.99cb7eb5598b6
nginx@1.26.3-r0
1.26.3-r1
1
fnzv/dump1090:latestb3079b95c336
nginx@1.18.0-6ubuntu14.4
1.18.0-6ubuntu14.15
1
galaxy/galaxy-stable:v18.018e577a626dfd
nginx@1.4.6-1ubuntu3.8ppa1
1.4.6-1ubuntu3.9+esm8
1
gulacedia/web-dvwa-new:v367b467d961ca
apache2@2.4.57-2
2.4.67-1~deb12u3
1
heartexlabs/label-studio:latestaa461572e8f9
nginx@1.28.2-r1
1.28.3-r3
1
intel/multimodal-data-visualization-streaming:3.01a89327e499b
nginx@1.18.0-0ubuntu1.3
1.18.0-0ubuntu1.7+esm3
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
apache2@2.4.66-1~deb12u1
2.4.67-1~deb12u3
1
jeboehm/mailserver-web:5.0.929da13edf5aa8
nginx@1.28.0-r3
1.28.3-r3
1
jhoncytech/bookworm-apache-wordpress:latest18c3ca1f411e
apache2@2.4.57-2
2.4.67-1~deb12u3
1
kfirfer/phppgadmin:7.13.0-22efb4a5d74a3
apache2@2.4.41-4ubuntu3.12
2.4.41-4ubuntu3.23+esm5
1
library/matomo:5.1.2-apache2415789e1602
apache2@2.4.62-1~deb12u2
2.4.67-1~deb12u3
1
library/nextcloud:31.0.6-apache588609d76b21
apache2@2.4.62-1~deb12u2
2.4.67-1~deb12u3
1
library/nextcloud:31.0.10-apacheb7faa1653c39
apache2@2.4.65-2
2.4.67-1~deb13u3
1
library/nginx:1.28-alpinea8b39bd9cf0f
nginx@1.28.3-r1
1.28.3-r3
1
library/wordpress:6.4.3-apache8ae66efb09a2
apache2@2.4.57-2
2.4.67-1~deb12u3
1
library/wordpress:php8.1-apachef73396626d2f
apache2@2.4.65-2
2.4.67-1~deb13u3
1
linkstackorg/linkstack:latest1c8b05399ee4
apache2@2.4.66-r0
2.4.68-r0
1
linuxserver/bookstack:26.05.202605282ebf97852661
apache2@2.4.67-r0
nginx@1.28.3-r2
2.4.68-r0
1.28.3-r3
1
martinhelmich/typo3:12.4c83a4f3fd7ae
apache2@2.4.66-1~deb12u1
2.4.67-1~deb12u3
1
mautic/mautic:7-apacheeb8cc73d97e1
apache2@2.4.67-1~deb12u2
2.4.67-1~deb12u3
1
mediagis/nominatim:3.7c15e941485ef
apache2@2.4.41-4ubuntu3.12
2.4.41-4ubuntu3.23+esm5
1
mediagis/nominatim:4.2d0eae7b51374
apache2@2.4.52-1ubuntu4.7
2.4.52-1ubuntu4.21
1
mrasif/mrasif.in:v4.6.0375a1ed8fdc0
nginx@1.28.1-r1
1.28.3-r3
1
openstackhelm/heat:wallaby-ubuntu_focalf728510bab3c
apache2@2.4.41-4ubuntu3.14
2.4.41-4ubuntu3.23+esm5
1
openstackhelm/keystone:wallaby-ubuntu_focale07d75953d2e
apache2@2.4.41-4ubuntu3.14
2.4.41-4ubuntu3.23+esm5
1
owncloud/server:10.15.051d9b74fc2a8
apache2@2.4.41-4ubuntu3.21
2.4.41-4ubuntu3.23+esm5
1
owncloud/server:10.16.274c53d341076
apache2@2.4.52-1ubuntu4.20
2.4.52-1ubuntu4.21
1
phpmyadmin/phpmyadmin:5.2.342a200db07b4
apache2@2.4.65-2
2.4.67-1~deb13u3
1
restic/rest-server:0.14.0d2aff06f47eb
apache2@2.4.63-r4
2.4.68-r0
1
seafileltd/seafile-mc:9.0.106693911bcc40
nginx@1.18.0-0ubuntu1.4
1.18.0-0ubuntu1.7+esm3
1
seafileltd/seafile-mc:9.0.97ac833196f60
nginx@1.18.0-0ubuntu1.3
1.18.0-0ubuntu1.7+esm3
1
seafileltd/seafile-mc:8.0.7ed0fcda5e6a9
nginx@1.18.0-0ubuntu1.2
1.18.0-0ubuntu1.7+esm3
1
snipe/snipe-it:v8.3.1141ebf2386fe
apache2@2.4.58-1ubuntu8.8
2.4.58-1ubuntu8.13
1
snipe/snipe-it:v6.0.1455fb7636a98c
apache2@2.4.41-4ubuntu3.12
2.4.41-4ubuntu3.23+esm5
1
someblackmagic/k8s-testing-multitool:v0.1.06eca64b6b440
apache2@2.4.41-4ubuntu3.11
2.4.41-4ubuntu3.23+esm5
1
sonroyaalmerol/docker-sogo:5.12.43f60f3abe990
apache2@2.4.66-1~deb13u1
2.4.67-1~deb13u3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.