CVE-2026-50020

Medium

Advisory

Published 15 Jun 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.002; 14th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 402; of 17,781 indexed, latest versions
Container images: 460; deployed by those charts
Fix available: 1 of 1; affected package

Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted

Carried by container images the latest versions of 402 of 17,781 indexed charts deploy, on 460 images.

Affected package	Affected versions	Fixed in	Images
netty-codec-httpmaven	4.0.27.Final, 4.0.52.Final, 4.1.12.Final, 4.1.13.Final+91 more	4.1.135.Final, 4.2.15.Final	460

OSV records: GHSA-hvcg-qmg6-jm4c

Charts affected

402 by stars

Chart

Latest

Affected images

Radar Score

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-50020.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	netty-codec-http@4.1.82.Final	4.1.135.Final

Open the chart page →

6,016

zipkinzipkin

0.5.0

1 of 1 See more

zipkin zipkin 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-50020.

Container image	Digest	Package	Fixed in
openzipkin/zipkin-slim :3.6.0	a69e1057df36	netty-codec-http@4.2.10.Final	4.2.15.Final

Open the chart page →

1,159

Container images carrying it

460 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
wavefronthq/proxy :9.2	d1064d28f6eb	netty-codec-http@4.1.50.Final	4.1.135.Final	1
wazuh/wazuh-indexer :4.14.4	9c344d2b1757	netty-codec-http@4.1.125.Final	4.1.135.Final	1
wazuh/wazuh-indexer :4.11.1	a7a2076b167e	netty-codec-http@4.1.108.Final	4.1.135.Final	1
wazuh/wazuh-indexer :4.14.3	b149b30da686	netty-codec-http@4.1.125.Final	4.1.135.Final	1
xeotek/kadeck :6.3.4	39a3b37a17c5	netty-codec-http@4.1.108.Final	4.1.135.Final	1
xeotek/kadeck :4.2.9	4c6b04d9ce55	netty-codec-http@4.1.70.Final	4.1.135.Final	1
xuxueli/xxl-job-admin :2.4.0	640093c35fd6	netty-codec-http@4.1.89.Final	4.1.135.Final	1
yuzutech/kroki :0.17.0	192b7b27c857	netty-codec-http@4.1.74.Final	4.1.135.Final	1
zahoriaut/zahori-process :0.1.13	351f8a220ed7	netty-codec-http@4.1.94.Final	4.1.135.Final	1
zahoriaut/zahori-server :0.1.17	b2de13916f3e	netty-codec-http@4.1.87.Final	4.1.135.Final	1
zammad/zammad-docker-compose :zammad-elasticsearch-4.1.0-31	8274d75a51fc	netty-codec-http@4.1.49.Final	4.1.135.Final	1
zbalogh/reservation-api-server :1.0.9	7c247e399a1f	netty-codec-http@4.1.82.Final	4.1.135.Final	1
gcr.io/spinnaker-marketplace/halyard :1.32.0	0ee5f968d2ab	netty-codec-http@4.1.45.Final	4.1.135.Final	1
ghcr.io/appscode/inbox-server :MailetGroup	4a2824296412	netty-codec-http@4.1.86.Final	4.1.135.Final	1
ghcr.io/camunda-community-hub/zeebe-simple-monitor :2.6.2	d9d796a1b846	netty-codec-http@4.1.104.Final	4.1.135.Final	1
ghcr.io/comet-ml/opik/opik-backend :2.2.59	50a7aa0562f5	netty-codec-http@4.2.13.Final	4.2.15.Final	1
ghcr.io/curium-rocks/mitre-siphon :main	503c00321502	netty-codec-http@4.1.92.Final	4.1.135.Final	1
ghcr.io/damap-org/damap-backend :5.0.0	f3d0c7d35498	netty-codec-http@4.1.108.Final	4.1.135.Final	1
ghcr.io/data-fair/elasticsearch :7.17.1	aa45adaf59a7	netty-codec-http@4.1.66.Final	4.1.135.Final	1
ghcr.io/devops-ia/cp-schema-registry :8.1.1-msk-iam-auth2.3.5	30d1a445acc7	netty-codec-http@4.1.128.Final	4.1.135.Final	1
ghcr.io/devops-ia/kafka-cruise-control :jdk17-cc2.5.146-iam2.3.8	e310642de2e2	netty-codec-http@4.1.110.Final	4.1.135.Final	1
ghcr.io/fleeksoft/hbase/hbase-base :2.4.13.2	c144bdd688d7	netty-codec-http@4.1.78.Final	4.1.135.Final	1
ghcr.io/fleeksoft/hbase/hdfs :3.3.3.2	ac62269785ac	netty-codec-http@4.1.61.Final	4.1.135.Final	1
ghcr.io/gla-rad/enav-api-gateway :latest	8f4345c77dda	netty-codec-http@4.2.12.Final	4.2.15.Final	1
ghcr.io/gla-rad/enav-aton-admin-service :latest	cf85570b1324	netty-codec-http@4.2.12.Final	4.2.15.Final	1
ghcr.io/gla-rad/enav-aton-service :latest	3be878690629	netty-codec-http@4.2.12.Final	4.2.15.Final	1
ghcr.io/gla-rad/enav-aton-service-client :latest	f1629ac5f9ec	netty-codec-http@4.2.12.Final	4.2.15.Final	1
ghcr.io/gla-rad/enav-ckeeper :latest	415323ef112b	netty-codec-http@4.2.12.Final	4.2.15.Final	1
ghcr.io/gla-rad/enav-eureka :latest	05002092c621	netty-codec-http@4.2.12.Final	4.2.15.Final	1
ghcr.io/gla-rad/enav-msg-broker :latest	6fe372e4e481	netty-codec-http@4.2.12.Final	4.2.15.Final	1
ghcr.io/jens-maus/raspberrymatic :3.83.6.20250824	4b22b4f407c4	netty-codec-http@4.1.67.Final	4.1.135.Final	1
ghcr.io/kafbat/kafka-ui :v1.2.0	185da4ad3e88	netty-codec-http@4.1.118.Final	4.1.135.Final	1
ghcr.io/komputing/fauceth :release	4ab8fa4143b4	netty-codec-http@4.1.69.Final	4.1.135.Final	1
ghcr.io/kubeflow/spark-operator/controller :2.2.1	865ff4da5686	netty-codec-http@4.1.96.Final	4.1.135.Final	1
ghcr.io/kvaps/linstor-controller :v1.14.0	00ce11c31087	netty-codec-http@4.1.51.Final	4.1.135.Final	1
ghcr.io/kvaps/linstor-satellite :v1.14.0	a573fb9bc809	netty-codec-http@4.1.51.Final	4.1.135.Final	1
ghcr.io/melodyyangaws/hive-metastore :3.0.0	e949b0f733f0	netty-codec-http@4.1.61.Final	4.1.135.Final	1
ghcr.io/microboxlabs/miot-calendar :latest-jvm	7157cdc0bf5b	netty-codec-http@4.1.130.Final	4.1.135.Final	1
ghcr.io/navikt/mock-oauth2-server :2.1.10	65d4ed47ce09	netty-codec-http@4.1.112.Final	4.1.135.Final	1
ghcr.io/openccu/openccu :3.89.8.20260719	b2de2ff6e8e0	netty-codec-http@4.2.5.Final	4.2.15.Final	1
ghcr.io/open-telemetry/demo :3.0.0-fraud-detection	1cdfd1bcf476	netty-codec-http@4.1.133.Final	4.1.135.Final	1
ghcr.io/open-telemetry/demo :1.12.0-frauddetectionservice	77cefdab4d5c	netty-codec-http@4.1.100.Final	4.1.135.Final	1
ghcr.io/open-telemetry/demo :1.12.0-adservice	a59e5eead495	netty-codec-http@4.1.100.Final	4.1.135.Final	1
ghcr.io/openunison/openunison-k8s :1.0.50	9ad450220ab9	netty-codec-http@4.2.13.Final	4.2.15.Final	1
ghcr.io/privacyengineering/hawk-service :latest	bfedf47bb5e0	netty-codec-http@4.1.101.Final	4.1.135.Final	1
ghcr.io/projectnessie/nessie :0.92.1	9efe3c74d55f	netty-codec-http@4.1.108.Final	4.1.135.Final	1
ghcr.io/punchplatform/punchline-java :8.1.1	d46ce7b96482	netty-codec-http@4.1.77.Final	4.1.135.Final	1
ghcr.io/radar-base/radar-output-restructure/radar-output-restructure :3.0.6	7fb9c70e96a4	netty-codec-http@4.2.10.Final	4.2.15.Final	1
ghcr.io/star-whale/server :0.6.15	8368359c8dd0	netty-codec-http@4.1.86.Final	4.1.135.Final	1
ghcr.io/stirling-tools/stirling-pdf :2.14.3	3b3670fce70b	netty-codec-http@4.2.12.Final	4.2.15.Final	1