StackRadar

CVE-2026-54399

High

Advisory

Published 1 Jul 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.009
57th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
152
of 17,781 indexed, latest versions
Container images
168
deployed by those charts
Fix available
1 of 1
affected package

Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service

Carried by container images the latest versions of 152 of 17,781 indexed charts deploy, on 168 images.

Affected packageAffected versionsFixed inImages
httpcore5maven5.0.1, 5.0.2, 5.1.1, 5.1.3+14 more5.4.3168
OSV records
GHSA-hf6x-8p5f-cgmf

Charts affected

152 by stars
ChartLatestAffected imagesRadar Score
zahori-processzahoriVerified publisher1.0.11 of 1See more

zahori-process zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-54399.

Container imageDigestPackageFixed in
zahoriaut/zahori-process:0.1.13351f8a220ed7
httpcore5@5.2.2
5.4.3

Open the chart page →

3,480
keycloakxzaks2.2.01 of 1See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2026-54399.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:20.0.3b8f2a453a17a
httpcore5@5.0.2
5.4.3

Open the chart page →

6,016

Container images carrying it

168 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
opensearchproject/opensearch:2.19.68690b204fe91
httpcore5@5.3.4
5.4.3
1
opensearchproject/opensearch:2.10.0c8f3ebd2a934
httpcore5@5.2.1
5.4.3
1
reportportal/service-api:5.15.4bf193091525a
httpcore5@5.3.6
5.4.3
1
reportportal/service-authorization:5.15.16a954407b417
httpcore5@5.3.6
5.4.3
1
resurfaceio/resurface:3.7.84d5cda2f64109
httpcore5@5.3.3
5.4.3
1
salehmir/jesse:1.10.101afa95f979e9
httpcore5@5.0.2
5.4.3
1
stardog/stardog:latest2714e5c4b3c1
httpcore5@5.3.1
5.4.3
1
structurizr/onpremises:2025.11.094b5ffb5119c8
httpcore5@5.3.6
5.4.3
1
tchiotludo/akhq:0.28.0c2824dc2ae44
httpcore5@5.4
5.4.3
1
thingsboard/tb-coap-transport:3.4.1bd45a09d85d9
httpcore5@5.1.3
5.4.3
1
thingsboard/tb-http-transport:3.4.1a06f53c5e2da
httpcore5@5.1.3
5.4.3
1
thingsboard/tb-mqtt-transport:3.4.1030f316ce301
httpcore5@5.1.3
5.4.3
1
thingsboard/tb-node:3.4.1645f43b688f7
httpcore5@5.1.3
5.4.3
1
thingsboard/tb-node:3.6.0f40a542832c4
httpcore5@5.2
5.4.3
1
thingsboard/tb-postgres:latest2d17e4e36edc
httpcore5@5.3.5
5.4.3
1
traccar/traccar:6.7-alpine621c8d6d46fd
httpcore5@5.2.4
5.4.3
1
trinodb/trino:4801565e8cac299
httpcore5@5.2.1
5.4.3
1
trinodb/trino:45038c6f24ab1a4
httpcore5@5.2.1
5.4.3
1
trinodb/trino:4815b5e0a97f599
httpcore5@5.3.4
5.4.3
1
trinodb/trino:4796af989b0846d
httpcore5@5.3.6
5.4.3
1
trinodb/trino:405ee80ab5eeab2
httpcore5@5.1.1
5.4.3
1
vespaengine/vespa:8.526.1569b160f58211
httpcore5@5.2.5
5.4.3
1
wazuh/wazuh-indexer:4.14.49c344d2b1757
httpcore5@5.3.1
5.4.3
1
wazuh/wazuh-indexer:4.11.1a7a2076b167e
httpcore5@5.2.2
5.4.3
1
wazuh/wazuh-indexer:4.14.3b149b30da686
httpcore5@5.3.1
5.4.3
1
yuzutech/kroki:0.17.0192b7b27c857
httpcore5@5.1.3
5.4.3
1
zahoriaut/zahori-process:0.1.13351f8a220ed7
httpcore5@5.2.2
5.4.3
1
gcr.io/spotinst-artifacts/spot-ocean-metric-exporter:1.0.5ae57b62291aa
httpcore5@5.3.4
5.4.3
1
ghcr.io/appscode/inbox-server:MailetGroup4a2824296412
httpcore5@5.1.5
5.4.3
1
ghcr.io/camunda-community-hub/zeebe-simple-monitor:2.6.2d9d796a1b846
httpcore5@5.2.4
5.4.3
1
ghcr.io/comet-ml/opik/opik-backend:2.2.5950a7aa0562f5
httpcore5@5.4
5.4.3
1
ghcr.io/cosmo-tech/cosmotech-api:5.2.0269ee25c359b
httpcore5@5.3.6
5.4.3
1
ghcr.io/damap-org/damap-backend:5.0.0f3d0c7d35498
httpcore5@5.0.2
5.4.3
1
ghcr.io/devops-ia/cp-schema-registry:8.1.1-msk-iam-auth2.3.530d1a445acc7
httpcore5@5.3.4
5.4.3
1
ghcr.io/gla-rad/enav-api-gateway:latest8f4345c77dda
httpcore5@5.3.6
5.4.3
1
ghcr.io/gla-rad/enav-aton-admin-service:latestcf85570b1324
httpcore5@5.3.6
5.4.3
1
ghcr.io/gla-rad/enav-aton-service:latest3be878690629
httpcore5@5.3.6
5.4.3
1
ghcr.io/gla-rad/enav-aton-service-client:latestf1629ac5f9ec
httpcore5@5.3.6
5.4.3
1
ghcr.io/gla-rad/enav-ckeeper:latest415323ef112b
httpcore5@5.3.6
5.4.3
1
ghcr.io/gla-rad/enav-eureka:latest05002092c621
httpcore5@5.3.6
5.4.3
1
ghcr.io/gla-rad/enav-msg-broker:latest6fe372e4e481
httpcore5@5.3.6
5.4.3
1
ghcr.io/gla-rad/enav-vdes-controller:latestc4c52955814f
httpcore5@5.3.6
5.4.3
1
ghcr.io/it-at-m/dave-backend/dave-backend:10.0.0f66413e62afc
httpcore5@5.3.6
5.4.3
1
ghcr.io/it-at-m/dave-document-storage/dave-document-storage:10.0.09c7fc07330c9
httpcore5@5.3.6
5.4.3
1
ghcr.io/it-at-m/dave-eai/dave-eai:10.0.0fd93e0d125b3
httpcore5@5.3.6
5.4.3
1
ghcr.io/it-at-m/dave-geodata-eai/dave-geodata-eai:10.0.06a3fe3136856
httpcore5@5.3.6
5.4.3
1
ghcr.io/itobey/fddb-exporter:2.4.1a824933e0f87
httpcore5@5.4.2
5.4.3
1
ghcr.io/openunison/openunison-k8s:1.0.509ad450220ab9
httpcore5@5.3.4
5.4.3
1
ghcr.io/privacyengineering/hawk-service:latestbfedf47bb5e0
httpcore5@5.0.2
5.4.3
1
ghcr.io/punchplatform/punchline-java:8.1.1d46ce7b96482
httpcore5@5.2
5.4.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.