StackRadar

CVE-2026-54428

High

Advisory

Published 1 Jul 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.009
57th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
135
of 17,781 indexed, latest versions
Container images
159
deployed by those charts
Fix available
1 of 1
affected package

Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK

Carried by container images the latest versions of 135 of 17,781 indexed charts deploy, on 159 images.

Affected packageAffected versionsFixed inImages
httpcore5-h2maven5.0.1, 5.0.2, 5.1.1, 5.1.3+14 more5.4.3159
OSV records
GHSA-v3jc-474w-2wm6

Charts affected

135 by stars
ChartLatestAffected imagesRadar Score
metabasepmint932.27.61 of 1See more

metabase pmint93 2.27.6

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
metabase/metabase:v0.61.1.x9491ed11c901
httpcore5-h2@5.3.5
5.4.3

Open the chart page →

1,639
jiraatlassian-data-centerVerified publisher2.0.151 of 2See more

jira atlassian-data-center 2.0.15

1 of the 2 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
atlassian/jira-software:11.3.11e5548cd4eea8
httpcore5-h2@5.3.4
5.4.3

Open the chart page →

1,490
trinotrino1.42.21 of 1See more

trino trino 1.42.2

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
trinodb/trino:4801565e8cac299
httpcore5-h2@5.4.2
5.4.3

Open the chart page →

1,309
graylogkong-zVerified publisher3.0.321 of 5See more

graylog kong-z 3.0.32

1 of the 5 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.19.68690b204fe91
httpcore5-h2@5.3.1
5.4.3

Open the chart page →

2,699
penpotpenpotOfficialVerified publisher1.9.01 of 4See more

penpot penpot 1.9.0

1 of the 4 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
penpotapp/backend:2.17.2770b55f6e51b
httpcore5-h2@5.4
5.4.3

Open the chart page →

4,314
nacosygqygq2Verified publisher2.1.101 of 4See more

nacos ygqygq2 2.1.10

1 of the 4 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
nacos/nacos-server:v3.0.20e951a1d07bb
httpcore5-h2@5.3.3
5.4.3

Open the chart page →

4,983
akhqakhq0.28.01 of 1See more

akhq akhq 0.28.0

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
tchiotludo/akhq:0.28.0c2824dc2ae44
httpcore5-h2@5.4
5.4.3

Open the chart page →

1,548
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
wazuh/wazuh-indexer:4.14.3b149b30da686
httpcore5-h2@5.3.1
5.4.3

Open the chart page →

11,384
bitbucketatlassian-data-centerVerified publisher2.0.151 of 1See more

bitbucket atlassian-data-center 2.0.15

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
atlassian/bitbucket:10.2.705933f2b1cfd
httpcore5-h2@5.3.6
5.4.3

Open the chart page →

1,444
apim3graviteeioVerified publisher4.12.192 of 4See more

apim3 graviteeio 4.12.19

2 of the 4 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
graviteeio/apim-gateway:4.12.19-debian05fd67a93056
httpcore5-h2@5.4
5.4.3
graviteeio/apim-management-api:4.12.19-debian27374522cd04
httpcore5-h2@5.4
5.4.3

Open the chart page →

4,806
cloudbeaveravistoVerified publisher1.1.71 of 1See more

cloudbeaver avisto 1.1.7

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
dbeaver/cloudbeaver:26.1.287ab86d00f8c
httpcore5-h2@5.3.6
5.4.3

Open the chart page →

1,710
druiddruid-helmVerified publisher37.0.21 of 3See more

druid druid-helm 37.0.2

1 of the 3 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
apache/druid:37.0.00116fb802786
httpcore5-h2@5.3.6
5.4.3

Open the chart page →

3,812
camunda-bpm-platformcamunda-community-hub7.6.111 of 1See more

camunda-bpm-platform camunda-community-hub 7.6.11

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
camunda/camunda-bpm-platform:latestbcc5bb0542df
httpcore5-h2@5.3.4
5.4.3

Open the chart page →

1,154
grayloggroundhog2k0.13.101 of 1See more

graylog groundhog2k 0.13.10

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
graylog/graylog:7.1.9598bd41fefd5
httpcore5-h2@5.3.4
5.4.3

Open the chart page →

1,074
unifiunifiVerified publisher1.16.01 of 1See more

unifi unifi 1.16.0

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
jacobalberty/unifi:v10.0.162896c0ab82d33
httpcore5-h2@5.2.5
5.4.3

Open the chart page →

7,268
crowdatlassian-data-centerVerified publisher2.0.151 of 2See more

crowd atlassian-data-center 2.0.15

1 of the 2 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
atlassian/crowd:7.2.3c81cc7d6bc9e
httpcore5-h2@5.3.6
5.4.3

Open the chart page →

1,415
grayloggraylog2OfficialVerified publisher2.0.01 of 2See more

graylog graylog2 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
graylog/graylog-enterprise:7.1.88a1f641cd7aa
httpcore5-h2@5.3.4
5.4.3

Open the chart page →

1,500
janssenjanssen-auth-serverOfficialVerified publisher0.0.0-nightly1 of 8See more

janssen janssen-auth-server 0.0.0-nightly

1 of the 8 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
ghcr.io/janssenproject/jans/casa:0.0.0-nightly3f2d14563495
httpcore5-h2@5.3.4
5.4.3

Open the chart page →

1,068
druidwiremindVerified publisher1.22.11 of 3See more

druid wiremind 1.22.1

1 of the 3 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
apache/druid:29.0.10cef139b6bf1
httpcore5-h2@5.1.3
5.4.3

Open the chart page →

7,930
bambooatlassian-data-centerVerified publisher2.0.151 of 2See more

bamboo atlassian-data-center 2.0.15

1 of the 2 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
atlassian/bamboo:12.1.114af4bb6c8d46
httpcore5-h2@5.3.4
5.4.3

Open the chart page →

2,031
geoservercloudcamptocamp23.0.17 of 7See more

geoservercloud camptocamp2 3.0.1

7 of the 7 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
geoservercloud/geoserver-cloud-gateway:3.0.1.1de0b20bd2a43
httpcore5-h2@5.3.6
5.4.3
geoservercloud/geoserver-cloud-gwc:3.0.1.1b04ed89b5d2b
httpcore5-h2@5.3.6
5.4.3
geoservercloud/geoserver-cloud-rest:3.0.1.1318254b52f96
httpcore5-h2@5.3.6
5.4.3
geoservercloud/geoserver-cloud-wcs:3.0.1.14f077124f591
httpcore5-h2@5.3.6
5.4.3
geoservercloud/geoserver-cloud-webui:3.0.1.14f91e3048ac8
httpcore5-h2@5.3.6
5.4.3
geoservercloud/geoserver-cloud-wfs:3.0.1.1299f0d6232d1
httpcore5-h2@5.3.6
5.4.3
geoservercloud/geoserver-cloud-wms:3.0.1.15164f687ce4d
httpcore5-h2@5.3.6
5.4.3

Open the chart page →

10,546
opensearchcaptnbpVerified publisher3.1.11 of 2See more

opensearch captnbp 3.1.1

1 of the 2 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.19.269588c664014
httpcore5-h2@5.3.1
5.4.3

Open the chart page →

998
thingsboardcetic0.1.21 of 2See more

thingsboard cetic 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
thingsboard/tb-postgres:latest2d17e4e36edc
httpcore5-h2@5.3.5
5.4.3

Open the chart page →

5,235
cosmotech-apicosmotech-apiVerified publisher5.2.01 of 1See more

cosmotech-api cosmotech-api 5.2.0

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-api:5.2.0269ee25c359b
httpcore5-h2@5.3.6
5.4.3

Open the chart page →

206
flowableflowable-oss7.1.01 of 2See more

flowable flowable-oss 7.1.0

1 of the 2 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
flowable/flowable-rest:7.1.0b7ae287502cd
httpcore5-h2@5.2.5
5.4.3

Open the chart page →

2,784
apimgraviteeioVerified publisher4.12.192 of 4See more

apim graviteeio 4.12.19

2 of the 4 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
graviteeio/apim-gateway:4.12.19-debian05fd67a93056
httpcore5-h2@5.4
5.4.3
graviteeio/apim-management-api:4.12.19-debian27374522cd04
httpcore5-h2@5.4
5.4.3

Open the chart page →

4,806
nacosgujunxiang0.1.51 of 1See more

nacos gujunxiang 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
nacos/nacos-server:latest1c191c30c8cd
httpcore5-h2@5.3.6
5.4.3

Open the chart page →

1,767
oesopsmxVerified publisher4.0.323 of 25See more

oes opsmx 4.0.32

3 of the 25 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
httpcore5-h2@5.1.5
5.4.3
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
httpcore5-h2@5.2.4
5.4.3
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
httpcore5-h2@5.2.4
5.4.3

Open the chart page →

107,811
thingsboard-clusterthingsboard-cluster-bettaVerified publisher0.2.261 of 6See more

thingsboard-cluster thingsboard-cluster-betta 0.2.26

1 of the 6 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
thingsboard/tb-node:3.6.0f40a542832c4
httpcore5-h2@5.2
5.4.3

Open the chart page →

14,566
structurizrvirtualrootVerified publisher0.5.01 of 1See more

structurizr virtualroot 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
structurizr/onpremises:2025.11.094b5ffb5119c8
httpcore5-h2@5.3.6
5.4.3

Open the chart page →

4,378
nacosbytectl0.1.61 of 1See more

nacos bytectl 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
nacos/nacos-server:latest1c191c30c8cd
httpcore5-h2@5.3.6
5.4.3

Open the chart page →

1,767
cbioportalcbioportalOfficialVerified publisher1.1.01 of 1See more

cbioportal cbioportal 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
cbioportal/cbioportal:6.4.1-web-shenandoah08debbd2dbf9
httpcore5-h2@5.2.1
5.4.3

Open the chart page →

3,674
cp-schema-registrycp-schema-registryVerified publisher1.0.01 of 1See more

cp-schema-registry cp-schema-registry 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
ghcr.io/devops-ia/cp-schema-registry:8.1.1-msk-iam-auth2.3.530d1a445acc7
httpcore5-h2@5.3.4
5.4.3

Open the chart page →

1,864
egagenteginnovationsVerified publisher0.10.01 of 1See more

egagent eginnovations 0.10.0

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
eginnovations/agent:7.5.4e4dfe242fe9f
httpcore5-h2@5.2.4
5.4.3

Open the chart page →

1,340
enavenav-service-architectureVerified publisher0.0.78 of 10See more

enav enav-service-architecture 0.0.7

8 of the 10 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
ghcr.io/gla-rad/enav-api-gateway:latest8f4345c77dda
httpcore5-h2@5.3.6
5.4.3
ghcr.io/gla-rad/enav-aton-admin-service:latestcf85570b1324
httpcore5-h2@5.3.6
5.4.3
ghcr.io/gla-rad/enav-aton-service:latest3be878690629
httpcore5-h2@5.3.6
5.4.3
ghcr.io/gla-rad/enav-aton-service-client:latestf1629ac5f9ec
httpcore5-h2@5.3.6
5.4.3
ghcr.io/gla-rad/enav-ckeeper:latest415323ef112b
httpcore5-h2@5.3.6
5.4.3
ghcr.io/gla-rad/enav-eureka:latest05002092c621
httpcore5-h2@5.3.6
5.4.3
ghcr.io/gla-rad/enav-msg-broker:latest6fe372e4e481
httpcore5-h2@5.3.6
5.4.3
ghcr.io/gla-rad/enav-vdes-controller:latestc4c52955814f
httpcore5-h2@5.3.6
5.4.3

Open the chart page →

15,860
paraerudikaVerified publisher0.3.01 of 1See more

para erudika 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
erudikaltd/para:latest_stable235e0bc53da2
httpcore5-h2@5.4.2
5.4.3

Open the chart page →

1,086
scoolderudikaVerified publisher0.3.01 of 1See more

scoold erudika 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
erudikaltd/scoold:1.66.0949c56b57e8f
httpcore5-h2@5.3.6
5.4.3

Open the chart page →

1,605
atlas-cmmsf3k-techVerified publisher0.151.51 of 4See more

atlas-cmms f3k-tech 0.151.5

1 of the 4 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
intelloop/atlas-cmms-backend:v1.5.14c61bc3dd3f8
httpcore5-h2@5.2.4
5.4.3

Open the chart page →

5,291
gluugluu-flexOfficialVerified publisher0.0.0-nightly1 of 9See more

gluu gluu-flex 0.0.0-nightly

1 of the 9 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
ghcr.io/janssenproject/jans/casa:0.0.0-nightly3f2d14563495
httpcore5-h2@5.3.4
5.4.3

Open the chart page →

1,507
iceberg-resticeberg-rest-fixture0.0.11 of 2See more

iceberg-rest iceberg-rest-fixture 0.0.1

1 of the 2 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
ahmetfurkandemir/iceberg-rest-fixture-postgresql:1.10.0142231a0b8b7
httpcore5-h2@5.3.4
5.4.3

Open the chart page →

3,470
traccarjeffrescVerified publisher0.2.01 of 2See more

traccar jeffresc 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
traccar/traccar:6.7-alpine621c8d6d46fd
httpcore5-h2@5.2.4
5.4.3

Open the chart page →

1,341
kokukokuVerified publisher1.0.01 of 7See more

koku koku 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
public.ecr.aws/v0r6c2e2/trino:latestc265156b00d1
httpcore5-h2@5.3.3
5.4.3

Open the chart page →

12,019
auditflowlabs64io-helm-chartsVerified publisher0.12.11 of 3See more

auditflow labs64io-helm-charts 0.12.1

1 of the 3 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
labs64/auditflowdigest-pinnedc7b26d3ca11c
httpcore5-h2@5.3.6
5.4.3

Open the chart page →

1,446
payment-gatewaylabs64io-helm-chartsVerified publisher0.8.01 of 2See more

payment-gateway labs64io-helm-charts 0.8.0

1 of the 2 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
labs64/payment-gateway:0.0.10c66feefca17
httpcore5-h2@5.3.6
5.4.3

Open the chart page →

2,657
mcpmcp-chartsVerified publisher0.0.231 of 7See more

mcp mcp-charts 0.0.23

1 of the 7 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
glarad/mc-service-registry:latest7b02b9e7f1ef
httpcore5-h2@5.3.6
5.4.3

Open the chart page →

6,929
data-prepperopensearch-project-helm-chartsVerified publisher0.3.11 of 1See more

data-prepper opensearch-project-helm-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
opensearchproject/data-prepper:2.8.057c25fa01d3c
httpcore5-h2@5.2.4
5.4.3

Open the chart page →

1,692
opikopikOfficialVerified publisher2.2.591 of 13See more

opik opik 2.2.59

1 of the 13 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
ghcr.io/comet-ml/opik/opik-backend:2.2.5950a7aa0562f5
httpcore5-h2@5.3.4
5.4.3

Open the chart page →

14,334
reportportalreportportal-ioOfficialVerified publisher26.8.122 of 15See more

reportportal reportportal-io 26.8.12

2 of the 15 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
reportportal/service-api:5.15.4bf193091525a
httpcore5-h2@5.3.6
5.4.3
reportportal/service-authorization:5.15.16a954407b417
httpcore5-h2@5.3.6
5.4.3

Open the chart page →

11,869
resurfaceresurfaceioVerified publisher3.9.01 of 3See more

resurface resurfaceio 3.9.0

1 of the 3 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
resurfaceio/resurface:3.7.84d5cda2f64109
httpcore5-h2@5.3.3
5.4.3

Open the chart page →

7,432
signserver-cesignserverOfficialVerified publisher2.3.51 of 1See more

signserver-ce signserver 2.3.5

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
keyfactor/signserver-ce:7.3.2798fbbe00283
httpcore5-h2@5.2.4
5.4.3

Open the chart page →

2,406

Container images carrying it

159 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
public.ecr.aws/aktosecurity/akto-api-security-runtime:latestfacdfba6d4e4
httpcore5-h2@5.2.4
5.4.3
1
public.ecr.aws/aktosecurity/akto-api-testing:latest97d830d5538a
httpcore5-h2@5.2.4
5.4.3
1
public.ecr.aws/aktosecurity/akto-threat-detection:latest3f103ce347ce
httpcore5-h2@5.2.4
5.4.3
1
public.ecr.aws/aktosecurity/akto-threat-detection:1.16.2a47eb6cc17ea
httpcore5-h2@5.2.4
5.4.3
1
public.ecr.aws/v0r6c2e2/trino:latestc265156b00d1
httpcore5-h2@5.3.3
5.4.3
1
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
httpcore5-h2@5.1.5
5.4.3
1
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
httpcore5-h2@5.2.4
5.4.3
1
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
httpcore5-h2@5.2.4
5.4.3
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
httpcore5-h2@5.3.1
5.4.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.