StackRadar

CVE-2026-54428

High

Advisory

Published 1 Jul 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.009
57th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
135
of 17,781 indexed, latest versions
Container images
159
deployed by those charts
Fix available
1 of 1
affected package

Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK

Carried by container images the latest versions of 135 of 17,781 indexed charts deploy, on 159 images.

Affected packageAffected versionsFixed inImages
httpcore5-h2maven5.0.1, 5.0.2, 5.1.1, 5.1.3+14 more5.4.3159
OSV records
GHSA-v3jc-474w-2wm6

Charts affected

135 by stars
ChartLatestAffected imagesRadar Score
xwikikeyporttech0.2.01 of 2See more

xwiki keyporttech 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
library/xwiki:lts-postgres-tomcat56490ac14a31
httpcore5-h2@5.3.6
5.4.3

Open the chart page →

1,595
kron-aapm-agentkron-pam-aapm-helmcharts1.2.51 of 1See more

kron-aapm-agent kron-pam-aapm-helmcharts 1.2.5

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
krontechnology/aapm-agent:1.8.41cc7d5be6529
httpcore5-h2@5.3.6
5.4.3

Open the chart page →

2,707
tdsfkubebb5.7.01 of 3See more

tdsf kubebb 5.7.0

1 of the 3 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
kubebb/mesh-api:v5.7.0a3879931dfa1
httpcore5-h2@5.2.2
5.4.3

Open the chart page →

6,490
dependency-trackmediamarktsaturn1.9.21 of 2See more

dependency-track mediamarktsaturn 1.9.2

1 of the 2 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
dependencytrack/apiserver:4.14.21ba4f004e1ec
httpcore5-h2@5.4
5.4.3

Open the chart page →

3,818
resource-processormicroservices-learningVerified publisher1.2.01 of 1See more

resource-processor microservices-learning 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
maksimkavalenka/microservices-learning.resource-processor:latest64a25afb8748
httpcore5-h2@5.2.2
5.4.3

Open the chart page →

3,683
resource-servicemicroservices-learningVerified publisher1.5.01 of 2See more

resource-service microservices-learning 1.5.0

1 of the 2 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
maksimkavalenka/microservices-learning.resource-service:latest13ad9bb170a0
httpcore5-h2@5.2.2
5.4.3

Open the chart page →

5,129
song-servicemicroservices-learningVerified publisher1.2.01 of 2See more

song-service microservices-learning 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
maksimkavalenka/microservices-learning.song-service:latest2bcdac368b07
httpcore5-h2@5.2.2
5.4.3

Open the chart page →

4,599
commafeedmt1905028.2.01 of 3See more

commafeed mt190502 8.2.0

1 of the 3 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
athou/commafeed:6.2.0-postgresql5e388351df1a
httpcore5-h2@5.4
5.4.3

Open the chart page →

3,687
nacosnacos-yunyeVerified publisher1.0.31 of 1See more

nacos nacos-yunye 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
nacos/nacos-server:v3.0.130a39cb0c54d
httpcore5-h2@5.3.3
5.4.3

Open the chart page →

1,783
olvid-botobeoneVerified publisher0.3.31 of 1See more

olvid-bot obeone 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
olvid/bot-daemon:2.0.1e0e6b165d879
httpcore5-h2@5.2.4
5.4.3

Open the chart page →

2,049
my-bloody-jenkinsodavid0.1.2181 of 1See more

my-bloody-jenkins odavid 0.1.218

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
odavid/my-bloody-jenkins:2.462.3-306e7ab3bbc948e
httpcore5-h2@5.3
5.4.3

Open the chart page →

5,826
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
vespaengine/vespa:8.526.1569b160f58211
httpcore5-h2@5.2.5
5.4.3

Open the chart page →

6,338
sentinelopennms-helm-chartsVerified publisher0.4.01 of 2See more

sentinel opennms-helm-charts 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
opennms/sentinel:36.0.288869082a14f
httpcore5-h2@5.2
5.4.3

Open the chart page →

2,024
cp-cmfopenshift2.4.11 of 1See more

cp-cmf openshift 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
confluentinc/cp-cmf:2.4.1f466f8649aa8
httpcore5-h2@5.3.6
5.4.3

Open the chart page →

179
fineractopenshift0.1.11 of 4See more

fineract openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
apache/fineract:1.12.1a83cf1980609
httpcore5-h2@5.3.3
5.4.3

Open the chart page →

7,792
trinoopstty0.2.121 of 1See more

trino opstty 0.2.12

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
trinodb/trino:4815b5e0a97f599
httpcore5-h2@5.4.2
5.4.3

Open the chart page →

1,158
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.01 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

1 of the 40 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
opensearchproject/opensearch:3.1.0474ea3fdf25d
httpcore5-h2@5.3.4
5.4.3

Open the chart page →

71,208
trinopresto-loadbalancer0.2.101 of 2See more

trino presto-loadbalancer 0.2.10

1 of the 2 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
trinodb/trino:4796af989b0846d
httpcore5-h2@5.2
5.4.3

Open the chart page →

2,264
punchline-javapunchplatform8.1.11 of 1See more

punchline-java punchplatform 8.1.1

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
ghcr.io/punchplatform/punchline-java:8.1.1d46ce7b96482
httpcore5-h2@5.2
5.4.3

Open the chart page →

1,995
unifiqaoruVerified publisher1.1.21 of 2See more

unifi qaoru 1.1.2

1 of the 2 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
linuxserver/unifi-network-application:10.6.101-ls144b6ce6968ee45
httpcore5-h2@5.3.6
5.4.3

Open the chart page →

3,642
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
trinodb/trino:45038c6f24ab1a4
httpcore5-h2@5.2.1
5.4.3

Open the chart page →

21,211
radar-cp-ksql-serverradar-baseVerified publisher0.0.21 of 2See more

radar-cp-ksql-server radar-base 0.0.2

1 of the 2 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
confluentinc/cp-ksqldb-server:7.6.08ec46c27982f
httpcore5-h2@5.0.2
5.4.3

Open the chart page →

5,269
stirling-pdfrubxkubeVerified publisher0.1.21 of 1See more

stirling-pdf rubxkube 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
ghcr.io/stirling-tools/stirling-pdf:2.14.33b3670fce70b
httpcore5-h2@5.3.6
5.4.3

Open the chart page →

6,207
trinostatcan1.23.41 of 2See more

trino statcan 1.23.4

1 of the 2 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
trinodb/trino:405ee80ab5eeab2
httpcore5-h2@5.1.1
5.4.3

Open the chart page →

13,767
netforge-besvtechVerified publisher0.0.21 of 3See more

netforge-be svtech 0.0.2

1 of the 3 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
conductoross/conductor:3.31.09fba127693e6
httpcore5-h2@5.2.5
5.4.3

Open the chart page →

4,674
krokiteochenglim1.0.11 of 5See more

kroki teochenglim 1.0.1

1 of the 5 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
yuzutech/kroki:0.17.0192b7b27c857
httpcore5-h2@5.1.3
5.4.3

Open the chart page →

8,715
thingsboardthingsboardVerified publisher0.1.34 of 12See more

thingsboard thingsboard 0.1.3

4 of the 12 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
thingsboard/tb-coap-transport:3.4.1bd45a09d85d9
httpcore5-h2@5.1.3
5.4.3
thingsboard/tb-http-transport:3.4.1a06f53c5e2da
httpcore5-h2@5.1.3
5.4.3
thingsboard/tb-mqtt-transport:3.4.1030f316ce301
httpcore5-h2@5.1.3
5.4.3
thingsboard/tb-node:3.4.1645f43b688f7
httpcore5-h2@5.1.3
5.4.3

Open the chart page →

25,394
orchestratremolo3.1.551 of 5See more

orchestra tremolo 3.1.55

1 of the 5 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
ghcr.io/openunison/openunison-k8s:1.0.509ad450220ab9
httpcore5-h2@5.4.2
5.4.3

Open the chart page →

7,637
configservertwomartensVerified publisher0.2.01 of 1See more

configserver twomartens 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
2martens/configserver:latestbf1cdb80239d
httpcore5-h2@5.2.5
5.4.3

Open the chart page →

2,144
timetabletwomartensVerified publisher0.2.01 of 1See more

timetable twomartens 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
2martens/timetable:latestbd1ba6ab84c9
httpcore5-h2@5.3.5
5.4.3

Open the chart page →

1,527
wahlrechttwomartensVerified publisher0.3.01 of 1See more

wahlrecht twomartens 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
2martens/wahlrecht:latestba2c3040dab0
httpcore5-h2@5.3.4
5.4.3

Open the chart page →

1,689
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
wazuh/wazuh-indexer:4.14.49c344d2b1757
httpcore5-h2@5.3.1
5.4.3

Open the chart page →

5,484
drillwearefrank1.3.61 of 3See more

drill wearefrank 1.3.6

1 of the 3 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
apache/drill:1.21.11f96558fd292
httpcore5-h2@5.1.3
5.4.3

Open the chart page →

9,397
metabasewiremindVerified publisher2.27.5-wiremind01 of 1See more

metabase wiremind 2.27.5-wiremind0

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
metabase/metabase:v0.61.1.x9491ed11c901
httpcore5-h2@5.3.5
5.4.3

Open the chart page →

1,639
zahori-processzahoriVerified publisher1.0.11 of 1See more

zahori-process zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-54428.

Container imageDigestPackageFixed in
zahoriaut/zahori-process:0.1.13351f8a220ed7
httpcore5-h2@5.2.2
5.4.3

Open the chart page →

3,480

Container images carrying it

159 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
public.ecr.aws/aktosecurity/akto-api-security-runtime:latestfacdfba6d4e4
httpcore5-h2@5.2.4
5.4.3
1
public.ecr.aws/aktosecurity/akto-api-testing:latest97d830d5538a
httpcore5-h2@5.2.4
5.4.3
1
public.ecr.aws/aktosecurity/akto-threat-detection:latest3f103ce347ce
httpcore5-h2@5.2.4
5.4.3
1
public.ecr.aws/aktosecurity/akto-threat-detection:1.16.2a47eb6cc17ea
httpcore5-h2@5.2.4
5.4.3
1
public.ecr.aws/v0r6c2e2/trino:latestc265156b00d1
httpcore5-h2@5.3.3
5.4.3
1
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
httpcore5-h2@5.1.5
5.4.3
1
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
httpcore5-h2@5.2.4
5.4.3
1
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
httpcore5-h2@5.2.4
5.4.3
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
httpcore5-h2@5.3.1
5.4.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.