StackRadar

CVE-2026-58055

Medium

Advisory

Published 28 Jun 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.003
17th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
1,680
of 17,787 indexed, latest versions
Container images
1,610
deployed by those charts
Fix available
3 of 3
affected packages

Red Hat Security Advisory: nghttp2 security update

Carried by container images the latest versions of 1,680 of 17,787 indexed charts deploy, on 1,610 images.

Affected packageAffected versionsFixed inImages
nghttp2deb1.30.0-1ubuntu1, 1.40.0-1build1, 1.40.0-1ubuntu0.1, 1.40.0-1ubuntu0.2+20 more1.43.0-1ubuntu0.4, 1.59.0-1ubuntu0.4, 1.64.0-1.1+e2, 1.64.0-1.1ubuntu1.2+1 more1,206
nghttp2apk1.63.0-r0, 1.64.0-r1, 1.66.0-r1, 1.68.0-r0+2 more1.70.0-r011
nghttp2rpm1.33.0-1.el8, 1.33.0-1.el8_0.1, 1.33.0-3.el8_2.1, 1.33.0-3.el8_2.2+18 more0:1.33.0-6.el8_10.3, 0:1.43.0-6.el9_8.2, 0:1.68.0-3.el10_2.2, 1.64.0-150700.3.6.1+2 more393
OSV records
CGA-43r8-f2xj-r388CGA-7g67-8qrj-cr3qDEBIAN-CVE-2026-58055RHSA-2026:54650RHSA-2026:54662RHSA-2026:55804RLSA-2026:54650RLSA-2026:54662RLSA-2026:55804UBUNTU-CVE-2026-58055ECHO-401a-73df-0d29openSUSE-SU-2026:11156-1SUSE-SU-2026:22630-1SUSE-SU-2026:4029-1
Also known as
CGA-8pjw-3mvg-2x6m, CGA-mrwp-fgwh-65q5, USN-8495-1

Charts affected

1,680 by stars
ChartLatestAffected imagesRadar Score
cluster-managerocm-helm-chartsVerified publisher1.3.11 of 1See more

cluster-manager ocm-helm-charts 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
quay.io/open-cluster-management/registration-operator:v1.3.1df6c926a2b54
nghttp2@1.43.0-6.el9_7.1
0:1.43.0-6.el9_8.2

Open the chart page →

792
klusterletocm-helm-chartsVerified publisher1.3.11 of 1See more

klusterlet ocm-helm-charts 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
quay.io/open-cluster-management/registration-operator:v1.3.1df6c926a2b54
nghttp2@1.43.0-6.el9_7.1
0:1.43.0-6.el9_8.2

Open the chart page →

792
kueue-addonocm-helm-chartsVerified publisher0.1.41 of 1See more

kueue-addon ocm-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
quay.io/open-cluster-management/kueue-addon:v0.1.47f728514fead
nghttp2@1.43.0-6.el9
0:1.43.0-6.el9_8.2

Open the chart page →

1,580
managed-serviceaccountocm-helm-chartsVerified publisher0.10.01 of 1See more

managed-serviceaccount ocm-helm-charts 0.10.0

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
quay.io/open-cluster-management/managed-serviceaccount:v0.10.0d6284bd7765a
nghttp2@1.43.0-6.el9
0:1.43.0-6.el9_8.2

Open the chart page →

1,051
multicluster-controlplaneocm-helm-chartsVerified publisher0.8.01 of 1See more

multicluster-controlplane ocm-helm-charts 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
quay.io/open-cluster-management/multicluster-controlplane:latest9888240f644b
nghttp2@1.33.0-6.el8_10.2
0:1.33.0-6.el8_10.3

Open the chart page →

612
web-chartoje-ktcloudlab0.1.01 of 1See more

web-chart oje-ktcloudlab 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
nghttp2@1.64.0-1.1+deb13u1
no fix listed

Open the chart page →

1,839
automx2oleds-helm-chartsVerified publisher1.0.51 of 1See more

automx2 oleds-helm-charts 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
oled01/automx2:2025.1.105d3e398e675
nghttp2@1.52.0-1+deb12u2
no fix listed

Open the chart page →

5,313
db-backupoleds-helm-chartsVerified publisher0.1.01 of 1See more

db-backup oleds-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
oled01/db-backup:0.1.06302fd2b5333
nghttp2@1.43.0-1build3
1.43.0-1ubuntu0.4

Open the chart page →

8,130
pulsarolehrgfVerified publisher0.0.51 of 2See more

pulsar olehrgf 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
apachepulsar/pulsar:3.1.016f9fdab3fa6
nghttp2@1.43.0-1build3
1.43.0-1ubuntu0.4

Open the chart page →

9,059
laravel-appoli-the-devVerified publisher2.0.171 of 1See more

laravel-app oli-the-dev 2.0.17

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
serversideup/php:8.5-fpm-nginx8f8c2f010ac5
nghttp2@1.64.0-1.1+deb13u1
no fix listed

Open the chart page →

2,692
paperless-ngxoli-the-devVerified publisher1.1.11 of 1See more

paperless-ngx oli-the-dev 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
nghttp2@1.64.0-1.1+deb13u1
no fix listed

Open the chart page →

4,644
apicurioone-acre-fundVerified publisher2.3.03 of 5See more

apicurio one-acre-fund 2.3.0

3 of the 5 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
apicurio/apicurio-studio-api:0.2.62.Final302d202ed149
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3
apicurio/apicurio-studio-ui:0.2.62.Final349c845270c2
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3
apicurio/apicurio-studio-ws:0.2.62.Final27a91978a388
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3

Open the chart page →

18,666
onedevonedev11.9.01 of 1See more

onedev onedev 11.9.0

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
1dev/server:11.9.0cd5b12fe5471
nghttp2@1.59.0-1ubuntu0.2
1.59.0-1ubuntu0.4

Open the chart page →

6,083
commonground-gatewayopencatalogi1.5.31 of 7See more

commonground-gateway opencatalogi 1.5.3

1 of the 7 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/gateway-ui:stag6a5594b7b32c
nghttp2@1.52.0-1
no fix listed

Open the chart page →

9,736
opentickopenchartVerified publisher0.1.01 of 1See more

opentick openchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
library/nginx:1.25.5a484819eb602
nghttp2@1.52.0-1+deb12u1
no fix listed

Open the chart page →

5,688
anchore-engineopencloudcx1.13.01 of 2See more

anchore-engine opencloudcx 1.13.0

1 of the 2 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
anchore/anchore-engine:v0.10.0bde9eedf639d
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3

Open the chart page →

18,023
cdn-remoteopencord0.2.41 of 3See more

cdn-remote opencord 0.2.4

1 of the 3 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
omecproject/cdn-antmedia:1.0.0b4ae7d0d6b74
nghttp2@1.30.0-1ubuntu1
no fix listed

Open the chart page →

63,277
freeradiusopencord1.0.41 of 1See more

freeradius opencord 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
freeradius/freeradius-server:3.0.2121c8bfa904d8
nghttp2@1.30.0-1ubuntu1
no fix listed

Open the chart page →

15,722
omec-control-planeopencord0.1.311 of 8See more

omec-control-plane opencord 0.1.31

1 of the 8 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
omecproject/c3po-hssdb:master-latest28a90cc26716
nghttp2@1.40.0-1build1
no fix listed

Open the chart page →

40,795
onosopencord3.0.21 of 1See more

onos opencord 3.0.2

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
onosproject/onos:2.2.144914a8d4b3f
nghttp2@1.30.0-1ubuntu1
no fix listed

Open the chart page →

12,939
voltha-infraopencord2.14.02 of 10See more

voltha-infra opencord 2.14.0

2 of the 10 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
freeradius/freeradius-server:3.0.2121c8bfa904d8
nghttp2@1.30.0-1ubuntu1
no fix listed
voltha/voltha-onos:5.1.8e038acb950d3
nghttp2@1.30.0-1ubuntu1
no fix listed

Open the chart page →

41,088
opencost-parquet-exporteropencostVerified publisher0.3.11 of 1See more

opencost-parquet-exporter opencost 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
ghcr.io/opencost/opencost-parquet-exporter:v0.2.1ce85ef0ce665
nghttp2@1.52.0-1+deb12u2
no fix listed

Open the chart page →

11,003
sentinelopennms-helm-chartsVerified publisher0.4.01 of 2See more

sentinel opennms-helm-charts 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
opennms/sentinel:36.0.288869082a14f
nghttp2@1.68.0-3.el10_2.1
0:1.68.0-3.el10_2.2

Open the chart page →

2,043
minioopenobserve5.0.72 of 2See more

minio openobserve 5.0.7

2 of the 2 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
quay.io/minio/mc:RELEASE.2023-01-28T20-29-38Zad34abeba912
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3
quay.io/minio/minio:RELEASE.2023-02-10T18-48-39Za0a002cb113c
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3

Open the chart page →

7,457
akeyless-api-gatewayopenshift1.41.21 of 1See more

akeyless-api-gateway openshift 1.41.2

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
akeyless/base-rhel:0.0.14ba8900a0061
nghttp2@1.33.0-5.el8_9
0:1.33.0-6.el8_10.3

Open the chart page →

11,795
alquimia-studioopenshift0.2.01 of 1See more

alquimia-studio openshift 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
alquimiaai/studio:certification38a1f0341982
nghttp2@1.43.0-6.el9
0:1.43.0-6.el9_8.2

Open the chart page →

2,386
bpjstk-serviceopenshift1.0.03 of 6See more

bpjstk-service openshift 1.0.0

3 of the 6 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
andrianrf/backoffice:latest047a7837651e
nghttp2@1.33.0-6.el8_10.1
0:1.33.0-6.el8_10.3
andrianrf/backoffice-be:latest6036614803d4
nghttp2@1.43.0-5.el9
0:1.43.0-6.el9_8.2
andrianrf/iso-server:latest7da47f525c7d
nghttp2@1.43.0-5.el9
0:1.43.0-6.el9_8.2

Open the chart page →

34,721
canvas-oamportalopenshift4.0.01 of 1See more

canvas-oamportal openshift 4.0.0

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
gurolakman/oam:4.0.0ed8fd2062548
nghttp2@1.33.0-6.el8_10.1
0:1.33.0-6.el8_10.3

Open the chart page →

7,519
chatbot-ai-sampleopenshift0.1.62 of 4See more

chatbot-ai-sample openshift 0.1.6

2 of the 4 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
quay.io/ai-lab/llamacpp_python:latest70d138997acd
nghttp2@1.43.0-5.el9_4.3
0:1.43.0-6.el9_8.2
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
nghttp2@1.43.0-5.el9_3.1
0:1.43.0-6.el9_8.2

Open the chart page →

18,991
dify-enterpriseopenshift3.9.810 of 13See more

dify-enterprise openshift 3.9.8

10 of the 13 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
langgenius/dify-ee-audit:3.9.8-ubi9e99aed151fc5
nghttp2@1.43.0-6.el9_8.1
0:1.43.0-6.el9_8.2
langgenius/dify-ee-collector:3.9.8-ubi9a9b91fd62c94
nghttp2@1.43.0-6.el9_8.1
0:1.43.0-6.el9_8.2
langgenius/dify-ee-enterprise:3.9.8-ubi9c392a36a4ef7
nghttp2@1.43.0-6.el9_8.1
0:1.43.0-6.el9_8.2
langgenius/dify-ee-enterprise-frontend:3.9.8-ubi98dd9de6b6190
nghttp2@1.43.0-6.el9_8.1
0:1.43.0-6.el9_8.2
langgenius/dify-ee-gateway:3.9.8-ubi99e314c29a61f
nghttp2@1.43.0-6.el9_8.1
0:1.43.0-6.el9_8.2
langgenius/dify-ee-plugin-connector:3.9.8-ubi91848d8f1f144
nghttp2@1.43.0-6.el9_8.1
0:1.43.0-6.el9_8.2
langgenius/dify-ee-plugin-crd:3.9.8-ubi96f4e0e5f6e5a
nghttp2@1.43.0-6.el9_8.1
0:1.43.0-6.el9_8.2
langgenius/dify-ee-plugin-daemon-serverless:3.9.8-ubi9d2b8df196d08
nghttp2@1.43.0-6.el9_8.1
0:1.43.0-6.el9_8.2
langgenius/dify-ee-plugin-manager:3.9.8-ubi9207b343013a0
nghttp2@1.43.0-6.el9_8.1
0:1.43.0-6.el9_8.2
langgenius/dify-ee-web:3.9.8-ubi9ba1dd1d0bcea
nghttp2@1.43.0-6.el9_8.1
0:1.43.0-6.el9_8.2

Open the chart page →

4,846
exporteropenshift1.0.473 of 3See more

exporter openshift 1.0.47

3 of the 3 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
public.ecr.aws/perfectscale-io/kube-state-metrics:4.1.14-redhat849e235e2d3e
nghttp2@1.33.0-6.el8_10.1
0:1.33.0-6.el8_10.3
public.ecr.aws/perfectscale-io/psc-exporter:v1.0.45-redhat9083e60c38bc
nghttp2@1.43.0-6.el9
0:1.43.0-6.el9_8.2
public.ecr.aws/perfectscale-io/ubi9/ubi:9.5d7c3def9252b
nghttp2@1.43.0-6.el9
0:1.43.0-6.el9_8.2

Open the chart page →

13,034
fineractopenshift0.1.11 of 4See more

fineract openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
nghttp2@1.64.0-1.1+deb13u1
no fix listed

Open the chart page →

7,848
flomesh-consoleopenshift0.70.0-30-ubi82 of 2See more

flomesh-console openshift 0.70.0-30-ubi8

2 of the 2 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3
quay.io/flomesh/pipy-repo-ubi8:0.70.0-469912fdf6c183
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3

Open the chart page →

9,968
fsmopenshift0.1.8-ubi.66 of 6See more

fsm openshift 0.1.8-ubi.6

6 of the 6 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
quay.io/flomesh/curl-ubi8:7.84.0bef31fa5f5f3
nghttp2@1.33.0-5.el8_9
0:1.33.0-6.el8_10.3
quay.io/flomesh/fsm-bootstrap-ubi8:0.1.8-ubi.6e6d7afb1a4bf
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3
quay.io/flomesh/fsm-ingress-pipy-ubi8:0.1.8-ubi.6fce990dece01
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3
quay.io/flomesh/fsm-manager-ubi8:0.1.8-ubi.63590af73f65a
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3
quay.io/flomesh/pipy-ubi8:0.50.0-8824352dca6672
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3
quay.io/flomesh/toolbox-ubi8:1.2.01f5e3161cb84
nghttp2@1.33.0-5.el8_9
0:1.33.0-6.el8_10.3

Open the chart page →

16,554
harikubeopenshift0.16.31 of 3See more

harikube openshift 0.16.3

1 of the 3 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
nghttp2@1.43.0-6.el9_8.1
0:1.43.0-6.el9_8.2

Open the chart page →

2,543
kb-cloud-installeropenshift2.1.351 of 1See more

kb-cloud-installer openshift 2.1.35

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
nghttp2@1.43.0-6.el9
0:1.43.0-6.el9_8.2

Open the chart page →

4,145
kite-agentopenshift1.0.01 of 1See more

kite-agent openshift 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
quay.io/fengyuanxing/zte_endogenous_security/kite-agent:V2.0.0734808044936
nghttp2@1.33.0-6.el8_10.2
0:1.33.0-6.el8_10.3

Open the chart page →

5,863
orion-ldopenshift1.0.32 of 2See more

orion-ld openshift 1.0.3

2 of the 2 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
quay.io/fiware/orion-ld:1.0.1ea838e5b4051
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3
quay.io/opencloudio/ibm-mongodb:4.0.24d8c631a6dc43
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3

Open the chart page →

14,727
osm-edgeopenshift1.2.1-ubi87 of 7See more

osm-edge openshift 1.2.1-ubi8

7 of the 7 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
quay.io/flomesh/curl-ubi8:7.84.0bef31fa5f5f3
nghttp2@1.33.0-5.el8_9
0:1.33.0-6.el8_10.3
quay.io/flomesh/osm-edge-bootstrap-ubi8:1.2.1e048bc7a17c2
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3
quay.io/flomesh/osm-edge-controller-ubi8:1.2.1674f45865af1
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3
quay.io/flomesh/osm-edge-crds-ubi8:1.2.1c3bc5e7a70e6
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3
quay.io/flomesh/osm-edge-injector-ubi8:1.2.18e9c39c34e89
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3
quay.io/flomesh/osm-edge-preinstall-ubi8:1.2.1f94282a9cfec
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3
quay.io/flomesh/pipy-ubi8:0.70.0-4635d87a381432
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3

Open the chart page →

19,449
redhat-trusted-application-pipelineopenshift1.0.21 of 2See more

redhat-trusted-application-pipeline openshift 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
nghttp2@1.43.0-5.el9
0:1.43.0-6.el9_8.2

Open the chart page →

8,634
smsf-configurationopenshift1.0.41 of 1See more

smsf-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
gurolakman/smsf-configuration:1.0.49abb3882bcbd
nghttp2@1.33.0-5.el8_9
0:1.33.0-6.el8_10.3

Open the chart page →

13,608
smsf-dispatcheropenshift1.0.41 of 1See more

smsf-dispatcher openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
gurolakman/smsf-dispatcher:1.0.46537e8ed8de8
nghttp2@1.33.0-5.el8_9
0:1.33.0-6.el8_10.3

Open the chart page →

11,740
smsf-momtopenshift1.0.41 of 1See more

smsf-momt openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
gurolakman/smsf-momt:1.0.4ce23b20a8a17
nghttp2@1.33.0-5.el8_9
0:1.33.0-6.el8_10.3

Open the chart page →

13,570
smsf-registrationopenshift1.0.41 of 1See more

smsf-registration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
gurolakman/smsf-registration:1.0.4b22e746edd5d
nghttp2@1.33.0-5.el8_9
0:1.33.0-6.el8_10.3

Open the chart page →

13,553
ussigw-configurationopenshift1.0.41 of 1See more

ussigw-configuration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
gurolakman/ussigw-configuration:1.0.4bf18525c5ad9
nghttp2@1.33.0-5.el8_9
0:1.33.0-6.el8_10.3

Open the chart page →

13,457
ussigw-coreopenshift1.0.41 of 1See more

ussigw-core openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
gurolakman/ussigw-core:1.0.48739565c3ea2
nghttp2@1.33.0-5.el8_9
0:1.33.0-6.el8_10.3

Open the chart page →

13,101
openshift-integration-operatoropenshift-integration-operatorVerified publisher0.8.21 of 2See more

openshift-integration-operator openshift-integration-operator 0.8.2

1 of the 2 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/openshift-integration-operator:v0.8.2d6fc43ac802e
nghttp2@1.43.0-6.el9
0:1.43.0-6.el9_8.2

Open the chart page →

2,063
open-vpnopenvpn0.0.11 of 1See more

open-vpn openvpn 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/openvpn-as:version-2.8.6-916f8e7d-ubuntu184ee0764310e7
nghttp2@1.30.0-1ubuntu1
no fix listed

Open the chart page →

15,607
openwhiskopenwhisk1.0.01 of 10See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
openwhisk/ow-utils:1.0.0c80dba0de3aa
nghttp2@1.30.0-1ubuntu1
no fix listed

Open the chart page →

36,230
opslevelopslevelVerified publisher2025.1.222 of 10See more

opslevel opslevel 2025.1.22

2 of the 10 container images this version deploys carry CVE-2026-58055.

Container imageDigestPackageFixed in
minio/mc:RELEASE.2023-02-28T00-12-59Zc631532a394e
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3
replicated/replicated-sdk:1.0.0-beta.318751b4963250
nghttp2@1.63.0-r0
1.70.0-r0

Open the chart page →

5,609

Container images carrying it

1,610 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
library/nginx:1.31:1.31.5:latest:trixie05b8cb60c354
nghttp2@1.64.0-1.1+deb13u1
no fix listed
106
dellcloud/pages:monitor6ba7b22caacd
nghttp2@1.40.0-1build1
no fix listed
79
flyway/flyway:6.4.422d97ceb0c47
nghttp2@1.30.0-1ubuntu1
no fix listed
79
library/nginx:stabled5792f71a949
nghttp2@1.64.0-1.1+deb13u1
no fix listed
23
jenkins/jenkins:2.568.3-jdk21:2.568.3-lts-jdk21:ltsc1e4c349365f
nghttp2@1.64.0-1.1+deb13u1
no fix listed
13
codeurjc/weatherservice:v1.0b9e2f7234349
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3
10
library/mongo:5.0.6-focal8e70544b6c76
nghttp2@1.40.0-1build1
no fix listed
10
codeurjc/server:v1.0310bea5b1ee7
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3
8
jellyfin/jellyfin:10.11:10.11.11:latestaefb67e6a7ff
nghttp2@1.64.0-1.1+deb13u1
no fix listed
7
library/kong:3.6a42d2b4503e7
nghttp2@1.43.0-1ubuntu0.2
1.43.0-1ubuntu0.4
7
library/phpmyadmin:5.2.3-apache:latest3a8a8d6b5289
nghttp2@1.64.0-1.1+deb13u1
no fix listed
7
vaultwarden/server:1.37.2:latest094b5689ed81
nghttp2@1.64.0-1.1+deb13u1
no fix listed
7
ghcr.io/appscode/b3:v2026.9.1176d28575b71c
nghttp2@1.52.0-1+deb12u3
no fix listed
7
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
nghttp2@1.64.0-1.1+deb13u1
no fix listed
7
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2:8.2.2-1-ubi98e01c0305844
nghttp2@1.43.0-6.el9_8.1
0:1.43.0-6.el9_8.2
7
bitnamilegacy/rabbitmq:4.1.3:4.1.3-debian-12-r19e635efba431
nghttp2@1.52.0-1+deb12u2
no fix listed
6
library/wordpress:7.1.0-apache:latest5a93c470ae82
nghttp2@1.64.0-1.1+deb13u1
no fix listed
6
quay.io/devtron/devtron-utils:dup-chart-repo-v1.1.095d6f0e05636
nghttp2@1.52.0-1
no fix listed
6
bitnamilegacy/kubectl:1.29.2c74b703deed2
nghttp2@1.52.0-1+deb12u1
no fix listed
5
flaresolverr/flaresolverr:latest:v3.5.0139dfee1c6f8
nghttp2@1.52.0-1+deb12u3
no fix listed
5
library/httpd:2.4:2.4.68:latest979c38c2228d
nghttp2@1.64.0-1.1+deb13u1
no fix listed
5
library/mongo:4.44be76f674fc4
nghttp2@1.40.0-1ubuntu0.3
no fix listed
5
bitnamilegacy/rabbitmq:4.1.2:4.1.2-debian-12-r1fac502149c40
nghttp2@1.52.0-1+deb12u2
no fix listed
4
jaegertracing/jaeger-cassandra-schema:1.53.0d48d6dab2c65
nghttp2@1.43.0-1ubuntu0.1
1.43.0-1ubuntu0.4
4
library/mongo:5.0-focal5e15a3f014ed
nghttp2@1.40.0-1ubuntu0.3
no fix listed
4
library/mongo:4.2.12-bionic628741415fc9
nghttp2@1.30.0-1ubuntu1
no fix listed
4
library/mongo:4.4.66efa05203990
nghttp2@1.30.0-1ubuntu1
no fix listed
4
library/nginx:1.27.1287ff321f9e3
nghttp2@1.52.0-1+deb12u1
no fix listed
4
mastercloudapps/planner:v1.2340a950b311b2
nghttp2@1.43.0-1build3
1.43.0-1ubuntu0.4
4
mastercloudapps/server:v2.23f3d24dfe2686
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3
4
mastercloudapps/weatherservice:v1.23de859d29c116
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3
4
oscarsotosanchez/weatherservice:v1.0911ec961d10b
nghttp2@1.30.0-1ubuntu1
no fix listed
4
rancher/rancher:v2.15.15f6c4dc52a05
nghttp2@1.64.0-150700.3.3.1
1.64.0-150700.3.6.1
4
quay.io/strimzi/operator:0.37.052f376e64b9b
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3
4
apache/superset:6.1.0:latest16b50bbef664
nghttp2@1.52.0-1+deb12u3
no fix listed
3
bitnamilegacy/kubectl:latestcd354d5b2556
nghttp2@1.52.0-1+deb12u2
no fix listed
3
bitnamilegacy/os-shell:12-debian-12-r5177e65e9d633e
nghttp2@1.52.0-1+deb12u2
no fix listed
3
cloudve/cloudlaunch-server:latest4a3d7fae90bb
nghttp2@1.40.0-1build1
no fix listed
3
cockroachdb/cockroach-self-signer-cert:1.1007a49acec18d
nghttp2@1.33.0-6.el8_10.2
0:1.33.0-6.el8_10.3
3
codeurjc/planner:v1.0800cf520c245
nghttp2@1.43.0-1build3
1.43.0-1ubuntu0.4
3
dgraph/dgraph:v21.12.03b55ea83fffe
nghttp2@1.40.0-1build1
no fix listed
3
dnationcloud/kubernetes-jsonnet-translator:2.0.178fed4f3c130
nghttp2@1.52.0-1+deb12u3
no fix listed
3
fluent/fluent-bit:5.1.2:latestd792375ca8e5
nghttp2@1.64.0-1.1+deb13u1
no fix listed
3
gchq/hdfs:3.3.35ec58edbb2db
nghttp2@1.59.0-1ubuntu0.2
1.59.0-1ubuntu0.4
3
guacamole/guacamole:1.6.0f344085e618b
nghttp2@1.59.0-1ubuntu0.2
1.59.0-1ubuntu0.4
3
jacobalberty/unifi:v10.0.162896c0ab82d33
nghttp2@1.40.0-1ubuntu0.3
no fix listed
3
library/nginx:1.25:1.25.5a484819eb602
nghttp2@1.52.0-1+deb12u1
no fix listed
3
library/node:ltsbe23f54a88d3
nghttp2@1.52.0-1+deb12u3
no fix listed
3
minio/minio:RELEASE.2021-02-14T04-01-33Zbd11edda91f3
nghttp2@1.33.0-3.el8_2.1
0:1.33.0-6.el8_10.3
3
selenium/hub:3.141.5902f251d48d5f
nghttp2@1.40.0-1build1
no fix listed
3

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.