CVE-2026-60589
LowAdvisory
Published 18 Aug 2026In the index since 5 Sept 2026
- Severity
- Low
- worst across findings
- CVSS
- 3.7
- base score, highest
- EPSS
- 0.003
- 18th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 101
- of 17,781 indexed, latest versions
- Container images
- 92
- deployed by those charts
- Fix available
- 5 of 8
- affected packages
The matching OSV records carry no description.
Carried by container images the latest versions of 101 of 17,781 indexed charts deploy, on 92 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| openjdk-8deb | 8u151-b12-0ubuntu0.16.04.2, 8u171-b11-0ubuntu0.16.04.1, 8u191-b12-2ubuntu0.16.04.1, 8u212-b03-0ubuntu1.18.04.1+12 more | no fix listed | 23 |
| openjdk-17deb | 17.0.3+7-0ubuntu0.20.04.1, 17.0.8+7-1~22.04, 17.0.9+9-1~20.04, 17.0.10+7-1~22.04.1+14 more | 17.0.20.1+1-1~deb12u1 | 22 |
| openjdk-ltsdeb | 11.0.3+7-1ubuntu2~18.04.1, 11.0.8+10-0ubuntu1~18.04.1, 11.0.11+9-0ubuntu2~20.04, 11.0.13+8-0ubuntu1~20.04+7 more | no fix listed | 17 |
| javabitnami | 11.0.15-150, 11.0.18-10-1, 11.0.18-10-2, 11.0.20-8-3+12 more | 1.8.0 | 16 |
| openjdk-21deb | 21.0.5+11-1ubuntu1~24.04, 21.0.7+6~us1-0ubuntu1~24.04, 21.0.11+10-1~24.04.2, 21.0.11+10-1~26.04.2+3 more | 21.0.12.1+1-1~deb13u1 | 13 |
| Javabitnami | 11.0.20-8, 11.0.21-10, 17.0.8-7, 17.0.10-13-1+2 more | 1.8.0 | 7 |
| jrebitnami | 17.0.16-12-0, 17.0.19-11-2, 21.0.8-12-0, 21.0.9-15-0+1 more | 1.8.0 | 5 |
| openjdk-25deb | 25.0.3+9-2~24.04.2, 25.0.3+9-2~26.04.2, 25.0.4+7-1~26.04 | no fix listed | 3 |
- OSV records
- BIT-java-2026-60589BIT-jre-2026-60589DEBIAN-CVE-2026-60589UBUNTU-CVE-2026-60589
- Also known as
- BIT-java-min-2026-60589
Charts affected
101 by stars
Container images carrying it
92 by charts deploying them
A fixed version is listed for 5 of the 8 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| hyperledger/ | 4ce6f43ded2e | openjdk-8 | no fix listed | 4 |
| hyperledger/ | f6c724592abf | openjdk-8 | no fix listed | 4 |
| gchq/ | 5ec58edbb2db | openjdk-8 | no fix listed | 3 |
| jacobalberty/ | 896c0ab82d33 | openjdk-17 | no fix listed | 3 |
| selenium/ | 02f251d48d5f | openjdk-8 | no fix listed | 3 |
| signoz/ | fcc4a3288154 | java Java | 1.8.0 1.8.0 | 3 |
| apache/ | 0116fb802786 | openjdk-17 | 17.0.20.1+1-1~deb12u1 | 2 |
| apache/ | ae0b86d3c4d0 | openjdk-17 | no fix listed | 2 |
| bitnamilegacy/ | 00176a47afa0 | java | 1.8.0 | 2 |
| bitnamilegacy/ | 10ed1ea3c8d1 | java Java | 1.8.0 1.8.0 | 2 |
| hookiesolutions/ | 0629694246ba | openjdk-lts | no fix listed | 2 |
| hyperledger/ | a674d35eec9a | openjdk-17 | no fix listed | 2 |
| mbentley/ | f4e682274bed | openjdk-8 | no fix listed | 2 |
| nacos/ | 1c191c30c8cd | openjdk-17 | no fix listed | 2 |
| ghcr.io/ | 82d0b161161d | openjdk-21 | no fix listed | 2 |
| ghcr.io/ | f4feb3323a29 | openjdk-21 | no fix listed | 2 |
| 1dev/ | cd5b12fe5471 | openjdk-lts | no fix listed | 1 |
| 5200710/ | 092d3088a5fb | openjdk-8 | no fix listed | 1 |
| anguda/ | c435285fc241 | openjdk-lts | no fix listed | 1 |
| apache/ | 0cef139b6bf1 | openjdk-17 | 17.0.20.1+1-1~deb12u1 | 1 |
| apachepulsar/ | 3b262ab7a7d9 | openjdk-lts | no fix listed | 1 |
| apachepulsar/ | d056c89b7131 | openjdk-lts | no fix listed | 1 |
| apachepulsar/ | d538416d5afe | openjdk-lts | no fix listed | 1 |
| apache/ | 80072bb73dd3 | openjdk-25 | no fix listed | 1 |
| apache/ | 90b7fa1dc018 | openjdk-21 | no fix listed | 1 |
| apache/ | 92d055a84e9e | openjdk-17 | no fix listed | 1 |
| bitnami/ | 9cc4a173c69e | jre | 1.8.0 | 1 |
| bitnamilegacy/ | 2b7a217999a1 | java | 1.8.0 | 1 |
| bitnamilegacy/ | 15d4647fd491 | java Java | 1.8.0 1.8.0 | 1 |
| bitnamilegacy/ | 9cfd2df1294d | java Java | 1.8.0 1.8.0 | 1 |
| bitnamilegacy/ | e6f6ddcce2f1 | java | 1.8.0 | 1 |
| bitnamilegacy/ | 8657bb93a581 | java | 1.8.0 | 1 |
| bitnamilegacy/ | ac64829e45b3 | java | 1.8.0 | 1 |
| bitnamilegacy/ | b6e381ffd6ae | java | 1.8.0 | 1 |
| bitnamilegacy/ | cb04e49e6eb1 | java | 1.8.0 | 1 |
| bitnamilegacy/ | cc599cbd15ff | java Java | 1.8.0 1.8.0 | 1 |
| bitnamilegacy/ | da3df0976a9f | jre | 1.8.0 | 1 |
| bitnamilegacy/ | d8440eb6b290 | java | 1.8.0 | 1 |
| bitnamilegacy/ | cbf54314c401 | java Java | 1.8.0 1.8.0 | 1 |
| bitnamilegacy/ | dba59d740e13 | java | 1.8.0 | 1 |
| bitnami/ | 113674f60814 | jre | 1.8.0 | 1 |
| browserless/ | c81ae5585b47 | openjdk-lts | no fix listed | 1 |
| cheyang/ | 46cc34755493 | openjdk-8 | no fix listed | 1 |
| conductoross/ | 9fba127693e6 | openjdk-21 | 21.0.12.1+1-1~deb13u1 | 1 |
| gchq/ | c460bb587d6d | openjdk-8 | no fix listed | 1 |
| hyperledger/ | c65891b6c237 | openjdk-8 | no fix listed | 1 |
| jacobalberty/ | 4a3616625dda | openjdk-8 | no fix listed | 1 |
| jacobalberty/ | b3edc809a3ff | openjdk-lts | no fix listed | 1 |
| jacobalberty/ | c409924e2463 | openjdk-8 | no fix listed | 1 |
| linuxserver/ | 0ae315a3a456 | openjdk-17 | no fix listed | 1 |