StackRadar

CVE-2026-75596

Medium

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.004
28th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
562
of 17,787 indexed, latest versions
Container images
631
deployed by those charts
Fix available
1 of 1
affected package

Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing

Carried by container images the latest versions of 562 of 17,787 indexed charts deploy, on 631 images.

Affected packageAffected versionsFixed inImages
netty-handlermaven4.0.23.Final, 4.0.27.Final, 4.0.36.Final, 4.0.37.Final+102 more4.1.137.Final, 4.2.17.Final631
OSV records
GHSA-fccg-mwvh-qqg4
Trending
Rank 13 in indexed charts, since 9 Sept 2026. See the ranking →

Charts affected

562 by stars
ChartLatestAffected imagesRadar Score
opendistro-eslsst-sqre1.4.11 of 3See more

opendistro-es lsst-sqre 1.4.1

1 of the 3 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch:1.4.06df71eb04639
netty-handler@4.1.38.Final
4.1.137.Final

Open the chart page →

7,929
elastictranscoderluiscajl0.46.01 of 4See more

elastictranscoder luiscajl 0.46.0

1 of the 4 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
elastictranscoder/media-storage:f6d861a026208b8c2359
netty-handler@4.1.65.Final
4.1.137.Final

Open the chart page →

58,160
torznab-atomohdluiscajl0.0.31 of 1See more

torznab-atomohd luiscajl 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
lavandadelpatio/torznab-atomohd:latest214eaef5444c
netty-handler@4.1.90.Final
4.1.137.Final

Open the chart page →

3,290
eoloplantmca-eoloplaner0.1.02 of 7See more

eoloplant mca-eoloplaner 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
hugohg34/planner:0.0.2171f61e8d7e2
netty-handler@4.1.70.Final
4.1.137.Final
hugohg34/toposervice:0.0.2812a03b3f274
netty-handler@4.1.70.Final
4.1.137.Final

Open the chart page →

29,588
metabase-k8smetabase-k8s1.0.01 of 1See more

metabase-k8s metabase-k8s 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
metabase/metabase:v0.53.4.17807bc5cad17
netty-handler@4.1.116.Final
4.1.137.Final

Open the chart page →

2,589
elasticmicroboxlabs0.3.01 of 1See more

elastic microboxlabs 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
library/elasticsearch:8.17.32cc40b15dff8
netty-handler@4.1.118.Final
4.1.137.Final

Open the chart page →

4,257
miot-calendarmicroboxlabs0.1.01 of 1See more

miot-calendar microboxlabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-calendar:latest-jvm7157cdc0bf5b
netty-handler@4.1.130.Final
4.1.137.Final

Open the chart page →

1,937
miot-modulithmicroboxlabs0.6.01 of 1See more

miot-modulith microboxlabs 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-srv:latest5796553b41ae
netty-handler@4.1.136.Final
4.1.137.Final

Open the chart page →

1,414
modulariotmicroboxlabs0.9.01 of 4See more

modulariot microboxlabs 0.9.0

1 of the 4 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-srv:latest4ec11d229028
netty-handler@4.1.136.Final
4.1.137.Final

Open the chart page →

2,256
microcks-operatormicrocksVerified publisher0.0.111 of 1See more

microcks-operator microcks 0.0.11

1 of the 1 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
quay.io/microcks/microcks-operator:0.0.1196d1054d4a61
netty-handler@4.1.128.Final
4.1.137.Final

Open the chart page →

1,261
resource-processormicroservices-learningVerified publisher1.2.01 of 1See more

resource-processor microservices-learning 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
maksimkavalenka/microservices-learning.resource-processor:latest64a25afb8748
netty-handler@4.1.97.Final
4.1.137.Final

Open the chart page →

3,683
resource-servicemicroservices-learningVerified publisher1.5.01 of 2See more

resource-service microservices-learning 1.5.0

1 of the 2 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
maksimkavalenka/microservices-learning.resource-service:latest13ad9bb170a0
netty-handler@4.1.97.Final
4.1.137.Final

Open the chart page →

5,129
song-servicemicroservices-learningVerified publisher1.2.01 of 2See more

song-service microservices-learning 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
maksimkavalenka/microservices-learning.song-service:latest2bcdac368b07
netty-handler@4.1.97.Final
4.1.137.Final

Open the chart page →

4,599
pulsarv2milvus-helm2.7.81 of 4See more

pulsarv2 milvus-helm 2.7.8

1 of the 4 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
netty-handler@4.1.24.Final
4.1.137.Final

Open the chart page →

15,855
aws-api-gateway-operatormintel0.1.21 of 11See more

aws-api-gateway-operator mintel 0.1.2

1 of the 11 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
opensearchproject/opensearch:1.1.0967d7f57f72f
netty-handler@4.1.59.Final
4.1.137.Final

Open the chart page →

10,603
standard-application-stackmintel11.4.11See more

standard-application-stack mintel 11.4.1

1 container image this version deploys carries CVE-2026-75596.

Container imageDigestPackageFixed in
opensearchproject/opensearch:1.1.0967d7f57f72f
netty-handler@4.1.59.Final
4.1.137.Final

Open the chart page →

—
mitre-siphonmitre-siphon0.2.91 of 4See more

mitre-siphon mitre-siphon 0.2.9

1 of the 4 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
ghcr.io/curium-rocks/mitre-siphon:main503c00321502
netty-handler@4.1.92.Final
4.1.137.Final

Open the chart page →

3,083
account-lookup-servicemojaloop13.0.01 of 4See more

account-lookup-service mojaloop 13.0.0

1 of the 4 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
solsson/kafka:latest41e5d8f6f290
netty-handler@4.1.78.Final
4.1.137.Final

Open the chart page →

11,695
account-lookup-service-adminmojaloop13.0.01 of 4See more

account-lookup-service-admin mojaloop 13.0.0

1 of the 4 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
solsson/kafka:latest41e5d8f6f290
netty-handler@4.1.78.Final
4.1.137.Final

Open the chart page →

11,695
admin-api-svcmojaloop12.0.01 of 4See more

admin-api-svc mojaloop 12.0.0

1 of the 4 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
solsson/kafka:latest41e5d8f6f290
netty-handler@4.1.78.Final
4.1.137.Final

Open the chart page →

12,108
backendmojaloop0.1.02 of 6See more

backend mojaloop 0.1.0

2 of the 6 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
bitnamilegacy/kafka:2.8.1-debian-11-r7b6e381ffd6ae
netty-handler@4.1.62.Final
4.1.137.Final
bitnamilegacy/zookeeper:3.7.2-debian-11-r5cbf54314c401
netty-handler@4.1.94.Final
4.1.137.Final

Open the chart page →

16,198
fspiop-transfer-api-svcmojaloop12.0.11 of 3See more

fspiop-transfer-api-svc mojaloop 12.0.1

1 of the 3 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
solsson/kafka:latest41e5d8f6f290
netty-handler@4.1.78.Final
4.1.137.Final

Open the chart page →

11,479
mojaloopmojaloop14.0.01 of 6See more

mojaloop mojaloop 14.0.0

1 of the 6 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
solsson/kafka:latest41e5d8f6f290
netty-handler@4.1.78.Final
4.1.137.Final

Open the chart page →

19,226
user-manager-neo4jmoreillonVerified publisher0.9.71 of 6See more

user-manager-neo4j moreillon 0.9.7

1 of the 6 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
library/neo4j:5.20.052d3dec8d455
netty-handler@4.1.109.Final
4.1.137.Final

Open the chart page →

30,363
chirpstackmosquitto-helm-chart0.5.01 of 8See more

chirpstack mosquitto-helm-chart 0.5.0

1 of the 8 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.9.0d056c89b7131
netty-handler@4.1.68.Final
4.1.137.Final

Open the chart page →

25,933
pulsarmosquitto-helm-chart0.2.01 of 1See more

pulsar mosquitto-helm-chart 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.10.03b262ab7a7d9
netty-handler@4.1.74.Final
4.1.137.Final

Open the chart page →

15,675
commafeedmt1905028.2.01 of 3See more

commafeed mt190502 8.2.0

1 of the 3 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
athou/commafeed:6.2.0-postgresql5e388351df1a
netty-handler@4.1.130.Final
4.1.137.Final

Open the chart page →

3,687
keycloakmt1905021.4.61 of 3See more

keycloak mt190502 1.4.6

1 of the 3 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.5.68d44614c7479
netty-handler@4.1.130.Final
4.1.137.Final

Open the chart page →

2,901
my-app-namemy-app-name0.0.21 of 1See more

my-app-name my-app-name 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
viniciusfcf/gitops-quarkus-app-jvm:latestbba8ee1b5cd5
netty-handler@4.1.79.Final
4.1.137.Final

Open the chart page →

9,149
elasticsearch-chartmy-elasticsearch0.1.01 of 2See more

elasticsearch-chart my-elasticsearch 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
library/elasticsearch:7.17.35e6ac15bf6a5
netty-handler@4.1.66.Final
4.1.137.Final

Open the chart page →

9,300
Practica_4_helmmy-heml-appVerified publisher0.1.03 of 7See more

Practica_4_helm my-heml-app 0.1.0

3 of the 7 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
adagber/planner:v1.0e5c1ed097752
netty-handler@4.1.42.Final
4.1.137.Final
codeurjc/server:v1.0310bea5b1ee7
netty-handler@4.1.82.Final
4.1.137.Final
codeurjc/toposervice:v1.09fb4c11e6a49
netty-handler@4.1.85.Final
4.1.137.Final

Open the chart page →

27,721
incorencsaVerified publisher1.38.01 of 29See more

incore ncsa 1.38.0

1 of the 29 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
bitnamilegacy/keycloak:24.0.4cc599cbd15ff
netty-handler@4.1.108.Final
4.1.137.Final

Open the chart page →

15,369
neo4jneo4j-helm-old4.3.2-11 of 1See more

neo4j neo4j-helm-old 4.3.2-1

1 of the 1 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
library/neo4j:4.3.2-enterprise56a9453c4064
netty-handler@4.1.63.Final
4.1.137.Final

Open the chart page →

2,640
neuralbank-stackneuralbank-stack0.1.01 of 4See more

neuralbank-stack neuralbank-stack 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/neuralbank-backend:latesta53899fcfc01
netty-handler@4.1.127.Final
4.1.137.Final

Open the chart page →

5,191
kafka-helm-chartnotesprojectchart0.1.01 of 1See more

kafka-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
netty-handler@4.1.62.Final
4.1.137.Final

Open the chart page →

4,547
logic-ms-helm-chartnotesprojectchart0.1.01 of 2See more

logic-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
vlebediantsev/logic-ms:latestdf8bf38c535b
netty-handler@4.1.78.Final
4.1.137.Final

Open the chart page →

6,852
my-bloody-jenkinsodavid0.1.2181 of 1See more

my-bloody-jenkins odavid 0.1.218

1 of the 1 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
odavid/my-bloody-jenkins:2.462.3-306e7ab3bbc948e
netty-handler@4.1.100.Final
4.1.137.Final

Open the chart page →

5,826
ojp-serverojp0.1.51 of 1See more

ojp-server ojp 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
rrobetti/ojp:0.1.0-beta1141bd88232b
netty-handler@4.1.110.Final
4.1.137.Final

Open the chart page →

2,587
hive-metastoreolehrgfVerified publisher0.1.01 of 1See more

hive-metastore olehrgf 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
ghcr.io/melodyyangaws/hive-metastore:3.0.0e949b0f733f0
netty-handler@4.1.61.Final
4.1.137.Final

Open the chart page →

8,540
pulsarolehrgfVerified publisher0.0.51 of 2See more

pulsar olehrgf 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
apachepulsar/pulsar:3.1.016f9fdab3fa6
netty-handler@4.1.94.Final
4.1.137.Final

Open the chart page →

9,005
apicurioone-acre-fundVerified publisher2.3.03 of 5See more

apicurio one-acre-fund 2.3.0

3 of the 5 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
apicurio/apicurio-studio-api:0.2.62.Final302d202ed149
netty-handler@4.1.86.Final
4.1.137.Final
apicurio/apicurio-studio-ui:0.2.62.Final349c845270c2
netty-handler@4.1.86.Final
4.1.137.Final
apicurio/apicurio-studio-ws:0.2.62.Final27a91978a388
netty-handler@4.1.86.Final
4.1.137.Final

Open the chart page →

18,667
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
vespaengine/vespa:8.526.1569b160f58211
netty-handler@4.1.118.Final
4.1.137.Final

Open the chart page →

6,338
raspberrymaticopenccuVerified publisher3.83.61 of 1See more

raspberrymatic openccu 3.83.6

1 of the 1 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
ghcr.io/jens-maus/raspberrymatic:3.83.6.202508244b22b4f407c4
netty-handler@4.1.67.Final
4.1.137.Final

Open the chart page →

2,421
mockserveropen-charts1.1.01 of 1See more

mockserver open-charts 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
mockserver/mockserver:5.15.00f9ef78c9489
netty-handler@4.1.86.Final
4.1.137.Final

Open the chart page →

1,257
cdn-remoteopencord0.2.41 of 3See more

cdn-remote opencord 0.2.4

1 of the 3 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
omecproject/cdn-antmedia:1.0.0b4ae7d0d6b74
netty-handler@4.1.19.Final
4.1.137.Final

Open the chart page →

63,223
comacopencord1.0.01 of 9See more

comac opencord 1.0.0

1 of the 9 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
omecproject/onos-progran:1.0.05715e5648aa0
netty-handler@4.0.36.Final
4.1.137.Final

Open the chart page →

88,546
onosopencord3.0.21 of 1See more

onos opencord 3.0.2

1 of the 1 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
onosproject/onos:2.2.144914a8d4b3f
netty-handler@4.1.35.Final
4.1.137.Final

Open the chart page →

12,927
onos-progranopencord1.2.71 of 2See more

onos-progran opencord 1.2.7

1 of the 2 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
muluder/prograncontrollermcord:0.1.843b597a93da7
netty-handler@4.0.23.Final
4.1.137.Final

Open the chart page →

38,865
voltha-infraopencord2.14.02 of 10See more

voltha-infra opencord 2.14.0

2 of the 10 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
atomix/atomix:3.1.127738ff4f5c63
netty-handler@4.1.27.Final
4.1.137.Final
voltha/voltha-onos:5.1.8e038acb950d3
netty-handler@4.1.35.Final
4.1.137.Final

Open the chart page →

41,044
sentinelopennms-helm-chartsVerified publisher0.4.01 of 2See more

sentinel opennms-helm-charts 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-75596.

Container imageDigestPackageFixed in
opennms/sentinel:36.0.288869082a14f
netty-handler@4.2.15.Final
4.2.17.Final

Open the chart page →

2,024

Container images carrying it

631 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/fiware/trusted-issuers-registry:0.11.1a8a9ec461034
netty-handler@4.1.89.Final
4.1.137.Final
1
quay.io/keycloak/keycloak:26.009a381c715ab
netty-handler@4.1.111.Final
4.1.137.Final
1
quay.io/keycloak/keycloak:26.60aae0de7fca8
netty-handler@4.1.135.Final
4.1.137.Final
1
quay.io/keycloak/keycloak:26.0.74388e2379b7e
netty-handler@4.1.111.Final
4.1.137.Final
1
quay.io/keycloak/keycloak:24.0.34d6f22991266
netty-handler@4.1.107.Final
4.1.137.Final
1
quay.io/keycloak/keycloak:23.0.34f72a5b0c076
netty-handler@4.1.100.Final
4.1.137.Final
1
quay.io/keycloak/keycloak:26.3.36a7217a100bd
netty-handler@4.1.124.Final
4.1.137.Final
1
quay.io/keycloak/keycloak:20.0.18830f76112b6
netty-handler@4.1.82.Final
4.1.137.Final
1
quay.io/keycloak/keycloak:26.5.68d44614c7479
netty-handler@4.1.130.Final
4.1.137.Final
1
quay.io/keycloak/keycloak:26.49409c59bdfb6
netty-handler@4.1.128.Final
4.1.137.Final
1
quay.io/keycloak/keycloak:26.6.39b0330756022
netty-handler@4.1.133.Final
4.1.137.Final
1
quay.io/keycloak/keycloak:26.7.29d1f1b2b7261
netty-handler@4.1.136.Final
4.1.137.Final
1
quay.io/keycloak/keycloak:26.0.6a93d22e13b86
netty-handler@4.1.111.Final
4.1.137.Final
1
quay.io/keycloak/keycloak:20.0.3b8f2a453a17a
netty-handler@4.1.82.Final
4.1.137.Final
1
quay.io/keycloak/keycloak-operator:26.7.268b1e5805b99
netty-handler@4.1.136.Final
4.1.137.Final
1
quay.io/keycloak/keycloak-operator:20.0.2b1710745fa64
netty-handler@4.1.82.Final
4.1.137.Final
1
quay.io/maximilianopizarro/custom-rhcl-console:dns-prober-v0.1.21a592ee6651a
netty-handler@4.1.132.Final
4.1.137.Final
1
quay.io/maximilianopizarro/neuralbank-backend:latesta53899fcfc01
netty-handler@4.1.127.Final
4.1.137.Final
1
quay.io/maximilianopizarro/openshift-integration-operator:v0.8.2d6fc43ac802e
netty-handler@4.1.133.Final
4.1.137.Final
1
quay.io/maximilianopizarro/showroom-docs-mcp:latest1a6eff92827a
netty-handler@4.1.130.Final
4.1.137.Final
1
quay.io/microcks/microcks-operator:0.0.1196d1054d4a61
netty-handler@4.1.128.Final
4.1.137.Final
1
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
netty-handler@4.1.94.Final
4.1.137.Final
1
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
netty-handler@4.1.105.Final
4.1.137.Final
1
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
netty-handler@4.1.105.Final
4.1.137.Final
1
quay.io/poundex/tekton-ci-environment-injector:0.2.46dd65f22949c
netty-handler@4.2.15.Final
4.2.17.Final
1
quay.io/poundex/tekton-stash-and-cache:0.2.2e854423caa09
netty-handler@4.2.15.Final
4.2.17.Final
1
quay.io/seamware/consent-facade:0.0.14be844c750c7e
netty-handler@4.1.115.Final
4.1.137.Final
1
quay.io/strimzi/operator:0.45.158c727cd2e68
netty-handler@4.1.118.Final
4.1.137.Final
1
quay.io/strimzi/operator:0.36.1e9e03b31007c
netty-handler@4.1.94.Final
4.1.137.Final
1
quay.io/wi_stefan/dss-validation-service:0.0.18e928db29ee1
netty-handler@4.1.115.Final
4.1.137.Final
1
registry.gitlab.com/lenitech/docker/keycloak:26.7.3-0297e9df1489d
netty-handler@4.1.136.Final
4.1.137.Final
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.