CVE-2026-77420
MediumAdvisory
Published 23 Sept 2026In the index since 24 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.5
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 166
- of 17,837 indexed, latest versions
- Container images
- 146
- deployed by those charts
- Fix available
- 1 of 1
- affected package
JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable
Carried by container images the latest versions of 166 of 17,837 indexed charts deploy, on 146 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| jline-readermaven | 3.8.2, 3.9.0, 3.12.1, 3.13.1+19 more | 3.30.15, 4.3.1 | 146 |
- OSV records
- GHSA-5q95-hrpc-m3w3
- Trending
- Rank 43 in indexed charts, since 24 Sept 2026. See the ranking →
Charts affected
166 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| graylogkong-zVerified publisher | 3.0.34 | 1 of 5See more | 2,663 |
| datahubdatahubVerified publisher | 1.1.4 | 1 of 4See more | 775 |
| milvusmilvus | 4.0.31 | 1 of 5See more | 167,236 |
| akhqakhq | 0.28.0 | 1 of 1See more | 1,683 |
| wazuhwazuh-helm-morgovedVerified publisher | 2.0.7 | 1 of 5See more | 11,655 |
| milvusmilvus-helm | 5.0.28 | 1 of 4See more | 11,312 |
| zookeepercloudpirates-zookeeperVerified publisher | 0.15.0 | 1 of 1See more | 3,058 |
| polarisapache-polarisOfficialVerified publisher | 1.3.0-incubating | 1 of 1See more | 548 |
| druiddruid-helmVerified publisher | 37.0.2 | 1 of 3See more | 3,968 |
| kafkakubelauncherVerified publisher | 0.1.26 | 1 of 1See more | 1,518 |
| sonarqube-ltssonarqubeVerified publisher | 1.0.16+98 | 1 of 4See more | 4,119 |
| kafkakafka | 18.0.1 | 1 of 1See more | 3,520 |
| elasticsearch-clusterwiremindVerified publisher | 4.5.2 | 1 of 2See more | 2,407 |
| hadoopbigdata-chartsVerified publisher | 1.0.1 | 1 of 2See more | 12,328 |
| grayloggraylog2OfficialVerified publisher | 2.0.0 | 1 of 2See more | 1,649 |
| thehivestrangebee-helmOfficialVerified publisher | 1.1.0 | 2 of 7See more | 16,628 |
| wazuhwazuh-helmVerified publisher | 0.0.8 | 1 of 4See more | 6,295 |
| druidwiremindVerified publisher | 1.22.1 | 1 of 3See more | 8,089 |
| seafiledatamateVerified publisher | 0.6.0 | 1 of 6See more | 76,537 |
| openhabhelmforgeVerified publisher | 1.2.0 | 1 of 1See more | 3,813 |
| infrahubinfrahubVerified publisher | 4.33.3 | 1 of 5See more | 10,736 |
| kubernetes-loggingkubernetes-logging | 4.8.0 | 1 of 6See more | 10,771 |
| flinkriskfocus | 0.2.0 | 1 of 1See more | 3,244 |
| sonarqube-dcesonarqubeVerified publisher | 0.1.2+121 | 2 of 5See more | 8,739 |
| opensearchcaptnbpVerified publisher | 3.1.1 | 1 of 2See more | 1,111 |
| flyte-binaryflyte | 2.0.49 | 1 of 4See more | 4,079 |
| hazelcasthazelcastVerified publisher | 5.10.3 | 1 of 2See more | 2,813 |
| infrahub-enterpriseinfrahub-enterpriseVerified publisher | 4.19.3 | 1 of 5See more | 10,840 |
| repoflowrepoflow-helm-public | 0.9.1 | 1 of 8See more | 12,827 |
| kafka-chartsoldevelo-kafka-chart | 32.4.4 | 1 of 1See more | 2,449 |
| thingsboard-clusterthingsboard-cluster-bettaVerified publisher | 0.2.26 | 1 of 6See more | 14,687 |
| icat-k8salba-helm-chartsVerified publisher | 1.1.0 | 2 of 4See more | 4,003 |
| clearml-servingallegroaiVerified publisher | 1.6.2 | 1 of 9See more | 18,832 |
| apache-rangerapache-ranger | 0.1.0 | 1 of 2See more | 7,903 |
| soarv113assist-iot-cybersecurity-monitoring-soar | 0.1.3 | 2 of 5See more | 18,129 |
| kafkacloudpirates-kafkaVerified publisher | 0.1.7 | 1 of 1See more | 572 |
| nifid4nVerified publisher | 2.0.0 | 1 of 5See more | 5,571 |
| data-fairdata354-helmVerified publisher | 1.1.2 | 1 of 12See more | 38,932 |
| dbrepodbrepo | 1.13.3 | 1 of 25See more | 54,244 |
| elasticsearch-dataempathyco | 0.2.0 | 1 of 2See more | 3,729 |
| elasticsearch-masterempathyco | 0.3.0 | 1 of 2See more | 3,729 |
| enavenav-service-architectureVerified publisher | 0.0.7 | 1 of 10See more | 12,729 |
| gentrace-self-hostedgentrace-self-hostedVerified publisher | 0.1.3 | 1 of 9See more | 14,753 |
| hazelcast-enterprisehazelcastVerified publisher | 5.15.2 | 1 of 2See more | 204 |
| kafkahelmforgeVerified publisher | 1.3.14 | 1 of 1See more | 572 |
| holoinsightholoinsight | 0.2.5 | 1 of 6See more | 27,995 |
| elasticinseefrlab | 2.2.0 | 1 of 2See more | 17,569 |
| kafka-kraft-on-k8skafka-kraft-on-k8sVerified publisher | 1.1.0 | 3 of 3See more | 14,719 |
| kokukokuVerified publisher | 1.0.0 | 1 of 7See more | 11,455 |
| hertzbeatkubesphere-testVerified publisher | 1.4.1 | 1 of 4See more | 7,848 |
Container images carrying it
146 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| wurstmeister/ | 2d4bbf9cc83d | jline-reader | 3.30.15 | 7 |
| public.ecr.aws/ | 8e01c0305844 | jline-reader | 3.30.15 | 7 |
| solsson/ | 41e5d8f6f290 | jline-reader | 3.30.15 | 5 |
| hazelcast/ | 5dd5d31c7a06 | jline-reader | 3.30.15 | 3 |
| library/ | 7d0f24ebb67b | jline-reader | 3.30.15 | 3 |
| ghcr.io/ | 896fc7b18b1b | jline-reader | 3.30.15 | 3 |
| apache/ | 0116fb802786 | jline-reader | 3.30.15 | 2 |
| apache/ | afa47bf1692a | jline-reader | 3.30.15 | 2 |
| apache/ | 77e3df905404 | jline-reader | 3.30.15 | 2 |
| apache/ | 7cdfd8deec92 | jline-reader | 3.30.15 | 2 |
| bitnamilegacy/ | 00176a47afa0 | jline-reader | 3.30.15 | 2 |
| confluentinc/ | ac776fad95a5 | jline-reader | 3.30.15 | 2 |
| confluentinc/ | 7610a50b13e7 | jline-reader | 3.30.15 | 2 |
| confluentinc/ | cae577096489 | jline-reader | 3.30.15 | 2 |
| empathyco/ | bcf4365ee7ec | jline-reader | 3.30.15 | 2 |
| library/ | 5e6ac15bf6a5 | jline-reader | 3.30.15 | 2 |
| library/ | 89729a95066a | jline-reader | 3.30.15 | 2 |
| library/ | 52d3dec8d455 | jline-reader | 3.30.15 | 2 |
| opensearchproject/ | 4254021a8c71 | jline-reader | 3.30.15 | 2 |
| opensearchproject/ | 7f6fa1efee8f | jline-reader | 3.30.15 | 2 |
| ghcr.io/ | 536358d7b17e | jline-reader | 3.30.15 | 2 |
| public.ecr.aws/ | d20bd62f0182 | jline-reader | 3.30.15 | 2 |
| 5200710/ | 092d3088a5fb | jline-reader | 3.30.15 | 1 |
| acryldata/ | c3db54d8fb94 | jline-reader | 4.3.1 | 1 |
| apache/ | 0305c26f19ed | jline-reader | 3.30.15 | 1 |
| apache/ | bae523439ee3 | jline-reader | 3.30.15 | 1 |
| apache/ | 1f96558fd292 | jline-reader | 3.30.15 | 1 |
| apache/ | 0cef139b6bf1 | jline-reader | 3.30.15 | 1 |
| apache/ | 80136ae753ee | jline-reader | 3.30.15 | 1 |
| apache/ | af361b20bec0 | jline-reader | 3.30.15 | 1 |
| apache/ | 8647309f95d1 | jline-reader | 3.30.15 | 1 |
| apache/ | bff074a5d005 | jline-reader | 3.30.15 | 1 |
| apache/ | fbc7d7c428e3 | jline-reader | 3.30.15 | 1 |
| apache/ | 63b8e3e40742 | jline-reader | 3.30.15 | 1 |
| apache/ | e66366e783f1 | jline-reader | 3.30.15 | 1 |
| apachepulsar/ | 16f9fdab3fa6 | jline-reader | 3.30.15 | 1 |
| apachepulsar/ | 3b262ab7a7d9 | jline-reader | 3.30.15 | 1 |
| apachepulsar/ | 9c9947de139d | jline-reader | 3.30.15 | 1 |
| apachepulsar/ | d056c89b7131 | jline-reader | 3.30.15 | 1 |
| apachepulsar/ | d538416d5afe | jline-reader | 3.30.15 | 1 |
| apache/ | 76c176e8a0e4 | jline-reader | 3.30.15 | 1 |
| assistiot/ | 23f195a7a26a | jline-reader | 3.30.15 | 1 |
| assistiot/ | 4228b7a8ef40 | jline-reader | 3.30.15 | 1 |
| assistiot/ | c8b6c7eaa0cd | jline-reader | 3.30.15 | 1 |
| assistiot/ | ea254b6d8a31 | jline-reader | 3.30.15 | 1 |
| bitnamilegacy/ | 15d4647fd491 | jline-reader | 3.30.15 | 1 |
| bitnamilegacy/ | 9cfd2df1294d | jline-reader | 3.30.15 | 1 |
| bitnamilegacy/ | e6f6ddcce2f1 | jline-reader | 3.30.15 | 1 |
| bitnamilegacy/ | 8657bb93a581 | jline-reader | 3.30.15 | 1 |
| bitnamilegacy/ | ac64829e45b3 | jline-reader | 3.30.15 | 1 |