StackRadar

CVE-2026-77421

Medium

Advisory

Published 23 Sept 2026In the index since 24 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
124
of 17,837 indexed, latest versions
Container images
107
deployed by those charts
Fix available
1 of 1
affected package

JLine: ReDoS in Nano Editor Regex Search Mode

Carried by container images the latest versions of 124 of 17,837 indexed charts deploy, on 107 images.

Affected packageAffected versionsFixed inImages
jline-builtinsmaven3.8.2, 3.9.0, 3.12.1, 3.13.1+16 more3.30.15, 4.3.1107
OSV records
GHSA-ph9c-7hw9-vhhw

Charts affected

124 by stars
ChartLatestAffected imagesRadar Score
graylogkong-zVerified publisher3.0.341 of 5See more

graylog kong-z 3.0.34

1 of the 5 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.19.6e321cb03c643
jline-builtins@3.27.1
3.30.15

Open the chart page →

2,663
datahubdatahubVerified publisher1.1.41 of 4See more

datahub datahub 1.1.4

1 of the 4 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
acryldata/datahub-upgrade:v1.7.0.1c3db54d8fb94
jline-builtins@4.2.1
4.3.1

Open the chart page →

775
akhqakhq0.28.01 of 1See more

akhq akhq 0.28.0

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
tchiotludo/akhq:0.28.0c2824dc2ae44
jline-builtins@3.30.9
3.30.15

Open the chart page →

1,683
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
wazuh/wazuh-indexer:4.14.3b149b30da686
jline-builtins@3.27.1
3.30.15

Open the chart page →

11,655
milvusmilvus-helm5.0.281 of 4See more

milvus milvus-helm 5.0.28

1 of the 4 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
apachepulsar/pulsar:3.0.79c9947de139d
jline-builtins@3.21.0
3.30.15

Open the chart page →

11,312
zookeepercloudpirates-zookeeperVerified publisher0.15.01 of 1See more

zookeeper cloudpirates-zookeeper 0.15.0

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
library/zookeeper:3.9.57d0f24ebb67b
jline-builtins@3.25.1
3.30.15

Open the chart page →

3,058
polarisapache-polarisOfficialVerified publisher1.3.0-incubating1 of 1See more

polaris apache-polaris 1.3.0-incubating

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
apache/polaris:lateste66366e783f1
jline-builtins@3.9.0
3.30.15

Open the chart page →

548
druiddruid-helmVerified publisher37.0.21 of 3See more

druid druid-helm 37.0.2

1 of the 3 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
apache/druid:37.0.00116fb802786
jline-builtins@3.9.0
3.30.15

Open the chart page →

3,968
kafkakubelauncherVerified publisher0.1.261 of 1See more

kafka kubelauncher 0.1.26

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/kafkadigest-pinned43e1085cd0a8
jline-builtins@3.25.1
3.30.15

Open the chart page →

1,518
kafkakafka18.0.11 of 1See more

kafka kafka 18.0.1

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
kafkace/kafka:v3.7.1-63ba8d27adc206bf5a4
jline-builtins@3.25.1
3.30.15

Open the chart page →

3,520
hadoopbigdata-chartsVerified publisher1.0.11 of 2See more

hadoop bigdata-charts 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
5200710/hadoop:3.2.3-java8092d3088a5fb
jline-builtins@3.9.0
3.30.15

Open the chart page →

12,328
grayloggraylog2OfficialVerified publisher2.0.01 of 2See more

graylog graylog2 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
graylog/graylog-enterprise:7.1.88a1f641cd7aa
jline-builtins@3.9.0
3.30.15

Open the chart page →

1,649
thehivestrangebee-helmOfficialVerified publisher1.1.01 of 7See more

thehive strangebee-helm 1.1.0

1 of the 7 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
strangebee/thehive:5.8.0-1a7f7b05fba24
jline-builtins@3.29.0
3.30.15

Open the chart page →

16,628
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
wazuh/wazuh-indexer:4.11.1a7a2076b167e
jline-builtins@3.21.0
3.30.15

Open the chart page →

6,295
druidwiremindVerified publisher1.22.11 of 3See more

druid wiremind 1.22.1

1 of the 3 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
apache/druid:29.0.10cef139b6bf1
jline-builtins@3.9.0
3.30.15

Open the chart page →

8,089
openhabhelmforgeVerified publisher1.2.01 of 1See more

openhab helmforge 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
openhab/openhab:5.2.1bfd4a60e90da
jline-builtins@3.30.9
3.30.15

Open the chart page →

3,813
kubernetes-loggingkubernetes-logging4.8.01 of 6See more

kubernetes-logging kubernetes-logging 4.8.0

1 of the 6 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.10.0c8f3ebd2a934
jline-builtins@3.21.0
3.30.15

Open the chart page →

10,771
opensearchcaptnbpVerified publisher3.1.11 of 2See more

opensearch captnbp 3.1.1

1 of the 2 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.19.269588c664014
jline-builtins@3.21.0
3.30.15

Open the chart page →

1,111
flyte-binaryflyte2.0.491 of 4See more

flyte-binary flyte 2.0.49

1 of the 4 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
jline-builtins@3.9.0
3.30.15

Open the chart page →

4,079
kafka-chartsoldevelo-kafka-chart32.4.41 of 1See more

kafka-chart soldevelo-kafka-chart 32.4.4

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
soldevelo/kafka:4.0.0-debian-12-r0cfdc08c2f577
jline-builtins@3.25.1
3.30.15

Open the chart page →

2,449
thingsboard-clusterthingsboard-cluster-bettaVerified publisher0.2.261 of 6See more

thingsboard-cluster thingsboard-cluster-betta 0.2.26

1 of the 6 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
bitnamilegacy/kafka:3.5.0-debian-11-r08657bb93a581
jline-builtins@3.22.0
3.30.15

Open the chart page →

14,687
icat-k8salba-helm-chartsVerified publisher1.1.02 of 4See more

icat-k8s alba-helm-charts 1.1.0

2 of the 4 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
payara/micro:7.2026.2-jdk25fb44b8ce1cb2
jline-builtins@3.30.6
3.30.15
payara/server-full:7.2026.2-jdk2531f1253f0cf8
jline-builtins@3.30.6
3.30.15

Open the chart page →

4,003
clearml-servingallegroaiVerified publisher1.6.21 of 9See more

clearml-serving allegroai 1.6.2

1 of the 9 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
bitnamilegacy/kafka:3.4.0-debian-11-r6ac64829e45b3
jline-builtins@3.21.0
3.30.15

Open the chart page →

18,832
apache-rangerapache-ranger0.1.01 of 2See more

apache-ranger apache-ranger 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
apache/ranger:2.7.076c176e8a0e4
jline-builtins@3.9.0
3.30.15

Open the chart page →

7,903
soarv113assist-iot-cybersecurity-monitoring-soar0.1.31 of 5See more

soarv113 assist-iot-cybersecurity-monitoring-soar 0.1.3

1 of the 5 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_ir-thv:latestc8b6c7eaa0cd
jline-builtins@3.9.0
3.30.15

Open the chart page →

18,129
kafkacloudpirates-kafkaVerified publisher0.1.71 of 1See more

kafka cloudpirates-kafka 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
apache/kafka:4.3.177e3df905404
jline-builtins@3.30.4
3.30.15

Open the chart page →

572
nifid4nVerified publisher2.0.01 of 5See more

nifi d4n 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
apache/nifi-registry:1.26.07cdfd8deec92
jline-builtins@3.25.1
3.30.15

Open the chart page →

5,571
dbrepodbrepo1.13.31 of 25See more

dbrepo dbrepo 1.13.3

1 of the 25 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
bitnamilegacy/opensearch:2.18.0-debian-12-r0d8440eb6b290
jline-builtins@3.21.0
3.30.15

Open the chart page →

54,244
elasticsearch-dataempathyco0.2.01 of 2See more

elasticsearch-data empathyco 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
empathyco/elasticsearch:6.6.2-memlockbcf4365ee7ec
jline-builtins@3.8.2
3.30.15

Open the chart page →

3,729
elasticsearch-masterempathyco0.3.01 of 2See more

elasticsearch-master empathyco 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
empathyco/elasticsearch:6.6.2-memlockbcf4365ee7ec
jline-builtins@3.8.2
3.30.15

Open the chart page →

3,729
enavenav-service-architectureVerified publisher0.0.71 of 10See more

enav enav-service-architecture 0.0.7

1 of the 10 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
apache/kafka:3.9.0fbc7d7c428e3
jline-builtins@3.25.1
3.30.15

Open the chart page →

12,729
gentrace-self-hostedgentrace-self-hostedVerified publisher0.1.31 of 9See more

gentrace-self-hosted gentrace-self-hosted 0.1.3

1 of the 9 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:7.4.4c0224a1adf7a
jline-builtins@3.22.0
3.30.15

Open the chart page →

14,753
kafkahelmforgeVerified publisher1.3.141 of 1See more

kafka helmforge 1.3.14

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
apache/kafka:4.3.177e3df905404
jline-builtins@3.30.4
3.30.15

Open the chart page →

572
kafka-kraft-on-k8skafka-kraft-on-k8sVerified publisher1.1.03 of 3See more

kafka-kraft-on-k8s kafka-kraft-on-k8s 1.1.0

3 of the 3 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
kafkakraft/kafka-connect:3.7.0062d697db7e5
jline-builtins@3.22.0
3.30.15
kafkakraft/kafka-controller:3.7.0f261ad288fce
jline-builtins@3.22.0
3.30.15
kafkakraft/kafkakraft:3.7.02e4b593b878b
jline-builtins@3.22.0
3.30.15

Open the chart page →

14,719
kokukokuVerified publisher1.0.01 of 7See more

koku koku 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
public.ecr.aws/v0r6c2e2/hive-metastore:latest794b3bff9510
jline-builtins@3.9.0
3.30.15

Open the chart page →

11,455
hertzbeatkubesphere-testVerified publisher1.4.11 of 4See more

hertzbeat kubesphere-test 1.4.1

1 of the 4 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
apache/iotdb:0.13.3-nodeafa47bf1692a
jline-builtins@3.21.0
3.30.15

Open the chart page →

7,848
magentomagento3.2.31 of 12See more

magento magento 3.2.3

1 of the 12 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
magento/magento-cloud-docker-opensearch:2.5-1.4.059fb6f0f1461
jline-builtins@3.21.0
3.30.15

Open the chart page →

13,894
data-prepperopensearch-project-helm-chartsVerified publisher0.3.11 of 1See more

data-prepper opensearch-project-helm-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
opensearchproject/data-prepper:2.8.057c25fa01d3c
jline-builtins@3.25.0
3.30.15

Open the chart page →

1,743
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.01 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.0

1 of the 34 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.1.0-kafka4402ba7fd544
jline-builtins@3.30.4
3.30.15

Open the chart page →

20,508
sentry-k8ssentry-k8sVerified publisher1.4.11 of 11See more

sentry-k8s sentry-k8s 1.4.1

1 of the 11 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:7.6.683dbca3efd2a
jline-builtins@3.25.1
3.30.15

Open the chart page →

17,273
spark-operatorwikimedia2.2.71 of 1See more

spark-operator wikimedia 2.2.7

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
ghcr.io/kubeflow/spark-operator/controller:2.2.1865ff4da5686
jline-builtins@3.9.0
3.30.15

Open the chart page →

53,956
active-mqactivemq-helm-chartVerified publisher1.8.21 of 3See more

active-mq activemq-helm-chart 1.8.2

1 of the 3 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
apache/activemq-artemis:2.44.00305c26f19ed
jline-builtins@3.30.6
3.30.15

Open the chart page →

3,362
airports-kafkaairports-kafka0.1.01 of 2See more

airports-kafka airports-kafka 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
jline-builtins@3.12.1
3.30.15

Open the chart page →

4,579
aktoakto0.2.02 of 7See more

akto akto 0.2.0

2 of the 7 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:6.2.11-1-ubi8ac776fad95a5
jline-builtins@3.12.1
3.30.15
confluentinc/cp-zookeeper:6.2.11-1-ubi8cae577096489
jline-builtins@3.12.1
3.30.15

Open the chart page →

13,988
akto-central-setupakto1.2.01 of 5See more

akto-central-setup akto 1.2.0

1 of the 5 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.28e01c0305844
jline-builtins@3.30.4
3.30.15

Open the chart page →

4,020
akto-hybrid-redactakto1.44.71 of 5See more

akto-hybrid-redact akto 1.44.7

1 of the 5 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.1-1-ubi9d20bd62f0182
jline-builtins@3.30.4
3.30.15

Open the chart page →

4,997
akto-mini-runtimeakto0.7.221 of 3See more

akto-mini-runtime akto 0.7.22

1 of the 3 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
jline-builtins@3.30.4
3.30.15

Open the chart page →

2,740
akto-mini-runtime-shaakto0.7.231 of 3See more

akto-mini-runtime-sha akto 0.7.23

1 of the 3 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafkadigest-pinnedd20bd62f0182
jline-builtins@3.30.4
3.30.15

Open the chart page →

3,357
akto-mini-testingakto1.45.71 of 5See more

akto-mini-testing akto 1.45.7

1 of the 5 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
jline-builtins@3.30.4
3.30.15

Open the chart page →

6,665
akto-mini-testing-kafkaakto1.42.12 of 5See more

akto-mini-testing-kafka akto 1.42.1

2 of the 5 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:7.8.0-3-ubi8adc392d28a1e
jline-builtins@3.25.1
3.30.15
confluentinc/cp-zookeeper:7.8.0-3-ubi85ca5f3269814
jline-builtins@3.25.1
3.30.15

Open the chart page →

6,551

Container images carrying it

107 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/punchplatform/punchline-java:8.1.1d46ce7b96482
jline-builtins@3.9.0
3.30.15
1
ghcr.io/quenchworks/images/kafka1fd1397ae1f7
jline-builtins@4.2.1
4.3.1
1
ghcr.io/quenchworks/images/opensearch03e845cab860
jline-builtins@3.21.0
3.30.15
1
ghcr.io/quenchworks/images/pulsar5bd32914943e
jline-builtins@4.2.1
4.3.1
1
ghcr.io/quenchworks/images/zookeeper72cc69246c76
jline-builtins@3.30.14
3.30.15
1
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.0-1-ubi99026dbbf280d
jline-builtins@3.30.4
3.30.15
1
public.ecr.aws/v0r6c2e2/hive-metastore:latest794b3bff9510
jline-builtins@3.9.0
3.30.15
1

syft 1.42.1 · advisories as of 24 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.