StackRadar

CVE-2026-77421

Medium

Advisory

Published 23 Sept 2026In the index since 24 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
124
of 17,837 indexed, latest versions
Container images
107
deployed by those charts
Fix available
1 of 1
affected package

JLine: ReDoS in Nano Editor Regex Search Mode

Carried by container images the latest versions of 124 of 17,837 indexed charts deploy, on 107 images.

Affected packageAffected versionsFixed inImages
jline-builtinsmaven3.8.2, 3.9.0, 3.12.1, 3.13.1+16 more3.30.15, 4.3.1107
OSV records
GHSA-ph9c-7hw9-vhhw

Charts affected

124 by stars
ChartLatestAffected imagesRadar Score
kafka-helm-chartnotesprojectchart0.1.01 of 1See more

kafka-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
jline-builtins@3.12.1
3.30.15

Open the chart page →

4,579
hive-metastoreolehrgfVerified publisher0.1.01 of 1See more

hive-metastore olehrgf 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
ghcr.io/melodyyangaws/hive-metastore:3.0.0e949b0f733f0
jline-builtins@3.9.0
3.30.15

Open the chart page →

8,571
pulsarolehrgfVerified publisher0.0.51 of 2See more

pulsar olehrgf 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
apachepulsar/pulsar:3.1.016f9fdab3fa6
jline-builtins@3.21.0
3.30.15

Open the chart page →

9,424
onosopencord3.0.21 of 1See more

onos opencord 3.0.2

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
onosproject/onos:2.2.144914a8d4b3f
jline-builtins@3.13.2
3.30.15

Open the chart page →

13,044
voltha-infraopencord2.14.01 of 10See more

voltha-infra opencord 2.14.0

1 of the 10 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
voltha/voltha-onos:5.1.8e038acb950d3
jline-builtins@3.19.0
3.30.15

Open the chart page →

41,446
sentinelopennms-helm-chartsVerified publisher0.4.01 of 2See more

sentinel opennms-helm-charts 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
opennms/sentinel:36.0.288869082a14f
jline-builtins@3.30.6
3.30.15

Open the chart page →

2,163
dfdeweyosdfir-infrastructureVerified publisher1.0.01 of 3See more

dfdewey osdfir-infrastructure 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.12.0645d3d9390ad
jline-builtins@3.21.0
3.30.15

Open the chart page →

1,303
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.01 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

1 of the 40 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
opensearchproject/opensearch:3.1.0474ea3fdf25d
jline-builtins@3.21.0
3.30.15

Open the chart page →

201,333
timesketchosdfir-infrastructureVerified publisher1.0.81 of 6See more

timesketch osdfir-infrastructure 1.0.8

1 of the 6 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.14.0466a49f379bb
jline-builtins@3.21.0
3.30.15

Open the chart page →

1,300
punchline-javapunchplatform8.1.11 of 1See more

punchline-java punchplatform 8.1.1

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
ghcr.io/punchplatform/punchline-java:8.1.1d46ce7b96482
jline-builtins@3.9.0
3.30.15

Open the chart page →

2,021
kafkaquench-kafkaVerified publisher0.0.171 of 1See more

kafka quench-kafka 0.0.17

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/kafkadigest-pinned1fd1397ae1f7
jline-builtins@4.2.1
4.3.1

Open the chart page →

33
opensearchquench-opensearchVerified publisher0.1.61 of 1See more

opensearch quench-opensearch 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/opensearchdigest-pinned03e845cab860
jline-builtins@3.21.0
3.30.15

Open the chart page →

33
pulsarquench-pulsarVerified publisher0.0.181 of 1See more

pulsar quench-pulsar 0.0.18

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/pulsardigest-pinned5bd32914943e
jline-builtins@4.2.1
4.3.1

Open the chart page →

59
zookeeperquench-zookeeperVerified publisher0.0.151 of 1See more

zookeeper quench-zookeeper 0.0.15

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/zookeeperdigest-pinned72cc69246c76
jline-builtins@3.30.14
3.30.15

Open the chart page →

33
radar-cp-ksql-serverradar-baseVerified publisher0.0.21 of 2See more

radar-cp-ksql-server radar-base 0.0.2

1 of the 2 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
confluentinc/cp-ksqldb-server:7.6.08ec46c27982f
jline-builtins@3.13.1
3.30.15

Open the chart page →

5,427
sonatype-nexus3simcube1.0.11 of 2See more

sonatype-nexus3 simcube 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
sonatype/nexus3:3.58.1586060431b64
jline-builtins@3.21.0
3.30.15

Open the chart page →

4,869
stewardsoftwaremillVerified publisher0.1.121 of 1See more

steward softwaremill 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
fthomas/scala-steward:latesta8eb43927576
jline-builtins@3.29.0
3.30.15

Open the chart page →

428
trinostatcan1.23.41 of 2See more

trino statcan 1.23.4

1 of the 2 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
trinodb/trino:405ee80ab5eeab2
jline-builtins@3.12.1
3.30.15

Open the chart page →

14,024
hadoop-deploymenttejaswita-hadoop-helmchart1.0.01 of 1See more

hadoop-deployment tejaswita-hadoop-helmchart 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
apache/hadoop:3af361b20bec0
jline-builtins@3.9.0
3.30.15

Open the chart page →

4,265
kafkatwomartensVerified publisher0.2.11 of 2See more

kafka twomartens 0.2.1

1 of the 2 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:latest5e8f3ab5b497
jline-builtins@3.30.4
3.30.15

Open the chart page →

1,271
zookeepertwomartensVerified publisher0.2.21 of 1See more

zookeeper twomartens 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
confluentinc/cp-zookeeper:latest7610a50b13e7
jline-builtins@3.25.1
3.30.15

Open the chart page →

1,781
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
wazuh/wazuh-indexer:4.14.49c344d2b1757
jline-builtins@3.27.1
3.30.15

Open the chart page →

5,648
drillwearefrank1.3.61 of 3See more

drill wearefrank 1.3.6

1 of the 3 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
apache/drill:1.21.11f96558fd292
jline-builtins@3.21.0
3.30.15

Open the chart page →

9,469
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-77421.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.18.07f6fa1efee8f
jline-builtins@3.21.0
3.30.15

Open the chart page →

9,550

Container images carrying it

107 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/punchplatform/punchline-java:8.1.1d46ce7b96482
jline-builtins@3.9.0
3.30.15
1
ghcr.io/quenchworks/images/kafka1fd1397ae1f7
jline-builtins@4.2.1
4.3.1
1
ghcr.io/quenchworks/images/opensearch03e845cab860
jline-builtins@3.21.0
3.30.15
1
ghcr.io/quenchworks/images/pulsar5bd32914943e
jline-builtins@4.2.1
4.3.1
1
ghcr.io/quenchworks/images/zookeeper72cc69246c76
jline-builtins@3.30.14
3.30.15
1
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.0-1-ubi99026dbbf280d
jline-builtins@3.30.4
3.30.15
1
public.ecr.aws/v0r6c2e2/hive-metastore:latest794b3bff9510
jline-builtins@3.9.0
3.30.15
1

syft 1.42.1 · advisories as of 24 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.