Skip to content
QuenchWorks

OpenSearch

Chart · Search · standard · v0.1.2

digest pinnedcosign signedSPDX SBOMSLSA provenanceamd64 · arm64Rebuilt 2026-07-15

Search and analytics suite with a Kibana-style dashboards UI. The Apache-2.0 community fork of Elasticsearch and the recommended open alternative.

Version

0.1.2 · latest0.1.10.1.00.0.130.0.120.0.100.0.90.0.80.0.70.0.60.0.50.0.40.0.30.0.20.0.1

The latest line lives at the base page; older lines have their own page so you can pin and verify exactly that version.

Deployed image digest

sha256:b14f3ca466499405a7f2d0b375d8976eb7e1eec7c9a40aae2e37c83eb9b32e6b

Chart OCI version

oci://ghcr.io/quenchworks/charts/opensearch:0.1.2

The chart pins its image by this signed digest, so you never track it yourself. Signatures, SBOM, and provenance attach to the same digest.

Signed
cosign keyless
SBOM
SPDX, on image
Provenance
SLSA build
Architectures
amd64, arm64
Runs as
nonroot (uid 1001)
Root filesystem
read-only
Image size
965.3 MB

Security report (Trivy)

D· 0/10058 fixable · rebuild clears them

Vulnerability detail

opensearch 3.7.0 · 20 CVE
CVESeverityPackageInstalledFixed inTitle
CVE-2026-10050HIGHorg.eclipse.jetty:jetty-security9.4.58.v202508149.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10In Eclipse Jetty, the Digest authentication server-side component uses ...
CVE-2026-55831HIGHio.netty:netty-codec-http4.2.15.Final4.2.16.Final, 4.1.136.Finalio.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing
CVE-2026-55833HIGHio.netty:netty-codec-http4.2.15.Final4.2.16.Final, 4.1.136.Finalnetty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification
CVE-2026-56745HIGHio.netty:netty-codec-http4.2.15.Final4.2.16.Final, 4.1.136.Finalnetty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec
CVE-2026-56816HIGHio.netty:netty-codec-http34.2.15.Final4.2.16.FinalNetty is a network application framework for development of protocol s ...
CVE-2026-56819HIGHio.netty:netty-codec-http24.2.15.Final4.2.16.Final, 4.1.136.Finalio.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak
CVE-2026-59901HIGHio.netty:netty-codec-compression4.2.15.Final4.2.16.Finalio.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)
GHSA-r7wm-3cxj-wff9HIGHcom.fasterxml.jackson.core:jackson-core2.21.32.18.8, 2.21.4jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
GHSA-r7wm-3cxj-wff9HIGHtools.jackson.core:jackson-core3.1.33.1.4jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
CVE-2026-46968MEDIUMopenjdk-21-jre21.0.11-r321.0.12-r0openjdk: Enhance TLS certificate handling (Oracle CPU 2026-07)
CVE-2026-47021MEDIUMopenjdk-21-jre21.0.11-r321.0.12-r0openjdk: Enhance XBM image support (Oracle CPU 2026-07)
CVE-2026-56746MEDIUMio.netty:netty-codec-http4.2.15.Final4.2.16.Final, 4.1.136.Finalio.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header
CVE-2026-59889MEDIUMtools.jackson.core:jackson-databind3.1.43.1.5, 3.2.1jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization
CVE-2026-59898MEDIUMio.netty:netty-codec-http4.2.15.Final4.2.16.Final, 4.1.136.Finalio.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)
CVE-2026-59899MEDIUMio.netty:netty-codec-http4.2.15.Final4.2.16.Final, 4.1.136.Finalio.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)
CVE-2026-59900MEDIUMio.netty:netty-codec-http24.2.15.Final4.2.16.Final, 4.1.136.Finalio.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2
CVE-2026-59921MEDIUMio.netty:netty-codec-http4.2.15.Final4.2.16.Final, 4.1.136.Finalio.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder
CVE-2026-71497MEDIUMorg.jsoup:jsoup1.15.31.23.1org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names
CVE-2026-71497MEDIUMorg.jsoup:jsoup1.19.11.23.1org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names
CVE-2026-47010LOWopenjdk-21-jre21.0.11-r321.0.12-r0openjdk: Enhance JPEG handling (Oracle CPU 2026-07)
0
Critical
23
High
34
Medium
1
Low
0
Unknown

Security report (Trivy) · image opensearch 3.7.0

Install the chart

Deploy to Kubernetes with hardened defaults. The chart pins its image by signed digest, so you never track it yourself.

Install (latest)

helm install my-opensearch oci://ghcr.io/quenchworks/charts/opensearch --version 0.1.2

Deploys image (digest-pinned)

ghcr.io/quenchworks/images/opensearch@sha256:b14f3ca466499405a7f2d0b375d8976eb7e1eec7c9a40aae2e37c83eb9b32e6b
Chart version
0.1.2
App version
3.7.0
Chart license
MIT
App license
Apache-2.0
Signed
cosign (keyless)
Values schema
yes
Last published
2026-08-02

Verify the chart

cosign verify ghcr.io/quenchworks/charts/opensearch:0.1.2 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Transparency

The chart publishes its attestations on GitHub and the image it deploys carries its own on the same digest, publicly verifiable with the commands above. Both log to the Sigstore transparency log (Rekor), which cosign verify checks for you.

View the imageView on ArtifactHubChart source

Upstream project: https://github.com/opensearch-project/OpenSearch