OpenSearch 0.0.2

Chart · Search · standard · v0.0.2

digest pinnedcosign signedSPDX SBOMSLSA provenanceamd64 · arm64

Search and analytics suite with a Kibana-style dashboards UI. The Apache-2.0 community fork of Elasticsearch and the recommended open alternative.

Version

0.1.2 · latest 0.1.1 0.1.0 0.0.13 0.0.12 0.0.10 0.0.9 0.0.8 0.0.7 0.0.6 0.0.5 0.0.4 0.0.3 0.0.2 0.0.1

The latest line lives at the base page; older lines have their own page so you can pin and verify exactly that version.

Released version

This is the 0.0.2 release of the OpenSearch chart, published 2026-06-14.For the live security report and the currently deployed image digest, see the latest release.

Signed

cosign keyless

SBOM

SPDX, on image

Provenance

SLSA build

Architectures

amd64, arm64

Runs as

nonroot (uid 1001)

Root filesystem

read-only

Security report (Trivy)

D· 0/10058 fixable · rebuild clears them

Vulnerability detail

opensearch 3.7.0 · 20 CVE

CVE	Severity	Package	Installed	Fixed in	Title
CVE-2026-10050	HIGH	org.eclipse.jetty:jetty-security	9.4.58.v20250814	9.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10	In Eclipse Jetty, the Digest authentication server-side component uses ...
CVE-2026-55831	HIGH	io.netty:netty-codec-http	4.2.15.Final	4.2.16.Final, 4.1.136.Final	io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing
CVE-2026-55833	HIGH	io.netty:netty-codec-http	4.2.15.Final	4.2.16.Final, 4.1.136.Final	netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification
CVE-2026-56745	HIGH	io.netty:netty-codec-http	4.2.15.Final	4.2.16.Final, 4.1.136.Final	netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec
CVE-2026-56816	HIGH	io.netty:netty-codec-http3	4.2.15.Final	4.2.16.Final	Netty is a network application framework for development of protocol s ...
CVE-2026-56819	HIGH	io.netty:netty-codec-http2	4.2.15.Final	4.2.16.Final, 4.1.136.Final	io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak
CVE-2026-59901	HIGH	io.netty:netty-codec-compression	4.2.15.Final	4.2.16.Final	io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)
GHSA-r7wm-3cxj-wff9	HIGH	com.fasterxml.jackson.core:jackson-core	2.21.3	2.18.8, 2.21.4	jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
GHSA-r7wm-3cxj-wff9	HIGH	tools.jackson.core:jackson-core	3.1.3	3.1.4	jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
CVE-2026-46968	MEDIUM	openjdk-21-jre	21.0.11-r3	21.0.12-r0	openjdk: Enhance TLS certificate handling (Oracle CPU 2026-07)
CVE-2026-47021	MEDIUM	openjdk-21-jre	21.0.11-r3	21.0.12-r0	openjdk: Enhance XBM image support (Oracle CPU 2026-07)
CVE-2026-56746	MEDIUM	io.netty:netty-codec-http	4.2.15.Final	4.2.16.Final, 4.1.136.Final	io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header
CVE-2026-59889	MEDIUM	tools.jackson.core:jackson-databind	3.1.4	3.1.5, 3.2.1	jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization
CVE-2026-59898	MEDIUM	io.netty:netty-codec-http	4.2.15.Final	4.2.16.Final, 4.1.136.Final	io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)
CVE-2026-59899	MEDIUM	io.netty:netty-codec-http	4.2.15.Final	4.2.16.Final, 4.1.136.Final	io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)
CVE-2026-59900	MEDIUM	io.netty:netty-codec-http2	4.2.15.Final	4.2.16.Final, 4.1.136.Final	io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2
CVE-2026-59921	MEDIUM	io.netty:netty-codec-http	4.2.15.Final	4.2.16.Final, 4.1.136.Final	io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder
CVE-2026-71497	MEDIUM	org.jsoup:jsoup	1.15.3	1.23.1	org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names
CVE-2026-71497	MEDIUM	org.jsoup:jsoup	1.19.1	1.23.1	org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names
CVE-2026-47010	LOW	openjdk-21-jre	21.0.11-r3	21.0.12-r0	openjdk: Enhance JPEG handling (Oracle CPU 2026-07)

Critical

High

Medium

Low

Unknown

Security report (Trivy) · image opensearch 3.7.0

Install the chart

Deploy to Kubernetes with hardened defaults. The chart pins its image by signed digest, so you never track it yourself.

Install (pinned to 0.0.2)

helm install my-opensearch oci://ghcr.io/quenchworks/charts/opensearch --version 0.0.2

Chart version: 0.0.2
Chart license: MIT
App license: Apache-2.0
Signed: cosign (keyless)
Released: 2026-06-14

Verify the chart

cosign verify ghcr.io/quenchworks/charts/opensearch:0.0.2 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Transparency

The chart publishes its attestations on GitHub and the image it deploys carries its own on the same digest, publicly verifiable with the commands above. Both log to the Sigstore transparency log (Rekor), which cosign verify checks for you.

View the image View on ArtifactHub Chart source

Upstream project: https://github.com/opensearch-project/OpenSearch