OpenSearch

Chart · Search · standard · v0.1.3

digest pinnedcosign signedSPDX SBOMSLSA provenanceamd64 · arm64Rebuilt 2026-07-15

Search and analytics suite with a Kibana-style dashboards UI. The Apache-2.0 community fork of Elasticsearch and the recommended open alternative.

Version

0.1.3 · latest 0.1.2 0.1.1 0.1.0 0.0.13 0.0.12 0.0.10 0.0.9 0.0.8 0.0.7 0.0.6 0.0.5 0.0.4 0.0.3 0.0.2 0.0.1

The latest line lives at the base page; older lines have their own page so you can pin and verify exactly that version.

Deployed image digest

sha256:ff6097ca0218bffc3946a4c87b623decc346eebed6d4d6e37bb10fb48f48baa2

Chart OCI version

oci://ghcr.io/quenchworks/charts/opensearch:0.1.3

The chart pins its image by this signed digest, so you never track it yourself. Signatures, SBOM, and provenance attach to the same digest.

Signed

cosign keyless

SBOM

SPDX, on image

Provenance

SLSA build

Architectures

amd64, arm64

Runs as

nonroot (uid 1001)

Root filesystem

read-only

Image size

965.3 MB

Security report (Trivy)

D· 0/10091 fixable · rebuild clears them

Vulnerability detail

opensearch 3.7.0 · 24 CVE

CVE	Severity	Package	Installed	Fixed in	Title
CVE-2026-10050	HIGH	org.eclipse.jetty:jetty-security	9.4.58.v20250814	9.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10	jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision
CVE-2026-54399	HIGH	org.apache.httpcomponents.core5:httpcore5	5.4	5.4.3, 5.5-beta2	org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers
CVE-2026-54428	HIGH	org.apache.httpcomponents.core5:httpcore5-h2	5.4	5.4.3, 5.5-beta2	org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks
CVE-2026-55831	HIGH	io.netty:netty-codec-http	4.2.15.Final	4.2.16.Final, 4.1.136.Final	io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing
CVE-2026-55833	HIGH	io.netty:netty-codec-http	4.2.15.Final	4.2.16.Final, 4.1.136.Final	netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification
CVE-2026-56745	HIGH	io.netty:netty-codec-http	4.2.15.Final	4.2.16.Final, 4.1.136.Final	netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec
CVE-2026-56816	HIGH	io.netty:netty-codec-http3	4.2.15.Final	4.2.16.Final	Netty is a network application framework for development of protocol s ...
CVE-2026-56819	HIGH	io.netty:netty-codec-http2	4.2.15.Final	4.2.16.Final, 4.1.136.Final	io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak
CVE-2026-59901	HIGH	io.netty:netty-codec-compression	4.2.15.Final	4.2.16.Final	io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)
GHSA-r7wm-3cxj-wff9	HIGH	com.fasterxml.jackson.core:jackson-core	2.21.3	2.18.8, 2.21.4	jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
GHSA-r7wm-3cxj-wff9	HIGH	tools.jackson.core:jackson-core	3.1.3	3.1.4	jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)
CVE-2026-46968	MEDIUM	openjdk-21-jre	21.0.11-r3	21.0.12-r0	openjdk: Enhance TLS certificate handling (Oracle CPU 2026-07)
CVE-2026-47021	MEDIUM	openjdk-21-jre	21.0.11-r3	21.0.12-r0	openjdk: Enhance XBM image support (Oracle CPU 2026-07)
CVE-2026-49844	MEDIUM	org.apache.logging.log4j:log4j-api	2.25.4	2.25.5, 2.26.1	org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values
CVE-2026-56746	MEDIUM	io.netty:netty-codec-http	4.2.15.Final	4.2.16.Final, 4.1.136.Final	io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header
CVE-2026-59889	MEDIUM	tools.jackson.core:jackson-databind	3.1.4	3.1.5, 3.2.1	jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization
CVE-2026-59898	MEDIUM	io.netty:netty-codec-http	4.2.15.Final	4.2.16.Final, 4.1.136.Final	io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)
CVE-2026-59899	MEDIUM	io.netty:netty-codec-http	4.2.15.Final	4.2.16.Final, 4.1.136.Final	io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)
CVE-2026-59900	MEDIUM	io.netty:netty-codec-http2	4.2.15.Final	4.2.16.Final, 4.1.136.Final	io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2
CVE-2026-59921	MEDIUM	io.netty:netty-codec-http	4.2.15.Final	4.2.16.Final, 4.1.136.Final	io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder
CVE-2026-64607	MEDIUM	org.apache.httpcomponents.client5:httpclient5	5.6.1	5.6.3	Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
CVE-2026-71497	MEDIUM	org.jsoup:jsoup	1.15.3	1.23.1	org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names
CVE-2026-71497	MEDIUM	org.jsoup:jsoup	1.19.1	1.23.1	org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names
CVE-2026-47010	LOW	openjdk-21-jre	21.0.11-r3	21.0.12-r0	openjdk: Enhance JPEG handling (Oracle CPU 2026-07)

Critical

High

Medium

Low

Unknown

Security report (Trivy) · image opensearch 3.7.0

Install the chart

Deploy to Kubernetes with hardened defaults. The chart pins its image by signed digest, so you never track it yourself.

Install (latest)

helm install my-opensearch oci://ghcr.io/quenchworks/charts/opensearch --version 0.1.3

Deploys image (digest-pinned)

ghcr.io/quenchworks/images/opensearch@sha256:b14f3ca466499405a7f2d0b375d8976eb7e1eec7c9a40aae2e37c83eb9b32e6b

Chart version: 0.1.3
App version: 3.8.0
Chart license: MIT
App license: Apache-2.0
Signed: cosign (keyless)
Values schema: yes
Last published: 2026-08-10

Verify the chart

cosign verify ghcr.io/quenchworks/charts/opensearch:0.1.3 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Transparency

The chart publishes its attestations on GitHub and the image it deploys carries its own on the same digest, publicly verifiable with the commands above. Both log to the Sigstore transparency log (Rekor), which cosign verify checks for you.

View the image View on ArtifactHub Chart source

Upstream project: https://github.com/opensearch-project/OpenSearch