StackRadar

CVE-2024-21664

Medium

Advisory

Published 9 Jan 2024In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.3
base score, highest
EPSS
0.009
57th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
56
of 17,781 indexed, latest versions
Container images
58
deployed by those charts
Fix available
2 of 2
affected packages

Parsing JSON serialized payload without protected field can lead to segfault

Carried by container images the latest versions of 56 of 17,781 indexed charts deploy, on 58 images.

Affected packageAffected versionsFixed inImages
github.com/lestrrat-go/jwxgolangv1.1.5, v1.1.7, v1.2.0, v1.2.1+10 more1.2.2853
github.com/lestrrat-go/jwx/v2golangv2.0.8, v2.0.11, v2.0.162.0.195
OSV records
GHSA-pvcr-v8j8-j5q3
Also known as
GO-2024-2454

Charts affected

56 by stars
ChartLatestAffected imagesRadar Score
milvusmilvus4.0.311 of 5See more

milvus milvus 4.0.31

1 of the 5 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2023-03-20T20-16-18Z6d770d7f255c
github.com/lestrrat-go/jwx@v1.2.25
1.2.28

Open the chart page →

32,259
glasskube-operatorglasskubeOfficialVerified publisher0.12.22 of 3See more

glasskube-operator glasskube 0.12.2

2 of the 3 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
quay.io/minio/mc:RELEASE.2023-09-29T16-41-22Za784ce6e3b1b
github.com/lestrrat-go/jwx@v1.2.26
1.2.28
quay.io/minio/minio:RELEASE.2023-09-30T07-02-29Z6262bc9a2730
github.com/lestrrat-go/jwx@v1.2.26
1.2.28

Open the chart page →

11,933
istio-operatorwiremindVerified publisher1.18.21 of 1See more

istio-operator wiremind 1.18.2

1 of the 1 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
istio/operator:1.18.270f9d1fe5fff
github.com/lestrrat-go/jwx@v1.2.26
1.2.28

Open the chart page →

5,630
kubeflowkubeflow1.6.21 of 45See more

kubeflow kubeflow 1.6.2

1 of the 45 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
istio/proxyv2:1.14.1df69c1a7af7c
github.com/lestrrat-go/jwx@v1.2.23
1.2.28

Open the chart page →

96,941
coder-observabilitycoder-observabilityVerified publisher0.7.32 of 21See more

coder-observability coder-observability 0.7.3

2 of the 21 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
quay.io/minio/mc:RELEASE.2022-09-16T09-16-47Z546a8b52d7b0
github.com/lestrrat-go/jwx@v1.2.19
1.2.28
quay.io/minio/minio:RELEASE.2022-09-17T00-09-45Zc3d20bc2ea08
github.com/lestrrat-go/jwx@v1.2.25
1.2.28

Open the chart page →

24,700
coreinstill-aiOfficialVerified publisher0.1.751 of 15See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
instill/api-gateway:9bfdc88b53eaa51c523
github.com/lestrrat-go/jwx/v2@v2.0.11
2.0.19

Open the chart page →

30,816
kraken-cikraken-ciVerified publisher1.7.361 of 10See more

kraken-ci kraken-ci 1.7.36

1 of the 10 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2022-10-24T18-35-07Zf9576903f19d
github.com/lestrrat-go/jwx@v1.2.25
1.2.28

Open the chart page →

7,273
kubecostmesosphere-stable0.37.51 of 9See more

kubecost mesosphere-stable 0.37.5

1 of the 9 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
gcr.io/kubecost1/cost-model:prod-1.108.1852f7923fad3
github.com/lestrrat-go/jwx@v1.2.26
1.2.28

Open the chart page →

17,693
oesopsmxVerified publisher4.0.321 of 25See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/forwarder-controller:v3.5.7f0c5bebaec96
github.com/lestrrat-go/jwx@v1.2.25
1.2.28

Open the chart page →

107,811
feedbacksystemthm-mni-iiVerified publisher0.47.11 of 10See more

feedbacksystem thm-mni-ii 0.47.1

1 of the 10 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2023.12.23-debian-11-r25bb0aa825d16
github.com/lestrrat-go/jwx@v1.2.27
1.2.28

Open the chart page →

28,534
minio-operatorwenerme4.3.71 of 2See more

minio-operator wenerme 4.3.7

1 of the 2 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
minio/operator:v4.3.754393e03f3b2
github.com/lestrrat-go/jwx@v1.2.0
1.2.28

Open the chart page →

6,085
navidromeemmas-chartsVerified publisher0.0.61 of 1See more

navidrome emmas-charts 0.0.6

1 of the 1 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
deluan/navidrome:0.50.02cf4442b0099
github.com/lestrrat-go/jwx/v2@v2.0.16
2.0.19

Open the chart page →

2,129
discoveryistio1.10.31 of 1See more

discovery istio 1.10.3

1 of the 1 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
istio/pilot:1.10.3e7e110a421c2
github.com/lestrrat-go/jwx@v1.1.5
1.2.28

Open the chart page →

10,475
egressistio1.10.31 of 1See more

egress istio 1.10.3

1 of the 1 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
istio/proxyv2:1.10.3a78b7a165744
github.com/lestrrat-go/jwx@v1.1.5
1.2.28

Open the chart page →

10,421
ingressistio1.10.31 of 1See more

ingress istio 1.10.3

1 of the 1 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
istio/proxyv2:1.10.3a78b7a165744
github.com/lestrrat-go/jwx@v1.1.5
1.2.28

Open the chart page →

10,421
operatoristio1.10.31 of 1See more

operator istio 1.10.3

1 of the 1 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
istio/operator:1.10.3655eefa11c84
github.com/lestrrat-go/jwx@v1.1.5
1.2.28

Open the chart page →

10,701
lgtm-stacklgtm-stackVerified publisher0.1.32 of 8See more

lgtm-stack lgtm-stack 0.1.3

2 of the 8 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
minio/mc:RELEASE.2024-01-16T16-06-34Z591b097ea2d4
github.com/lestrrat-go/jwx@v1.2.27
1.2.28
minio/minio:RELEASE.2024-01-18T22-51-28Z551682a57a94
github.com/lestrrat-go/jwx@v1.2.27
1.2.28

Open the chart page →

5,576
clowder2ncsaVerified publisher1.9.71 of 12See more

clowder2 ncsa 1.9.7

1 of the 12 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2023.12.230b60b6565ab2
github.com/lestrrat-go/jwx@v1.2.27
1.2.28

Open the chart page →

37,373
wraftwraft0.1.121 of 9See more

wraft wraft 0.1.12

1 of the 9 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2023-07-21T21-12-44Z8e5e9490cd50
github.com/lestrrat-go/jwx@v1.2.26
1.2.28

Open the chart page →

10,090
airbyteairbyte-v2Verified publisher2.2.01 of 10See more

airbyte airbyte-v2 2.2.0

1 of the 10 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2023-11-20T22-40-07Zb833a1699b4f
github.com/lestrrat-go/jwx@v1.2.26
1.2.28

Open the chart page →

12,473
minioappscodeVerified publisher2026.9.111 of 1See more

minio appscode 2026.9.11

1 of the 1 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2023-01-12T02-06-16Zfc6bedc99355
github.com/lestrrat-go/jwx@v1.2.25
1.2.28

Open the chart page →

4,043
assemblylineassemblylineVerified publisher7.4.172 of 12See more

assemblyline assemblyline 7.4.17

2 of the 12 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
quay.io/minio/mc:RELEASE.2024-01-11T05-49-32Z026ae522febc
github.com/lestrrat-go/jwx@v1.2.27
1.2.28
quay.io/minio/minio:RELEASE.2024-01-11T07-46-16Z796f75ea413b
github.com/lestrrat-go/jwx@v1.2.27
1.2.28

Open the chart page →

12,898
botkubeaveshaVerified publisher1.0.01 of 2See more

botkube avesha 1.0.0

1 of the 2 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
ghcr.io/kubeshop/botkube:v1.0.0669e27a5d1af
github.com/lestrrat-go/jwx@v1.1.7
1.2.28

Open the chart page →

5,074
istio-discoveryaveshaVerified publisher1.16.01 of 1See more

istio-discovery avesha 1.16.0

1 of the 1 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
istio/pilot:1.16.0ac0284d75ec9
github.com/lestrrat-go/jwx@v1.2.25
1.2.28

Open the chart page →

6,908
ragflowbaboulinet0.1.11 of 5See more

ragflow baboulinet 0.1.1

1 of the 5 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2023-12-20T01-00-02Z5702ea361420
github.com/lestrrat-go/jwx@v1.2.27
1.2.28

Open the chart page →

5,823
dnation-kubernetes-monitoring-stackdnationcloud4.0.22 of 17See more

dnation-kubernetes-monitoring-stack dnationcloud 4.0.2

2 of the 17 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
quay.io/minio/mc:RELEASE.2022-10-20T23-26-33Z50ee58bc9770
github.com/lestrrat-go/jwx@v1.2.25
1.2.28
quay.io/minio/minio:RELEASE.2022-10-24T18-35-07Zd853057f2800
github.com/lestrrat-go/jwx@v1.2.25
1.2.28

Open the chart page →

21,641
Navidromeemmas-chartsVerified publisher0.0.41 of 1See more

Navidrome emmas-charts 0.0.4

1 of the 1 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
deluan/navidrome:0.49.311a24da08977
github.com/lestrrat-go/jwx/v2@v2.0.8
2.0.19

Open the chart page →

2,837
dsba-pdpfiware0.1.21 of 2See more

dsba-pdp fiware 0.1.2

1 of the 2 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
quay.io/fiware/dsba-pdp:0.3.20cca71497e9e
github.com/lestrrat-go/jwx/v2@v2.0.8
2.0.19

Open the chart page →

4,103
navidromegeek-cookbookVerified publisher6.4.21 of 1See more

navidrome geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
deluan/navidrome:0.43.04e9ae3bff6aa
github.com/lestrrat-go/jwx@v1.2.0
1.2.28

Open the chart page →

3,597
istiogetindataVerified publisher1.11.12 of 2See more

istio getindata 1.11.1

2 of the 2 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
gcr.io/istio-release/pilot:1.11.1c552478f8f11
github.com/lestrrat-go/jwx@v1.2.0
1.2.28
gcr.io/istio-release/proxyv2:1.11.19538fabe49fd
github.com/lestrrat-go/jwx@v1.2.0
1.2.28

Open the chart page →

16,756
vcverifieri4trustVerified publisher1.0.231 of 1See more

vcverifier i4trust 1.0.23

1 of the 1 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
quay.io/fiware/vcverifier:2.0.1cd36290dc849
github.com/lestrrat-go/jwx@v1.2.25
1.2.28

Open the chart page →

1,784
cloudshellinseefrlab4.3.01 of 2See more

cloudshell inseefrlab 4.3.0

1 of the 2 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
inseefrlab/shelly:cloudshell31f04ca7436b
github.com/lestrrat-go/jwx@v1.2.27
1.2.28

Open the chart page →

10,494
evi-miniointelVerified publisher3.0.32 of 2See more

evi-minio intel 3.0.3

2 of the 2 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
quay.io/minio/mc:RELEASE.2023-01-28T20-29-38Zad34abeba912
github.com/lestrrat-go/jwx@v1.2.25
1.2.28
quay.io/minio/minio:RELEASE.2023-02-10T18-48-39Za0a002cb113c
github.com/lestrrat-go/jwx@v1.2.25
1.2.28

Open the chart page →

7,459
istio-aws-private-ingress-customizedistio-aws-private-ingress-customized1.0.01 of 1See more

istio-aws-private-ingress-customized istio-aws-private-ingress-customized 1.0.0

1 of the 1 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
istio/proxyv2:1.18.0757d28c24100
github.com/lestrrat-go/jwx@v1.2.25
1.2.28

Open the chart page →

5,530
istio-azure-private-ingress-customizedistio-azure-private-ingress-customized1.0.01 of 1See more

istio-azure-private-ingress-customized istio-azure-private-ingress-customized 1.0.0

1 of the 1 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
istio/proxyv2:1.18.0757d28c24100
github.com/lestrrat-go/jwx@v1.2.25
1.2.28

Open the chart page →

5,530
kiaekiae0.1.61 of 9See more

kiae kiae 0.1.6

1 of the 9 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
istio/pilot:1.15.2db08d6963975
github.com/lestrrat-go/jwx@v1.2.25
1.2.28

Open the chart page →

19,168
casdoorkrzwiatrzyk1.0.01 of 1See more

casdoor krzwiatrzyk 1.0.0

1 of the 1 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
casbin/casdoor:v1.224.066f836ef778b
github.com/lestrrat-go/jwx@v1.2.21
1.2.28

Open the chart page →

3,649
miniokubebb5.0.102 of 2See more

minio kubebb 5.0.10

2 of the 2 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
hyperledgerk8s/minio-mc:RELEASE.2023-01-28T20-29-38Z729b3d128487
github.com/lestrrat-go/jwx@v1.2.25
1.2.28
hyperledgerk8s/minio-minio:RELEASE.2023-02-10T18-48-39Zed0b0c56f1ea
github.com/lestrrat-go/jwx@v1.2.25
1.2.28

Open the chart page →

7,459
istio-operatormetakube1.12.01 of 1See more

istio-operator metakube 1.12.0

1 of the 1 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
istio/operator:1.12.06cfce8a071b9
github.com/lestrrat-go/jwx@v1.2.0
1.2.28

Open the chart page →

8,902
minio-operatorminio-operator4.3.71 of 2See more

minio-operator minio-operator 4.3.7

1 of the 2 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
minio/operator:v4.3.754393e03f3b2
github.com/lestrrat-go/jwx@v1.2.0
1.2.28

Open the chart page →

6,085
papergirlneoskop3.2.61 of 5See more

papergirl neoskop 3.2.6

1 of the 5 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
minio/mc:RELEASE.2022-05-09T04-08-26Z4b415310d8d0
github.com/lestrrat-go/jwx@v1.2.14
1.2.28

Open the chart page →

6,982
nexus-tasksnexus-tasks2.0.01 of 5See more

nexus-tasks nexus-tasks 2.0.0

1 of the 5 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
ghcr.io/ashvinbambhaniya/nexus-tasks-backend:2.0.0f80349eb018b
github.com/lestrrat-go/jwx/v2@v2.0.11
2.0.19

Open the chart page →

3,798
minio-operatornineinfra-charts5.0.91 of 1See more

minio-operator nineinfra-charts 5.0.9

1 of the 1 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
minio/operator:v5.0.9170b154d2c61
github.com/lestrrat-go/jwx@v1.2.26
1.2.28

Open the chart page →

3,419
multicluster-meshocm-helm-chartsVerified publisher0.0.21 of 1See more

multicluster-mesh ocm-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
quay.io/open-cluster-management/multicluster-mesh-addon:latest3e010e1188f1
github.com/lestrrat-go/jwx@v1.2.17
1.2.28

Open the chart page →

2,124
minioopenobserve5.0.72 of 2See more

minio openobserve 5.0.7

2 of the 2 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
quay.io/minio/mc:RELEASE.2023-01-28T20-29-38Zad34abeba912
github.com/lestrrat-go/jwx@v1.2.25
1.2.28
quay.io/minio/minio:RELEASE.2023-02-10T18-48-39Za0a002cb113c
github.com/lestrrat-go/jwx@v1.2.25
1.2.28

Open the chart page →

7,459
opslevelopslevelVerified publisher2025.1.221 of 10See more

opslevel opslevel 2025.1.22

1 of the 10 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
minio/mc:RELEASE.2023-02-28T00-12-59Zc631532a394e
github.com/lestrrat-go/jwx@v1.2.25
1.2.28

Open the chart page →

5,554
cdmswebapppyalive-cdmswebappVerified publisher0.1.01 of 3See more

cdmswebapp pyalive-cdmswebapp 0.1.0

1 of the 3 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
sarwansharma/minio:v359d1da9385d1
github.com/lestrrat-go/jwx@v1.2.19
1.2.28

Open the chart page →

6,668
miniosergiotocaliniVerified publisher1.0.01 of 1See more

minio sergiotocalini 1.0.0

1 of the 1 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
quay.io/minio/minio:RELEASE.2023-07-21T21-12-44Z8e5e9490cd50
github.com/lestrrat-go/jwx@v1.2.26
1.2.28

Open the chart page →

4,203
mimirskyloud-helm-chartsVerified publisher5.5.12 of 5See more

mimir skyloud-helm-charts 5.5.1

2 of the 5 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
quay.io/minio/mc:RELEASE.2023-09-29T16-41-22Za784ce6e3b1b
github.com/lestrrat-go/jwx@v1.2.26
1.2.28
quay.io/minio/minio:RELEASE.2023-09-30T07-02-29Z6262bc9a2730
github.com/lestrrat-go/jwx@v1.2.26
1.2.28

Open the chart page →

10,651
servicexssl-hep1.8.51 of 16See more

servicex ssl-hep 1.8.5

1 of the 16 container images this version deploys carry CVE-2024-21664.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2022.12.12-debian-11-r90f7c8ac484ac
github.com/lestrrat-go/jwx@v1.2.25
1.2.28

Open the chart page →

66,266

Container images carrying it

58 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/minio/mc:RELEASE.2022-10-20T23-26-33Z50ee58bc9770
github.com/lestrrat-go/jwx@v1.2.25
1.2.28
1
quay.io/minio/mc:RELEASE.2022-09-16T09-16-47Z546a8b52d7b0
github.com/lestrrat-go/jwx@v1.2.19
1.2.28
1
quay.io/minio/minio:RELEASE.2023-12-20T01-00-02Z5702ea361420
github.com/lestrrat-go/jwx@v1.2.27
1.2.28
1
quay.io/minio/minio:RELEASE.2024-01-11T07-46-16Z796f75ea413b
github.com/lestrrat-go/jwx@v1.2.27
1.2.28
1
quay.io/minio/minio:RELEASE.2022-09-17T00-09-45Zc3d20bc2ea08
github.com/lestrrat-go/jwx@v1.2.25
1.2.28
1
quay.io/minio/minio:RELEASE.2022-10-24T18-35-07Zd853057f2800
github.com/lestrrat-go/jwx@v1.2.25
1.2.28
1
quay.io/open-cluster-management/multicluster-mesh-addon:latest3e010e1188f1
github.com/lestrrat-go/jwx@v1.2.17
1.2.28
1
quay.io/opsmxpublic/forwarder-controller:v3.5.7f0c5bebaec96
github.com/lestrrat-go/jwx@v1.2.25
1.2.28
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.