CVE-2024-27454
HighAdvisory
Published 26 Feb 2024In the index since 6 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.012
- 66th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 18
- of 17,781 indexed, latest versions
- Container images
- 27
- deployed by those charts
- Fix available
- 1 of 1
- affected package
orjson does not limit recursion for deeply nested JSON documents
Carried by container images the latest versions of 18 of 17,781 indexed charts deploy, on 27 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| orjsonpypi | 2.6.1, 2.6.8, 3.3.1, 3.5.2+7 more | 3.9.15 | 27 |
- OSV records
- GHSA-pwr2-4v36-6qpr
- Also known as
- PYSEC-2024-40
Charts affected
18 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| ambassadordatawire | 6.9.5 | 1 of 2See more | 4,086 |
| emissary-ingressdatawire | 7.1.8-ea | 1 of 1See more | 4,918 |
| homeassistantvolker-raschekVerified publisher | 0.2.3 | 1 of 1See more | 6,041 |
| edge-stackdatawire | 7.1.8-ea | 1 of 2See more | 5,173 |
| stackstorm-hastackstormVerified publisher | 1.1.0 | 11 of 17See more | 96,419 |
| clearml-servingallegroaiVerified publisher | 1.6.2 | 1 of 9See more | 17,877 |
| datadogdatadog-test | 2.4.23 | 1 of 2See more | 4,568 |
| ambassadorazureorkestra | 6.7.9 | 1 of 2See more | 5,521 |
| home-assistantdamounVerified publisher | 1.1.0 | 1 of 1See more | 6,179 |
| huntingfactlyVerified publisher | 0.4.14 | 1 of 1See more | 4,085 |
| home-assistantkfirfer | 0.5.4 | 1 of 1See more | 6,447 |
| pavkrzwiatrzyk | 0.0.3 | 1 of 1See more | 1,132 |
| kafka-aggregatorlsst-sqre | 0.1.2 | 1 of 1See more | 3,052 |
| MINTmint | 8.0.2 | 1 of 15See more | 43,341 |
| mlflowncsaVerified publisher | 1.2.1 | 1 of 4See more | 5,456 |
| ambassador-manifestssqream-chartsVerified publisher | 0.6.3 | 1 of 1See more | 2,416 |
| ambassadorwenerme | 6.9.5 | 1 of 2See more | 4,086 |
| emissary-ingresswenerme | 8.12.2 | 1 of 2See more | 10,843 |
Container images carrying it
27 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| datawire/ | 8588eafe6862 | orjson | 3.9.15 | 2 |
| allegroai/ | fca885e8cfc6 | orjson | 3.9.15 | 1 |
| datadog/ | 8f20e56b5311 | orjson | 3.9.15 | 1 |
| datawire/ | 07f8fe4f4f8e | orjson | 3.9.15 | 1 |
| datawire/ | 2beb65062c8b | orjson | 3.9.15 | 1 |
| datawire/ | 95ec30b3c732 | orjson | 3.9.15 | 1 |
| datawire/ | 1f67a1292d2a | orjson | 3.9.15 | 1 |
| datawire/ | 9716efbdd24b | orjson | 3.9.15 | 1 |
| evk02/ | ef6ff257ef35 | orjson | 3.9.15 | 1 |
| factly/ | ca5bc71d1d5c | orjson | 3.9.15 | 1 |
| homeassistant/ | 021e2afc6e57 | orjson | 3.9.15 | 1 |
| homeassistant/ | 8d000332b09b | orjson | 3.9.15 | 1 |
| lsstsqre/ | be1b21060854 | orjson | 3.9.15 | 1 |
| mintproject/ | 02260d20a21f | orjson | 3.9.15 | 1 |
| stackstorm/ | 88235ba70cad | orjson | 3.9.15 | 1 |
| stackstorm/ | 6f56d239d280 | orjson | 3.9.15 | 1 |
| stackstorm/ | 33ecfda16608 | orjson | 3.9.15 | 1 |
| stackstorm/ | 4e3f8c7ca52d | orjson | 3.9.15 | 1 |
| stackstorm/ | f190a6212195 | orjson | 3.9.15 | 1 |
| stackstorm/ | 259503496ff9 | orjson | 3.9.15 | 1 |
| stackstorm/ | b1de2055c362 | orjson | 3.9.15 | 1 |
| stackstorm/ | b1a338f64773 | orjson | 3.9.15 | 1 |
| stackstorm/ | 1c8904a3bf67 | orjson | 3.9.15 | 1 |
| stackstorm/ | 1bf35bfaf00c | orjson | 3.9.15 | 1 |
| stackstorm/ | 19fdfffdbba8 | orjson | 3.9.15 | 1 |
| witcherek7/ | 42a744f29ac0 | orjson | 3.9.15 | 1 |
| ghcr.io/ | feffc0b8227d | orjson | 3.9.15 | 1 |