StackRadar

CVE-2024-37168

Medium

Advisory

Published 10 Jun 2024In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.007
50th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
34
of 17,781 indexed, latest versions
Container images
32
deployed by those charts
Fix available
1 of 1
affected package

@grpc/grpc-js can allocate memory for incoming messages well above configured limits

Carried by container images the latest versions of 34 of 17,781 indexed charts deploy, on 32 images.

Affected packageAffected versionsFixed inImages
@grpc/grpc-jsnpm1.1.8, 1.3.2, 1.3.3, 1.4.2+16 more1.8.22, 1.9.15, 1.10.932
OSV records
GHSA-7v5v-9h63-cj86

Charts affected

34 by stars
ChartLatestAffected imagesRadar Score
n8nn8n0.23.01 of 1See more

n8n n8n 0.23.0

1 of the 1 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
n8nio/n8n:1.33.1dd171d45102a
@grpc/grpc-js@1.8.21
1.8.22

Open the chart page →

5,639
kubeflowkubeflow1.6.21 of 45See more

kubeflow kubeflow 1.6.2

1 of the 45 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
kubeflownotebookswg/centraldashboard:v1.6.137300551dea6
@grpc/grpc-js@1.4.4
1.8.22

Open the chart page →

96,941
code-serveralekcVerified publisher0.1.11 of 1See more

code-server alekc 0.1.1

1 of the 1 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
linuxserver/code-server:4.10.1a5e43a05ae79
@grpc/grpc-js@1.6.12
1.8.22

Open the chart page →

8,212
dltbrokerassist-iot-distributed-broker0.2.01 of 9See more

dltbroker assist-iot-distributed-broker 0.2.0

1 of the 9 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
@grpc/grpc-js@1.9.13
1.9.15

Open the chart page →

77,706
dltloggingassist-iot-logging-auditing0.2.01 of 9See more

dltlogging assist-iot-logging-auditing 0.2.0

1 of the 9 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
@grpc/grpc-js@1.9.13
1.9.15

Open the chart page →

77,687
uptimekumahelm-l3st86Verified publisher0.1.101 of 1See more

uptimekuma helm-l3st86 0.1.10

1 of the 1 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.1396510915e6be
@grpc/grpc-js@1.7.3
1.8.22

Open the chart page →

4,196
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
codercom/code-server:4.11.0-debian1e2cc688008e
@grpc/grpc-js@1.6.12
1.8.22

Open the chart page →

31,844
dltkvassist-iot-data-integrity-verification0.2.01 of 9See more

dltkv assist-iot-data-integrity-verification 0.2.0

1 of the 9 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.0.0e36a8922fa0c
@grpc/grpc-js@1.9.13
1.9.15

Open the chart page →

77,706
dltflassist-iot-dlt-based-fl0.2.01 of 9See more

dltfl assist-iot-dlt-based-fl 0.2.0

1 of the 9 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
assistiot/dlt_api:2.1.0c8a170683be7
@grpc/grpc-js@1.4.2
1.8.22

Open the chart page →

77,706
uptime-kumadjjudas21Verified publisher1.5.181 of 1See more

uptime-kuma djjudas21 1.5.18

1 of the 1 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.23.12bc6f244ecf27
@grpc/grpc-js@1.7.3
1.8.22

Open the chart page →

4,217
eolo-plannereolo-planner-repo0.1.01 of 7See more

eolo-planner eolo-planner-repo 0.1.0

1 of the 7 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
arturisimo/server-urjc:v1.0d8dc4430531e
@grpc/grpc-js@1.4.4
1.8.22

Open the chart page →

27,096
galoy-paygaloymoney0.11.481 of 2See more

galoy-pay galoymoney 0.11.48

1 of the 2 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
krtk6160/galoy-nostrdigest-pinnedcc82a694f818
@grpc/grpc-js@1.8.8
1.8.22

Open the chart page →

2,528
galoy-paygaloymoney20.11.481 of 2See more

galoy-pay galoymoney2 0.11.48

1 of the 2 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
krtk6160/galoy-nostrdigest-pinnedcc82a694f818
@grpc/grpc-js@1.8.8
1.8.22

Open the chart page →

2,528
ghostghostVerified publisher0.1.01 of 4See more

ghost ghost 0.1.0

1 of the 4 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
library/ghost:5.79.083f7bf209844
@grpc/grpc-js@1.9.7
1.9.15

Open the chart page →

9,019
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-paymentserviceb0f13eef3abf
@grpc/grpc-js@1.10.8
1.10.9

Open the chart page →

49,025
dtlinfradao0.0.11 of 1See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
@grpc/grpc-js@1.8.0
1.8.22

Open the chart page →

4,944
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
@grpc/grpc-js@1.3.2
1.8.22

Open the chart page →

7,232
kubeflowkromanow94-kubeflow0.5.11 of 30See more

kubeflow kromanow94-kubeflow 0.5.1

1 of the 30 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
kubeflownotebookswg/centraldashboard:v1.9.2af55c22ef5de
@grpc/grpc-js@1.10.8
1.10.9

Open the chart page →

70,530
tooljetkrzwiatrzyk1.1.11 of 2See more

tooljet krzwiatrzyk 1.1.1

1 of the 2 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
tooljet/tooljet-ce:v1.18.0c85a4720e42e
@grpc/grpc-js@1.4.6
1.8.22

Open the chart page →

5,410
eoloplantmca-eoloplaner0.1.01 of 7See more

eoloplant mca-eoloplaner 0.1.0

1 of the 7 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
hugohg34/server:0.0.2503e5d8960ff
@grpc/grpc-js@1.4.4
1.8.22

Open the chart page →

29,588
middleware-odigosmiddleware-labsVerified publisher0.2.411 of 6See more

middleware-odigos middleware-labs 0.2.41

1 of the 6 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/odigos-odiglet:middleware-test-0.0.103c8c835ecee
@grpc/grpc-js@1.8.11
1.8.22

Open the chart page →

8,370
middleware-visionmiddleware-labsVerified publisher0.2.651 of 6See more

middleware-vision middleware-labs 0.2.65

1 of the 6 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/vision-odiglet:middleware-test-0.0.3bce34c98668e
@grpc/grpc-js@1.8.12
1.8.22

Open the chart page →

8,361
finance-portalmojaloop5.1.41 of 11See more

finance-portal mojaloop 5.1.4

1 of the 11 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
mojaloop/role-assignment-service:v2.1.0def4bf273721
@grpc/grpc-js@1.9.14
1.9.15

Open the chart page →

14,809
role-assignment-servicemojaloop3.1.01 of 1See more

role-assignment-service mojaloop 3.1.0

1 of the 1 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
mojaloop/role-assignment-service:v2.1.0def4bf273721
@grpc/grpc-js@1.9.14
1.9.15

Open the chart page →

2,316
myawesomeappmyawesomapp-mitchxxx0.1.11 of 1See more

myawesomeapp myawesomapp-mitchxxx 0.1.1

1 of the 1 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
mitchxxx/amazon:214e72480ec63a
@grpc/grpc-js@1.8.14
1.8.22

Open the chart page →

2,116
myawesomeapp14myawesomeapp140.1.11 of 1See more

myawesomeapp14 myawesomeapp14 0.1.1

1 of the 1 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
ccjacobs14/amazon:59a9b14a6f09e
@grpc/grpc-js@1.8.14
1.8.22

Open the chart page →

2,116
myawesomeapp-janmyawesomeapp-jan0.1.11 of 1See more

myawesomeapp-jan myawesomeapp-jan 0.1.1

1 of the 1 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
ooghenekaro/amazon:latest03394ba1d6d8
@grpc/grpc-js@1.8.14
1.8.22

Open the chart page →

2,144
myawesomeapp-marmyawesomeapp-mar0.1.11 of 1See more

myawesomeapp-mar myawesomeapp-mar 0.1.1

1 of the 1 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
winfred008/amazon:910a68de5b398
@grpc/grpc-js@1.8.14
1.8.22

Open the chart page →

2,116
uptime-kumasarab97Verified publisher0.1.51 of 1See more

uptime-kuma sarab97 0.1.5

1 of the 1 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.22.10b55bcb83a1c
@grpc/grpc-js@1.7.3
1.8.22

Open the chart page →

4,744
unifi-protectschichtelVerified publisher0.10.11 of 1See more

unifi-protect schichtel 0.10.1

1 of the 1 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
markdegroot/unifi-protect-arm64:latestd8445f2a0de6
@grpc/grpc-js@1.6.12
1.8.22

Open the chart page →

5,582
fdi-dotstatsuite-dlmstatcan0.3.11 of 1See more

fdi-dotstatsuite-dlm statcan 0.3.1

1 of the 1 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
@grpc/grpc-js@1.3.3
1.8.22

Open the chart page →

3,881
thingsboardthingsboardVerified publisher0.1.31 of 12See more

thingsboard thingsboard 0.1.3

1 of the 12 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
thingsboard/tb-js-executor:3.4.113e1eadf8ace
@grpc/grpc-js@1.6.7
1.8.22

Open the chart page →

25,394
kubernetes-external-secretstrozz6.3.01 of 1See more

kubernetes-external-secrets trozz 6.3.0

1 of the 1 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/kubernetes-external-secrets:6.3.0eab9bd0b6986
@grpc/grpc-js@1.1.8
1.8.22

Open the chart page →

2,838
workadventureworkadventure1.1.03 of 9See more

workadventure workadventure 1.1.0

3 of the 9 container images this version deploys carry CVE-2024-37168.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-back:v1.17.764001369dad5
@grpc/grpc-js@1.8.13
1.8.22
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
@grpc/grpc-js@1.8.13
1.8.22
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
@grpc/grpc-js@1.8.13
1.8.22

Open the chart page →

16,083

Container images carrying it

32 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
assistiot/dlt_api:2.0.0e36a8922fa0c
@grpc/grpc-js@1.9.13
1.9.15
3
krtk6160/galoy-nostrcc82a694f818
@grpc/grpc-js@1.8.8
1.8.22
2
mojaloop/role-assignment-service:v2.1.0def4bf273721
@grpc/grpc-js@1.9.14
1.9.15
2
arturisimo/server-urjc:v1.0d8dc4430531e
@grpc/grpc-js@1.4.4
1.8.22
1
assistiot/dlt_api:2.1.0c8a170683be7
@grpc/grpc-js@1.4.2
1.8.22
1
ccjacobs14/amazon:59a9b14a6f09e
@grpc/grpc-js@1.8.14
1.8.22
1
codercom/code-server:4.11.0-debian1e2cc688008e
@grpc/grpc-js@1.6.12
1.8.22
1
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
@grpc/grpc-js@1.8.0
1.8.22
1
hugohg34/server:0.0.2503e5d8960ff
@grpc/grpc-js@1.4.4
1.8.22
1
kubeflownotebookswg/centraldashboard:v1.6.137300551dea6
@grpc/grpc-js@1.4.4
1.8.22
1
kubeflownotebookswg/centraldashboard:v1.9.2af55c22ef5de
@grpc/grpc-js@1.10.8
1.10.9
1
library/ghost:5.79.083f7bf209844
@grpc/grpc-js@1.9.7
1.9.15
1
linuxserver/code-server:4.10.1a5e43a05ae79
@grpc/grpc-js@1.6.12
1.8.22
1
louislam/uptime-kuma:1.22.10b55bcb83a1c
@grpc/grpc-js@1.7.3
1.8.22
1
louislam/uptime-kuma:1.23.1396510915e6be
@grpc/grpc-js@1.7.3
1.8.22
1
louislam/uptime-kuma:1.23.12bc6f244ecf27
@grpc/grpc-js@1.7.3
1.8.22
1
markdegroot/unifi-protect-arm64:latestd8445f2a0de6
@grpc/grpc-js@1.6.12
1.8.22
1
mitchxxx/amazon:214e72480ec63a
@grpc/grpc-js@1.8.14
1.8.22
1
n8nio/n8n:1.33.1dd171d45102a
@grpc/grpc-js@1.8.21
1.8.22
1
ooghenekaro/amazon:latest03394ba1d6d8
@grpc/grpc-js@1.8.14
1.8.22
1
roadiehq/community-backstage-image:latestef355bf5b639
@grpc/grpc-js@1.3.2
1.8.22
1
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
@grpc/grpc-js@1.3.3
1.8.22
1
thecodingmachine/workadventure-back:v1.17.764001369dad5
@grpc/grpc-js@1.8.13
1.8.22
1
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
@grpc/grpc-js@1.8.13
1.8.22
1
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
@grpc/grpc-js@1.8.13
1.8.22
1
thingsboard/tb-js-executor:3.4.113e1eadf8ace
@grpc/grpc-js@1.6.7
1.8.22
1
tooljet/tooljet-ce:v1.18.0c85a4720e42e
@grpc/grpc-js@1.4.6
1.8.22
1
winfred008/amazon:910a68de5b398
@grpc/grpc-js@1.8.14
1.8.22
1
ghcr.io/external-secrets/kubernetes-external-secrets:6.3.0eab9bd0b6986
@grpc/grpc-js@1.1.8
1.8.22
1
ghcr.io/middleware-labs/odigos-odiglet:middleware-test-0.0.103c8c835ecee
@grpc/grpc-js@1.8.11
1.8.22
1
ghcr.io/middleware-labs/vision-odiglet:middleware-test-0.0.3bce34c98668e
@grpc/grpc-js@1.8.12
1.8.22
1
ghcr.io/open-telemetry/demo:1.12.0-paymentserviceb0f13eef3abf
@grpc/grpc-js@1.10.8
1.10.9
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.