StackRadar

CVE-2024-7254

High

Advisory

Published 19 Sept 2024In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.028
86th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
256
of 17,781 indexed, latest versions
Container images
260
deployed by those charts
Fix available
5 of 5
affected packages

protobuf-java has potential Denial of Service issue

Carried by container images the latest versions of 256 of 17,781 indexed charts deploy, on 260 images.

Affected packageAffected versionsFixed inImages
protobuf-javamaven2.4.1, 2.5.0, 2.6.0, 2.6.1+56 more3.25.5, 4.27.5238
protobufdeb2.6.1-1.3, 3.0.0-9.1ubuntu1, 3.0.0-9.1ubuntu1.1, 3.6.1.3-2ubuntu5+2 more2.6.1-1.3ubuntu0.1~esm4, 3.0.0-9.1ubuntu1.1+esm3, 3.6.1.3-2ubuntu5.2+esm2, 3.21.12-3+deb12u114
google-protobufgem3.8.0, 3.22.3, 3.24.23.25.56
protobuf-javalitemaven3.11.4, 3.18.0, 3.19.4, 3.21.12+1 more3.25.56
protobuf-kotlinmaven3.19.43.25.53
OSV records
DEBIAN-CVE-2024-7254GHSA-735f-pc8j-v9w8UBUNTU-CVE-2024-7254
Also known as
USN-7629-2

Charts affected

256 by stars
ChartLatestAffected imagesRadar Score
sonarqubesonarqubeVerified publisher10.0.0+5211 of 3See more

sonarqube sonarqube 10.0.0+521

1 of the 3 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
library/sonarqube:10.0.0-communityef9723cf4fe4
protobuf-java@3.21.7
3.25.5

Open the chart page →

6,556
keycloakcodecentricVerified publisher18.10.01 of 3See more

keycloak codecentric 18.10.0

1 of the 3 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:17.0.1-legacy68f9f38c8f30
protobuf-java@3.19.2
3.25.5

Open the chart page →

7,713
milvusmilvus4.0.311 of 5See more

milvus milvus 4.0.31

1 of the 5 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.8.2d538416d5afe
protobuf-java@3.11.4
3.25.5

Open the chart page →

32,259
dependency-trackevryfs-ossVerified publisher1.5.51 of 3See more

dependency-track evryfs-oss 1.5.5

1 of the 3 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
dependencytrack/apiserver:4.6.3485ac0952c02
protobuf-java@3.19.4
3.25.5

Open the chart page →

2,503
rocketmqrocketmq12.6.02 of 2See more

rocketmq rocketmq 12.6.0

2 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
apache/rocketmq:5.4.0319cd8a81ed1
protobuf-java@3.20.1
3.25.5
apacherocketmq/rocketmq-dashboard:2.1.0ce78506bd6fe
protobuf-java@3.20.1
3.25.5

Open the chart page →

6,328
apicurio-registryapicurio-registry-helmVerified publisher3.8.01 of 2See more

apicurio-registry apicurio-registry-helm 3.8.0

1 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
quay.io/apicurio/apicurio-registry-mem:2.5.8.Final3b036692d546
protobuf-java@3.25.1
3.25.5

Open the chart page →

6,675
druiddruid-helmVerified publisher37.0.21 of 3See more

druid druid-helm 37.0.2

1 of the 3 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
apache/druid:37.0.00116fb802786
protobuf-java@3.7.1
3.25.5

Open the chart page →

3,812
sonarqube-ltssonarqubeVerified publisher1.0.16+981 of 4See more

sonarqube-lts sonarqube 1.0.16+98

1 of the 4 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
library/sonarqube:8.9.2-community88cd63154d4b
protobuf-java@3.8.0
3.25.5

Open the chart page →

4,099
metabasedeliveryheroVerified publisher0.14.41 of 1See more

metabase deliveryhero 0.14.4

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
metabase/metabase:v0.45.21fb334ce4820
protobuf-java@3.17.3
3.25.5

Open the chart page →

2,572
hdfsgaffer2.2.11 of 2See more

hdfs gaffer 2.2.1

1 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
gchq/hdfs:3.3.35ec58edbb2db
protobuf-java@2.5.0
3.25.5

Open the chart page →

5,357
kafkakafka18.0.11 of 1See more

kafka kafka 18.0.1

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
kafkace/kafka:v3.7.1-63ba8d27adc206bf5a4
protobuf-java@3.23.4
3.25.5

Open the chart page →

3,395
sparkmicrosoft1.0.42 of 3See more

spark microsoft 1.0.4

2 of the 3 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
dbanda/livy:0.80ca125e68e53
protobuf-java@2.5.0
3.25.5
dbanda/spark:2.4.6d0e6367876ae
protobuf-java@3.3.0
3.25.5

Open the chart page →

13,738
solrpreferred-aiVerified publisher3.2.01 of 3See more

solr preferred-ai 3.2.0

1 of the 3 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
library/solr:8.7.0d124efd81fbb
protobuf-java@3.11.0
3.25.5

Open the chart page →

6,048
hadoopbigdata-chartsVerified publisher1.0.12 of 2See more

hadoop bigdata-charts 1.0.1

2 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
5200710/hadoop:3.2.3-java8092d3088a5fb
protobuf-java@3.7.1
3.25.5
marcelmay/hadoop-hdfs-fsimage-exporter:1.3abeccb740ef7
protobuf-java@2.5.0
3.25.5

Open the chart page →

12,111
jira-softwaremoxVerified publisher2.7.11 of 3See more

jira-software mox 2.7.1

1 of the 3 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
atlassian/jira-software:9.7.264a75aa4ec4e
protobuf-java@3.21.9
3.25.5

Open the chart page →

8,636
druidwiremindVerified publisher1.22.11 of 3See more

druid wiremind 1.22.1

1 of the 3 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
apache/druid:29.0.10cef139b6bf1
protobuf-java@3.7.1
3.25.5

Open the chart page →

7,930
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
bitnamilegacy/elasticsearch:8.12.1-debian-11-r29cfd2df1294d
protobuf-java@3.21.9
3.25.5

Open the chart page →

27,267
hertzbeathertzbeatOfficialVerified publisher1.8.12 of 4See more

hertzbeat hertzbeat 1.8.1

2 of the 4 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
apache/hertzbeat:1.8.075d48a62748f
protobuf-java@3.21.11
3.25.5
apache/hertzbeat-collector:1.8.0a2bab1be574c
protobuf-java@3.21.11
3.25.5

Open the chart page →

14,000
kamu-api-serverkamuVerified publisher0.89.01 of 1See more

kamu-api-server kamu 0.89.0

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
ghcr.io/kamu-data/kamu-api-server:0.89.04ed7a896dd2b
protobuf@3.6.1.3-2ubuntu5.2
3.6.1.3-2ubuntu5.2+esm2

Open the chart page →

6,307
unifi-controllerqonstruktVerified publisher2.6.11 of 1See more

unifi-controller qonstrukt 2.6.1

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
linuxserver/unifi-controller:8.0.240ae315a3a456
protobuf-java@3.6.0
3.25.5

Open the chart page →

10,469
flinkriskfocus0.2.01 of 1See more

flink riskfocus 0.2.0

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
library/flink:1.11.2-scala_2.121fe4fb22a2a5
protobuf-java@2.6.1
3.25.5

Open the chart page →

3,235
sonarqube-dcesonarqubeVerified publisher0.1.2+1212 of 5See more

sonarqube-dce sonarqube 0.1.2+121

2 of the 5 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
library/sonarqube:9.1.0-datacenter-search7e43ff493a47
protobuf-java@3.14.0
3.25.5
library/sonarqube:9.1.0-datacenter-appa9bc5a3a1fc3
protobuf-java@3.11.4
3.25.5

Open the chart page →

8,698
hivebigdata-chartsVerified publisher0.1.81 of 1See more

hive bigdata-charts 0.1.8

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
5200710/hive:3.1.3-postgresql-metastoree34ab066d2ed
protobuf-java@2.5.0
3.25.5

Open the chart page →

7,166
cloudflowcloudflow-helm-charts0.0.0-NIGHTLY011220201 of 1See more

cloudflow cloudflow-helm-charts 0.0.0-NIGHTLY01122020

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
lightbend/cloudflow-operator:0.0.0-NIGHTLY011220202647f396de23
protobuf-java@3.11.4
3.25.5

Open the chart page →

1,886
hdfsdmwm-bigdataVerified publisher1.0.12 of 2See more

hdfs dmwm-bigdata 1.0.1

2 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
gradiant/hdfs:3.2.2e3bf364fe713
protobuf-java@2.5.0
3.25.5
marcelmay/hadoop-hdfs-fsimage-exporter:1.26292c0a41ffa
protobuf-java@2.5.0
3.25.5

Open the chart page →

7,948
hivedmwm-bigdataVerified publisher0.1.64 of 5See more

hive dmwm-bigdata 0.1.6

4 of the 5 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
bde2020/hive:2.3.2-postgresql-metastore620267768985
protobuf-java@2.5.0
3.25.5
gradiant/hdfs:2.7.73b28784ba41f
protobuf-java@2.5.0
3.25.5
gradiant/hive:2.3.2-postgresql-metastoreaae4f8a21f8b
protobuf-java@2.5.0
3.25.5
marcelmay/hadoop-hdfs-fsimage-exporter:1.26292c0a41ffa
protobuf-java@2.5.0
3.25.5

Open the chart page →

20,837
edgelessdbedgelesssysVerified publisher0.3.21 of 1See more

edgelessdb edgelesssys 0.3.2

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
ghcr.io/edgelesssys/edgelessdb-sgx-1gb:v0.3.27e1d7a11a11a
protobuf@3.6.1.3-2ubuntu5
3.6.1.3-2ubuntu5.2+esm2

Open the chart page →

4,830
signal-cli-rest-apigeek-cookbookVerified publisher1.2.21 of 1See more

signal-cli-rest-api geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
bbernhard/signal-cli-rest-api:0.57549ad08d7e14
protobuf-javalite@3.11.4
3.25.5

Open the chart page →

10,154
unifigeek-cookbookVerified publisher5.1.31 of 1See more

unifi geek-cookbook 5.1.3

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
jacobalberty/unifi:v7.4.162b3edc809a3ff
protobuf-java@3.6.0
3.25.5

Open the chart page →

11,839
hazelcasthazelcastVerified publisher5.10.22 of 2See more

hazelcast hazelcast 5.10.2

2 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
hazelcast/hazelcast:5.5.05dd5d31c7a06
protobuf-java@3.21.12
3.25.5
hazelcast/management-center:5.5.2991ddb27c251
protobuf-java@3.25.3
3.25.5

Open the chart page →

2,634
hive-metastoreheva-helm-chartsVerified publisher0.2.01 of 2See more

hive-metastore heva-helm-charts 0.2.0

1 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
sslhep/hive-metastore:3.1.39e80af083079
protobuf-java@2.5.0
3.25.5

Open the chart page →

7,335
cratedbhmdmph2.0.31 of 2See more

cratedb hmdmph 2.0.3

1 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
library/crate:4.7.0c7984a05e15b
protobuf-java@2.5.0
3.25.5

Open the chart page →

1,335
skywalkingkubesphere-testVerified publisher3.1.01 of 4See more

skywalking kubesphere-test 3.1.0

1 of the 4 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
apache/skywalking-oap-server:8.1.0-es7641237e0299b
protobuf-java@3.11.4
3.25.5

Open the chart page →

18,042
kafdroplsst-sqre0.1.31 of 1See more

kafdrop lsst-sqre 0.1.3

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
obsidiandynamics/kafdrop:3.30.05337c9e0e2de
protobuf-java@3.19.1
3.25.5

Open the chart page →

7,901
oesopsmxVerified publisher4.0.324 of 25See more

oes opsmx 4.0.32

4 of the 25 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
protobuf-java@3.21.12
3.25.5
quay.io/opsmxpublic/ubi8-oes-audit-client:isd-spin-2025.10.01-cb1bfce-20251126103732a5b1887eab
protobuf-java@3.23.4
3.25.5
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
protobuf-java@3.21.7
3.25.5
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
protobuf-java@3.25.2
3.25.5

Open the chart page →

107,811
repoflowrepoflow-helm-public0.9.11 of 8See more

repoflow repoflow-helm-public 0.9.1

1 of the 8 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
library/elasticsearch:8.15.0310b9fc03b06
protobuf-java@3.21.9
3.25.5

Open the chart page →

13,521
rocketmq-clusterrocketmq12.6.02 of 2See more

rocketmq-cluster rocketmq 12.6.0

2 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
apache/rocketmq:5.4.0319cd8a81ed1
protobuf-java@3.20.1
3.25.5
apacherocketmq/rocketmq-dashboard:2.1.0ce78506bd6fe
protobuf-java@3.20.1
3.25.5

Open the chart page →

6,328
hive-metastoreslamdev0.0.51 of 2See more

hive-metastore slamdev 0.0.5

1 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
slamdev/apache-hive:2.3.9-2.10.1b4b029c9b15f
protobuf-java@2.5.0
3.25.5

Open the chart page →

8,198
thingsboard-clusterthingsboard-cluster-bettaVerified publisher0.2.261 of 6See more

thingsboard-cluster thingsboard-cluster-betta 0.2.26

1 of the 6 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
thingsboard/tb-node:3.6.0f40a542832c4
protobuf-java@3.21.9
3.25.5

Open the chart page →

14,566
feedbacksystemthm-mni-iiVerified publisher0.47.11 of 10See more

feedbacksystem thm-mni-ii 0.47.1

1 of the 10 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
thmmniii/fbs-runner:v1.27.186105349c1a3
protobuf-java@3.21.9
3.25.5

Open the chart page →

28,534
apache-rangerapache-ranger0.1.01 of 2See more

apache-ranger apache-ranger 0.1.0

1 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
apache/ranger:2.7.076c176e8a0e4
protobuf-java@3.7.1
3.25.5

Open the chart page →

7,740
soarv113assist-iot-cybersecurity-monitoring-soar0.1.31 of 5See more

soarv113 assist-iot-cybersecurity-monitoring-soar 0.1.3

1 of the 5 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_ir-thv:latestc8b6c7eaa0cd
protobuf-java@2.5.0
3.25.5

Open the chart page →

17,896
siemassist-iot-cybersecurity-monitroting-siem0.1.01 of 3See more

siem assist-iot-cybersecurity-monitroting-siem 0.1.0

1 of the 3 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_id-elk:latestba1d85ec3739
protobuf-java@3.11.0
3.25.5

Open the chart page →

10,730
hadoopcloudnativeapp1.1.01 of 1See more

hadoop cloudnativeapp 1.1.0

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
danisla/hadoop:2.9.0255ba2dd739b
protobuf-java@2.5.0
3.25.5

Open the chart page →

5,772
ignitecloudnativeapp1.0.01 of 1See more

ignite cloudnativeapp 1.0.0

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
apacheignite/ignite:2.7.0d7deab68b8fa
protobuf-java@2.5.0
3.25.5

Open the chart page →

7,891
nifid4nVerified publisher2.0.01 of 5See more

nifi d4n 2.0.0

1 of the 5 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
apache/nifi-registry:1.26.07cdfd8deec92
protobuf-java@3.24.3
3.25.5

Open the chart page →

5,398
data-fairdata354-helmVerified publisher1.1.21 of 12See more

data-fair data354-helm 1.1.2

1 of the 12 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
ghcr.io/data-fair/elasticsearch:7.17.1aa45adaf59a7
protobuf-java@3.16.1
3.25.5

Open the chart page →

38,346
hbasedmwm-bigdataVerified publisher0.1.63 of 5See more

hbase dmwm-bigdata 0.1.6

3 of the 5 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
gradiant/hbase-base:2.0.1a1ee6de94c04
protobuf-java@2.5.0
3.25.5
gradiant/hdfs:2.7.73b28784ba41f
protobuf-java@2.5.0
3.25.5
marcelmay/hadoop-hdfs-fsimage-exporter:1.26292c0a41ffa
protobuf-java@2.5.0
3.25.5

Open the chart page →

13,392
hive-metastoredmwm-bigdataVerified publisher0.1.31 of 2See more

hive-metastore dmwm-bigdata 0.1.3

1 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
bde2020/hive:2.3.2-postgresql-metastore620267768985
protobuf-java@2.5.0
3.25.5

Open the chart page →

6,882
opentsdbdmwm-bigdataVerified publisher0.1.74 of 6See more

opentsdb dmwm-bigdata 0.1.7

4 of the 6 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
gradiant/hbase-base:2.0.1a1ee6de94c04
protobuf-java@2.5.0
3.25.5
gradiant/hdfs:2.7.73b28784ba41f
protobuf-java@2.5.0
3.25.5
gradiant/opentsdb:2.4.0c33d53913869
protobuf-java@2.5.0
3.25.5
marcelmay/hadoop-hdfs-fsimage-exporter:1.26292c0a41ffa
protobuf-java@2.5.0
3.25.5

Open the chart page →

17,511

Container images carrying it

260 by charts deploying them

A fixed version is listed for 5 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/streamingfast/substreams-sink-kv:v2.3.026953ec68d5d
protobuf@3.6.1.3-2ubuntu5.2
3.6.1.3-2ubuntu5.2+esm2
1
ghcr.io/streamingfast/substreams-sink-noop:v1.4.0d7c43c3135c6
protobuf@3.6.1.3-2ubuntu5.2
3.6.1.3-2ubuntu5.2+esm2
1
public.ecr.aws/v0r6c2e2/hive-metastore:latest794b3bff9510
protobuf-java@3.7.1
3.25.5
1
quay.io/apicurio/apicurio-registry-mem:2.5.8.Final3b036692d546
protobuf-java@3.25.1
3.25.5
1
quay.io/fiware/waltid:1.14.1-SNAPSHOT93889c3d8a34
protobuf-java@3.19.3
protobuf-javalite@3.18.0
3.25.5
3.25.5
1
quay.io/keycloak/keycloak:14.0.03029dc0f1d38
protobuf-java@3.12.2
3.25.5
1
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
protobuf-java@3.21.12
3.25.5
1
quay.io/opsmxpublic/ubi8-oes-audit-client:isd-spin-2025.10.01-cb1bfce-20251126103732a5b1887eab
protobuf-java@3.23.4
3.25.5
1
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
protobuf-java@3.21.7
3.25.5
1
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
protobuf-java@3.25.2
3.25.5
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.