StackRadar

CVE-2024-7254

High

Advisory

Published 19 Sept 2024In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.028
86th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
256
of 17,781 indexed, latest versions
Container images
260
deployed by those charts
Fix available
5 of 5
affected packages

protobuf-java has potential Denial of Service issue

Carried by container images the latest versions of 256 of 17,781 indexed charts deploy, on 260 images.

Affected packageAffected versionsFixed inImages
protobuf-javamaven2.4.1, 2.5.0, 2.6.0, 2.6.1+56 more3.25.5, 4.27.5238
protobufdeb2.6.1-1.3, 3.0.0-9.1ubuntu1, 3.0.0-9.1ubuntu1.1, 3.6.1.3-2ubuntu5+2 more2.6.1-1.3ubuntu0.1~esm4, 3.0.0-9.1ubuntu1.1+esm3, 3.6.1.3-2ubuntu5.2+esm2, 3.21.12-3+deb12u114
google-protobufgem3.8.0, 3.22.3, 3.24.23.25.56
protobuf-javalitemaven3.11.4, 3.18.0, 3.19.4, 3.21.12+1 more3.25.56
protobuf-kotlinmaven3.19.43.25.53
OSV records
DEBIAN-CVE-2024-7254GHSA-735f-pc8j-v9w8UBUNTU-CVE-2024-7254
Also known as
USN-7629-2

Charts affected

256 by stars
ChartLatestAffected imagesRadar Score
idmassist-iot-identity-manager0.1.01 of 2See more

idm assist-iot-identity-manager 0.1.0

1 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
assistiot/identity-manager_kc:latest0df4b4fa899a
protobuf-java@3.19.2
3.25.5

Open the chart page →

13,352
videoaugmentationassist-iot-video-augmentation0.1.01 of 3See more

videoaugmentation assist-iot-video-augmentation 0.1.0

1 of the 3 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
assistiot/video_augmentation:runner-cpu-lateste5ae539ce2cb
protobuf@3.6.1.3-2ubuntu5.2
3.6.1.3-2ubuntu5.2+esm2

Open the chart page →

13,913
asya-playgroundasya1.1.31 of 1See more

asya-playground asya 1.1.3

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
localstack/localstack:3.19d278167f2b7
protobuf-java@3.21.5
3.25.5

Open the chart page →

9,412
axelor-open-suiteaxelor-open-suiteVerified publisher7.2.581 of 2See more

axelor-open-suite axelor-open-suite 7.2.58

1 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
pmoscode/axelor-open-suite:v7.2.57a58f4d762f5c
protobuf-java@3.19.4
3.25.5

Open the chart page →

9,722
opendistro-esbeeinventor1.15.11 of 3See more

opendistro-es beeinventor 1.15.1

1 of the 3 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch:1.13.32acfa1dcc5f8
protobuf-java@3.11.0
3.25.5

Open the chart page →

5,806
firehoseblip-firehoseVerified publisher0.0.181 of 11See more

firehose blip-firehose 0.0.18

1 of the 11 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
obsidiandynamics/kafdrop:3.30.05337c9e0e2de
protobuf-java@3.19.1
3.25.5

Open the chart page →

13,459
bluerange-serverbluerangeOfficialVerified publisher1.3.11 of 1See more

bluerange-server bluerange 1.3.1

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
bluerange/bluerange:26.1.307c8f73b55df
protobuf-java@3.25.3
3.25.5

Open the chart page →

1,816
otbrcharts-derwitt-devVerified publisher0.2.01 of 1See more

otbr charts-derwitt-dev 0.2.0

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
openthread/otbr:latestf307f59f6432
protobuf@3.0.0-9.1ubuntu1.1
3.0.0-9.1ubuntu1.1+esm3

Open the chart page →

12,779
riemanncloudnativeapp0.1.21 of 1See more

riemann cloudnativeapp 0.1.2

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
raykrueger/riemann:0.2.14c8baf3de57bb
protobuf-java@2.6.1
3.25.5

Open the chart page →

6,497
rundeckcloudnativeapp0.1.01 of 2See more

rundeck cloudnativeapp 0.1.0

1 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
rundeck/rundeck:3.0.16b13e8059ad72
protobuf-java@3.5.1
3.25.5

Open the chart page →

23,665
spark-history-servercloudnativeapp1.0.01 of 3See more

spark-history-server cloudnativeapp 1.0.0

1 of the 3 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
lightbend/spark-history-server:2.4.00bedf37f428a
protobuf-java@2.5.0
3.25.5

Open the chart page →

14,066
unificloudnativeapp0.4.21 of 1See more

unifi cloudnativeapp 0.4.2

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
jacobalberty/unifi:5.10.19c409924e2463
protobuf-java@3.6.1
3.25.5

Open the chart page →

22,442
webpagetest-agentcloudnativeapp0.2.01 of 1See more

webpagetest-agent cloudnativeapp 0.2.0

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
protobuf@2.6.1-1.3
protobuf-java@2.5.0
2.6.1-1.3ubuntu0.1~esm4
3.25.5

Open the chart page →

77,758
dependency-trackcnieg3.0.81 of 2See more

dependency-track cnieg 3.0.8

1 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
dependencytrack/apiserver:4.6.3485ac0952c02
protobuf-java@3.19.4
3.25.5

Open the chart page →

2,503
pulsarcnieg1.0.82 of 2See more

pulsar cnieg 1.0.8

2 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.6.14db6ff0b4045
protobuf-java@3.5.1
3.25.5
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
protobuf-java@2.4.1
3.25.5

Open the chart page →

16,860
sumo-besu-genesisconsensys0.1.751 of 1See more

sumo-besu-genesis consensys 0.1.75

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
hyperledger/besu:22.4-openjdk-latesta674d35eec9a
protobuf-java@3.19.4
3.25.5

Open the chart page →

7,963
sumo-besu-nodeconsensys0.1.751 of 4See more

sumo-besu-node consensys 0.1.75

1 of the 4 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
hyperledger/besu:22.4-openjdk-latesta674d35eec9a
protobuf-java@3.19.4
3.25.5

Open the chart page →

7,963
cp-helm-chartscp-helm-charts0.6.16 of 8See more

cp-helm-charts cp-helm-charts 0.6.1

6 of the 8 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
confluentinc/cp-enterprise-control-center:6.1.0f2975d507a2a
protobuf-java@3.11.4
3.25.5
confluentinc/cp-enterprise-kafka:6.1.08f1544df1f48
protobuf-java@3.11.4
3.25.5
confluentinc/cp-kafka-connect:6.1.04bc70a83ca6f
protobuf-java@3.11.4
3.25.5
confluentinc/cp-kafka-rest:6.1.0b0b7aa26254a
protobuf-java@3.11.4
3.25.5
confluentinc/cp-ksqldb-server:6.1.0ee403d5b9090
protobuf-java@3.11.4
3.25.5
confluentinc/cp-schema-registry:6.1.0b651d4b6185a
protobuf-java@3.11.4
3.25.5

Open the chart page →

58,857
nifi-registryd4nVerified publisher1.0.01 of 2See more

nifi-registry d4n 1.0.0

1 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
apache/nifi-registry:1.26.07cdfd8deec92
protobuf-java@3.24.3
3.25.5

Open the chart page →

5,398
apache-ranger-admindata-platform-stableVerified publisher0.2.01 of 2See more

apache-ranger-admin data-platform-stable 0.2.0

1 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
egdsandaru/apache-ranger-admin:1.0.0681baa1926f4
protobuf-java@2.5.0
3.25.5

Open the chart page →

8,245
eoloplannerdfa-amm-eoloplannerVerified publisher0.1.01 of 7See more

eoloplanner dfa-amm-eoloplanner 0.1.0

1 of the 7 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
amartinm82/planner:v2.01184353ff57b
protobuf-java@3.10.0
3.25.5

Open the chart page →

27,550
spark-standalonedmwm-bigdataVerified publisher0.1.01 of 2See more

spark-standalone dmwm-bigdata 0.1.0

1 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
gradiant/spark:2.4.4-python-alpine97657d56e927
protobuf-java@2.5.0
3.25.5

Open the chart page →

6,147
spark-shuffleduyet0.2.01 of 1See more

spark-shuffle duyet 0.2.0

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
snappydatainc/spark-shuffle:v2.2.0-kubernetes-0.5.1fd4b2070466f
protobuf-java@2.5.0
3.25.5

Open the chart page →

5,639
rundeckdwardu-helm-charts0.3.41 of 2See more

rundeck dwardu-helm-charts 0.3.4

1 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
rundeck/rundeck:3.2.74d64fe56f767
protobuf-java@3.5.1
3.25.5

Open the chart page →

19,802
dshackledysnixVerified publisher0.1.11 of 2See more

dshackle dysnix 0.1.1

1 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
emeraldpay/dshackle:0.12ac2a4bc66ab6
protobuf-java@3.12.0
3.25.5

Open the chart page →

2,237
marblerun-coordinatoredgelesssysVerified publisher0.5.01 of 1See more

marblerun-coordinator edgelesssys 0.5.0

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
ghcr.io/edgelesssys/coordinator:v0.5.0bcd5b8d4c45c
protobuf@3.0.0-9.1ubuntu1
3.0.0-9.1ubuntu1.1+esm3

Open the chart page →

10,981
elasticsearch-umbrellaempathyco0.8.121 of 3See more

elasticsearch-umbrella empathyco 0.8.12

1 of the 3 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
empathyco/elasticsearch:7.17.2-memlock03e724e41eeb
protobuf-java@3.16.1
3.25.5

Open the chart page →

10,564
eolicplantseolicplantsVerified publisher0.1.01 of 7See more

eolicplants eolicplants 0.1.0

1 of the 7 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
oscarsotosanchez/planner:v1.0730c00a099b8
protobuf-java@3.10.0
3.25.5

Open the chart page →

27,291
eoloPlanteolo-plannerVerified publisher0.1.01 of 7See more

eoloPlant eolo-planner 0.1.0

1 of the 7 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
mastercloudapps/planner:v1.2340a950b311b2
protobuf-java@3.10.0
3.25.5

Open the chart page →

27,537
eoloplannereoloplannerVerified publisher0.1.01 of 7See more

eoloplanner eoloplanner 0.1.0

1 of the 7 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
codeurjc/planner:v1.0800cf520c245
protobuf-java@3.10.0
3.25.5

Open the chart page →

32,205
eoloPlannerCommunicationsKubernetes3eoloplannercommunicationskuberneteshelmVerified publisher0.1.01 of 7See more

eoloPlannerCommunicationsKubernetes3 eoloplannercommunicationskuberneteshelm 0.1.0

1 of the 7 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
mastercloudapps/planner:v1.2340a950b311b2
protobuf-java@3.10.0
3.25.5

Open the chart page →

27,537
eoloplanner-mcaeoloplanner-mcaVerified publisher0.1.01 of 7See more

eoloplanner-mca eoloplanner-mca 0.1.0

1 of the 7 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
franrobles8/planner:v3.099985392d63c
protobuf-java@3.10.0
3.25.5

Open the chart page →

27,256
eoloplannereoloplanner-molynx-gat0.1.01 of 7See more

eoloplanner eoloplanner-molynx-gat 0.1.0

1 of the 7 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
molynx/planner:v1441c9f52f092
protobuf-java@3.10.0
3.25.5

Open the chart page →

28,482
eolo-plannereolo-planner-repo0.1.01 of 7See more

eolo-planner eolo-planner-repo 0.1.0

1 of the 7 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
arturisimo/planner:v1.0fff9de644941
protobuf-java@3.10.0
3.25.5

Open the chart page →

27,096
eoloplanteoloplant1.0.01 of 7See more

eoloplant eoloplant 1.0.0

1 of the 7 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
mastercloudapps/planner:v1.2340a950b311b2
protobuf-java@3.10.0
3.25.5

Open the chart page →

27,537
eoloplantseoloplants-urjcVerified publisher0.1.01 of 7See more

eoloplants eoloplants-urjc 0.1.0

1 of the 7 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
lourdesmorente/new-planner:1.0.0608745878cdb
protobuf-java@3.10.0
3.25.5

Open the chart page →

27,721
servereoloserverVerified publisher0.1.01 of 7See more

server eoloserver 0.1.0

1 of the 7 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
codeurjc/planner:v1.0800cf520c245
protobuf-java@3.10.0
3.25.5

Open the chart page →

32,205
flywayeosc-lot-1Verified publisher0.7.01 of 3See more

flyway eosc-lot-1 0.7.0

1 of the 3 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
flyway/flyway:9.1545b5d7cdc75a
protobuf-java@3.21.7
3.25.5

Open the chart page →

9,334
shenyuerdeng2.4.212 of 2See more

shenyu erdeng 2.4.21

2 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
apache/shenyu-admin:2.4.2e8b7c4ddd069
protobuf-java@3.8.0
3.25.5
apache/shenyu-bootstrap:2.4.20bd3b25c4be4
protobuf-java@3.8.0
3.25.5

Open the chart page →

12,513
dshackleethereum-helm-chartsVerified publisher0.1.91 of 2See more

dshackle ethereum-helm-charts 0.1.9

1 of the 2 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
emeraldpay/dshackle:0.14.0126f0ae0b388
protobuf-java@3.17.2
3.25.5

Open the chart page →

2,021
business-api-ecosystemfiware1.1.02 of 4See more

business-api-ecosystem fiware 1.1.0

2 of the 4 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
protobuf@3.6.1.3-2ubuntu5.2
3.6.1.3-2ubuntu5.2+esm2
fiware/biz-ecosystem-logic-proxy:11.20.3d551a13e8278
protobuf-java@2.5.0
3.25.5

Open the chart page →

64,489
mod-marccatfolio-org0.1.301 of 1See more

mod-marccat folio-org 0.1.30

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
folioci/mod-marccat:latest1b57d690d568
protobuf-java@2.6.0
3.25.5

Open the chart page →

6,988
accumulogaffer2.2.12 of 4See more

accumulo gaffer 2.2.1

2 of the 4 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
gchq/accumulo:2.0.1c460bb587d6d
protobuf-java@3.7.1
3.25.5
gchq/hdfs:3.3.35ec58edbb2db
protobuf-java@2.5.0
3.25.5

Open the chart page →

16,892
gaffer-road-trafficgaffer2.2.11 of 8See more

gaffer-road-traffic gaffer 2.2.1

1 of the 8 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
gchq/hdfs:3.3.35ec58edbb2db
protobuf-java@2.5.0
3.25.5

Open the chart page →

9,342
icinga2geek-cookbookVerified publisher4.2.01 of 1See more

icinga2 geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
jordan/icinga2:latestf75025fe8ea8
protobuf@3.21.12-3
3.21.12-3+deb12u1

Open the chart page →

9,077
openkmgeek-cookbookVerified publisher4.2.01 of 1See more

openkm geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
openkm/openkm-ce:6.3.113bc465a7461b
protobuf-java@2.5.0
3.25.5

Open the chart page →

27,949
xtevegeek-cookbookVerified publisher8.4.21 of 1See more

xteve geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/xteve:v2.2.0.200292b3614670f
protobuf@3.6.1.3-2ubuntu5
3.6.1.3-2ubuntu5.2+esm2

Open the chart page →

17,929
rocketmqgengxiankun-charts0.3.01 of 1See more

rocketmq gengxiankun-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
apache/rocketmq:5.3.0434d8398f996
protobuf-java@3.20.1
3.25.5

Open the chart page →

4,921
geonetwork-k8sgeonetwork-k8sVerified publisher4.2.82 of 5See more

geonetwork-k8s geonetwork-k8s 4.2.8

2 of the 5 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
jingking/geonetwork-hnap:4.2.843e74ab234e1
protobuf-java@3.19.4
3.25.5
library/elasticsearch:7.17.1588c2ec10c7f2
protobuf-java@3.16.3
3.25.5

Open the chart page →

34,754
opentelemetry-demogpg-dev0.33.82 of 27See more

opentelemetry-demo gpg-dev 0.33.8

2 of the 27 container images this version deploys carry CVE-2024-7254.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-kafka071a788162e8
protobuf-java@3.23.4
3.25.5
ghcr.io/open-telemetry/demo:1.12.0-adservicea59e5eead495
protobuf-java@3.25.3
3.25.5

Open the chart page →

49,025

Container images carrying it

260 by charts deploying them

A fixed version is listed for 5 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/streamingfast/substreams-sink-kv:v2.3.026953ec68d5d
protobuf@3.6.1.3-2ubuntu5.2
3.6.1.3-2ubuntu5.2+esm2
1
ghcr.io/streamingfast/substreams-sink-noop:v1.4.0d7c43c3135c6
protobuf@3.6.1.3-2ubuntu5.2
3.6.1.3-2ubuntu5.2+esm2
1
public.ecr.aws/v0r6c2e2/hive-metastore:latest794b3bff9510
protobuf-java@3.7.1
3.25.5
1
quay.io/apicurio/apicurio-registry-mem:2.5.8.Final3b036692d546
protobuf-java@3.25.1
3.25.5
1
quay.io/fiware/waltid:1.14.1-SNAPSHOT93889c3d8a34
protobuf-java@3.19.3
protobuf-javalite@3.18.0
3.25.5
3.25.5
1
quay.io/keycloak/keycloak:14.0.03029dc0f1d38
protobuf-java@3.12.2
3.25.5
1
quay.io/opsmxpublic/ubi8-gate:isd-spin-2025.10.01-5c720954-2025112608102b3554029737
protobuf-java@3.21.12
3.25.5
1
quay.io/opsmxpublic/ubi8-oes-audit-client:isd-spin-2025.10.01-cb1bfce-20251126103732a5b1887eab
protobuf-java@3.23.4
3.25.5
1
quay.io/opsmxpublic/ubi8-oes-autopilot:isd-spin-2025.10.01-af26a30d4-20251126105458bd0bcf72f9
protobuf-java@3.21.7
3.25.5
1
quay.io/opsmxpublic/ubi8-oes-platform:isd-spin-2025.10.01-a7c191ec-2025112611228ed603ab7417
protobuf-java@3.25.2
3.25.5
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.