StackRadar

CVE-2026-0994

High

Advisory

Published 23 Jan 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
0.007
51st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
199
of 17,781 indexed, latest versions
Container images
200
deployed by those charts
Fix available
2 of 2
affected packages

protobuf affected by a JSON recursion depth bypass

Carried by container images the latest versions of 199 of 17,781 indexed charts deploy, on 200 images.

Affected packageAffected versionsFixed inImages
protobufpypi3.5.1, 3.5.2, 3.6.1, 3.7.0+54 more5.29.6, 6.33.5190
protobufdeb3.0.0-9.1ubuntu1, 3.0.0-9.1ubuntu1.1, 3.6.1.3-2ubuntu5, 3.6.1.3-2ubuntu5.2+2 more3.0.0-9.1ubuntu1.1+esm4, 3.6.1.3-2ubuntu5.2+esm3, 3.21.12-3+deb12u1, 3.21.12-8.2ubuntu0.313
OSV records
DEBIAN-CVE-2026-0994GHSA-7gcm-g887-7qv7UBUNTU-CVE-2026-0994
Also known as
PYSEC-2026-1805, USN-8063-1, USN-8063-2

Charts affected

199 by stars
ChartLatestAffected imagesRadar Score
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
protobuf@4.25.3
5.29.6

Open the chart page →

11,367
rook-cephrookOfficialVerified publisher1.20.71 of 2See more

rook-ceph rook 1.20.7

1 of the 2 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
rook/ceph:v1.20.72f970c425617
protobuf@3.14.0
5.29.6

Open the chart page →

1,447
ceph-csi-cephfsceph-csiOfficialVerified publisher3.17.11 of 6See more

ceph-csi-cephfs ceph-csi 3.17.1

1 of the 6 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.17.10b62db8afc9b
protobuf@3.14.0
5.29.6

Open the chart page →

4,061
ceph-csi-rbdceph-csiOfficialVerified publisher3.17.11 of 6See more

ceph-csi-rbd ceph-csi 3.17.1

1 of the 6 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.17.10b62db8afc9b
protobuf@3.14.0
5.29.6

Open the chart page →

4,061
netboxbootcVerified publisher4.1.11 of 4See more

netbox bootc 4.1.1

1 of the 4 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.2.83d652dca5351
protobuf@4.21.4
5.29.6

Open the chart page →

9,145
milvusmilvus4.0.311 of 5See more

milvus milvus 4.0.31

1 of the 5 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
apachepulsar/pulsar:2.8.2d538416d5afe
protobuf@3.19.1
5.29.6

Open the chart page →

32,259
clearmlallegroaiOfficialVerified publisher7.15.01 of 4See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
allegroai/clearml:2.0.0-613713ae38f7daf
protobuf@5.29.2
5.29.6

Open the chart page →

10,622
ambassadordatawire6.9.51 of 2See more

ambassador datawire 6.9.5

1 of the 2 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
protobuf@3.13.0
5.29.6

Open the chart page →

4,086
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
grafana/oncall:v1.16.5499851658393
protobuf@4.25.8
5.29.6

Open the chart page →

16,251
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.14.3f09282d281f6
protobuf@5.29.5
5.29.6

Open the chart page →

11,384
emissary-ingressdatawire7.1.8-ea1 of 1See more

emissary-ingress datawire 7.1.8-ea

1 of the 1 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
datawire/emissary:2.0.2-ea9716efbdd24b
protobuf@3.13.0
5.29.6

Open the chart page →

4,918
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
protobuf@3.20.1
5.29.6

Open the chart page →

7,705
redashredash4.2.01 of 3See more

redash redash 4.2.0

1 of the 3 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
redash/redash:25.8.000d813437db5
protobuf@3.20.2
5.29.6

Open the chart page →

5,987
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
protobuf@4.25.1
5.29.6

Open the chart page →

6,041
edge-stackdatawire7.1.8-ea1 of 2See more

edge-stack datawire 7.1.8-ea

1 of the 2 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
datawire/aes:2.0.3-ea07f8fe4f4f8e
protobuf@3.13.0
5.29.6

Open the chart page →

5,173
milvusmilvus-helm5.0.271 of 4See more

milvus milvus-helm 5.0.27

1 of the 4 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
apachepulsar/pulsar:3.0.79c9947de139d
protobuf@3.20.3
5.29.6

Open the chart page →

10,670
supersetcloudposse1.2.01 of 1See more

superset cloudposse 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
amancevice/superset:0.35.212a0a9e66550
protobuf@3.11.2
5.29.6

Open the chart page →

5,851
frigateblakeblackshear7.8.01 of 1See more

frigate blakeblackshear 7.8.0

1 of the 1 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
ghcr.io/blakeblackshear/frigate:0.14.122e3d0b486df
protobuf@5.27.3
5.29.6

Open the chart page →

3,004
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
protobuf@5.29.3
5.29.6

Open the chart page →

17,245
home-assistantalekcVerified publisher2.11.21 of 1See more

home-assistant alekc 2.11.2

1 of the 1 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
protobuf@6.32.0
6.33.5

Open the chart page →

2,133
home-assistantandrenarchyVerified publisher14.103.01 of 1See more

home-assistant andrenarchy 14.103.0

1 of the 1 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.1612d76760b54
protobuf@6.32.0
6.33.5

Open the chart page →

2,133
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.11.11da5c38c6a78
protobuf@3.19.6
5.29.6

Open the chart page →

6,168
fadicetic0.3.11 of 25See more

fadi cetic 0.3.1

1 of the 25 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
amancevice/superset:0.35.212a0a9e66550
protobuf@3.11.2
5.29.6

Open the chart page →

52,919
kamu-api-serverkamuVerified publisher0.89.01 of 1See more

kamu-api-server kamu 0.89.0

1 of the 1 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
ghcr.io/kamu-data/kamu-api-server:0.89.04ed7a896dd2b
protobuf@3.6.1
protobuf@3.6.1.3-2ubuntu5.2
5.29.6
3.6.1.3-2ubuntu5.2+esm3

Open the chart page →

6,307
kubeflowkubeflow1.6.21 of 45See more

kubeflow kubeflow 1.6.2

1 of the 45 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
gcr.io/ml-pipeline/metadata-writer:2.0.0-alpha.5ec3ae9f6df47
protobuf@3.19.3
5.29.6

Open the chart page →

96,941
netboxstartechnicaVerified publisher5.1.01 of 4See more

netbox startechnica 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
protobuf@4.25.3
5.29.6

Open the chart page →

1,650
alerta-webalerta-webVerified publisher0.1.121 of 2See more

alerta-web alerta-web 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
hayk96/alerta-web:9.0.486377705e9e3
protobuf@3.20.3
5.29.6

Open the chart page →

3,569
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
protobuf@4.25.3
5.29.6

Open the chart page →

17,404
dyff-apidyff-apiVerified publisher0.57.41 of 1See more

dyff-api dyff-api 0.57.4

1 of the 1 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
registry.gitlab.com/dyff/dyff-api:0.57.4911acf4052e5
protobuf@3.20.2
5.29.6

Open the chart page →

1,314
edgelessdbedgelesssysVerified publisher0.3.21 of 1See more

edgelessdb edgelesssys 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
ghcr.io/edgelesssys/edgelessdb-sgx-1gb:v0.3.27e1d7a11a11a
protobuf@3.6.1.3-2ubuntu5
3.6.1.3-2ubuntu5.2+esm3

Open the chart page →

4,830
openshift-secured-pgadmineximiaitVerified publisher0.2.01 of 2See more

openshift-secured-pgadmin eximiait 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
dpage/pgadmin4:7.537946e4f3e7b
protobuf@4.23.4
5.29.6

Open the chart page →

14,546
esphomegeek-cookbookVerified publisher8.4.21 of 1See more

esphome geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
esphome/esphome:1.18.03f51ec10e823
protobuf@3.15.8
5.29.6

Open the chart page →

3,717
mlflowgetindataVerified publisher0.1.21 of 1See more

mlflow getindata 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
gcr.io/getindata-images-public/mlflow:latest25d6975951f1
protobuf@4.25.3
5.29.6

Open the chart page →

2,452
home-assistanthome-assistantVerified publisher0.5.101 of 3See more

home-assistant home-assistant 0.5.10

1 of the 3 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.0372d991e5888
protobuf@6.32.0
6.33.5

Open the chart page →

2,331
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
protobuf@6.32.0
6.33.5

Open the chart page →

4,634
flagsmithone-acre-fundVerified publisher0.1.51 of 6See more

flagsmith one-acre-fund 0.1.5

1 of the 6 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
flagsmith/flagsmith-api:v2.6.0fd58556339a4
protobuf@3.14.0
5.29.6

Open the chart page →

6,868
oesopsmxVerified publisher4.0.321 of 25See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/ubi8-oes-datascience:isd-spin-2025.10.01-af26a30d4-202511261054d8f66f4117fe
protobuf@4.25.8
5.29.6

Open the chart page →

107,811
clearml-servingallegroaiVerified publisher1.6.21 of 9See more

clearml-serving allegroai 1.6.2

1 of the 9 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
allegroai/clearml-serving-inference:1.3.0fca885e8cfc6
protobuf@3.20.3
5.29.6

Open the chart page →

17,877
psonoankra-chartsVerified publisher1.2.01 of 2See more

psono ankra-charts 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
psono/psono-server:5.0.03b974b43ea03
protobuf@4.25.3
5.29.6

Open the chart page →

2,388
anteonanteonVerified publisher2.6.41 of 13See more

anteon anteon 2.6.4

1 of the 13 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
ddosify/selfhosted_backend:3.2.93c11e3182652
protobuf@4.25.3
5.29.6

Open the chart page →

22,202
siemassist-iot-cybersecurity-monitroting-siem0.1.01 of 3See more

siem assist-iot-cybersecurity-monitroting-siem 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_id-wzh:latest0aacefac9677
protobuf@3.17.3
5.29.6

Open the chart page →

10,730
tensorflow-notebookcloudnativeapp0.1.21 of 1See more

tensorflow-notebook cloudnativeapp 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
tensorflow/tensorflow:1.6.0-devel1e3172090703
protobuf@3.5.1
5.29.6

Open the chart page →

36,094
pgbenchcloudnative-pgVerified publisher0.1.01 of 1See more

pgbench cloudnative-pg 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
ghcr.io/cloudnative-pg/postgresql:14.5b3b30d04b362
protobuf@4.21.9
5.29.6

Open the chart page →

2,713
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
protobuf@4.25.3
5.29.6

Open the chart page →

11,205
datadogdatadog-test2.4.231 of 2See more

datadog datadog-test 2.4.23

1 of the 2 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
datadog/agent:7.22.08f20e56b5311
protobuf@3.7.0
5.29.6

Open the chart page →

4,568
weblatedeliveryheroVerified publisher0.3.21 of 3See more

weblate deliveryhero 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
weblate/weblate:4.2.2-169c160d37a3c
protobuf@3.13.0
5.29.6

Open the chart page →

7,984
kubedashdevopstalesOfficialVerified publisher4.0.01 of 8See more

kubedash devopstales 4.0.0

1 of the 8 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
devopstales/kubedash:3.1.08bb837da5aec
protobuf@5.29.5
5.29.6

Open the chart page →

9,205
archerydoubanVerified publisher0.4.31 of 6See more

archery douban 0.4.3

1 of the 6 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
hhyo/archery:v1.9.11aa41843419e
protobuf@4.21.7
5.29.6

Open the chart page →

5,853
genesis-generatorethereum-helm-chartsVerified publisher0.2.31 of 2See more

genesis-generator ethereum-helm-charts 0.2.3

1 of the 2 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
skylenet/ethereum-genesis-generator:latest210353ce7c89
protobuf@3.20.3
5.29.6

Open the chart page →

3,135
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-0994.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latest612d76760b54
protobuf@6.32.0
6.33.5

Open the chart page →

2,133

Container images carrying it

200 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
mozilla/syncserver:latest016162bf39d8
protobuf@3.17.3
5.29.6
1
netboxcommunity/netbox:v3.2.83d652dca5351
protobuf@4.21.4
5.29.6
1
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
protobuf@4.25.3
5.29.6
1
omecproject/progran-synchronizer:comac-1.0.0d109a8e57e71
protobuf@3.5.2
5.29.6
1
opea/asr:1.025dd26d9cd09
protobuf@4.25.5
5.29.6
1
opea/chatqna:1.038c51b791efa
protobuf@4.25.5
5.29.6
1
opea/codegen:1.058f91683892d
protobuf@4.25.5
5.29.6
1
opea/codetrans:1.0e2436483b73d
protobuf@4.25.5
5.29.6
1
opea/docsum:1.03eaa91849512
protobuf@4.25.5
5.29.6
1
opea/guardrails-tgi:1.0262c6048aab8
protobuf@4.25.5
5.29.6
1
opea/guardrails-tgi:latestf68bec6a1271
protobuf@5.29.2
5.29.6
1
opea/llm-docsum-tgi:1.002f9e8fa5d71
protobuf@4.25.5
5.29.6
1
opea/speecht5:1.0249afad3d268
protobuf@4.25.5
5.29.6
1
opea/tts:1.0257ae94709e9
protobuf@4.25.5
5.29.6
1
opea/web-retriever-chroma:1.0fe08165d7770
protobuf@4.25.5
5.29.6
1
opencsghq/agenticflow:ee-v0.6-52f03fead54db
protobuf@5.29.5
5.29.6
1
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
protobuf@6.33.4
6.33.5
1
opencsghq/csgship-agentic:v0.4.02cd29671a03e
protobuf@5.29.5
5.29.6
1
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
protobuf@3.20.3
5.29.6
1
opencsghq/label-studio:v2.5.047e22aa71870
protobuf@4.25.8
5.29.6
1
opencsghq/label-studio:v2.4.0b4e849fcf94a
protobuf@4.25.8
5.29.6
1
openmined/syft-backend:0.9.5b72f74a68b32
protobuf@5.29.3
5.29.6
1
openthread/otbr:latestf307f59f6432
protobuf@3.0.0-9.1ubuntu1.1
3.0.0-9.1ubuntu1.1+esm4
1
psono/psono-server:5.0.03b974b43ea03
protobuf@4.25.3
5.29.6
1
redash/redash:25.8.000d813437db5
protobuf@3.20.2
5.29.6
1
redash/redash:10.0.0.b503639392753c0376
protobuf@3.17.3
5.29.6
1
robmarkcole/deepstack-ui:latest410275726459
protobuf@3.17.3
5.29.6
1
robotshop/rs-payment:latest774b52c6180d
protobuf@3.18.0rc2
5.29.6
1
rommapp/romm:4.4.1b909e95d1aab
protobuf@6.31.1
6.33.5
1
rook/ceph:v1.20.72f970c425617
protobuf@3.14.0
5.29.6
1
rook/ceph:v1.19.2944a1dd70496
protobuf@3.14.0
5.29.6
1
salehmir/jesse:1.10.101afa95f979e9
protobuf@6.31.1
6.33.5
1
seldonio/locust-core:0.81d0da98a2d76
protobuf@3.7.1
5.29.6
1
seldonio/seldon-request-logger:1.11.24e985d2006a8
protobuf@3.18.1
5.29.6
1
skylenet/ethereum-genesis-generator:latest210353ce7c89
protobuf@3.20.3
5.29.6
1
softonic/gar-exporter:0.2.1a64d6c0e0ae5
protobuf@3.13.0
5.29.6
1
sruthitanneru/pi-sample:ui-lateste565ea454ffd
protobuf@5.29.0
5.29.6
1
t3nde/gtmetrix-bq:0.2.0d2939e9a719b
protobuf@3.11.3
5.29.6
1
tachyongroup/mlflow-deployment-controller:mlflow-controller-0.1.87e79b9000856
protobuf@3.20.0
5.29.6
1
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
protobuf@4.22.0
5.29.6
1
tensorflow/tensorflow:1.6.0-devel1e3172090703
protobuf@3.5.1
5.29.6
1
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
protobuf@5.29.3
5.29.6
1
twentycrm/twenty-postgres-spilo:latest2f78405a78be
protobuf@4.25.3
5.29.6
1
voltha/voltha-cli:1.6.0c4e41e92f046
protobuf@3.6.1
5.29.6
1
voltha/voltha-netconf:1.6.037f80524c207
protobuf@3.6.1
5.29.6
1
voltha/voltha-ofagent:1.6.09ee8c1f4428c
protobuf@3.6.1
5.29.6
1
voltha/voltha-tester:1.7.0655c3048a602
protobuf@3.6.1
5.29.6
1
voltha/voltha-voltha:1.6.0ff596b62de59
protobuf@3.6.1
5.29.6
1
wazuh/wazuh-manager:4.11.11da5c38c6a78
protobuf@3.19.6
5.29.6
1
wazuh/wazuh-manager:4.4.121994f40e0da
protobuf@3.19.6
5.29.6
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.