StackRadar

CVE-2026-106450

Medium

Advisory

Published 7 Oct 2026In the index since 8 Oct 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.004
29th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
113
of 18,053 indexed, latest versions
Container images
113
deployed by those charts
Fix available
1 of 1
affected package

yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

Carried by container images the latest versions of 113 of 18,053 indexed charts deploy, on 113 images.

Affected packageAffected versionsFixed inImages
lz4-javamaven1.10.1, 1.10.2, 1.10.4, 1.11.0+2 more1.11.4113
OSV records
GHSA-gm45-99xc-r7wv

Charts affected

113 by stars
ChartLatestAffected imagesRadar Score
metabasepmint932.27.71 of 1See more

metabase pmint93 2.27.7

1 of the 1 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
metabase/metabase:v0.61.1.x9491ed11c901
lz4-java@1.10.4
1.11.4

Open the chart page →

1,878
kafka-uikafka-uiVerified publisher1.6.51 of 1See more

kafka-ui kafka-ui 1.6.5

1 of the 1 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
ghcr.io/kafbat/kafka-ui:v1.5.07cda86a33344
lz4-java@1.10.1
1.11.4

Open the chart page →

950
strimzi-kafka-operatorstrimzi-kafka-operator1.2.01 of 1See more

strimzi-kafka-operator strimzi-kafka-operator 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:1.2.077f8fa8121a6
lz4-java@1.10.2
1.11.4

Open the chart page →

281
trinotrino1.42.21 of 1See more

trino trino 1.42.2

1 of the 1 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
trinodb/trino:4801565e8cac299
lz4-java@1.10.4
1.11.4

Open the chart page →

1,693
graylogkong-zVerified publisher3.0.361 of 5See more

graylog kong-z 3.0.36

1 of the 5 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.19.6e321cb03c643
lz4-java@1.10.1
1.11.4

Open the chart page →

3,076
strimzi-kafka-operatorstrimzi1.2.01 of 1See more

strimzi-kafka-operator strimzi 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:1.2.077f8fa8121a6
lz4-java@1.10.2
1.11.4

Open the chart page →

281
datahubdatahubVerified publisher1.1.62 of 4See more

datahub datahub 1.1.6

2 of the 4 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
acryldata/datahub-frontend-react:v1.7.0.199513cc1c45e
lz4-java@1.11.1
1.11.4
acryldata/datahub-upgrade:v1.7.0.1c3db54d8fb94
lz4-java@1.11.1
1.11.4

Open the chart page →

1,579
penpotpenpotOfficialVerified publisher1.11.31 of 5See more

penpot penpot 1.11.3

1 of the 5 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
penpotapp/backend:2.18.32df1b3440d2a
lz4-java@1.11.2
1.11.4

Open the chart page →

6,179
akhqakhq0.28.01 of 1See more

akhq akhq 0.28.0

1 of the 1 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
tchiotludo/akhq:0.28.0c2824dc2ae44
lz4-java@1.11.1
1.11.4

Open the chart page →

2,082
cloudbeaveravistoVerified publisher1.1.71 of 1See more

cloudbeaver avisto 1.1.7

1 of the 1 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
dbeaver/cloudbeaver:26.1.287ab86d00f8c
lz4-java@1.10.1
1.11.4

Open the chart page →

2,149
apim3graviteeioVerified publisher4.12.212 of 4See more

apim3 graviteeio 4.12.21

2 of the 4 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
graviteeio/apim-gateway:4.12.21-debianc7564f313dda
lz4-java@1.10.1
1.11.4
graviteeio/apim-management-api:4.12.21-debian3caf0b09f8b5
lz4-java@1.10.1
1.11.4

Open the chart page →

5,074
polarisapache-polarisOfficialVerified publisher1.3.0-incubating1 of 1See more

polaris apache-polaris 1.3.0-incubating

1 of the 1 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
apache/polaris:latest347615e736ca
lz4-java@1.11.1
1.11.4

Open the chart page →

436
druiddruid-helmVerified publisher37.0.21 of 3See more

druid druid-helm 37.0.2

1 of the 3 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
apache/druid:37.0.00116fb802786
lz4-java@1.10.2
1.11.4

Open the chart page →

4,337
cassandrakubelauncherVerified publisher0.1.291 of 1See more

cassandra kubelauncher 0.1.29

1 of the 1 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/cassandradigest-pinned4a2625365fc6
lz4-java@1.10.1
1.11.4

Open the chart page →

1,433
grayloggroundhog2k0.13.101 of 1See more

graylog groundhog2k 0.13.10

1 of the 1 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
graylog/graylog:7.1.9598bd41fefd5
lz4-java@1.10.4
1.11.4

Open the chart page →

1,519
tbmq-clustertbmq-helm-chartOfficialVerified publisher2.3.02 of 3See more

tbmq-cluster tbmq-helm-chart 2.3.0

2 of the 3 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
thingsboard/tbmq-integration-executor:2.4.0b5a9c1addf80
lz4-java@1.11.2
1.11.4
thingsboard/tbmq-node:2.4.070661025dba5
lz4-java@1.11.2
1.11.4

Open the chart page →

3,961
elasticsearch-clusterwiremindVerified publisher4.5.41 of 2See more

elasticsearch-cluster wiremind 4.5.4

1 of the 2 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
library/elasticsearch:8.19.22d071f96fab6c
lz4-java@1.11.1
1.11.4

Open the chart page →

863
grayloggraylog2OfficialVerified publisher2.1.01 of 2See more

graylog graylog2 2.1.0

1 of the 2 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
graylog/graylog-enterprise:7.1.88a1f641cd7aa
lz4-java@1.10.4
1.11.4

Open the chart page →

2,001
thehivestrangebee-helmOfficialVerified publisher1.1.01 of 7See more

thehive strangebee-helm 1.1.0

1 of the 7 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
strangebee/thehive:5.8.0-1a7f7b05fba24
lz4-java@1.11.2
1.11.4

Open the chart page →

16,409
kpowfactorhouseOfficialVerified publisher1.0.841 of 1See more

kpow factorhouse 1.0.84

1 of the 1 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
factorhouse/kpow:96.55994fa3bacce
lz4-java@1.11.1
1.11.4

Open the chart page →

139
thingsboardcetic0.1.21 of 2See more

thingsboard cetic 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
thingsboard/tb-postgres:latest2d17e4e36edc
lz4-java@1.10.1
1.11.4

Open the chart page →

5,982
apimgraviteeioVerified publisher4.12.212 of 4See more

apim graviteeio 4.12.21

2 of the 4 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
graviteeio/apim-gateway:4.12.21-debianc7564f313dda
lz4-java@1.10.1
1.11.4
graviteeio/apim-management-api:4.12.21-debian3caf0b09f8b5
lz4-java@1.10.1
1.11.4

Open the chart page →

5,074
infrahub-enterpriseinfrahub-enterpriseVerified publisher4.21.21 of 5See more

infrahub-enterprise infrahub-enterprise 4.21.2

1 of the 5 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
library/neo4j:2026.05.0-enterprise2caf944aa4a5
lz4-java@1.11.0
1.11.4

Open the chart page →

12,382
metabaseone-acre-fundVerified publisher0.1.111 of 3See more

metabase one-acre-fund 0.1.11

1 of the 3 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
metabase/metabase:latestb7c6250d7fd2
lz4-java@1.10.4
1.11.4

Open the chart page →

87
aerospike-graphaerospike-helmOfficialVerified publisher3.7.01 of 1See more

aerospike-graph aerospike-helm 3.7.0

1 of the 1 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
aerospike/aerospike-graph-service:3.3.1781ba5213efd
lz4-java@1.11.2
1.11.4

Open the chart page →

475
kafkacloudpirates-kafkaVerified publisher0.2.01 of 1See more

kafka cloudpirates-kafka 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
apache/kafka:4.3.177e3df905404
lz4-java@1.10.2
1.11.4

Open the chart page →

765
enavenav-service-architectureVerified publisher0.0.73 of 10See more

enav enav-service-architecture 0.0.7

3 of the 10 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
ghcr.io/gla-rad/enav-aton-admin-service:latest8b963221a007
lz4-java@1.10.1
1.11.4
ghcr.io/gla-rad/enav-aton-service:latest3ffe10cd9cef
lz4-java@1.10.1
1.11.4
ghcr.io/gla-rad/enav-msg-broker:latest5c0966fa0257
lz4-java@1.10.1
1.11.4

Open the chart page →

12,625
kpow-cefactorhouseOfficialVerified publisher1.0.821 of 1See more

kpow-ce factorhouse 1.0.82

1 of the 1 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
factorhouse/kpow-ce:96.5b1d5f1eea44c
lz4-java@1.11.1
1.11.4

Open the chart page →

139
amgraviteeioVerified publisher4.12.82 of 3See more

am graviteeio 4.12.8

2 of the 3 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
graviteeio/am-gateway:4.12.8d09cf41530da
lz4-java@1.10.1
1.11.4
graviteeio/am-management-api:4.12.849d0188a58ae
lz4-java@1.10.1
1.11.4

Open the chart page →

2,271
hazelcast-enterprisehazelcastVerified publisher5.16.01 of 2See more

hazelcast-enterprise hazelcast 5.16.0

1 of the 2 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
hazelcast/hazelcast-enterprise:5.7.1cdff425edc10
lz4-java@1.10.1
1.11.4

Open the chart page →

352
kafkahelmforgeVerified publisher1.4.01 of 1See more

kafka helmforge 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
apache/kafka:4.3.177e3df905404
lz4-java@1.10.2
1.11.4

Open the chart page →

765
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.32 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.3

2 of the 34 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.1.0-kafka4402ba7fd544
lz4-java@1.10.2
1.11.4
ghcr.io/open-telemetry/demo:3.1.0-fraud-detectiona07ee694304b
lz4-java@1.10.2
1.11.4

Open the chart page →

24,860
opikopikOfficialVerified publisher2.2.941 of 13See more

opik opik 2.2.94

1 of the 13 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
ghcr.io/comet-ml/opik/opik-backend:2.2.94809d837a1dcf
lz4-java@1.10.4
1.11.4

Open the chart page →

15,349
graphserviceaerospike-helmVerified publisher3.3.01 of 1See more

graphservice aerospike-helm 3.3.0

1 of the 1 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
aerospike/aerospike-graph-service:3.3.0f35739b97a46
lz4-java@1.11.2
1.11.4

Open the chart page →

617
airbyteairbyte-v2Verified publisher2.3.05 of 10See more

airbyte airbyte-v2 2.3.0

5 of the 10 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
airbyte/bootloader:2.3.0205b99d17c1a
lz4-java@1.11.1
1.11.4
airbyte/server:2.3.039141ed8ce5e
lz4-java@1.11.1
1.11.4
airbyte/worker:2.3.0f2e33fbc53d1
lz4-java@1.11.1
1.11.4
airbyte/workload-api-server:2.3.0434b4a811156
lz4-java@1.11.1
1.11.4
airbyte/workload-launcher:2.3.00e18b1abcda6
lz4-java@1.11.1
1.11.4

Open the chart page →

14,978
airbyte-data-planeairbyte-v2Verified publisher2.3.01 of 1See more

airbyte-data-plane airbyte-v2 2.3.0

1 of the 1 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
airbyte/workload-launcher:2.3.00e18b1abcda6
lz4-java@1.11.1
1.11.4

Open the chart page →

865
aktoakto0.2.02 of 7See more

akto akto 0.2.0

2 of the 7 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-dashboard:latest142caa08d1f0
lz4-java@1.10.1
1.11.4
public.ecr.aws/aktosecurity/akto-api-security-runtime:latestc89a1c10c9c2
lz4-java@1.10.1
1.11.4

Open the chart page →

14,322
akto-central-setupakto1.2.44 of 5See more

akto-central-setup akto 1.2.4

4 of the 5 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
aktosecurity/akto-threat-detection-backend:1.18.75a0c66e59678
lz4-java@1.10.1
1.11.4
public.ecr.aws/aktosecurity/akto-api-security-dashboard:1.70.3142caa08d1f0
lz4-java@1.10.1
1.11.4
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor:1.70.366b0ec8b3de3
lz4-java@1.10.1
1.11.4
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.28e01c0305844
lz4-java@1.10.1
1.11.4

Open the chart page →

4,033
akto-dashboardakto0.1.71 of 1See more

akto-dashboard akto 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
aktosecurity/akto-api-security-dashboard:latest9ef5e8cb6a43
lz4-java@1.10.1
1.11.4

Open the chart page →

816
akto-mini-runtimeakto0.7.221 of 3See more

akto-mini-runtime akto 0.7.22

1 of the 3 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
lz4-java@1.10.1
1.11.4

Open the chart page →

3,103
akto-mini-testingakto1.46.01 of 5See more

akto-mini-testing akto 1.46.0

1 of the 5 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
lz4-java@1.10.1
1.11.4

Open the chart page →

5,440
akto-regional-setupakto1.4.93 of 9See more

akto-regional-setup akto 1.4.9

3 of the 9 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
aktosecurity/data-ingestion-service:1.5.35d4eab1c36b9
lz4-java@1.10.1
1.11.4
public.ecr.aws/aktosecurity/akto-threat-detection:1.18.755b1bd20ef02
lz4-java@1.10.1
1.11.4
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.28e01c0305844
lz4-java@1.10.1
1.11.4

Open the chart page →

46,900
akto-runtimeakto0.1.81 of 2See more

akto-runtime akto 0.1.8

1 of the 2 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
lz4-java@1.10.1
1.11.4

Open the chart page →

1,551
akto-threat-backendakto0.1.52 of 2See more

akto-threat-backend akto 0.1.5

2 of the 2 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
aktosecurity/akto-threat-detection-backend:latestd9d0e7c78578
lz4-java@1.10.1
1.11.4
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
lz4-java@1.10.1
1.11.4

Open the chart page →

1,627
akto-threat-clientakto0.2.02 of 2See more

akto-threat-client akto 0.2.0

2 of the 2 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-threat-detection:latestf14d68a2b1cf
lz4-java@1.10.1
1.11.4
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
lz4-java@1.10.1
1.11.4

Open the chart page →

1,658
kafka-uiappscodeVerified publisher2026.3.301 of 1See more

kafka-ui appscode 2026.3.30

1 of the 1 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
ghcr.io/kafbat/kafka-ui:v1.5.07cda86a33344
lz4-java@1.10.1
1.11.4

Open the chart page →

950
kafka-connectdasmeta1.0.21 of 3See more

kafka-connect dasmeta 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
confluentinc/cp-schema-registry:latest482d3048b3f6
lz4-java@1.11.1
1.11.4

Open the chart page →

382
metabasedasmeta0.1.01 of 1See more

metabase dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
metabase/metabase:v0.63.1.124f150effd484
lz4-java@1.10.4
1.11.4

Open the chart page →

996
datagrokdatagrok1.0.31 of 7See more

datagrok datagrok 1.0.3

1 of the 7 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
datagrok/grok_connect:latestf5876d3aebb8
lz4-java@1.10.1
1.11.4

Open the chart page →

2,123
datagrok_grok_connectdatagrok1.0.01 of 1See more

datagrok_grok_connect datagrok 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-106450.

Container imageDigestPackageFixed in
datagrok/grok_connect:latestf5876d3aebb8
lz4-java@1.10.1
1.11.4

Open the chart page →

1,993

Container images carrying it

113 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/quenchworks/images/nifiac51c98e9e37
lz4-java@1.11.2
1.11.4
1
ghcr.io/quenchworks/images/pulsar1b3a533f6607
lz4-java@1.11.1
1.11.4
1
ghcr.io/quenchworks/images/skywalkingb234844163cf
lz4-java@1.11.2
1.11.4
1
ghcr.io/quenchworks/images/wildfly51c31ca1bc16
lz4-java@1.11.2
1.11.4
1
ghcr.io/quenchworks/images/zipkincd4d4af2076b
lz4-java@1.11.1
1.11.4
1
ghcr.io/radar-base/radar-gateway/radar-gateway:0.9.4219d894aa7a6
lz4-java@1.10.1
1.11.4
1
ghcr.io/radar-base/radar-schemas/radar-schemas-tools:0.8.16c442e8bfe6b4
lz4-java@1.10.1
1.11.4
1
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor:1.70.366b0ec8b3de3
lz4-java@1.10.1
1.11.4
1
public.ecr.aws/aktosecurity/akto-api-security-runtime:latestc89a1c10c9c2
lz4-java@1.10.1
1.11.4
1
public.ecr.aws/aktosecurity/akto-threat-detection:1.18.755b1bd20ef02
lz4-java@1.10.1
1.11.4
1
public.ecr.aws/aktosecurity/akto-threat-detection:latestf14d68a2b1cf
lz4-java@1.10.1
1.11.4
1
quay.io/kannika/kannika-api:0.19.05e5a3b3a911e
lz4-java@1.10.2
1.11.4
1
quay.io/strimzi/operator:latest60abcb19699f
lz4-java@1.10.2
1.11.4
1

syft 1.42.1 · advisories as of 8 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.