StackRadar

CVE-2026-21452

High

Advisory

Published 5 Jan 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
47th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
8
of 17,781 indexed, latest versions
Container images
7
deployed by those charts
Fix available
1 of 1
affected package

MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation

Carried by container images the latest versions of 8 of 17,781 indexed charts deploy, on 7 images.

Affected packageAffected versionsFixed inImages
msgpack-coremaven0.8.16, 0.8.21, 0.8.24, 0.9.0+2 more0.9.117
OSV records
GHSA-cw39-r4h6-8j3x

Charts affected

8 by stars
ChartLatestAffected imagesRadar Score
hertzbeathertzbeatOfficialVerified publisher1.8.11 of 4See more

hertzbeat hertzbeat 1.8.1

1 of the 4 container images this version deploys carry CVE-2026-21452.

Container imageDigestPackageFixed in
apache/hertzbeat:1.8.075d48a62748f
msgpack-core@0.9.6
0.9.11

Open the chart page →

14,000
skywalkingkubesphere-testVerified publisher3.1.01 of 4See more

skywalking kubesphere-test 3.1.0

1 of the 4 container images this version deploys carry CVE-2026-21452.

Container imageDigestPackageFixed in
apache/skywalking-oap-server:8.1.0-es7641237e0299b
msgpack-core@0.8.16
0.9.11

Open the chart page →

18,042
kafdroplsst-sqre0.1.31 of 1See more

kafdrop lsst-sqre 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-21452.

Container imageDigestPackageFixed in
obsidiandynamics/kafdrop:3.30.05337c9e0e2de
msgpack-core@0.8.24
0.9.11

Open the chart page →

7,901
pitchforkexpediagroup0.1.41 of 1See more

pitchfork expediagroup 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-21452.

Container imageDigestPackageFixed in
expediagroup/pitchfork:1.314f2cf61e7de9
msgpack-core@0.9.0
0.9.11

Open the chart page →

3,309
hertzbeatkubesphere-testVerified publisher1.4.11 of 4See more

hertzbeat kubesphere-test 1.4.1

1 of the 4 container images this version deploys carry CVE-2026-21452.

Container imageDigestPackageFixed in
apache/iotdb:0.13.3-nodeafa47bf1692a
msgpack-core@0.8.21
0.9.11

Open the chart page →

7,710
amorphieamorphie0.1.21 of 18See more

amorphie amorphie 0.1.2

1 of the 18 container images this version deploys carry CVE-2026-21452.

Container imageDigestPackageFixed in
camunda/zeebe:8.4.5ab5abc09e407
msgpack-core@0.9.8
0.9.11

Open the chart page →

28,131
firehoseblip-firehoseVerified publisher0.0.181 of 11See more

firehose blip-firehose 0.0.18

1 of the 11 container images this version deploys carry CVE-2026-21452.

Container imageDigestPackageFixed in
obsidiandynamics/kafdrop:3.30.05337c9e0e2de
msgpack-core@0.8.24
0.9.11

Open the chart page →

13,459
skywalking-v1huangchengwu-helm-chart0.1.01 of 4See more

skywalking-v1 huangchengwu-helm-chart 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-21452.

Container imageDigestPackageFixed in
apache/skywalking-oap-server:8.9.1b4ec8c18d079
msgpack-core@0.8.16
0.9.11

Open the chart page →

20,650

Container images carrying it

7 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
obsidiandynamics/kafdrop:3.30.05337c9e0e2de
msgpack-core@0.8.24
0.9.11
2
apache/hertzbeat:1.8.075d48a62748f
msgpack-core@0.9.6
0.9.11
1
apache/iotdb:0.13.3-nodeafa47bf1692a
msgpack-core@0.8.21
0.9.11
1
apache/skywalking-oap-server:8.1.0-es7641237e0299b
msgpack-core@0.8.16
0.9.11
1
apache/skywalking-oap-server:8.9.1b4ec8c18d079
msgpack-core@0.8.16
0.9.11
1
camunda/zeebe:8.4.5ab5abc09e407
msgpack-core@0.9.8
0.9.11
1
expediagroup/pitchfork:1.314f2cf61e7de9
msgpack-core@0.9.0
0.9.11
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.