StackRadar

CVE-2026-45740

Medium

Advisory

Published 19 May 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.003
18th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
116
of 17,781 indexed, latest versions
Container images
113
deployed by those charts
Fix available
1 of 1
affected package

protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

Carried by container images the latest versions of 116 of 17,781 indexed charts deploy, on 113 images.

Affected packageAffected versionsFixed inImages
protobufjsnpm5.0.3, 6.8.6, 6.8.8, 6.8.9+19 more7.5.8, 8.2.0113
OSV records
GHSA-jggg-4jg4-v7c6

Charts affected

116 by stars
ChartLatestAffected imagesRadar Score
ghostghostVerified publisher0.1.01 of 4See more

ghost ghost 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
library/ghost:5.79.083f7bf209844
protobufjs@7.2.5
7.5.8

Open the chart page →

9,019
qryn-helmgigapipeVerified publisher0.1.91 of 1See more

qryn-helm gigapipe 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
qxip/qryn:3.2.3977acc9c7a9fd
protobufjs@7.4.0
7.5.8

Open the chart page →

2,973
opentelemetry-demogpg-dev0.33.82 of 27See more

opentelemetry-demo gpg-dev 0.33.8

2 of the 27 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
protobufjs@7.3.0
7.5.8
ghcr.io/open-telemetry/demo:1.12.0-paymentserviceb0f13eef3abf
protobufjs@7.2.5
7.5.8

Open the chart page →

49,025
librechathajowielandVerified publisher1.1.01 of 1See more

librechat hajowieland 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
protobufjs@7.4.0
7.5.8

Open the chart page →

2,950
countlyhelmforgeVerified publisher1.2.61 of 3See more

countly helmforge 1.2.6

1 of the 3 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
countly/countly-server:25.05.4e3c238248f99
protobufjs@7.2.6
7.5.8

Open the chart page →

18,813
homarrhelmforgeVerified publisher1.2.81 of 1See more

homarr helmforge 1.2.8

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v1.77.0f23ad77a681b
protobufjs@7.4.0
7.5.8

Open the chart page →

435
uptime-kumahelmforgeVerified publisher1.5.121 of 1See more

uptime-kuma helmforge 1.5.12

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.33e24e96c89ef
protobufjs@7.2.6
7.5.8

Open the chart page →

30,099
dtlinfradao0.0.11 of 1See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
protobufjs@6.11.3
7.5.8

Open the chart page →

4,944
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
protobufjs@6.11.2
7.5.8

Open the chart page →

7,232
n8njanip81-helm-chartsVerified publisher0.1.41 of 1See more

n8n janip81-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
n8nio/n8n:1.86.08b39ed5a2de9
protobufjs@7.4.0
7.5.8

Open the chart page →

5,826
shinsei-managerjtektVerified publisher0.2.01 of 8See more

shinsei-manager jtekt 0.2.0

1 of the 8 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
protobufjs@7.2.5
7.5.8

Open the chart page →

63,461
kubeflowkromanow94-kubeflow0.5.11 of 30See more

kubeflow kromanow94-kubeflow 0.5.1

1 of the 30 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
kubeflownotebookswg/centraldashboard:v1.9.2af55c22ef5de
protobufjs@7.3.0
7.5.8

Open the chart page →

70,530
tooljetkrzwiatrzyk1.1.11 of 2See more

tooljet krzwiatrzyk 1.1.1

1 of the 2 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
tooljet/tooljet-ce:v1.18.0c85a4720e42e
protobufjs@6.11.2
7.5.8

Open the chart page →

5,410
homepagekubernetes-homelab-helm-chartsVerified publisher0.1.01 of 1See more

homepage kubernetes-homelab-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
ghcr.io/gethomepage/homepage:v1.13.1d8d784e50901
protobufjs@7.5.5
7.5.8

Open the chart page →

1,378
uptime-kumakubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

uptime-kuma kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.2.1-slim059b49d64739
protobufjs@7.2.6
7.5.8

Open the chart page →

6,356
online-boutiquekubesphere-testVerified publisher0.1.02 of 11See more

online-boutique kubesphere-test 0.1.0

2 of the 11 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
gcr.io/google-samples/microservices-demo/currencyservice:v0.2.349d458a3650f
protobufjs@6.10.2
7.5.8
gcr.io/google-samples/microservices-demo/paymentservice:v0.2.36eb201217a8f
protobufjs@5.0.3
7.5.8

Open the chart page →

26,018
uptime-kumalbenicio-communityVerified publisher0.1.11 of 1See more

uptime-kuma lbenicio-community 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
protobufjs@7.2.6
7.5.8

Open the chart page →

33,242
uptime-kumaloeken-at-homeVerified publisher2.3.21 of 1See more

uptime-kuma loeken-at-home 2.3.2

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.3.29aeb4e51d038
protobufjs@7.2.6
7.5.8

Open the chart page →

33,242
eoloplantmca-eoloplaner0.1.01 of 7See more

eoloplant mca-eoloplaner 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
hugohg34/server:0.0.2503e5d8960ff
protobufjs@6.11.2
7.5.8

Open the chart page →

29,588
backstagemcwarmanVerified publisher0.10.101 of 2See more

backstage mcwarman 0.10.10

1 of the 2 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
protobufjs@7.2.6
7.5.8

Open the chart page →

9,668
homarrmedia-servarrVerified publisher0.55.11 of 1See more

homarr media-servarr 0.55.1

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v1.77.11f5b892aeef4
protobufjs@7.4.0
7.5.8

Open the chart page →

435
middleware-odigosmiddleware-labsVerified publisher0.2.411 of 6See more

middleware-odigos middleware-labs 0.2.41

1 of the 6 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/odigos-odiglet:middleware-test-0.0.103c8c835ecee
protobufjs@7.2.2
7.5.8

Open the chart page →

8,370
middleware-visionmiddleware-labsVerified publisher0.2.651 of 6See more

middleware-vision middleware-labs 0.2.65

1 of the 6 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/vision-odiglet:middleware-test-0.0.3bce34c98668e
protobufjs@7.2.2
7.5.8

Open the chart page →

8,361
account-lookup-servicemojaloop13.0.02 of 4See more

account-lookup-service mojaloop 13.0.0

2 of the 4 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
protobufjs@6.11.2
7.5.8
mojaloop/event-sidecar:v11.0.189b8ab71b74b
protobufjs@5.0.3
7.5.8

Open the chart page →

11,695
account-lookup-service-adminmojaloop13.0.02 of 4See more

account-lookup-service-admin mojaloop 13.0.0

2 of the 4 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
protobufjs@6.11.2
7.5.8
mojaloop/event-sidecar:v11.0.189b8ab71b74b
protobufjs@5.0.3
7.5.8

Open the chart page →

11,695
admin-api-svcmojaloop12.0.02 of 4See more

admin-api-svc mojaloop 12.0.0

2 of the 4 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
mojaloop/central-ledger:v13.14.01abc8a7aa71c
protobufjs@5.0.3
7.5.8
mojaloop/event-sidecar:v11.0.189b8ab71b74b
protobufjs@5.0.3
7.5.8

Open the chart page →

12,108
bofmojaloop5.1.61 of 1See more

bof mojaloop 5.1.6

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
protobufjs@7.5.4
7.5.8

Open the chart page →

2,457
finance-portalmojaloop5.1.43 of 11See more

finance-portal mojaloop 5.1.4

3 of the 11 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
protobufjs@7.5.3
7.5.8
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
protobufjs@7.5.3
7.5.8
mojaloop/role-assignment-service:v2.1.0def4bf273721
protobufjs@7.2.6
7.5.8

Open the chart page →

14,809
fspiop-transfer-api-svcmojaloop12.0.12 of 3See more

fspiop-transfer-api-svc mojaloop 12.0.1

2 of the 3 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
mojaloop/event-sidecar:v11.0.189b8ab71b74b
protobufjs@5.0.3
7.5.8
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
protobufjs@6.11.2
7.5.8

Open the chart page →

11,479
mojaloopmojaloop14.0.04 of 6See more

mojaloop mojaloop 14.0.0

4 of the 6 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
mojaloop/account-lookup-service:v11.8.0b06d3287ea82
protobufjs@6.11.2
7.5.8
mojaloop/central-ledger:v13.14.01abc8a7aa71c
protobufjs@5.0.3
7.5.8
mojaloop/event-sidecar:v11.0.189b8ab71b74b
protobufjs@5.0.3
7.5.8
mojaloop/ml-api-adapter:v11.1.6fb71d233c742
protobufjs@6.11.2
7.5.8

Open the chart page →

19,226
reporting-events-processor-svcmojaloop3.5.31 of 1See more

reporting-events-processor-svc mojaloop 3.5.3

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
mojaloop/reporting-events-processor-svc:v3.5.11e0d24d28512
protobufjs@7.5.3
7.5.8

Open the chart page →

2,631
reporting-hub-bop-experience-api-svcmojaloop1.0.31 of 1See more

reporting-hub-bop-experience-api-svc mojaloop 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
mojaloop/reporting-hub-bop-experience-api-svc:v2.0.4265102a049d6
protobufjs@7.5.3
7.5.8

Open the chart page →

2,318
role-assignment-servicemojaloop3.1.01 of 1See more

role-assignment-service mojaloop 3.1.0

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
mojaloop/role-assignment-service:v2.1.0def4bf273721
protobufjs@7.2.6
7.5.8

Open the chart page →

2,316
security-role-perm-operator-svcmojaloop3.0.01 of 1See more

security-role-perm-operator-svc mojaloop 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
mojaloop/security-role-perm-operator-svc:v3.0.212af60892c75
protobufjs@7.5.4
7.5.8

Open the chart page →

2,457
myawesomeappmyawesomapp-mitchxxx0.1.11 of 1See more

myawesomeapp myawesomapp-mitchxxx 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
mitchxxx/amazon:214e72480ec63a
protobufjs@6.11.3
7.5.8

Open the chart page →

2,116
myawesomeapp14myawesomeapp140.1.11 of 1See more

myawesomeapp14 myawesomeapp14 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
ccjacobs14/amazon:59a9b14a6f09e
protobufjs@6.11.3
7.5.8

Open the chart page →

2,116
myawesomeapp-janmyawesomeapp-jan0.1.11 of 1See more

myawesomeapp-jan myawesomeapp-jan 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
ooghenekaro/amazon:latest03394ba1d6d8
protobufjs@7.2.3
7.5.8

Open the chart page →

2,144
myawesomeapp-marmyawesomeapp-mar0.1.11 of 1See more

myawesomeapp-mar myawesomeapp-mar 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
winfred008/amazon:910a68de5b398
protobufjs@6.11.3
7.5.8

Open the chart page →

2,116
uptime-kumancsaVerified publisher1.7.21 of 1See more

uptime-kuma ncsa 1.7.2

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
protobufjs@7.2.6
7.5.8

Open the chart page →

30,028
mishtip2p-avs0.1.01 of 2See more

mishti p2p-avs 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
mishtinetwork/operator:latestbb3fe67a5f7c
protobufjs@7.3.2
7.5.8

Open the chart page →

3,999
ungatep2p-avs0.1.01 of 3See more

ungate p2p-avs 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
xom4ekp2p/infini-route-attestators-public-mainnet-attester:latestd0e0aa238b02
protobufjs@7.3.2
7.5.8

Open the chart page →

27,373
myappp4-helm0.1.01 of 6See more

myapp p4-helm 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
fjvela/urjc-fjvela-external-service:1.0.1a8ebe5ca13fc
protobufjs@6.8.8
7.5.8

Open the chart page →

19,720
practica-helmpractica-helm0.1.01 of 7See more

practica-helm practica-helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
slagattollas/weatherservice-practica:latest68e7f56393fc
protobufjs@6.8.8
7.5.8

Open the chart page →

28,484
retromretsamedocVerified publisher2026.2.51 of 1See more

retrom retsamedoc 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
protobufjs@7.4.0
7.5.8

Open the chart page →

7,084
devtron-enterpriseromholdings48.0.01 of 28See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
protobufjs@7.5.3
7.5.8

Open the chart page →

68,240
routr-connectroutr0.4.35 of 10See more

routr-connect routr 0.4.3

5 of the 10 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
fonoster/routr-connect:2.13.6e8c84b5eaa67
protobufjs@7.4.0
7.5.8
fonoster/routr-dispatcher:2.13.65f8f380dc174
protobufjs@7.4.0
7.5.8
fonoster/routr-location:2.13.6051ba9c34ef5
protobufjs@7.4.0
7.5.8
fonoster/routr-pgdata:2.13.6e4d5f5ff1945
protobufjs@7.4.0
7.5.8
fonoster/routr-registry:2.13.6e27001f2813c
protobufjs@7.4.0
7.5.8

Open the chart page →

11,021
uptime-kumarubxkubeVerified publisher1.2.11 of 1See more

uptime-kuma rubxkube 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.4.091e963bfda56
protobufjs@7.2.6
7.5.8

Open the chart page →

30,219
uptime-kumasarab97Verified publisher0.1.51 of 1See more

uptime-kuma sarab97 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
louislam/uptime-kuma:1.22.10b55bcb83a1c
protobufjs@7.1.2
7.5.8

Open the chart page →

4,744
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
protobufjs@7.5.4
7.5.8

Open the chart page →

4,684
unifi-protectschichtelVerified publisher0.10.11 of 1See more

unifi-protect schichtel 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-45740.

Container imageDigestPackageFixed in
markdegroot/unifi-protect-arm64:latestd8445f2a0de6
protobufjs@7.0.0
7.5.8

Open the chart page →

5,582

Container images carrying it

113 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/homarr-labs/homarr:v1.77.0f23ad77a681b
protobufjs@7.4.0
7.5.8
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
protobufjs@7.5.4
7.5.8
1
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
protobufjs@7.4.0
7.5.8
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
protobufjs@7.5.6
7.5.8
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
protobufjs@7.2.6
7.5.8
1
ghcr.io/middleware-labs/odigos-odiglet:middleware-test-0.0.103c8c835ecee
protobufjs@7.2.2
7.5.8
1
ghcr.io/middleware-labs/vision-odiglet:middleware-test-0.0.3bce34c98668e
protobufjs@7.2.2
7.5.8
1
ghcr.io/open-telemetry/demo:1.12.0-frontend8b348f00ca4c
protobufjs@7.3.0
7.5.8
1
ghcr.io/open-telemetry/demo:1.12.0-paymentserviceb0f13eef3abf
protobufjs@7.2.5
7.5.8
1
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
protobufjs@7.5.3
7.5.8
1
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
protobufjs@7.2.5
7.5.8
1
quay.io/soketi/k8soketi:0.1-18-debian4cd9ea9434c4
protobufjs@6.11.3
7.5.8
1
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
protobufjs@6.8.9
7.5.8
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.