StackRadar

CVE-2026-54297

High

Advisory

Published 19 Jun 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
40th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
25
of 17,781 indexed, latest versions
Container images
23
deployed by those charts
Fix available
1 of 1
affected package

Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters

Carried by container images the latest versions of 25 of 17,781 indexed charts deploy, on 23 images.

Affected packageAffected versionsFixed inImages
faradaygem1.0.1, 1.4.2, 1.7.1, 1.8.0+12 more1.10.6, 2.14.323
OSV records
GHSA-98m9-hrrm-r99r

Charts affected

25 by stars
ChartLatestAffected imagesRadar Score
chatwootchatwootVerified publisher2.0.241 of 3See more

chatwoot chatwoot 2.0.24

1 of the 3 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v4.15.167ebc751c171
faraday@2.14.2
2.14.3

Open the chart page →

9,203
puppetserverpuppetserver9.5.21 of 5See more

puppetserver puppetserver 9.5.2

1 of the 5 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
ghcr.io/voxpupuli/container-puppetserver:7.17.0-v1.5.0916746209ac5
faraday@2.8.1
2.14.3

Open the chart page →

14,184
kubernetes-loggingkubernetes-logging4.8.01 of 6See more

kubernetes-logging kubernetes-logging 4.8.0

1 of the 6 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
opensearchproject/logstash-oss-with-opensearch-output-plugin:8.9.043b0cdaf26ed
faraday@1.10.3
1.10.6

Open the chart page →

10,530
uffizzi-appuffizzi-app1.3.01 of 14See more

uffizzi-app uffizzi-app 1.3.0

1 of the 14 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
uffizzi/app:latest66e9e3937c60
faraday@1.10.3
1.10.6

Open the chart page →

19,337
efkcryptexlabsVerified publisher7.17.31 of 3See more

efk cryptexlabs 7.17.3

1 of the 3 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.12.4-debian-elasticsearch7-1.0656423b5fabb
faraday@1.4.2
1.10.6

Open the chart page →

1,299
mastodondefault-ghVerified publisher0.3.11 of 3See more

mastodon default-gh 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
faraday@1.9.3
1.10.6

Open the chart page →

5,056
docker-registry-browsergmelilloVerified publisher0.1.21 of 1See more

docker-registry-browser gmelillo 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
klausmeyer/docker-registry-browser:1.3.5430a440d95af
faraday@1.0.1
1.10.6

Open the chart page →

4,108
openprojecthomeenterpriseinc0.5.01 of 1See more

openproject homeenterpriseinc 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
openproject/community:12.0.2734743d11094
faraday@1.8.0
1.10.6

Open the chart page →

6,810
chatwootmaxcrm-chartsVerified publisher1.1.2011 of 4See more

chatwoot maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
faraday@2.7.4
2.14.3

Open the chart page →

5,940
logstashromanow-helm-chartsVerified publisher1.5.01 of 1See more

logstash romanow-helm-charts 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
library/logstash:7.17.817a4f64e9cf5
faraday@1.10.2
1.10.6

Open the chart page →

7,529
ansible-inspecansible-inspec0.2.171 of 2See more

ansible-inspec ansible-inspec 0.2.17

1 of the 2 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
faraday@1.10.4
1.10.6

Open the chart page →

5,558
antigenic-docuseal-helm-chartantigenic-docuseal-helm-chartVerified publisher0.2.01 of 1See more

antigenic-docuseal-helm-chart antigenic-docuseal-helm-chart 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
docuseal/docuseal:2.4.17493fd7f6728
faraday@2.14.1
2.14.3

Open the chart page →

2,766
puppetservercamptocamp31.0.11 of 2See more

puppetserver camptocamp3 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
ghcr.io/voxpupuli/puppetserver:8.7.0-main63873f3f698e
faraday@2.12.2
2.14.3

Open the chart page →

5,886
elk-stackelk-stack-test1.0.21 of 9See more

elk-stack elk-stack-test 1.0.2

1 of the 9 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
library/logstash:9.1.233eae14f0867
faraday@2.13.4
2.14.3

Open the chart page →

2,942
docker-registry-browsergtaylor0.4.41 of 1See more

docker-registry-browser gtaylor 0.4.4

1 of the 1 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
klausmeyer/docker-registry-browser:1.4.0bdc4c6b8595b
faraday@1.8.0
1.10.6

Open the chart page →

3,564
octoboxhalkeye0.1.11 of 1See more

octobox halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
octoboxio/octobox:latestd909041c46eb
faraday@1.10.4
1.10.6

Open the chart page →

3,255
fluentdhelm0.2.161 of 1See more

fluentd helm 0.2.16

1 of the 1 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.14.0-debian-elasticsearch7-1.03933cae61054
faraday@1.7.1
1.10.6

Open the chart page →

1,217
manyfoldjeffrescVerified publisher1.0.31 of 1See more

manyfold jeffresc 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
ghcr.io/manyfold3d/manyfold:0.136.0d14ca4d82475
faraday@2.14.1
2.14.3

Open the chart page →

1,960
fluentd-elasticsearchkfirfer13.9.11 of 1See more

fluentd-elasticsearch kfirfer 13.9.1

1 of the 1 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
quay.io/fluentd_elasticsearch/fluentd:v4.2.399079df58561
faraday@1.10.2
1.10.6

Open the chart page →

1,178
maxcrm-chartsmaxcrm-chartsVerified publisher1.1.2011 of 4See more

maxcrm-charts maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
faraday@2.7.4
2.14.3

Open the chart page →

5,940
danboorumy0nVerified publisher0.0.21 of 1See more

danbooru my0n 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
faraday@2.3.0
2.14.3

Open the chart page →

12,791
danbooru-stackmy0nVerified publisher0.0.31 of 4See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
faraday@2.3.0
2.14.3

Open the chart page →

12,791
mastodonrivals-spaceVerified publisher3.1.21 of 3See more

mastodon rivals-space 3.1.2

1 of the 3 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
faraday@1.9.3
1.10.6

Open the chart page →

6,026
fluentd-operatorstatcan0.5.11 of 1See more

fluentd-operator statcan 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
vmware/kube-fluentd-operator:latestf028c138a5f4
faraday@2.7.10
2.14.3

Open the chart page →

1,955
maybe-financevicsuferVerified publisher0.2.71 of 3See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-54297.

Container imageDigestPackageFixed in
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
faraday@2.12.2
2.14.3

Open the chart page →

10,795

Container images carrying it

23 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
chatwoot/chatwoot:v3.1.0d530ab8c1753
faraday@2.7.4
2.14.3
2
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
faraday@2.3.0
2.14.3
2
chatwoot/chatwoot:v4.15.167ebc751c171
faraday@2.14.2
2.14.3
1
docuseal/docuseal:2.4.17493fd7f6728
faraday@2.14.1
2.14.3
1
fluent/fluentd-kubernetes-daemonset:v1.14.0-debian-elasticsearch7-1.03933cae61054
faraday@1.7.1
1.10.6
1
fluent/fluentd-kubernetes-daemonset:v1.12.4-debian-elasticsearch7-1.0656423b5fabb
faraday@1.4.2
1.10.6
1
klausmeyer/docker-registry-browser:1.3.5430a440d95af
faraday@1.0.1
1.10.6
1
klausmeyer/docker-registry-browser:1.4.0bdc4c6b8595b
faraday@1.8.0
1.10.6
1
library/logstash:7.17.817a4f64e9cf5
faraday@1.10.2
1.10.6
1
library/logstash:9.1.233eae14f0867
faraday@2.13.4
2.14.3
1
octoboxio/octobox:latestd909041c46eb
faraday@1.10.4
1.10.6
1
openproject/community:12.0.2734743d11094
faraday@1.8.0
1.10.6
1
opensearchproject/logstash-oss-with-opensearch-output-plugin:8.9.043b0cdaf26ed
faraday@1.10.3
1.10.6
1
uffizzi/app:latest66e9e3937c60
faraday@1.10.3
1.10.6
1
vmware/kube-fluentd-operator:latestf028c138a5f4
faraday@2.7.10
2.14.3
1
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
faraday@1.10.4
1.10.6
1
ghcr.io/manyfold3d/manyfold:0.136.0d14ca4d82475
faraday@2.14.1
2.14.3
1
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
faraday@1.9.3
1.10.6
1
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
faraday@2.12.2
2.14.3
1
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
faraday@1.9.3
1.10.6
1
ghcr.io/voxpupuli/container-puppetserver:7.17.0-v1.5.0916746209ac5
faraday@2.8.1
2.14.3
1
ghcr.io/voxpupuli/puppetserver:8.7.0-main63873f3f698e
faraday@2.12.2
2.14.3
1
quay.io/fluentd_elasticsearch/fluentd:v4.2.399079df58561
faraday@1.10.2
1.10.6
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.