StackRadar

CVE-2026-54522

Low

Advisory

Published 30 Jul 2026In the index since 6 Sept 2026
Severity
Low
worst across findings
CVSS
2.1
base score, highest
EPSS
0.002
6th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
39
of 17,781 indexed, latest versions
Container images
38
deployed by those charts
Fix available
1 of 1
affected package

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Carried by container images the latest versions of 39 of 17,781 indexed charts deploy, on 38 images.

Affected packageAffected versionsFixed inImages
msgpackgem1.1.0, 1.2.4, 1.2.6, 1.3.0+10 more1.8.238
OSV records
GHSA-4mrv-5p47-p938

Charts affected

39 by stars
ChartLatestAffected imagesRadar Score
chatwootchatwootVerified publisher2.0.241 of 3See more

chatwoot chatwoot 2.0.24

1 of the 3 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v4.15.167ebc751c171
msgpack@1.8.0
1.8.2

Open the chart page →

9,203
kubernetes-loggingkubernetes-logging4.8.01 of 6See more

kubernetes-logging kubernetes-logging 4.8.0

1 of the 6 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
opensearchproject/logstash-oss-with-opensearch-output-plugin:8.9.043b0cdaf26ed
msgpack@1.7.1
1.8.2

Open the chart page →

10,530
uffizzi-appuffizzi-app1.3.01 of 14See more

uffizzi-app uffizzi-app 1.3.0

1 of the 14 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
uffizzi/app:latest66e9e3937c60
msgpack@1.4.5
1.8.2

Open the chart page →

19,337
efkcryptexlabsVerified publisher7.17.31 of 3See more

efk cryptexlabs 7.17.3

1 of the 3 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.12.4-debian-elasticsearch7-1.0656423b5fabb
msgpack@1.4.2
1.8.2

Open the chart page →

1,299
huginnutkuozdemirVerified publisher2.2.11 of 4See more

huginn utkuozdemir 2.2.1

1 of the 4 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
huginn/huginn-single-process:4d17829cf6b15b004ad3f4be196303dca4944810c794eddc7b47
msgpack@1.3.1
1.8.2

Open the chart page →

18,137
mastodondefault-ghVerified publisher0.3.11 of 3See more

mastodon default-gh 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
msgpack@1.6.0
1.8.2

Open the chart page →

5,056
zammaddevplayer0Verified publisher4.0.51 of 4See more

zammad devplayer0 4.0.5

1 of the 4 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
zammad/zammad-docker-compose:zammad-4.1.0-312808e2dfa810
msgpack@1.2.4
1.8.2

Open the chart page →

6,110
docker-registry-browsergmelilloVerified publisher0.1.21 of 1See more

docker-registry-browser gmelillo 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
klausmeyer/docker-registry-browser:1.3.5430a440d95af
msgpack@1.3.3
1.8.2

Open the chart page →

4,108
openprojecthomeenterpriseinc0.5.01 of 1See more

openproject homeenterpriseinc 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
openproject/community:12.0.2734743d11094
msgpack@1.4.2
1.8.2

Open the chart page →

6,810
chatwootmaxcrm-chartsVerified publisher1.1.2011 of 4See more

chatwoot maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
msgpack@1.7.0
1.8.2

Open the chart page →

5,940
logstashromanow-helm-chartsVerified publisher1.5.01 of 1See more

logstash romanow-helm-charts 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
library/logstash:7.17.817a4f64e9cf5
msgpack@1.4.5
1.8.2

Open the chart page →

7,529
antigenic-docuseal-helm-chartantigenic-docuseal-helm-chartVerified publisher0.2.01 of 1See more

antigenic-docuseal-helm-chart antigenic-docuseal-helm-chart 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
docuseal/docuseal:2.4.17493fd7f6728
msgpack@1.8.0
1.8.2

Open the chart page →

2,766
fluentdbryanalves0.1.01 of 1See more

fluentd bryanalves 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
bryanalves/fluentd:0.5d3605be4b178
msgpack@1.2.4
1.8.2

Open the chart page →

723
fluentd-cloudwatchcloudnativeapp0.9.01 of 2See more

fluentd-cloudwatch cloudnativeapp 0.9.0

1 of the 2 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.3.3-debian-cloudwatch-1.017398121d3cc
msgpack@1.2.6
1.8.2

Open the chart page →

1,342
fluentd-kubernetes-awscloudposse0.2.11 of 2See more

fluentd-kubernetes-aws cloudposse 0.2.1

1 of the 2 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.4.2-debian-elasticsearch-1.1ce4885865850
msgpack@1.3.0
1.8.2

Open the chart page →

1,305
monitoring-stackdata354-helmVerified publisher1.4.21 of 4See more

monitoring-stack data354-helm 1.4.2

1 of the 4 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
grafana/fluent-plugin-loki:latest8a3882e8c28b
msgpack@1.8.0
1.8.2

Open the chart page →

3,176
coralogix-fluentddevtron1.0.31 of 1See more

coralogix-fluentd devtron 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
coralogixrepo/fluentd-coralogix-image:1.1.6b976e0412424
msgpack@1.3.1
1.8.2

Open the chart page →

750
coralogix-fluentddevtron-labs1.0.31 of 1See more

coralogix-fluentd devtron-labs 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
coralogixrepo/fluentd-coralogix-image:1.1.6b976e0412424
msgpack@1.3.1
1.8.2

Open the chart page →

750
elk-stackelk-stack-test1.0.21 of 9See more

elk-stack elk-stack-test 1.0.2

1 of the 9 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
library/logstash:9.1.233eae14f0867
msgpack@1.8.0
1.8.2

Open the chart page →

2,942
docker-registry-browsergtaylor0.4.41 of 1See more

docker-registry-browser gtaylor 0.4.4

1 of the 1 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
klausmeyer/docker-registry-browser:1.4.0bdc4c6b8595b
msgpack@1.4.2
1.8.2

Open the chart page →

3,564
gwangju_2-3gwangju2-30.1.01 of 5See more

gwangju_2-3 gwangju2-3 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.10.3-debian-cloudwatch-1.019a8f0662241
msgpack@1.3.3
1.8.2

Open the chart page →

6,491
octoboxhalkeye0.1.11 of 1See more

octobox halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
octoboxio/octobox:latestd909041c46eb
msgpack@1.8.0
1.8.2

Open the chart page →

3,255
fluentdhelm0.2.161 of 1See more

fluentd helm 0.2.16

1 of the 1 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.14.0-debian-elasticsearch7-1.03933cae61054
msgpack@1.4.2
1.8.2

Open the chart page →

1,217
coralogix-fluentdhelmtest1.0.41 of 1See more

coralogix-fluentd helmtest 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
coralogixrepo/fluentd-coralogix-image:1.1.6b976e0412424
msgpack@1.3.1
1.8.2

Open the chart page →

750
manyfoldjeffrescVerified publisher1.0.31 of 1See more

manyfold jeffresc 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
ghcr.io/manyfold3d/manyfold:0.136.0d14ca4d82475
msgpack@1.8.0
1.8.2

Open the chart page →

1,960
fluentd-elasticsearchkfirfer13.9.11 of 1See more

fluentd-elasticsearch kfirfer 13.9.1

1 of the 1 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
quay.io/fluentd_elasticsearch/fluentd:v4.2.399079df58561
msgpack@1.6.0
1.8.2

Open the chart page →

1,178
gitlabkubesphereVerified publisher4.2.34 of 17See more

gitlab kubesphere 4.2.3

4 of the 17 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
mirrorgitlabcontainers/gitaly:v13.2.283599461ef8b
msgpack@1.3.1
1.8.2
mirrorgitlabcontainers/gitlab-sidekiq-ce:v13.2.294d1431683fa
msgpack@1.3.1
1.8.2
mirrorgitlabcontainers/gitlab-task-runner-ce:v13.2.29efd73993c34
msgpack@1.3.1
1.8.2
mirrorgitlabcontainers/gitlab-webservice-ce:v13.2.230393f990f5c
msgpack@1.3.1
1.8.2

Open the chart page →

38,133
lm-logslogicmonitorVerified publisher0.3.51 of 1See more

lm-logs logicmonitor 0.3.5

1 of the 1 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
logicmonitor/lm-logs-k8s-fluentd:1.0.55ac21b3f1572
msgpack@1.7.0
1.8.2

Open the chart page →

1,029
maxcrm-chartsmaxcrm-chartsVerified publisher1.1.2011 of 4See more

maxcrm-charts maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
msgpack@1.7.0
1.8.2

Open the chart page →

5,940
fluentd-papertrailmozilla0.2.21 of 1See more

fluentd-papertrail mozilla 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:papertrail9c209835eea1
msgpack@1.2.4
1.8.2

Open the chart page →

1,001
danboorumy0nVerified publisher0.0.21 of 1See more

danbooru my0n 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
msgpack@1.5.3
1.8.2

Open the chart page →

12,791
danbooru-stackmy0nVerified publisher0.0.31 of 4See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
msgpack@1.5.3
1.8.2

Open the chart page →

12,791
mastodonrivals-spaceVerified publisher3.1.21 of 3See more

mastodon rivals-space 3.1.2

1 of the 3 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
msgpack@1.6.0
1.8.2

Open the chart page →

6,026
coralogix-fluentdromholdings1.0.31 of 1See more

coralogix-fluentd romholdings 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
coralogixrepo/fluentd-coralogix-image:1.1.6b976e0412424
msgpack@1.3.1
1.8.2

Open the chart page →

750
fluentdslamdev0.0.61 of 1See more

fluentd slamdev 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.11.5-debian-forward-1.00717111a3362
msgpack@1.3.3
1.8.2

Open the chart page →

1,384
fluentd-operatorstatcan0.5.11 of 1See more

fluentd-operator statcan 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
vmware/kube-fluentd-operator:latestf028c138a5f4
msgpack@1.7.2
1.8.2

Open the chart page →

1,955
maybe-financevicsuferVerified publisher0.2.71 of 3See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
msgpack@1.8.0
1.8.2

Open the chart page →

10,795
kongwallarmVerified publisher4.6.32 of 7See more

kong wallarm 4.6.3

2 of the 7 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
wallarm/ingress-ruby:4.6.0-1aecdb35c4def
msgpack@1.1.0
1.8.2
wallarm/kong:3.1.0-ubuntu-4.6.0ea9608c82e40
msgpack@1.1.0
1.8.2

Open the chart page →

11,405
kong-previewwallarmVerified publisher4.2.31 of 5See more

kong-preview wallarm 4.2.3

1 of the 5 container images this version deploys carry CVE-2026-54522.

Container imageDigestPackageFixed in
wallarm/ingress-ruby:4.2.1-195ea2632326c
msgpack@1.1.0
1.8.2

Open the chart page →

2,905

Container images carrying it

38 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
coralogixrepo/fluentd-coralogix-image:1.1.6b976e0412424
msgpack@1.3.1
1.8.2
4
chatwoot/chatwoot:v3.1.0d530ab8c1753
msgpack@1.7.0
1.8.2
2
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
msgpack@1.5.3
1.8.2
2
bryanalves/fluentd:0.5d3605be4b178
msgpack@1.2.4
1.8.2
1
chatwoot/chatwoot:v4.15.167ebc751c171
msgpack@1.8.0
1.8.2
1
docuseal/docuseal:2.4.17493fd7f6728
msgpack@1.8.0
1.8.2
1
fluent/fluentd-kubernetes-daemonset:v1.11.5-debian-forward-1.00717111a3362
msgpack@1.3.3
1.8.2
1
fluent/fluentd-kubernetes-daemonset:v1.3.3-debian-cloudwatch-1.017398121d3cc
msgpack@1.2.6
1.8.2
1
fluent/fluentd-kubernetes-daemonset:v1.10.3-debian-cloudwatch-1.019a8f0662241
msgpack@1.3.3
1.8.2
1
fluent/fluentd-kubernetes-daemonset:v1.14.0-debian-elasticsearch7-1.03933cae61054
msgpack@1.4.2
1.8.2
1
fluent/fluentd-kubernetes-daemonset:v1.12.4-debian-elasticsearch7-1.0656423b5fabb
msgpack@1.4.2
1.8.2
1
fluent/fluentd-kubernetes-daemonset:papertrail9c209835eea1
msgpack@1.2.4
1.8.2
1
fluent/fluentd-kubernetes-daemonset:v1.4.2-debian-elasticsearch-1.1ce4885865850
msgpack@1.3.0
1.8.2
1
grafana/fluent-plugin-loki:latest8a3882e8c28b
msgpack@1.8.0
1.8.2
1
huginn/huginn-single-process:4d17829cf6b15b004ad3f4be196303dca4944810c794eddc7b47
msgpack@1.3.1
1.8.2
1
klausmeyer/docker-registry-browser:1.3.5430a440d95af
msgpack@1.3.3
1.8.2
1
klausmeyer/docker-registry-browser:1.4.0bdc4c6b8595b
msgpack@1.4.2
1.8.2
1
library/logstash:7.17.817a4f64e9cf5
msgpack@1.4.5
1.8.2
1
library/logstash:9.1.233eae14f0867
msgpack@1.8.0
1.8.2
1
logicmonitor/lm-logs-k8s-fluentd:1.0.55ac21b3f1572
msgpack@1.7.0
1.8.2
1
mirrorgitlabcontainers/gitaly:v13.2.283599461ef8b
msgpack@1.3.1
1.8.2
1
mirrorgitlabcontainers/gitlab-sidekiq-ce:v13.2.294d1431683fa
msgpack@1.3.1
1.8.2
1
mirrorgitlabcontainers/gitlab-task-runner-ce:v13.2.29efd73993c34
msgpack@1.3.1
1.8.2
1
mirrorgitlabcontainers/gitlab-webservice-ce:v13.2.230393f990f5c
msgpack@1.3.1
1.8.2
1
octoboxio/octobox:latestd909041c46eb
msgpack@1.8.0
1.8.2
1
openproject/community:12.0.2734743d11094
msgpack@1.4.2
1.8.2
1
opensearchproject/logstash-oss-with-opensearch-output-plugin:8.9.043b0cdaf26ed
msgpack@1.7.1
1.8.2
1
uffizzi/app:latest66e9e3937c60
msgpack@1.4.5
1.8.2
1
vmware/kube-fluentd-operator:latestf028c138a5f4
msgpack@1.7.2
1.8.2
1
wallarm/ingress-ruby:4.2.1-195ea2632326c
msgpack@1.1.0
1.8.2
1
wallarm/ingress-ruby:4.6.0-1aecdb35c4def
msgpack@1.1.0
1.8.2
1
wallarm/kong:3.1.0-ubuntu-4.6.0ea9608c82e40
msgpack@1.1.0
1.8.2
1
zammad/zammad-docker-compose:zammad-4.1.0-312808e2dfa810
msgpack@1.2.4
1.8.2
1
ghcr.io/manyfold3d/manyfold:0.136.0d14ca4d82475
msgpack@1.8.0
1.8.2
1
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
msgpack@1.6.0
1.8.2
1
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
msgpack@1.8.0
1.8.2
1
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
msgpack@1.6.0
1.8.2
1
quay.io/fluentd_elasticsearch/fluentd:v4.2.399079df58561
msgpack@1.6.0
1.8.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.