StackRadar

CVE-2026-54896

High

Advisory

Published 19 Jun 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.002
6th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
23
of 17,781 indexed, latest versions
Container images
22
deployed by those charts
Fix available
1 of 1
affected package

Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indent

Carried by container images the latest versions of 23 of 17,781 indexed charts deploy, on 22 images.

Affected packageAffected versionsFixed inImages
ojgem3.3.10, 3.5.1, 3.8.1, 3.10.6+7 more3.17.322
OSV records
GHSA-35w3-pjm6-wj95

Charts affected

23 by stars
ChartLatestAffected imagesRadar Score
chatwootchatwootVerified publisher2.0.241 of 3See more

chatwoot chatwoot 2.0.24

1 of the 3 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v4.15.167ebc751c171
oj@3.16.10
3.17.3

Open the chart page →

9,203
efkcryptexlabsVerified publisher7.17.31 of 3See more

efk cryptexlabs 7.17.3

1 of the 3 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.12.4-debian-elasticsearch7-1.0656423b5fabb
oj@3.10.18
3.17.3

Open the chart page →

1,299
mastodondefault-ghVerified publisher0.3.11 of 3See more

mastodon default-gh 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
oj@3.13.23
3.17.3

Open the chart page →

5,056
openprojecthomeenterpriseinc0.5.01 of 1See more

openproject homeenterpriseinc 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
openproject/community:12.0.2734743d11094
oj@3.13.9
3.17.3

Open the chart page →

6,810
antigenic-docuseal-helm-chartantigenic-docuseal-helm-chartVerified publisher0.2.01 of 1See more

antigenic-docuseal-helm-chart antigenic-docuseal-helm-chart 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
docuseal/docuseal:2.4.17493fd7f6728
oj@3.16.13
3.17.3

Open the chart page →

2,766
fluentdbryanalves0.1.01 of 1See more

fluentd bryanalves 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
bryanalves/fluentd:0.5d3605be4b178
oj@3.3.10
3.17.3

Open the chart page →

723
fluentd-cloudwatchcloudnativeapp0.9.01 of 2See more

fluentd-cloudwatch cloudnativeapp 0.9.0

1 of the 2 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.3.3-debian-cloudwatch-1.017398121d3cc
oj@3.3.10
3.17.3

Open the chart page →

1,342
fluentd-kubernetes-awscloudposse0.2.11 of 2See more

fluentd-kubernetes-aws cloudposse 0.2.1

1 of the 2 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.4.2-debian-elasticsearch-1.1ce4885865850
oj@3.3.10
3.17.3

Open the chart page →

1,305
monitoring-stackdata354-helmVerified publisher1.4.21 of 4See more

monitoring-stack data354-helm 1.4.2

1 of the 4 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
grafana/fluent-plugin-loki:latest8a3882e8c28b
oj@3.16.11
3.17.3

Open the chart page →

3,176
coralogix-fluentddevtron1.0.31 of 1See more

coralogix-fluentd devtron 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
coralogixrepo/fluentd-coralogix-image:1.1.6b976e0412424
oj@3.8.1
3.17.3

Open the chart page →

750
coralogix-fluentddevtron-labs1.0.31 of 1See more

coralogix-fluentd devtron-labs 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
coralogixrepo/fluentd-coralogix-image:1.1.6b976e0412424
oj@3.8.1
3.17.3

Open the chart page →

750
gwangju_2-3gwangju2-30.1.01 of 5See more

gwangju_2-3 gwangju2-3 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.10.3-debian-cloudwatch-1.019a8f0662241
oj@3.8.1
3.17.3

Open the chart page →

6,491
octoboxhalkeye0.1.11 of 1See more

octobox halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
octoboxio/octobox:latestd909041c46eb
oj@3.16.13
3.17.3

Open the chart page →

3,255
fluentdhelm0.2.161 of 1See more

fluentd helm 0.2.16

1 of the 1 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.14.0-debian-elasticsearch7-1.03933cae61054
oj@3.10.18
3.17.3

Open the chart page →

1,217
coralogix-fluentdhelmtest1.0.41 of 1See more

coralogix-fluentd helmtest 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
coralogixrepo/fluentd-coralogix-image:1.1.6b976e0412424
oj@3.8.1
3.17.3

Open the chart page →

750
fluentd-elasticsearchkfirfer13.9.11 of 1See more

fluentd-elasticsearch kfirfer 13.9.1

1 of the 1 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
quay.io/fluentd_elasticsearch/fluentd:v4.2.399079df58561
oj@3.13.23
3.17.3

Open the chart page →

1,178
gitlabkubesphereVerified publisher4.2.33 of 17See more

gitlab kubesphere 4.2.3

3 of the 17 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
mirrorgitlabcontainers/gitlab-sidekiq-ce:v13.2.294d1431683fa
oj@3.10.6
3.17.3
mirrorgitlabcontainers/gitlab-task-runner-ce:v13.2.29efd73993c34
oj@3.10.6
3.17.3
mirrorgitlabcontainers/gitlab-webservice-ce:v13.2.230393f990f5c
oj@3.10.6
3.17.3

Open the chart page →

38,133
lm-logslogicmonitorVerified publisher0.3.51 of 1See more

lm-logs logicmonitor 0.3.5

1 of the 1 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
logicmonitor/lm-logs-k8s-fluentd:1.0.55ac21b3f1572
oj@3.14.3
3.17.3

Open the chart page →

1,029
fluentd-papertrailmozilla0.2.21 of 1See more

fluentd-papertrail mozilla 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:papertrail9c209835eea1
oj@3.5.1
3.17.3

Open the chart page →

1,001
mastodonrivals-spaceVerified publisher3.1.21 of 3See more

mastodon rivals-space 3.1.2

1 of the 3 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
oj@3.13.23
3.17.3

Open the chart page →

6,026
coralogix-fluentdromholdings1.0.31 of 1See more

coralogix-fluentd romholdings 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
coralogixrepo/fluentd-coralogix-image:1.1.6b976e0412424
oj@3.8.1
3.17.3

Open the chart page →

750
fluentdslamdev0.0.61 of 1See more

fluentd slamdev 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.11.5-debian-forward-1.00717111a3362
oj@3.8.1
3.17.3

Open the chart page →

1,384
fluentd-operatorstatcan0.5.11 of 1See more

fluentd-operator statcan 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-54896.

Container imageDigestPackageFixed in
vmware/kube-fluentd-operator:latestf028c138a5f4
oj@3.13.23
3.17.3

Open the chart page →

1,955

Container images carrying it

22 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
coralogixrepo/fluentd-coralogix-image:1.1.6b976e0412424
oj@3.8.1
3.17.3
4
bryanalves/fluentd:0.5d3605be4b178
oj@3.3.10
3.17.3
1
chatwoot/chatwoot:v4.15.167ebc751c171
oj@3.16.10
3.17.3
1
docuseal/docuseal:2.4.17493fd7f6728
oj@3.16.13
3.17.3
1
fluent/fluentd-kubernetes-daemonset:v1.11.5-debian-forward-1.00717111a3362
oj@3.8.1
3.17.3
1
fluent/fluentd-kubernetes-daemonset:v1.3.3-debian-cloudwatch-1.017398121d3cc
oj@3.3.10
3.17.3
1
fluent/fluentd-kubernetes-daemonset:v1.10.3-debian-cloudwatch-1.019a8f0662241
oj@3.8.1
3.17.3
1
fluent/fluentd-kubernetes-daemonset:v1.14.0-debian-elasticsearch7-1.03933cae61054
oj@3.10.18
3.17.3
1
fluent/fluentd-kubernetes-daemonset:v1.12.4-debian-elasticsearch7-1.0656423b5fabb
oj@3.10.18
3.17.3
1
fluent/fluentd-kubernetes-daemonset:papertrail9c209835eea1
oj@3.5.1
3.17.3
1
fluent/fluentd-kubernetes-daemonset:v1.4.2-debian-elasticsearch-1.1ce4885865850
oj@3.3.10
3.17.3
1
grafana/fluent-plugin-loki:latest8a3882e8c28b
oj@3.16.11
3.17.3
1
logicmonitor/lm-logs-k8s-fluentd:1.0.55ac21b3f1572
oj@3.14.3
3.17.3
1
mirrorgitlabcontainers/gitlab-sidekiq-ce:v13.2.294d1431683fa
oj@3.10.6
3.17.3
1
mirrorgitlabcontainers/gitlab-task-runner-ce:v13.2.29efd73993c34
oj@3.10.6
3.17.3
1
mirrorgitlabcontainers/gitlab-webservice-ce:v13.2.230393f990f5c
oj@3.10.6
3.17.3
1
octoboxio/octobox:latestd909041c46eb
oj@3.16.13
3.17.3
1
openproject/community:12.0.2734743d11094
oj@3.13.9
3.17.3
1
vmware/kube-fluentd-operator:latestf028c138a5f4
oj@3.13.23
3.17.3
1
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
oj@3.13.23
3.17.3
1
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
oj@3.13.23
3.17.3
1
quay.io/fluentd_elasticsearch/fluentd:v4.2.399079df58561
oj@3.13.23
3.17.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.