StackRadar

CVE-2026-6409

High

Advisory

Published 25 Mar 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.1
base score, highest
EPSS
0.004
29th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
29
of 17,781 indexed, latest versions
Container images
26
deployed by those charts
Fix available
2 of 2
affected packages

Protobuf: Denial of Service issue through malicious messages containing negative varints or deep recursion

Carried by container images the latest versions of 29 of 17,781 indexed charts deploy, on 26 images.

Affected packageAffected versionsFixed inImages
protobufdeb2.6.1-1.3, 3.0.0-9, 3.0.0-9.1ubuntu1, 3.0.0-9.1ubuntu1.1+7 more3.21.12-3+deb12u120
google/protobufcomposerv3.15.6, v3.17.3, v4.28.3, v4.31.1+2 more4.33.66
OSV records
DEBIAN-CVE-2026-6409GHSA-p2gh-cfq4-4wjcUBUNTU-CVE-2026-6409

Charts affected

29 by stars
ChartLatestAffected imagesRadar Score
mysqlkubelauncherVerified publisher0.4.41 of 1See more

mysql kubelauncher 0.4.4

1 of the 1 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/mysqldigest-pinnede9609bd50416
protobuf@3.21.12-15ubuntu1
no fix listed

Open the chart page →

938
headwind-mdmchristianhuthVerified publisher5.10.11 of 2See more

headwind-mdm christianhuth 5.10.1

1 of the 2 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
headwindmdm/hmdm:0.1.93550b4840840
protobuf@3.12.4-1ubuntu7.22.04.6
no fix listed

Open the chart page →

5,870
kamu-api-serverkamuVerified publisher0.89.01 of 1See more

kamu-api-server kamu 0.89.0

1 of the 1 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
ghcr.io/kamu-data/kamu-api-server:0.89.04ed7a896dd2b
protobuf@3.6.1.3-2ubuntu5.2
no fix listed

Open the chart page →

6,307
edgelessdbedgelesssysVerified publisher0.3.21 of 1See more

edgelessdb edgelesssys 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
ghcr.io/edgelesssys/edgelessdb-sgx-1gb:v0.3.27e1d7a11a11a
protobuf@3.6.1.3-2ubuntu5
no fix listed

Open the chart page →

4,830
matomodigitalist-open-cloud-matomo12.0.201 of 3See more

matomo digitalist-open-cloud-matomo 12.0.20

1 of the 3 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
digitalist/matomo:5.12.0bc4aeeaea769
google/protobuf@v4.33.5
4.33.6

Open the chart page →

3,539
mumblesyntaxerror404Verified publisher1.0.41 of 1See more

mumble syntaxerror404 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
ghcr.io/mumble-voip/mumble-server:v1.6.87002fd613b6a35
protobuf@3.21.12-8.2ubuntu0.3
no fix listed

Open the chart page →

2,099
appwriteappwrite-helmVerified publisher1.3.21 of 8See more

appwrite appwrite-helm 1.3.2

1 of the 8 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
openruntimes/executor:0.11.42228f186dcbb
google/protobuf@v4.33.0
4.33.6

Open the chart page →

9,847
videoaugmentationassist-iot-video-augmentation0.1.01 of 3See more

videoaugmentation assist-iot-video-augmentation 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
assistiot/video_augmentation:runner-cpu-lateste5ae539ce2cb
protobuf@3.6.1.3-2ubuntu5.2
no fix listed

Open the chart page →

13,913
otbrcharts-derwitt-devVerified publisher0.2.01 of 1See more

otbr charts-derwitt-dev 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
openthread/otbr:latestf307f59f6432
protobuf@3.0.0-9.1ubuntu1.1
no fix listed

Open the chart page →

12,779
webpagetest-agentcloudnativeapp0.2.01 of 1See more

webpagetest-agent cloudnativeapp 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
protobuf@2.6.1-1.3
no fix listed

Open the chart page →

77,758
marblerun-coordinatoredgelesssysVerified publisher0.5.01 of 1See more

marblerun-coordinator edgelesssys 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
ghcr.io/edgelesssys/coordinator:v0.5.0bcd5b8d4c45c
protobuf@3.0.0-9.1ubuntu1
no fix listed

Open the chart page →

10,981
supportpalevilgn0me0.1.61 of 1See more

supportpal evilgn0me 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
google/protobuf@v3.15.6
4.33.6

Open the chart page →

20,933
business-api-ecosystemfiware1.1.01 of 4See more

business-api-ecosystem fiware 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
protobuf@3.6.1.3-2ubuntu5.2
no fix listed

Open the chart page →

64,489
icinga2geek-cookbookVerified publisher4.2.01 of 1See more

icinga2 geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
jordan/icinga2:latestf75025fe8ea8
protobuf@3.21.12-3
3.21.12-3+deb12u1

Open the chart page →

9,077
xtevegeek-cookbookVerified publisher8.4.21 of 1See more

xteve geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/xteve:v2.2.0.200292b3614670f
protobuf@3.6.1.3-2ubuntu5
no fix listed

Open the chart page →

17,929
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-quoteservice87eb325d306f
google/protobuf@v4.28.3
4.33.6

Open the chart page →

49,025
tcs-issuerintelVerified publisher0.5.01 of 2See more

tcs-issuer intel 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
intel/trusted-certificate-issuer:0.5.0591a9db4a427
protobuf@3.6.1.3-2ubuntu5
no fix listed

Open the chart page →

5,958
mumble-serverjuniorjpdj0.1.411 of 1See more

mumble-server juniorjpdj 0.1.41

1 of the 1 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
ghcr.io/mumble-voip/mumble-server:v1.6.87002fd613b6a35
protobuf@3.21.12-8.2ubuntu0.3
no fix listed

Open the chart page →

2,099
cdn-remoteopencord0.2.41 of 3See more

cdn-remote opencord 0.2.4

1 of the 3 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
omecproject/cdn-video-repo:1.0.0d59ccb138ffb
protobuf@2.6.1-1.3
no fix listed

Open the chart page →

63,223
mcord-cdn-remoteopencord0.1.61 of 2See more

mcord-cdn-remote opencord 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
omecproject/cdn-video-repo:remote-v3d59ccb138ffb
protobuf@2.6.1-1.3
no fix listed

Open the chart page →

42,614
mcord-cdn-remote-freeopencord0.1.31 of 1See more

mcord-cdn-remote-free opencord 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
omecproject/cdn-video-repo:remote-v3d59ccb138ffb
protobuf@2.6.1-1.3
no fix listed

Open the chart page →

29,124
sebaopencord1.0.02 of 17See more

seba opencord 1.0.0

2 of the 17 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
voltha/voltha-netconf:1.6.037f80524c207
protobuf@3.0.0-9
no fix listed
voltha/voltha-ofagent:1.6.09ee8c1f4428c
protobuf@3.0.0-9
no fix listed

Open the chart page →

93,855
substreams-sink-kvpinaxVerified publisher0.0.41 of 1See more

substreams-sink-kv pinax 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/substreams-sink-kv:v2.3.026953ec68d5d
protobuf@3.6.1.3-2ubuntu5.2
no fix listed

Open the chart page →

6,641
substreams-sink-nooppinaxVerified publisher0.0.31 of 1See more

substreams-sink-noop pinax 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/substreams-sink-noop:v1.4.0d7c43c3135c6
protobuf@3.6.1.3-2ubuntu5.2
no fix listed

Open the chart page →

6,587
retromretsamedocVerified publisher2026.2.51 of 1See more

retrom retsamedoc 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
protobuf@3.21.12-3
3.21.12-3+deb12u1

Open the chart page →

7,084
kurento_webrtc_demostunner0.1.01 of 2See more

kurento_webrtc_demo stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
kurento/kurento-media-server:latest03c0d34d0828
protobuf@3.21.12-8.2ubuntu0.2
no fix listed

Open the chart page →

12,460
stunner-kurento-one2one-callstunner0.1.01 of 2See more

stunner-kurento-one2one-call stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
kurento/kurento-media-server:latest03c0d34d0828
protobuf@3.21.12-8.2ubuntu0.2
no fix listed

Open the chart page →

12,460
apiwbstack0.36.01 of 1See more

api wbstack 0.36.0

1 of the 1 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
ghcr.io/wbstack/api:8x.9.11eee94f9f7a53
google/protobuf@v3.17.3
4.33.6

Open the chart page →

2,019
xboardxboard0.2.01 of 1See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-6409.

Container imageDigestPackageFixed in
ghcr.io/cedar2025/xboard:latest896e4926e0d7
google/protobuf@v4.31.1
4.33.6

Open the chart page →

1,042

Container images carrying it

26 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
omecproject/cdn-video-repo:1.0.0:remote-v3d59ccb138ffb
protobuf@2.6.1-1.3
no fix listed
3
kurento/kurento-media-server:latest03c0d34d0828
protobuf@3.21.12-8.2ubuntu0.2
no fix listed
2
ghcr.io/mumble-voip/mumble-server:v1.6.87002fd613b6a35
protobuf@3.21.12-8.2ubuntu0.3
no fix listed
2
assistiot/video_augmentation:runner-cpu-lateste5ae539ce2cb
protobuf@3.6.1.3-2ubuntu5.2
no fix listed
1
digitalist/matomo:5.12.0bc4aeeaea769
google/protobuf@v4.33.5
4.33.6
1
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
protobuf@3.6.1.3-2ubuntu5.2
no fix listed
1
headwindmdm/hmdm:0.1.93550b4840840
protobuf@3.12.4-1ubuntu7.22.04.6
no fix listed
1
intel/trusted-certificate-issuer:0.5.0591a9db4a427
protobuf@3.6.1.3-2ubuntu5
no fix listed
1
jordan/icinga2:latestf75025fe8ea8
protobuf@3.21.12-3
3.21.12-3+deb12u1
1
openruntimes/executor:0.11.42228f186dcbb
google/protobuf@v4.33.0
4.33.6
1
openthread/otbr:latestf307f59f6432
protobuf@3.0.0-9.1ubuntu1.1
no fix listed
1
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
protobuf@2.6.1-1.3
no fix listed
1
voltha/voltha-netconf:1.6.037f80524c207
protobuf@3.0.0-9
no fix listed
1
voltha/voltha-ofagent:1.6.09ee8c1f4428c
protobuf@3.0.0-9
no fix listed
1
ghcr.io/cedar2025/xboard:latest896e4926e0d7
google/protobuf@v4.31.1
4.33.6
1
ghcr.io/edgelesssys/coordinator:v0.5.0bcd5b8d4c45c
protobuf@3.0.0-9.1ubuntu1
no fix listed
1
ghcr.io/edgelesssys/edgelessdb-sgx-1gb:v0.3.27e1d7a11a11a
protobuf@3.6.1.3-2ubuntu5
no fix listed
1
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
protobuf@3.21.12-3
3.21.12-3+deb12u1
1
ghcr.io/k8s-at-home/xteve:v2.2.0.200292b3614670f
protobuf@3.6.1.3-2ubuntu5
no fix listed
1
ghcr.io/kamu-data/kamu-api-server:0.89.04ed7a896dd2b
protobuf@3.6.1.3-2ubuntu5.2
no fix listed
1
ghcr.io/kubelauncher/mysqle9609bd50416
protobuf@3.21.12-15ubuntu1
no fix listed
1
ghcr.io/open-telemetry/demo:1.12.0-quoteservice87eb325d306f
google/protobuf@v4.28.3
4.33.6
1
ghcr.io/streamingfast/substreams-sink-kv:v2.3.026953ec68d5d
protobuf@3.6.1.3-2ubuntu5.2
no fix listed
1
ghcr.io/streamingfast/substreams-sink-noop:v1.4.0d7c43c3135c6
protobuf@3.6.1.3-2ubuntu5.2
no fix listed
1
ghcr.io/wbstack/api:8x.9.11eee94f9f7a53
google/protobuf@v3.17.3
4.33.6
1
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
google/protobuf@v3.15.6
4.33.6
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.