StackRadar

GHSA-3prj-6hqw-cm82

High

Advisory

Published 18 Jun 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
26
of 17,781 indexed, latest versions
Container images
22
deployed by those charts
Fix available
2 of 2
affected packages

PHP JWT Library: PBES2-HS*+A*KW unwrap accepts an unbounded p2c iteration count, enabling CPU-amplification denial of service

Carried by container images the latest versions of 26 of 17,781 indexed charts deploy, on 22 images.

Affected packageAffected versionsFixed inImages
web-token/jwt-frameworkcomposerv2.2.8, v2.2.10, v2.2.113.4.1019
web-token/jwt-librarycomposer3.4.3, 3.4.6, 4.0.53.4.10, 4.0.73
OSV records
GHSA-3prj-6hqw-cm82

Charts affected

26 by stars
ChartLatestAffected imagesRadar Score
monicamonicaOfficialVerified publisher1.0.151 of 1See more

monica monica 1.0.15

1 of the 1 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/monicahq/monica-next:main8be69156acbb
web-token/jwt-library@4.0.5
4.0.7

Open the chart page →

5,634
brpservicebrpservice1.1.01 of 4See more

brpservice brpservice 1.1.0

1 of the 4 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/brpservice-php:latestc17f1ba17d36
web-token/jwt-framework@v2.2.10
3.4.10

Open the chart page →

7,830
commonground-gatewaycommonground-gateway1.5.41 of 7See more

commonground-gateway commonground-gateway 1.5.4

1 of the 7 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/commonground-gateway-php:latest947882bf2c37
web-token/jwt-framework@v2.2.11
3.4.10

Open the chart page →

9,724
contactcataloguscontact-catalogus1.0.01 of 3See more

contactcatalogus contact-catalogus 1.0.0

1 of the 3 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/contactcatalogus-php:latesteeb625bd660c
web-token/jwt-framework@v2.2.11
3.4.10

Open the chart page →

7,303
digispoof-interfacedigispoof-interface1.0.01 of 3See more

digispoof-interface digispoof-interface 1.0.0

1 of the 3 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/digispoof-interface-php:latest03aba499950f
web-token/jwt-framework@v2.2.11
3.4.10

Open the chart page →

7,779
opencatalogiopencatalogi1.0.61 of 8See more

opencatalogi opencatalogi 1.0.6

1 of the 8 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/commonground-gateway-php:latest947882bf2c37
web-token/jwt-framework@v2.2.11
3.4.10

Open the chart page →

14,838
user-componentuser-component1.2.01 of 4See more

user-component user-component 1.2.0

1 of the 4 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/user-component-php:latest198db44fabb5
web-token/jwt-framework@v2.2.11
3.4.10

Open the chart page →

7,303
waardepapierenwaardepapieren1.0.01 of 3See more

waardepapieren waardepapieren 1.0.0

1 of the 3 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/waardepapieren-php:latestb2666ffcbad8
web-token/jwt-framework@v2.2.8
3.4.10

Open the chart page →

8,079
waardepapieren-baliewaardepapieren-balie1.0.01 of 3See more

waardepapieren-balie waardepapieren-balie 1.0.0

1 of the 3 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/waardepapieren-balie-php:latestf36c423cd259
web-token/jwt-framework@v2.2.8
3.4.10

Open the chart page →

7,871
adresserviceadresservice1.1.01 of 5See more

adresservice adresservice 1.1.0

1 of the 5 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/adresservice-php:latestc5075f0320cd
web-token/jwt-framework@v2.2.11
3.4.10

Open the chart page →

7,447
authorization-componentauthorization-component1.0.01 of 3See more

authorization-component authorization-component 1.0.0

1 of the 3 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/authorization-component-php:latest94a749392fcf
web-token/jwt-framework@v2.2.10
3.4.10

Open the chart page →

7,561
berichtserviceberichtservice1.0.01 of 3See more

berichtservice berichtservice 1.0.0

1 of the 3 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/berichtservice-php:latestee6a21e66ff0
web-token/jwt-framework@v2.2.11
3.4.10

Open the chart page →

7,342
commonground-gatewaycommonground-gateway-frontend0.1.51 of 4See more

commonground-gateway commonground-gateway-frontend 0.1.5

1 of the 4 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/commonground-gateway-php:latest947882bf2c37
web-token/jwt-framework@v2.2.11
3.4.10

Open the chart page →

2,825
conduction-uiconduction-ui0.1.01 of 6See more

conduction-ui conduction-ui 0.1.0

1 of the 6 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
conduction/conduction-ui-php:dev2744565516e8
web-token/jwt-framework@v2.2.10
3.4.10

Open the chart page →

12,907
eav-componenteav-component1.0.01 of 3See more

eav-component eav-component 1.0.0

1 of the 3 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/eav-component-php:latest24bbca4a52a8
web-token/jwt-framework@v2.2.11
3.4.10

Open the chart page →

7,255
education-componenteducation-component1.0.01 of 3See more

education-component education-component 1.0.0

1 of the 3 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/education-component-php:latestda6b05a1a601
web-token/jwt-framework@v2.2.11
3.4.10

Open the chart page →

7,327
monicagabe565Verified publisher0.10.01 of 2See more

monica gabe565 0.10.0

1 of the 2 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
library/monica:4.1.2-fpm-alpine6d1b2bd0947e
web-token/jwt-library@3.4.3
3.4.10

Open the chart page →

1,173
logicservicelogicservice1.0.01 of 4See more

logicservice logicservice 1.0.0

1 of the 4 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/logicservice-php:latest72aae2080595
web-token/jwt-framework@v2.2.10
3.4.10

Open the chart page →

7,499
medewerkercatalogusmedewerkercatalogus1.0.01 of 3See more

medewerkercatalogus medewerkercatalogus 1.0.0

1 of the 3 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/medewerkercatalogus-php:latest1ea5412bed26
web-token/jwt-framework@v2.2.11
3.4.10

Open the chart page →

7,327
librenmsnimbolus0.5.11 of 3See more

librenms nimbolus 0.5.1

1 of the 3 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
librenms/librenms:24.11.00920bc9117a8
web-token/jwt-library@3.4.6
3.4.10

Open the chart page →

2,293
commonground-gatewayopencatalogi1.5.31 of 7See more

commonground-gateway opencatalogi 1.5.3

1 of the 7 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/commonground-gateway-php:latest947882bf2c37
web-token/jwt-framework@v2.2.11
3.4.10

Open the chart page →

9,724
review-componentreview-component1.0.01 of 3See more

review-component review-component 1.0.0

1 of the 3 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/review-component-php:latestafe623824b82
web-token/jwt-framework@v2.2.10
3.4.10

Open the chart page →

7,491
commonground-gatewayskeleton-pip0.1.71 of 5See more

commonground-gateway skeleton-pip 0.1.7

1 of the 5 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/commonground-gateway-php:latest947882bf2c37
web-token/jwt-framework@v2.2.11
3.4.10

Open the chart page →

2,825
taalhuizen-servicetaalhuizen-service1.0.01 of 3See more

taalhuizen-service taalhuizen-service 1.0.0

1 of the 3 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/taalhuizen-service-php:latest04f1b7f0d573
web-token/jwt-framework@v2.2.10
3.4.10

Open the chart page →

7,480
verzoekconversieserviceverzoekconversieservice1.0.01 of 3See more

verzoekconversieservice verzoekconversieservice 1.0.0

1 of the 3 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/verzoekconversieservice-php:lateste918014fb8d3
web-token/jwt-framework@v2.2.8
3.4.10

Open the chart page →

7,528
webresourcecataloguswebresourcecatalogus1.1.01 of 4See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry GHSA-3prj-6hqw-cm82.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/webresourcecatalogus-php:latest8f1bbd5cda85
web-token/jwt-framework@v2.2.11
3.4.10

Open the chart page →

7,552

Container images carrying it

22 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/conductionnl/commonground-gateway-php:latest947882bf2c37
web-token/jwt-framework@v2.2.11
3.4.10
5
conduction/conduction-ui-php:dev2744565516e8
web-token/jwt-framework@v2.2.10
3.4.10
1
library/monica:4.1.2-fpm-alpine6d1b2bd0947e
web-token/jwt-library@3.4.3
3.4.10
1
librenms/librenms:24.11.00920bc9117a8
web-token/jwt-library@3.4.6
3.4.10
1
ghcr.io/conductionnl/adresservice-php:latestc5075f0320cd
web-token/jwt-framework@v2.2.11
3.4.10
1
ghcr.io/conductionnl/authorization-component-php:latest94a749392fcf
web-token/jwt-framework@v2.2.10
3.4.10
1
ghcr.io/conductionnl/berichtservice-php:latestee6a21e66ff0
web-token/jwt-framework@v2.2.11
3.4.10
1
ghcr.io/conductionnl/brpservice-php:latestc17f1ba17d36
web-token/jwt-framework@v2.2.10
3.4.10
1
ghcr.io/conductionnl/contactcatalogus-php:latesteeb625bd660c
web-token/jwt-framework@v2.2.11
3.4.10
1
ghcr.io/conductionnl/digispoof-interface-php:latest03aba499950f
web-token/jwt-framework@v2.2.11
3.4.10
1
ghcr.io/conductionnl/eav-component-php:latest24bbca4a52a8
web-token/jwt-framework@v2.2.11
3.4.10
1
ghcr.io/conductionnl/education-component-php:latestda6b05a1a601
web-token/jwt-framework@v2.2.11
3.4.10
1
ghcr.io/conductionnl/logicservice-php:latest72aae2080595
web-token/jwt-framework@v2.2.10
3.4.10
1
ghcr.io/conductionnl/medewerkercatalogus-php:latest1ea5412bed26
web-token/jwt-framework@v2.2.11
3.4.10
1
ghcr.io/conductionnl/review-component-php:latestafe623824b82
web-token/jwt-framework@v2.2.10
3.4.10
1
ghcr.io/conductionnl/taalhuizen-service-php:latest04f1b7f0d573
web-token/jwt-framework@v2.2.10
3.4.10
1
ghcr.io/conductionnl/user-component-php:latest198db44fabb5
web-token/jwt-framework@v2.2.11
3.4.10
1
ghcr.io/conductionnl/verzoekconversieservice-php:lateste918014fb8d3
web-token/jwt-framework@v2.2.8
3.4.10
1
ghcr.io/conductionnl/waardepapieren-balie-php:latestf36c423cd259
web-token/jwt-framework@v2.2.8
3.4.10
1
ghcr.io/conductionnl/waardepapieren-php:latestb2666ffcbad8
web-token/jwt-framework@v2.2.8
3.4.10
1
ghcr.io/conductionnl/webresourcecatalogus-php:latest8f1bbd5cda85
web-token/jwt-framework@v2.2.11
3.4.10
1
ghcr.io/monicahq/monica-next:main8be69156acbb
web-token/jwt-library@4.0.5
4.0.7
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.