StackRadar

GHSA-3pv8-6f4r-ffg2

Medium

Advisory

Published 29 May 2026In the index since 8 Sept 2026
Severity
Medium
worst across findings
CVSS
5.5
base score, highest
EPSS
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
9
of 17,781 indexed, latest versions
Container images
9
deployed by those charts
Fix available
1 of 1
affected package

tar has a PAX header desynchronization issue

Carried by container images the latest versions of 9 of 17,781 indexed charts deploy, on 9 images.

Affected packageAffected versionsFixed inImages
tarcargo0.4.43, 0.4.44, 0.4.450.4.469
OSV records
GHSA-3pv8-6f4r-ffg2

Charts affected

9 by stars
ChartLatestAffected imagesRadar Score
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry GHSA-3pv8-6f4r-ffg2.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
tar@0.4.45
0.4.46

Open the chart page →

5,880
litellmlitellm-helm0.2.01 of 1See more

litellm litellm-helm 0.2.0

1 of the 1 container images this version deploys carry GHSA-3pv8-6f4r-ffg2.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
tar@0.4.44
0.4.46

Open the chart page →

4,292
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry GHSA-3pv8-6f4r-ffg2.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
tar@0.4.45
0.4.46

Open the chart page →

8,158
authentikcluster-deploy0.2.01 of 1See more

authentik cluster-deploy 0.2.0

1 of the 1 container images this version deploys carry GHSA-3pv8-6f4r-ffg2.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
tar@0.4.45
0.4.46

Open the chart page →

2,481
chiefonboardinghelmforgeVerified publisher1.1.141 of 3See more

chiefonboarding helmforge 1.1.14

1 of the 3 container images this version deploys carry GHSA-3pv8-6f4r-ffg2.

Container imageDigestPackageFixed in
chiefonboarding/chiefonboarding:v2.4.159bc7aa60fe7
tar@0.4.44
0.4.46

Open the chart page →

10,849
mumbledjjuniorjpdj0.1.1991 of 2See more

mumbledj juniorjpdj 0.1.199

1 of the 2 container images this version deploys carry GHSA-3pv8-6f4r-ffg2.

Container imageDigestPackageFixed in
ghcr.io/juniorjpdj/mumbledj:latest558cb7e2604d
tar@0.4.43
0.4.46

Open the chart page →

953
music-assistantkarljorgensen0.1.31 of 1See more

music-assistant karljorgensen 0.1.3

1 of the 1 container images this version deploys carry GHSA-3pv8-6f4r-ffg2.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
tar@0.4.45
0.4.46

Open the chart page →

7,081
memgraph-mcpmemgraphVerified publisher1.0.01 of 1See more

memgraph-mcp memgraph 1.0.0

1 of the 1 container images this version deploys carry GHSA-3pv8-6f4r-ffg2.

Container imageDigestPackageFixed in
memgraph/mcp-memgraph:0.1.13ecdf7faea3f7
tar@0.4.45
0.4.46

Open the chart page →

1,672
svc-lb-muxsvc-lb-mux0.1.31 of 1See more

svc-lb-mux svc-lb-mux 0.1.3

1 of the 1 container images this version deploys carry GHSA-3pv8-6f4r-ffg2.

Container imageDigestPackageFixed in
ghcr.io/nowakeai/svc-lb-mux:0.1.37d8fb8e996b6
tar@0.4.44
0.4.46

Open the chart page →

1,419

Container images carrying it

9 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
chiefonboarding/chiefonboarding:v2.4.159bc7aa60fe7
tar@0.4.44
0.4.46
1
memgraph/mcp-memgraph:0.1.13ecdf7faea3f7
tar@0.4.45
0.4.46
1
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
tar@0.4.45
0.4.46
1
prowlercloud/prowler-api:5.31.14f252d579be2
tar@0.4.45
0.4.46
1
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
tar@0.4.44
0.4.46
1
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
tar@0.4.45
0.4.46
1
ghcr.io/juniorjpdj/mumbledj:latest558cb7e2604d
tar@0.4.43
0.4.46
1
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
tar@0.4.45
0.4.46
1
ghcr.io/nowakeai/svc-lb-mux:0.1.37d8fb8e996b6
tar@0.4.44
0.4.46
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.