StackRadar

GHSA-87m9-rv8p-rgmg

High

Advisory

Published 10 Jun 2024In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
31
of 17,781 indexed, latest versions
Container images
26
deployed by those charts
Fix available
1 of 1
affected package

go-grpc-compression has a zstd decompression bombing vulnerability

Carried by container images the latest versions of 31 of 17,781 indexed charts deploy, on 26 images.

Affected packageAffected versionsFixed inImages
github.com/mostynb/go-grpc-compressiongolangv1.1.16, v1.1.17, v1.2.0, v1.2.1+1 more1.2.326
OSV records
GHSA-87m9-rv8p-rgmgGO-2024-2911

Charts affected

31 by stars
ChartLatestAffected imagesRadar Score
aws-cloudwatch-metricsaws0.0.111 of 1See more

aws-cloudwatch-metrics aws 0.0.11

1 of the 1 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
amazon/cloudwatch-agent:1.300032.2b36173b79b02f03a
github.com/mostynb/go-grpc-compression@v1.2.0
1.2.3

Open the chart page →

1,556
linkerd-jaegerlinkerd2Verified publisher30.12.111 of 4See more

linkerd-jaeger linkerd2 30.12.11

1 of the 4 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
otel/opentelemetry-collector:0.59.0ee9da0b08d83
github.com/mostynb/go-grpc-compression@v1.1.17
1.2.3

Open the chart page →

4,405
jaeger-all-in-onejaeger-all-in-oneVerified publisher0.1.121 of 1See more

jaeger-all-in-one jaeger-all-in-one 0.1.12

1 of the 1 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
jaegertracing/all-in-one:1.55f6b5d09073f1
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3

Open the chart page →

1,216
coder-observabilitycoder-observabilityVerified publisher0.7.31 of 21See more

coder-observability coder-observability 0.7.3

1 of the 21 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
grafana/agent:v0.40.3f6cbec9409be
github.com/mostynb/go-grpc-compression@v1.2.1
1.2.3

Open the chart page →

24,700
elchi-stackelchi1.13.01 of 10See more

elchi-stack elchi 1.13.0

1 of the 10 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.89.0995f17004231
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3

Open the chart page →

15,383
otel-collectorgeek-cookbookVerified publisher1.2.21 of 1See more

otel-collector geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.46.0ba173aa85f3f
github.com/mostynb/go-grpc-compression@v1.1.16
1.2.3

Open the chart page →

2,556
joylive-injectorjoyliveOfficialVerified publisher1.3.51 of 2See more

joylive-injector joylive 1.3.5

1 of the 2 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
otel/opentelemetry-collector:0.100.09e36620d6c2c
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3

Open the chart page →

1,273
linkerd-jaegerlinkerd2-edgeVerified publisher30.14.11-edge1 of 4See more

linkerd-jaeger linkerd2-edge 30.14.11-edge

1 of the 4 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.83.071fcef33ae71
github.com/mostynb/go-grpc-compression@v1.2.0
1.2.3

Open the chart page →

4,389
jaeger-collectorromanow-helm-chartsVerified publisher1.5.01 of 1See more

jaeger-collector romanow-helm-charts 1.5.0

1 of the 1 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
jaegertracing/jaeger-collector:1.41.0ff81f0a9f63c
github.com/mostynb/go-grpc-compression@v1.1.17
1.2.3

Open the chart page →

1,854
sp-otel-collectorsp-otel-collectorVerified publisher1.1.61 of 1See more

sp-otel-collector sp-otel-collector 1.1.6

1 of the 1 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
quay.io/geored/spmm-collector-contrib:1.0.063baf86a49ac
github.com/mostynb/go-grpc-compression@v1.2.0
1.2.3

Open the chart page →

2,022
jaegerbook-k8sinfra-v23.4.01 of 5See more

jaeger book-k8sinfra-v2 3.4.0

1 of the 5 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
jaegertracing/jaeger-collector:1.53.07f1269222903
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3

Open the chart page →

19,229
pyroscopebook-k8sinfra-v21.10.01 of 3See more

pyroscope book-k8sinfra-v2 1.10.0

1 of the 3 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
grafana/alloy:v1.1.1c3dac4e26471
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3

Open the chart page →

3,244
tempobook-k8sinfra-v21.10.31 of 1See more

tempo book-k8sinfra-v2 1.10.3

1 of the 1 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
grafana/tempo:2.5.0f0200a9bff6d
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3

Open the chart page →

1,859
catalyst-agentscatalyst-agents0.1.301 of 18See more

catalyst-agents catalyst-agents 0.1.30

1 of the 18 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
grafana/tempo:2.5.0f0200a9bff6d
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3

Open the chart page →

15,027
adot-exporter-for-eks-on-ec2dasmeta-adot0.15.51 of 1See more

adot-exporter-for-eks-on-ec2 dasmeta-adot 0.15.5

1 of the 1 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
amazon/aws-otel-collector:v0.27.0d8ab0eef5074
github.com/mostynb/go-grpc-compression@v1.1.17
1.2.3

Open the chart page →

1,926
jaegergpg-dev3.3.31 of 5See more

jaeger gpg-dev 3.3.3

1 of the 5 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
jaegertracing/jaeger-collector:1.53.07f1269222903
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3

Open the chart page →

19,229
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
jaegertracing/all-in-one:1.53.060e65bfffe1f
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3

Open the chart page →

49,025
jx-app-datadogjenkins-x0.0.101 of 2See more

jx-app-datadog jenkins-x 0.0.10

1 of the 2 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
datadog/agent:6aad9994de6a7
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3

Open the chart page →

3,999
kiaekiae0.1.61 of 9See more

kiae kiae 0.1.6

1 of the 9 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.63.1dfb3a55ea8c9
github.com/mostynb/go-grpc-compression@v1.1.17
1.2.3

Open the chart page →

19,168
tracetestkubeshop0.3.391 of 2See more

tracetest kubeshop 0.3.39

1 of the 2 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
kubeshop/tracetest:v1.7.173d7e3a2db43
github.com/mostynb/go-grpc-compression@v1.2.1
1.2.3

Open the chart page →

1,554
lightsteplightstep-microsat2.0.211 of 1See more

lightstep lightstep-microsat 2.0.21

1 of the 1 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
lightstep/microsatellite:2024-01-22_17-52-59Zc800e05e1eff
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3

Open the chart page →

1,116
apica-ascentlogiqai2.0.41 of 19See more

apica-ascent logiqai 2.0.4

1 of the 19 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
logiqai/tracing:v1.35.2-lq1-c3e149f6781b8
github.com/mostynb/go-grpc-compression@v1.1.16
1.2.3

Open the chart page →

23,613
magistralamagistrala-devopsVerified publisher0.16.21 of 42See more

magistrala magistrala-devops 0.16.2

1 of the 42 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
jaegertracing/jaeger-collector:1.53.07f1269222903
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3

Open the chart page →

24,400
kube-agent-chartmiddleware-labsVerified publisher0.1.21 of 1See more

kube-agent-chart middleware-labs 0.1.2

1 of the 1 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/agent-kube-go:dev17369c4cd390
github.com/mostynb/go-grpc-compression@v1.1.17
1.2.3

Open the chart page →

1,799
mw-kube-agentmiddleware-labsVerified publisher0.1.21 of 1See more

mw-kube-agent middleware-labs 0.1.2

1 of the 1 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/mw-kube-agent:master056f0953763d
github.com/mostynb/go-grpc-compression@v1.2.0
1.2.3

Open the chart page →

1,594
cognativemyaVerified publisher0.2403.31 of 3See more

cognative mya 0.2403.3

1 of the 3 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3

Open the chart page →

7,309
arpap2p-avs0.1.31 of 2See more

arpa p2p-avs 0.1.3

1 of the 2 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
ghcr.io/arpa-network/node-client:latest657a2c9f6e6d
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3

Open the chart page →

1,980
opentelemetry-collectorsb-helm-charts0.3.01 of 1See more

opentelemetry-collector sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3

Open the chart page →

1,721
agentssynapse0.1.301 of 9See more

agents synapse 0.1.30

1 of the 9 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
jaegertracing/all-in-one:1.42.07d32a4eddec7
github.com/mostynb/go-grpc-compression@v1.1.17
1.2.3

Open the chart page →

7,244
jaegerwikimedia3.1.21 of 4See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
jaegertracing/jaeger-collector:1.53.07f1269222903
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3

Open the chart page →

9,248
opentelemetry-collectorwikimedia0.62.71 of 1See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry GHSA-87m9-rv8p-rgmg.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
github.com/mostynb/go-grpc-compression@v1.2.0
1.2.3

Open the chart page →

2,022

Container images carrying it

26 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
jaegertracing/jaeger-collector:1.53.07f1269222903
github.com/mostynb/go-grpc-compression@v1.2.2
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3
1.2.3
4
grafana/tempo:2.5.0f0200a9bff6d
github.com/mostynb/go-grpc-compression@v1.2.2
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3
1.2.3
2
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
github.com/mostynb/go-grpc-compression@v1.2.2
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3
1.2.3
2
amazon/aws-otel-collector:v0.27.0d8ab0eef5074
github.com/mostynb/go-grpc-compression@v1.1.17
github.com/mostynb/go-grpc-compression@v1.1.17
1.2.3
1.2.3
1
amazon/cloudwatch-agent:1.300032.2b36173b79b02f03a
github.com/mostynb/go-grpc-compression@v1.2.0
github.com/mostynb/go-grpc-compression@v1.2.0
1.2.3
1.2.3
1
datadog/agent:6aad9994de6a7
github.com/mostynb/go-grpc-compression@v1.2.2
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3
1.2.3
1
grafana/agent:v0.40.3f6cbec9409be
github.com/mostynb/go-grpc-compression@v1.2.1
github.com/mostynb/go-grpc-compression@v1.2.1
1.2.3
1.2.3
1
grafana/alloy:v1.1.1c3dac4e26471
github.com/mostynb/go-grpc-compression@v1.2.2
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3
1.2.3
1
jaegertracing/all-in-one:1.53.060e65bfffe1f
github.com/mostynb/go-grpc-compression@v1.2.2
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3
1.2.3
1
jaegertracing/all-in-one:1.42.07d32a4eddec7
github.com/mostynb/go-grpc-compression@v1.1.17
github.com/mostynb/go-grpc-compression@v1.1.17
1.2.3
1.2.3
1
jaegertracing/all-in-one:1.55f6b5d09073f1
github.com/mostynb/go-grpc-compression@v1.2.2
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3
1.2.3
1
jaegertracing/jaeger-collector:1.41.0ff81f0a9f63c
github.com/mostynb/go-grpc-compression@v1.1.17
github.com/mostynb/go-grpc-compression@v1.1.17
1.2.3
1.2.3
1
kubeshop/tracetest:v1.7.173d7e3a2db43
github.com/mostynb/go-grpc-compression@v1.2.1
github.com/mostynb/go-grpc-compression@v1.2.1
1.2.3
1.2.3
1
lightstep/microsatellite:2024-01-22_17-52-59Zc800e05e1eff
github.com/mostynb/go-grpc-compression@v1.2.2
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3
1.2.3
1
logiqai/tracing:v1.35.2-lq1-c3e149f6781b8
github.com/mostynb/go-grpc-compression@v1.1.16
github.com/mostynb/go-grpc-compression@v1.1.16
1.2.3
1.2.3
1
otel/opentelemetry-collector:0.100.09e36620d6c2c
github.com/mostynb/go-grpc-compression@v1.2.2
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3
1.2.3
1
otel/opentelemetry-collector:0.59.0ee9da0b08d83
github.com/mostynb/go-grpc-compression@v1.1.17
github.com/mostynb/go-grpc-compression@v1.1.17
1.2.3
1.2.3
1
otel/opentelemetry-collector-contrib:0.83.071fcef33ae71
github.com/mostynb/go-grpc-compression@v1.2.0
github.com/mostynb/go-grpc-compression@v1.2.0
1.2.3
1.2.3
1
otel/opentelemetry-collector-contrib:0.89.0995f17004231
github.com/mostynb/go-grpc-compression@v1.2.2
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3
1.2.3
1
otel/opentelemetry-collector-contrib:0.46.0ba173aa85f3f
github.com/mostynb/go-grpc-compression@v1.1.16
github.com/mostynb/go-grpc-compression@v1.1.16
1.2.3
1.2.3
1
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
github.com/mostynb/go-grpc-compression@v1.2.0
github.com/mostynb/go-grpc-compression@v1.2.0
1.2.3
1.2.3
1
otel/opentelemetry-collector-contrib:0.63.1dfb3a55ea8c9
github.com/mostynb/go-grpc-compression@v1.1.17
github.com/mostynb/go-grpc-compression@v1.1.17
1.2.3
1.2.3
1
ghcr.io/arpa-network/node-client:latest657a2c9f6e6d
github.com/mostynb/go-grpc-compression@v1.2.2
github.com/mostynb/go-grpc-compression@v1.2.2
1.2.3
1.2.3
1
ghcr.io/middleware-labs/agent-kube-go:dev17369c4cd390
github.com/mostynb/go-grpc-compression@v1.1.17
github.com/mostynb/go-grpc-compression@v1.1.17
1.2.3
1.2.3
1
ghcr.io/middleware-labs/mw-kube-agent:master056f0953763d
github.com/mostynb/go-grpc-compression@v1.2.0
github.com/mostynb/go-grpc-compression@v1.2.0
1.2.3
1.2.3
1
quay.io/geored/spmm-collector-contrib:1.0.063baf86a49ac
github.com/mostynb/go-grpc-compression@v1.2.0
github.com/mostynb/go-grpc-compression@v1.2.0
1.2.3
1.2.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.