StackRadar

RUSTSEC-2026-0195

High

Advisory

Published 29 Jun 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
16
of 17,781 indexed, latest versions
Container images
30
deployed by those charts
Fix available
1 of 1
affected package

Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service

Carried by container images the latest versions of 16 of 17,781 indexed charts deploy, on 30 images.

Affected packageAffected versionsFixed inImages
quick-xmlcargo0.38.4, 0.39.20.41.030
OSV records
RUSTSEC-2026-0195

Charts affected

16 by stars
ChartLatestAffected imagesRadar Score
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry RUSTSEC-2026-0195.

Container imageDigestPackageFixed in
langgenius/dify-plugin-daemon:0.6.3-local3c694329357b
quick-xml@0.39.2
0.41.0

Open the chart page →

22,002
skypilotskypilotOfficialVerified publisher0.13.01 of 3See more

skypilot skypilot 0.13.0

1 of the 3 container images this version deploys carry RUSTSEC-2026-0195.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot:0.13.03bc8bf8f4d83
quick-xml@0.39.2
0.41.0

Open the chart page →

5,852
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry RUSTSEC-2026-0195.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
quick-xml@0.39.2
0.41.0

Open the chart page →

5,880
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry RUSTSEC-2026-0195.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
quick-xml@0.39.2
0.41.0

Open the chart page →

8,158
music-assistant-serverandibraeuVerified publisher2.1.21 of 1See more

music-assistant-server andibraeu 2.1.2

1 of the 1 container images this version deploys carry RUSTSEC-2026-0195.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.9.950666a6f8d7f
quick-xml@0.39.2
0.41.0

Open the chart page →

5,817
authentikcluster-deploy0.2.01 of 1See more

authentik cluster-deploy 0.2.0

1 of the 1 container images this version deploys carry RUSTSEC-2026-0195.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
quick-xml@0.39.2
0.41.0

Open the chart page →

2,481
chiefonboardinghelmforgeVerified publisher1.1.141 of 3See more

chiefonboarding helmforge 1.1.14

1 of the 3 container images this version deploys carry RUSTSEC-2026-0195.

Container imageDigestPackageFixed in
chiefonboarding/chiefonboarding:v2.4.159bc7aa60fe7
quick-xml@0.38.4
0.41.0

Open the chart page →

10,849
inventreeinventreeOfficialVerified publisher0.4.281 of 2See more

inventree inventree 0.4.28

1 of the 2 container images this version deploys carry RUSTSEC-2026-0195.

Container imageDigestPackageFixed in
inventree/inventree:1.5.4a946ec09da3e
quick-xml@0.39.2
0.41.0

Open the chart page →

5,788
mumbledjjuniorjpdj0.1.1991 of 2See more

mumbledj juniorjpdj 0.1.199

1 of the 2 container images this version deploys carry RUSTSEC-2026-0195.

Container imageDigestPackageFixed in
ghcr.io/juniorjpdj/mumbledj:latest558cb7e2604d
quick-xml@0.38.4
0.41.0

Open the chart page →

953
music-assistantkarljorgensen0.1.31 of 1See more

music-assistant karljorgensen 0.1.3

1 of the 1 container images this version deploys carry RUSTSEC-2026-0195.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
quick-xml@0.39.2
0.41.0

Open the chart page →

7,081
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry RUSTSEC-2026-0195.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
quick-xml@0.39.2
0.41.0

Open the chart page →

2,444
memgraph-mcpmemgraphVerified publisher1.0.01 of 1See more

memgraph-mcp memgraph 1.0.0

1 of the 1 container images this version deploys carry RUSTSEC-2026-0195.

Container imageDigestPackageFixed in
memgraph/mcp-memgraph:0.1.13ecdf7faea3f7
quick-xml@0.39.2
0.41.0

Open the chart page →

1,672
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.016 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

16 of the 40 container images this version deploys carry RUSTSEC-2026-0195.

Container imageDigestPackageFixed in
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
quick-xml@0.39.2
0.41.0
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestb175cc61959a
quick-xml@0.39.2
0.41.0
ghcr.io/openrelik/openrelik-worker-bulkextractor:latest67498ee2e639
quick-xml@0.39.2
0.41.0
ghcr.io/openrelik/openrelik-worker-capa:latest71323a4f3fc5
quick-xml@0.39.2
0.41.0
ghcr.io/openrelik/openrelik-worker-chromecreds:latest76d4fbcc6ff0
quick-xml@0.39.2
0.41.0
ghcr.io/openrelik/openrelik-worker-cloud-logs:latesta5d7e3cf71d3
quick-xml@0.39.2
0.41.0
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
quick-xml@0.39.2
0.41.0
ghcr.io/openrelik/openrelik-worker-dfindexeddb:latest31966a825782
quick-xml@0.39.2
0.41.0
ghcr.io/openrelik/openrelik-worker-extraction:latestec9fc5864cd5
quick-xml@0.39.2
0.41.0
ghcr.io/openrelik/openrelik-worker-floss:latest7a331eb83c6a
quick-xml@0.39.2
0.41.0
ghcr.io/openrelik/openrelik-worker-grep:latest470ff3529746
quick-xml@0.39.2
0.41.0
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
quick-xml@0.39.2
0.41.0
ghcr.io/openrelik/openrelik-worker-plaso:latest75537ea8c851
quick-xml@0.39.2
0.41.0
ghcr.io/openrelik/openrelik-worker-strings:latest6e05055b701f
quick-xml@0.39.2
0.41.0
ghcr.io/openrelik/openrelik-worker-timesketch:latest4cb88b603cdc
quick-xml@0.39.2
0.41.0
ghcr.io/openrelik/openrelik-worker-yara:latestbd7fbf4505b5
quick-xml@0.39.2
0.41.0

Open the chart page →

71,208
safe-config-servicesafe-global0.1.01 of 3See more

safe-config-service safe-global 0.1.0

1 of the 3 container images this version deploys carry RUSTSEC-2026-0195.

Container imageDigestPackageFixed in
safeglobal/safe-config-service:latest09a5e495c219
quick-xml@0.39.2
0.41.0

Open the chart page →

1,577
safe-stacksafe-global0.1.01 of 9See more

safe-stack safe-global 0.1.0

1 of the 9 container images this version deploys carry RUSTSEC-2026-0195.

Container imageDigestPackageFixed in
safeglobal/safe-config-service:latest09a5e495c219
quick-xml@0.39.2
0.41.0

Open the chart page →

19,560
svc-lb-muxsvc-lb-mux0.1.31 of 1See more

svc-lb-mux svc-lb-mux 0.1.3

1 of the 1 container images this version deploys carry RUSTSEC-2026-0195.

Container imageDigestPackageFixed in
ghcr.io/nowakeai/svc-lb-mux:0.1.37d8fb8e996b6
quick-xml@0.38.4
0.41.0

Open the chart page →

1,419

Container images carrying it

30 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
safeglobal/safe-config-service:latest09a5e495c219
quick-xml@0.39.2
0.41.0
2
berkeleyskypilot/skypilot:0.13.03bc8bf8f4d83
quick-xml@0.39.2
0.41.0
1
chiefonboarding/chiefonboarding:v2.4.159bc7aa60fe7
quick-xml@0.38.4
0.41.0
1
homeassistant/home-assistant:2026.75a531753cea9
quick-xml@0.39.2
0.41.0
1
inventree/inventree:1.5.4a946ec09da3e
quick-xml@0.39.2
0.41.0
1
langgenius/dify-plugin-daemon:0.6.3-local3c694329357b
quick-xml@0.39.2
0.41.0
1
memgraph/mcp-memgraph:0.1.13ecdf7faea3f7
quick-xml@0.39.2
0.41.0
1
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
quick-xml@0.39.2
0.41.0
1
prowlercloud/prowler-api:5.31.14f252d579be2
quick-xml@0.39.2
0.41.0
1
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
quick-xml@0.39.2
0.41.0
1
ghcr.io/juniorjpdj/mumbledj:latest558cb7e2604d
quick-xml@0.38.4
0.41.0
1
ghcr.io/music-assistant/server:2.9.950666a6f8d7f
quick-xml@0.39.2
0.41.0
1
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
quick-xml@0.39.2
0.41.0
1
ghcr.io/nowakeai/svc-lb-mux:0.1.37d8fb8e996b6
quick-xml@0.38.4
0.41.0
1
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
quick-xml@0.39.2
0.41.0
1
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestb175cc61959a
quick-xml@0.39.2
0.41.0
1
ghcr.io/openrelik/openrelik-worker-bulkextractor:latest67498ee2e639
quick-xml@0.39.2
0.41.0
1
ghcr.io/openrelik/openrelik-worker-capa:latest71323a4f3fc5
quick-xml@0.39.2
0.41.0
1
ghcr.io/openrelik/openrelik-worker-chromecreds:latest76d4fbcc6ff0
quick-xml@0.39.2
0.41.0
1
ghcr.io/openrelik/openrelik-worker-cloud-logs:latesta5d7e3cf71d3
quick-xml@0.39.2
0.41.0
1
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
quick-xml@0.39.2
0.41.0
1
ghcr.io/openrelik/openrelik-worker-dfindexeddb:latest31966a825782
quick-xml@0.39.2
0.41.0
1
ghcr.io/openrelik/openrelik-worker-extraction:latestec9fc5864cd5
quick-xml@0.39.2
0.41.0
1
ghcr.io/openrelik/openrelik-worker-floss:latest7a331eb83c6a
quick-xml@0.39.2
0.41.0
1
ghcr.io/openrelik/openrelik-worker-grep:latest470ff3529746
quick-xml@0.39.2
0.41.0
1
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
quick-xml@0.39.2
0.41.0
1
ghcr.io/openrelik/openrelik-worker-plaso:latest75537ea8c851
quick-xml@0.39.2
0.41.0
1
ghcr.io/openrelik/openrelik-worker-strings:latest6e05055b701f
quick-xml@0.39.2
0.41.0
1
ghcr.io/openrelik/openrelik-worker-timesketch:latest4cb88b603cdc
quick-xml@0.39.2
0.41.0
1
ghcr.io/openrelik/openrelik-worker-yara:latestbd7fbf4505b5
quick-xml@0.39.2
0.41.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.