dify 0.39.0 Helm chart

Name: dify Helm chart 0.39.0: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

dify-helm

Scored 16 Oct 2026

Instant cloud deployment for https://github.com/langgenius/dify.

Version 0.39.0 yesterdayapp version 1.17.0 12Artifact Hub

dify 0.39.0 deploys 11 container images: langgenius/dify-agent-backend, langgenius/dify-api, langgenius/dify-agent-local-sandbox, langgenius/dify-plugin-daemon and 7 more. Across the 10 measured, 6,595 findings — 11 critical, 3 high — 5 on CISA KEV. The highest contribution is BIT-redis-2025-49844 in redis 7.0.11-1, fixed in 6.2.20.

Radar Score

62,7971136535,927

6,595 findings over 10 of 11 images measured

KEV ×5 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

11 images

Image	Tag	Vulnerabilities	Radar Score
langgenius/dify-agent-backend	1.17.0	0018174	1,919
langgenius/dify-api×4	1.17.0	0052372	4,426
langgenius/dify-agent-local-sandbox	1.17.0	0146295	3,544
langgenius/dify-plugin-daemon	0.6.10-local	213784,340	42,043
library/nginx	latest	0027158	1,799
langgenius/dify-sandbox	0.2.15	0045288	3,451
langgenius/dify-web	1.17.0	001969	1,073
bitnamilegacy/postgresql×2	15.3.0-debian-11-r7	4034125	2,276
bitnamilegacy/redis×2	7.0.11-debian-11-r12	5134105	2,253
library/alpine	latest	0001	13
cr.weaviate.io/semitechnologies/weaviate	1.27.27	—	unmeasured

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

5,447 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	UBUNTU-CVE-2026-68198	linux@6.8.0-137.137	no fix listed
Low	DEBIAN-CVE-2020-15719	openldap@2.5.13+dfsg-5	no fix listed
Low	UBUNTU-CVE-2026-53229	linux@6.8.0-137.137	6.8.0-146.146
Low	UBUNTU-CVE-2026-63980	linux@6.8.0-137.137	6.8.0-146.146
Low	UBUNTU-CVE-2026-64003	linux@6.8.0-137.137	6.8.0-146.146
Low	UBUNTU-CVE-2026-80691	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-89561	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-89685	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-64578	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2026-68433	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2025-38563	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2026-56208	aom@3.8.2-2ubuntu0.1	3.8.2-2ubuntu0.2
Low	GO-2026-6303	golang.org/x/crypto@v0.52.0	0.55.0
Low	DEBIAN-CVE-2026-66034	libssh2@1.10.0-3+b1	1.10.0-3+deb12u1
Low	UBUNTU-CVE-2026-63925	linux@6.8.0-137.137	6.8.0-146.146
Low	UBUNTU-CVE-2026-98115	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-88807	libxrender@1:0.9.10-1.1build1	no fix listed
Low	GHSA-8x88-c5mf-7j5w	tar@7.4.3	7.5.18
Low	UBUNTU-CVE-2026-93787	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-64435	linux@6.8.0-137.137	6.8.0-147.147
Low	GO-2026-6354	golang.org/x/crypto@v0.55.0	0.56.0
Low	DLA-4065-1	krb5@1.18.3-6+deb11u3	1.18.3-6+deb11u6
Low	UBUNTU-CVE-2026-74592	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-93786	linux@6.8.0-137.137	no fix listed
Low	DEBIAN-CVE-2026-11822	sqlite3@3.40.1-2+deb12u2	no fix listed
Low	UBUNTU-CVE-2026-64531	linux@6.8.0-137.137	6.8.0-138.138
Low	UBUNTU-CVE-2026-90091	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-90092	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-54559	pocketsphinx@0.8.0+real5prealpha+1-15ubuntu5	no fix listed
Low	GO-2023-2382	stdlib@go1.19.9	1.20.12
Low	UBUNTU-CVE-2026-53284	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-74695	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-74598	linux@6.8.0-137.137	no fix listed
Low	DEBIAN-CVE-2025-7458	sqlite3@3.40.1-2+deb12u2	no fix listed
Low	UBUNTU-CVE-2026-64408	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2026-68091	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2026-68326	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2026-68397	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2026-74508	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-89725	linux@6.8.0-137.137	no fix listed
Low	DEBIAN-CVE-2025-15661	libssh2@1.10.0-3+b1	1.10.0-3+deb12u1
Low	UBUNTU-CVE-2026-4775	tiff@4.5.1+git230720-4ubuntu2.5	no fix listed
Low	UBUNTU-CVE-2026-53275	linux@6.8.0-137.137	6.8.0-146.146
Low	BIT-postgresql-2026-14668	PostgreSQL@15.3.0	14.24.0
Low	BIT-postgresql-2026-14668	postgresql@15.3.0-3	14.24.0
Low	UBUNTU-CVE-2023-50008	ffmpeg@7:6.1.1-3ubuntu5	7:6.1.1-3ubuntu5+esm1
Low	DEBIAN-CVE-2026-63379	libevent@2.1.12-stable-8	2.1.12-stable-8+deb12u1
Low	UBUNTU-CVE-2026-64206	linux@6.8.0-137.137	6.8.0-147.147
Low	DEBIAN-CVE-2026-19553	python3.11@3.11.2-6+deb12u8	3.11.2-6+deb12u9
Low	UBUNTU-CVE-2026-19553	python3.12@3.12.3-1ubuntu0.15	no fix listed

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.39.0latest	yesterday	1.17.0	1136535,927	62,797
0.38.0	1 month ago	1.16.1	1147547,235	75,134

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/dify-helm/dify.svg)](https://charts.stackradar.io/charts/dify-helm/dify)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.