dify 0.39.0 Helm chart

Name: dify Helm chart 0.39.0: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

dify-helm

Scored 16 Oct 2026

Instant cloud deployment for https://github.com/langgenius/dify.

Version 0.39.0 yesterdayapp version 1.17.0 12Artifact Hub

dify 0.39.0 deploys 11 container images: langgenius/dify-agent-backend, langgenius/dify-api, langgenius/dify-agent-local-sandbox, langgenius/dify-plugin-daemon and 7 more. Across the 10 measured, 6,595 findings — 11 critical, 3 high — 5 on CISA KEV. The highest contribution is BIT-redis-2025-49844 in redis 7.0.11-1, fixed in 6.2.20.

Radar Score

62,7971136535,927

6,595 findings over 10 of 11 images measured

KEV ×5 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

11 images

Image	Tag	Vulnerabilities	Radar Score
langgenius/dify-agent-backend	1.17.0	0018174	1,919
langgenius/dify-api×4	1.17.0	0052372	4,426
langgenius/dify-agent-local-sandbox	1.17.0	0146295	3,544
langgenius/dify-plugin-daemon	0.6.10-local	213784,340	42,043
library/nginx	latest	0027158	1,799
langgenius/dify-sandbox	0.2.15	0045288	3,451
langgenius/dify-web	1.17.0	001969	1,073
bitnamilegacy/postgresql×2	15.3.0-debian-11-r7	4034125	2,276
bitnamilegacy/redis×2	7.0.11-debian-11-r12	5134105	2,253
library/alpine	latest	0001	13
cr.weaviate.io/semitechnologies/weaviate	1.27.27	—	unmeasured

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

5,447 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	DEBIAN-CVE-2026-48961	perl@5.40.1-6	5.40.1-6+deb13u1
Low	UBUNTU-CVE-2026-80914	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-74439	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2026-80551	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-80554	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-80684	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-68119	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2026-53358	linux@6.8.0-137.137	6.8.0-146.146
Low	DEBIAN-CVE-2026-80230	curl@7.88.1-10+deb12u15	no fix listed
Low	UBUNTU-CVE-2025-66862	binutils@2.42-4ubuntu2.10	no fix listed
Low	UBUNTU-CVE-2026-72495	linux@6.8.0-137.137	no fix listed
Low	BIT-postgresql-2025-4207	PostgreSQL@15.3.0	13.21.0
Low	BIT-postgresql-2025-4207	postgresql@15.3.0-3	13.21.0
Low	DLA-3878-1	libxml2@2.9.10+dfsg-6.7+deb11u4	2.9.10+dfsg-6.7+deb11u5
Low	UBUNTU-CVE-2026-98169	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2022-25836	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2022-25837	linux@6.8.0-137.137	no fix listed
Low	GO-2026-5841	github.com/klauspost/compress@v1.18.0	1.18.7
Low	UBUNTU-CVE-2026-98174	linux@6.8.0-137.137	no fix listed
Low	DEBIAN-CVE-2026-5435	glibc@2.36-9+deb12u14	no fix listed
Low	UBUNTU-CVE-2026-72085	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2026-74310	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2026-6385	ffmpeg@7:6.1.1-3ubuntu5	no fix listed
Low	GO-2025-3420	stdlib@go1.19.9	1.22.11
Low	GHSA-ffc3-869f-jxw9	pyjwt@2.13.0	2.14.0
Low	UBUNTU-CVE-2026-64442	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2026-68353	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2026-64255	linux@6.8.0-137.137	no fix listed
Low	DEBIAN-CVE-2026-107778	krb5@1.20.1-2+deb12u5	no fix listed
Low	GO-2025-3956	stdlib@go1.19.9	1.23.12
Low	UBUNTU-CVE-2026-90224	linux@6.8.0-137.137	no fix listed
Low	PYSEC-2026-3739	nltk@3.10.0	3.10.3
Low	UBUNTU-CVE-2025-1594	ffmpeg@7:6.1.1-3ubuntu5	7:6.1.1-3ubuntu5+esm4
Low	GO-2026-4946	stdlib@go1.24.13	1.25.9
Low	UBUNTU-CVE-2026-76641	expat@2.6.1-2ubuntu0.4	2.6.1-2ubuntu0.6
Low	UBUNTU-CVE-2026-63940	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2026-72289	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2026-89930	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-64443	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2026-64444	linux@6.8.0-137.137	6.8.0-147.147
Low	GHSA-3cv6-jpf6-8222	litellm@1.89.3	1.89.7
Low	UBUNTU-CVE-2024-50613	libsndfile@1.2.2-1ubuntu5.24.04.1	no fix listed
Low	DEBIAN-CVE-2026-6253	curl@7.88.1-10+deb12u15	no fix listed
Low	GHSA-6j4f-fj2g-mc7p	brace-expansion@2.0.2	2.1.5
Low	GHSA-qhr7-859c-m2p7	brace-expansion@2.0.2	2.1.6
Low	PYSEC-2026-3788	gitpython@3.1.58	3.1.59
Low	DEBIAN-CVE-2026-6276	curl@7.88.1-10+deb12u15	no fix listed
Low	UBUNTU-CVE-2026-72288	linux@6.8.0-137.137	no fix listed
Low	GHSA-w4pp-8pjf-rmxw	pacote@19.0.1	21.5.1
Low	UBUNTU-CVE-2026-53070	linux@6.8.0-137.137	6.8.0-147.147

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.39.0latest	yesterday	1.17.0	1136535,927	62,797
0.38.0	1 month ago	1.16.1	1147547,235	75,134

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/dify-helm/dify.svg)](https://charts.stackradar.io/charts/dify-helm/dify)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.