dify 0.39.0 Helm chart

Name: dify Helm chart 0.39.0: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

dify-helm

Scored 16 Oct 2026

Instant cloud deployment for https://github.com/langgenius/dify.

Version 0.39.0 yesterdayapp version 1.17.0 12Artifact Hub

dify 0.39.0 deploys 11 container images: langgenius/dify-agent-backend, langgenius/dify-api, langgenius/dify-agent-local-sandbox, langgenius/dify-plugin-daemon and 7 more. Across the 10 measured, 6,595 findings — 11 critical, 3 high — 5 on CISA KEV. The highest contribution is BIT-redis-2025-49844 in redis 7.0.11-1, fixed in 6.2.20.

Radar Score

62,7971136535,927

6,595 findings over 10 of 11 images measured

KEV ×5 confirmed exploited

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

11 images

Image	Tag	Vulnerabilities	Radar Score
langgenius/dify-agent-backend	1.17.0	0018174	1,919
langgenius/dify-api×4	1.17.0	0052372	4,426
langgenius/dify-agent-local-sandbox	1.17.0	0146295	3,544
langgenius/dify-plugin-daemon	0.6.10-local	213784,340	42,043
library/nginx	latest	0027158	1,799
langgenius/dify-sandbox	0.2.15	0045288	3,451
langgenius/dify-web	1.17.0	001969	1,073
bitnamilegacy/postgresql×2	15.3.0-debian-11-r7	4034125	2,276
bitnamilegacy/redis×2	7.0.11-debian-11-r12	5134105	2,253
library/alpine	latest	0001	13
cr.weaviate.io/semitechnologies/weaviate	1.27.27	—	unmeasured

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

5,447 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	UBUNTU-CVE-2024-36619	ffmpeg@7:6.1.1-3ubuntu5	7:6.1.1-3ubuntu5+esm5
Low	UBUNTU-CVE-2026-89795	linux@6.8.0-137.137	no fix listed
Low	GHSA-vmxc-h2x2-jmf3	pydantic-ai-slim@2.31.0	2.44.0
Low	UBUNTU-CVE-2024-53098	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-80549	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-63828	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2026-90231	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2024-57857	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-93543	libxi@2:1.8.1-1build1	no fix listed
Low	UBUNTU-CVE-2026-93190	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-31786	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2024-52616	avahi@0.8-13ubuntu6.2	no fix listed
Low	UBUNTU-CVE-2026-16118	glib2.0@2.80.0-6ubuntu3.8	2.80.0-6ubuntu3.9
Low	DLA-3926-1	perl@5.32.1-4+deb11u2	5.32.1-4+deb11u4
Low	DEBIAN-CVE-2026-7010	perl@5.36.0-7+deb12u3	5.36.0-7+deb12u4
Low	UBUNTU-CVE-2026-93826	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-72243	linux@6.8.0-137.137	6.8.0-147.147
Low	DEBIAN-CVE-2026-106552	openssh@1:9.2p1-2+deb12u10	no fix listed
Low	UBUNTU-CVE-2026-63869	linux@6.8.0-137.137	6.8.0-146.146
Low	GHSA-5639-2j2p-m4mx	mako@1.3.12	1.4.2
Low	UBUNTU-CVE-2026-38343	ffmpeg@7:6.1.1-3ubuntu5	no fix listed
Low	UBUNTU-CVE-2026-38345	ffmpeg@7:6.1.1-3ubuntu5	no fix listed
Low	UBUNTU-CVE-2026-75466	libjpeg-turbo@2.1.5-2ubuntu2	no fix listed
Low	UBUNTU-CVE-2026-89954	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-63952	linux@6.8.0-137.137	6.8.0-146.146
Low	UBUNTU-CVE-2026-68414	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2026-97957	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-107696	ffmpeg@7:6.1.1-3ubuntu5	no fix listed
Low	UBUNTU-CVE-2026-90347	linux@6.8.0-137.137	no fix listed
Low	GHSA-rpw4-54j3-4h4q	ip-address@9.0.5	10.5.1
Low	UBUNTU-CVE-2026-64286	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2026-64287	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2025-21693	linux@6.8.0-137.137	no fix listed
Low	GHSA-4xh5-x5gv-qwph	pip@25.0.1	25.3
Low	GHSA-w8wr-v893-vjvp	tar@7.4.3	7.5.18
Low	UBUNTU-CVE-2026-70632	ffmpeg@7:6.1.1-3ubuntu5	7:6.1.1-3ubuntu5+esm12
Low	GHSA-gh4c-6fx4-qh6g	urllib3@2.7.0	2.8.0
Low	UBUNTU-CVE-2026-97688	python-pip@24.0+dfsg-1ubuntu1.3	no fix listed
Low	UBUNTU-CVE-2026-64095	linux@6.8.0-137.137	6.8.0-146.146
Low	UBUNTU-CVE-2026-97508	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-64015	linux@6.8.0-137.137	6.8.0-139.139
Low	UBUNTU-CVE-2026-53253	linux@6.8.0-137.137	6.8.0-146.146
Low	UBUNTU-CVE-2026-64403	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2026-68402	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2026-64153	linux@6.8.0-137.137	6.8.0-139.139
Low	UBUNTU-CVE-2026-64475	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2026-68142	linux@6.8.0-137.137	6.8.0-147.147
Low	UBUNTU-CVE-2022-50090	linux@6.8.0-137.137	no fix listed
Low	UBUNTU-CVE-2026-75141	ffmpeg@7:6.1.1-3ubuntu5	7:6.1.1-3ubuntu5+esm13
Low	UBUNTU-CVE-2026-75142	ffmpeg@7:6.1.1-3ubuntu5	7:6.1.1-3ubuntu5+esm13

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.39.0latest	yesterday	1.17.0	1136535,927	62,797
0.38.0	1 month ago	1.16.1	1147547,235	75,134

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/dify-helm/dify.svg)](https://charts.stackradar.io/charts/dify-helm/dify)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.