StackRadarChart IndexLive demo

CVE-2025-57804

Medium

Advisory

Published 25 Aug 2025In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.9; base score, highest
EPSS: 0.017; 76th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 29; of 17,781 indexed, latest versions
Container images: 27; deployed by those charts
Fix available: 1 of 2; affected packages

h2 allows HTTP Request Smuggling due to illegal characters in headers

Carried by container images the latest versions of 29 of 17,781 indexed charts deploy, on 27 images.

Affected package	Affected versions	Fixed in	Images
h2pypi	2.6.2, 3.1.1, 4.0.0, 4.1.0+1 more	4.3.0	27
python-h2deb	4.1.0-4	no fix listed	1

OSV records: GHSA-847f-9342-265h UBUNTU-CVE-2025-57804
Also known as: PYSEC-2026-1435

Charts affected

29 by stars

Chart

Latest

Affected images

Radar Score

homeassistantvolker-raschek

1 of 1 See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
homeassistant/home-assistant :2023.12.4	8d000332b09b	h2@4.1.0	4.3.0

Open the chart page →

6,041

openvpn-asas-helm-chart

1 of 1 See more

openvpn-as as-helm-chart 0.2.1

1 of the 1 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
openvpn/openvpn-as :latest	2253c10ec652	h2@4.1.0 python-h2@4.1.0-4	4.3.0 no fix listed

Open the chart page →

2,668

paperless-ngxcrystalnet

1 of 3 See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :2.13.1	0642357c5dbd	h2@4.1.0	4.3.0

Open the chart page →

13,761

obicogabe565

1 of 3 See more

obico gabe565 0.6.0

1 of the 3 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
ghcr.io/gabe565/obico/web :latest	a5c1daef46c0	h2@4.1.0	4.3.0

Open the chart page →

1,965

1 of 1 See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
makersquad/harp-proxy :0.8.1	a40dd258c527	h2@4.2.0	4.3.0

Open the chart page →

6,374

huehue

1 of 3 See more

12,397

difykubeblocks

1 of 5 See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
langgenius/dify-api :0.6.11	fca918260dd6	h2@4.1.0	4.3.0

Open the chart page →

20,403

asya-playgroundasya

1 of 1 See more

asya-playground asya 1.1.3

1 of the 1 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
localstack/localstack :3.1	9d278167f2b7	h2@4.1.0	4.3.0

Open the chart page →

9,412

azure-app-exporterazure-app-exporter

1 of 2 See more

azure-app-exporter azure-app-exporter 0.4.2

1 of the 2 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter :0.1.38	b472877847f5	h2@4.1.0	4.3.0

Open the chart page →

1,790

huebigdata-charts

1 of 2 See more

22,891

csghubcsghub

2 of 34 See more

csghub csghub 2.4.3

2 of the 34 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
opencsghq/agenticflow :ee-v0.6-5	2f03fead54db	h2@4.2.0	4.3.0
opencsghq/csgbot :v0.6.7-ee	af7191a9cf8a	h2@4.1.0	4.3.0

Open the chart page →

58,897

1 of 10 See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
opencsghq/csgship-agentic :v0.4.0	2cd29671a03e	h2@4.1.0	4.3.0

Open the chart page →

11,335

home-assistantdamoun

1 of 1 See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2023.11.3	feffc0b8227d	h2@4.1.0	4.3.0

Open the chart page →

6,179

ai-agentdevtron

1 of 1 See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
quay.io/devtron/ai-agent :0.0.1	6545dac92173	h2@4.1.0	4.3.0

Open the chart page →

9,607

ai-agentdevtron-labs

1 of 1 See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
quay.io/devtron/ai-agent :0.0.1	6545dac92173	h2@4.1.0	4.3.0

Open the chart page →

9,607

difydify

1 of 4 See more

19,224

searxgeek-cookbook

1 of 4 See more

searx geek-cookbook 5.6.2

1 of the 4 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
searx/searx :1.0.0-211-968b2899	3dbb3a6d9419	h2@4.0.0	4.3.0

Open the chart page →

7,470

home-assistanthelm-chart-roei

1 of 1 See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
ghcr.io/home-assistant/home-assistant :2025.3.0	26c51e44d932	h2@4.1.0	4.3.0

Open the chart page →

4,647

paperlesshomelabcihelmchartstest

1 of 1 See more

paperless homelabcihelmchartstest 9.1.9

1 of the 1 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
ghcr.io/paperless-ngx/paperless-ngx :2.0.1	ab255bea133e	h2@4.1.0	4.3.0

Open the chart page →

16,384

huekatool

1 of 1 See more

16,417

home-assistantkfirfer

1 of 1 See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
homeassistant/home-assistant :2023.10.3	021e2afc6e57	h2@4.1.0	4.3.0

Open the chart page →

6,447

aperagkubeblocks

1 of 3 See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
apecloud/aperag :v0.0.0-nightly	8ac9947a2c84	h2@4.2.0	4.3.0

Open the chart page →

8,405

splashntppool

1 of 1 See more

27,633

prefect-agentprefect

2024.8.30163822

1 of 1 See more

prefect-agent prefect 2024.8.30163822

1 of the 1 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
prefecthq/prefect :2.20.4-python3.10	1df4b5b6238a	h2@4.1.0	4.3.0

Open the chart page →

5,451

rada-platformrada-platform

1 of 7 See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
apache/airflow :2.10.2-python3.9	ce90bdc3d2af	h2@4.1.0	4.3.0

Open the chart page →

21,211

ai-agentromholdings

1 of 1 See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
quay.io/devtron/ai-agent :0.0.1	6545dac92173	h2@4.1.0	4.3.0

Open the chart page →

9,607

imgtagrotational

1 of 1 See more

imgtag rotational 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
gcr.io/rotationalio-habanero/imgtag :89ec287	a534a3170d03	h2@4.2.0	4.3.0

Open the chart page →

3,312

alertmanager-matrix-forwarderzloi-space

1 of 2 See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
matrixdotorg/pantalaimon :v0.10.4	ba6a587fa508	h2@4.1.0	4.3.0

Open the chart page →

3,118

grafana-matrix-forwarderzloi-space

1 of 2 See more

grafana-matrix-forwarder zloi-space 1.0.0

1 of the 2 container images this version deploys carry CVE-2025-57804.

Container image	Digest	Package	Fixed in
matrixdotorg/pantalaimon :v0.10.4	ba6a587fa508	h2@4.1.0	4.3.0

Open the chart page →

1,636

Container images carrying it

27 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/devtron/ai-agent :0.0.1	6545dac92173	h2@4.1.0	4.3.0	3
matrixdotorg/pantalaimon :v0.10.4	ba6a587fa508	h2@4.1.0	4.3.0	2
apache/airflow :2.10.2-python3.9	ce90bdc3d2af	h2@4.1.0	4.3.0	1
apecloud/aperag :v0.0.0-nightly	8ac9947a2c84	h2@4.2.0	4.3.0	1
gethue/hue :4.11.0	11b649636e68	h2@2.6.2	4.3.0	1
gethue/hue :4.10.0	5702b2c37ff9	h2@2.6.2	4.3.0	1
gethue/hue :latest	7d5c1b9f8a79	h2@2.6.2	4.3.0	1
homeassistant/home-assistant :2023.10.3	021e2afc6e57	h2@4.1.0	4.3.0	1
homeassistant/home-assistant :2023.12.4	8d000332b09b	h2@4.1.0	4.3.0	1
langgenius/dify-api :1.0.0	066035f93856	h2@4.2.0	4.3.0	1
langgenius/dify-api :0.6.11	fca918260dd6	h2@4.1.0	4.3.0	1
localstack/localstack :3.1	9d278167f2b7	h2@4.1.0	4.3.0	1
makersquad/harp-proxy :0.8.1	a40dd258c527	h2@4.2.0	4.3.0	1
opencsghq/agenticflow :ee-v0.6-5	2f03fead54db	h2@4.2.0	4.3.0	1
opencsghq/csgbot :v0.6.7-ee	af7191a9cf8a	h2@4.1.0	4.3.0	1
opencsghq/csgship-agentic :v0.4.0	2cd29671a03e	h2@4.1.0	4.3.0	1
openvpn/openvpn-as :latest	2253c10ec652	h2@4.1.0 python-h2@4.1.0-4	4.3.0 no fix listed	1
prefecthq/prefect :2.20.4-python3.10	1df4b5b6238a	h2@4.1.0	4.3.0	1
scrapinghub/splash :3.4.1	a5f89bc84606	h2@3.1.1	4.3.0	1
searx/searx :1.0.0-211-968b2899	3dbb3a6d9419	h2@4.0.0	4.3.0	1
gcr.io/rotationalio-habanero/imgtag :89ec287	a534a3170d03	h2@4.2.0	4.3.0	1
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter :0.1.38	b472877847f5	h2@4.1.0	4.3.0	1
ghcr.io/gabe565/obico/web :latest	a5c1daef46c0	h2@4.1.0	4.3.0	1
ghcr.io/home-assistant/home-assistant :2025.3.0	26c51e44d932	h2@4.1.0	4.3.0	1
ghcr.io/home-assistant/home-assistant :2023.11.3	feffc0b8227d	h2@4.1.0	4.3.0	1
ghcr.io/paperless-ngx/paperless-ngx :2.13.1	0642357c5dbd	h2@4.1.0	4.3.0	1
ghcr.io/paperless-ngx/paperless-ngx :2.0.1	ab255bea133e	h2@4.1.0	4.3.0	1