StackRadar

CVE-2026-103261

Medium

Advisory

Published 30 Sept 2026In the index since 2 Oct 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
138
of 17,985 indexed, latest versions
Container images
137
deployed by those charts
Fix available
1 of 2
affected packages

Tornado: Unbounded query-string argument count allows event-loop-stalling DoS

Carried by container images the latest versions of 138 of 17,985 indexed charts deploy, on 137 images.

Affected packageAffected versionsFixed inImages
python-tornadodeb6.2.0-3+deb12u1no fix listed1
tornadopypi2.4.1, 4.4.3, 4.5.3, 5.0.2+17 more6.5.9137
OSV records
DEBIAN-CVE-2026-103261GHSA-3hv7-mjh2-fv65

Charts affected

138 by stars
ChartLatestAffected imagesRadar Score
bookinfobasictechno0.1.01 of 6See more

bookinfo basictechno 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
istio/examples-bookinfo-productpage-v1:1.17.06668bcf42ef0
tornado@4.5.3
6.5.9

Open the chart page →

21,819
huebigdata-chartsVerified publisher1.0.41 of 2See more

hue bigdata-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
gethue/hue:4.10.05702b2c37ff9
tornado@6.1
6.5.9

Open the chart page →

88,622
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
tornado@6.4.1
6.5.9

Open the chart page →

10,874
istio-bookinfobookinfo1.2.21 of 6See more

istio-bookinfo bookinfo 1.2.2

1 of the 6 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
istio/examples-bookinfo-productpage-v1:1.15.00a5eb4795952
tornado@4.5.3
6.5.9

Open the chart page →

20,013
sickchillbryanalves0.3.01 of 1See more

sickchill bryanalves 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
tornado@5.1.1
6.5.9

Open the chart page →

2,703
calibre-web-automatedcalibre-web-automated1.0.01 of 1See more

calibre-web-automated calibre-web-automated 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
crocodilestick/calibre-web-automated:v4.0.6c31a738b6d5e
tornado@6.5.4
6.5.9

Open the chart page →

7,112
opencvecfi20170.1.21 of 7See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
tornado@6.5.8
6.5.9

Open the chart page →

17,006
paperless-ngxcharts-derwitt-devVerified publisher2.1.51 of 1See more

paperless-ngx charts-derwitt-dev 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.2.15fa76604a81d
tornado@6.5.8
6.5.9

Open the chart page →

4,568
daskcloudnativeapp2.2.12 of 2See more

dask cloudnativeapp 2.2.1

2 of the 2 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
daskdev/dask:1.1.04ecd7bc35500
tornado@5.1.1
6.5.9
daskdev/dask-notebook:1.1.0052630f5ca04
tornado@5.1.1
6.5.9

Open the chart page →

30,556
distributed-tensorflowcloudnativeapp0.1.11 of 1See more

distributed-tensorflow cloudnativeapp 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
cheyang/distributed-tf:1.6.046cc34755493
tornado@4.5.3
6.5.9

Open the chart page →

95,920
supersetcloudnativeapp1.1.61 of 1See more

superset cloudnativeapp 1.1.6

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
amancevice/superset:0.28.1c8c04bfe3d66
tornado@5.1.1
6.5.9

Open the chart page →

5,525
webpagetest-agentcloudnativeapp0.2.01 of 1See more

webpagetest-agent cloudnativeapp 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
tornado@4.5.3
6.5.9

Open the chart page →

138,216
galaxycloudve6.8.81 of 3See more

galaxy cloudve 6.8.8

1 of the 3 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
tornado@6.5.5
6.5.9

Open the chart page →

6,148
codehubcodehubVerified publisher6.2.181 of 5See more

codehub codehub 6.2.18

1 of the 5 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
jupyterhub/jupyterhub:5.4.63974ba945e65
tornado@6.5.6
6.5.9

Open the chart page →

14,459
csghubcsghubVerified publisher2.5.01 of 34See more

csghub csghub 2.5.0

1 of the 34 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
tornado@6.5.1
6.5.9

Open the chart page →

53,977
jupyterhubd4nVerified publisher3.3.72 of 7See more

jupyterhub d4n 3.3.7

2 of the 7 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
aristidetm/basic-notebook:3.6.5469dbc951224
tornado@6.4.1
6.5.9
aristidetm/k8s-hub:3.3.7ccb516cb8474
tornado@6.4
6.5.9

Open the chart page →

17,684
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
tornado@6.3.3
6.5.9

Open the chart page →

6,528
datacube-datadatacube-charts0.2.61 of 1See more

datacube-data datacube-charts 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
geoscienceaustralia/dea-k8s-data:latestf4039b45572a
tornado@6.0.4
6.5.9

Open the chart page →

85,891
datacube-indexdatacube-charts0.4.41 of 2See more

datacube-index datacube-charts 0.4.4

1 of the 2 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
opendatacube/ows:latest668cbb41473c
tornado@6.4.2
6.5.9

Open the chart page →

6,461
datacube-owsdatacube-charts0.20.31 of 1See more

datacube-ows datacube-charts 0.20.3

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
ghcr.io/opendatacube/ows:latestf591c9d96c0f
tornado@6.5.7
6.5.9

Open the chart page →

3,053
datacube-wpsdatacube-charts0.9.01 of 1See more

datacube-wps datacube-charts 0.9.0

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
opendatacube/wps:latest80df355a660b
tornado@6.4.2
6.5.9

Open the chart page →

6,757
datagrokdatagrok1.0.31 of 7See more

datagrok datagrok 1.0.3

1 of the 7 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
datagrok/grok_spawner:latest8c2d48c1545c
tornado@6.5.7
6.5.9

Open the chart page →

2,669
amundsenduyet1.1.01 of 7See more

amundsen duyet 1.1.0

1 of the 7 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
amundsendev/amundsen-metadata:2.5.44d98eb21f5f9
tornado@4.5.3
6.5.9

Open the chart page →

11,416
huntingfactlyVerified publisher0.4.141 of 1See more

hunting factly 0.4.14

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
tornado@6.2
6.5.9

Open the chart page →

4,702
calibre-webgeek-cookbookVerified publisher8.4.21 of 1See more

calibre-web geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
linuxserver/calibre-web:version-0.6.12938810eca3d3
tornado@6.1
6.5.9

Open the chart page →

16,845
mopidygeek-cookbookVerified publisher0.1.21 of 1See more

mopidy geek-cookbook 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
jaedb/iris:latest048cfbf58d57
python-tornado@6.2.0-3+deb12u1
tornado@6.2
no fix listed
6.5.9

Open the chart page →

14,256
motioneyegermanium-gitVerified publisher0.1.31 of 1See more

motioneye germanium-git 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
ccrisan/motioneye:master-armhf1d7abea3e92e
tornado@4.4.3
6.5.9

Open the chart page →

3,626
gmaas-github-apigmaas-github-api2.0.11 of 1See more

gmaas-github-api gmaas-github-api 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
gmaas2/github-api:latest148fc2d9afe9
tornado@6.2
6.5.9

Open the chart page →

1,281
helixhelix1.4.31 of 2See more

helix helix 1.4.3

1 of the 2 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
tornado@6.5.5
6.5.9

Open the chart page →

6,248
esphomehelm-chart-roeiVerified publisher2025.3.01 of 1See more

esphome helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
esphome/esphome:2025.3.0def8b6e4f517
tornado@6.4.2
6.5.9

Open the chart page →

6,475
hermes-agenthelmforgeVerified publisher1.0.11 of 1See more

hermes-agent helmforge 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.9.24fca358f12efd
tornado@6.5.8
6.5.9

Open the chart page →

6,273
jupyterhubhelmforgeVerified publisher1.0.61 of 3See more

jupyterhub helmforge 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
tornado@6.5.5
6.5.9

Open the chart page →

6,029
homeassistanthomeenterpriseinc0.3.01 of 1See more

homeassistant homeenterpriseinc 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2022.3.5565751f33794
tornado@6.1
6.5.9

Open the chart page →

8,032
motioneyehomeenterpriseinc0.1.01 of 1See more

motioneye homeenterpriseinc 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
ccrisan/motioneye:master-amd641704cddc44e0
tornado@5.0.2
6.5.9

Open the chart page →

1,649
paperlesshomelabcihelmchartstestVerified publisher9.1.91 of 1See more

paperless homelabcihelmchartstest 9.1.9

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
tornado@6.3.3
6.5.9

Open the chart page →

17,370
paperlesshpVerified publisher0.1.21 of 5See more

paperless hp 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
tornado@6.5.8
6.5.9

Open the chart page →

30,686
ikigaiikigai-chartVerified publisher0.0.91 of 58See more

ikigai ikigai-chart 0.0.9

1 of the 58 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
jupyterhub/k8s-hub:1.2.0e4770285aaf7
tornado@6.1
6.5.9

Open the chart page →

115,955
ilum-streamlitilumVerified publisher0.1.01 of 1See more

ilum-streamlit ilum 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
ilum/streamlit-example:1.0.0ce5dcdeb22ba
tornado@6.5.2
6.5.9

Open the chart page →

3,209
itm-servicesintelVerified publisher2.0.01 of 8See more

itm-services intel 2.0.0

1 of the 8 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
intel/dlstreamer-pipeline-server:2022.1.1-ubuntu20aa8f5483a2ef
tornado@6.1
6.5.9

Open the chart page →

91,046
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
tornado@6.5.5
6.5.9

Open the chart page →

20,029
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
tornado@5.1.1
6.5.9

Open the chart page →

7,687
istio-bookinfoistio-bookinfo1.2.21 of 6See more

istio-bookinfo istio-bookinfo 1.2.2

1 of the 6 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
istio/examples-bookinfo-productpage-v1:1.15.00a5eb4795952
tornado@4.5.3
6.5.9

Open the chart page →

20,013
webappiti-web-appVerified publisher0.1.01 of 2See more

webapp iti-web-app 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
mohameddev006/web-app:v50fbc7360ecf4
tornado@5.1.1
6.5.9

Open the chart page →

1,272
esphomejeffrescVerified publisher0.2.21 of 1See more

esphome jeffresc 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.4.078a82d810709
tornado@6.5.5
6.5.9

Open the chart page →

5,549
palworld-serverk8s-chartsVerified publisher1.2.11 of 1See more

palworld-server k8s-charts 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
thijsvanloef/palworld-server-docker:v2.5.0b4ac9ee22483
tornado@6.5.5
6.5.9

Open the chart page →

3,881
paperlessk8s-home-lab-repo11.0.11 of 1See more

paperless k8s-home-lab-repo 11.0.1

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
tornado@6.5.2
6.5.9

Open the chart page →

10,201
jupyterhub-chartk8s-jupyterhub0.1.01 of 1See more

jupyterhub-chart k8s-jupyterhub 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
truebyteinnovationllp/jupyterhub-k8s:5.5.06bf978b96279
tornado@6.5.7
6.5.9

Open the chart page →

1,841
huekatool1.0.81 of 1See more

hue katool 1.0.8

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
gethue/hue:4.11.011b649636e68
tornado@6.2
6.5.9

Open the chart page →

85,376
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
tornado@6.3.3
6.5.9

Open the chart page →

6,796
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-103261.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
tornado@6.4.2
6.5.9

Open the chart page →

9,405

Container images carrying it

137 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
tornado@6.5.8
6.5.9
4
ghcr.io/paperless-ngx/paperless-ngx:3.2.15fa76604a81d
tornado@6.5.8
6.5.9
3
istio/examples-bookinfo-productpage-v1:1.15.00a5eb4795952
tornado@4.5.3
6.5.9
2
istio/examples-bookinfo-productpage-v1:1.14.022a0410f35a8
tornado@4.5.3
6.5.9
2
kubesphere/examples-bookinfo-productpage-v1:1.13.0378f49ec9c44
tornado@4.5.3
6.5.9
2
nousresearch/hermes-agent:v2026.9.24fca358f12efd
tornado@6.5.8
6.5.9
2
safeglobal/safe-transaction-service:latest7b576c73f865
tornado@6.5.8
6.5.9
2
alaaamin/reload-count-tornado-py-app:v1.0.1alpine46da5844794e
tornado@5.1.1
6.5.9
1
amagdi888/my-repo:hello-appd8a10fc8faf6
tornado@5.1.1
6.5.9
1
amancevice/superset:0.28.1c8c04bfe3d66
tornado@5.1.1
6.5.9
1
amundsendev/amundsen-metadata:2.5.44d98eb21f5f9
tornado@4.5.3
6.5.9
1
apache/airflow:2.8.4-python3.964e58748b6b9
tornado@6.4
6.5.9
1
apache/airflow:2.10.2-python3.9ce90bdc3d2af
tornado@6.4.1
6.5.9
1
apache/airflow:2.8.1e5560ad0b86e
tornado@6.4
6.5.9
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
tornado@6.4.2
6.5.9
1
apsl/thumbor:6.7.051e2de5c2c70
tornado@5.1.1
6.5.9
1
aristidetm/basic-notebook:3.6.5469dbc951224
tornado@6.4.1
6.5.9
1
aristidetm/k8s-hub:3.3.7ccb516cb8474
tornado@6.4
6.5.9
1
baserow/backend:2.3.37c00549b3a6f
tornado@6.5.7
6.5.9
1
baserow/backend:1.31.1e0b3c8130b91
tornado@6.4.1
6.5.9
1
baserow/baserow:1.30.1df0c42eb67e8
tornado@6.4.1
6.5.9
1
bmeares/meerschaum:2.8.48e9c5bacaa82
tornado@6.4.2
6.5.9
1
ccrisan/motioneye:master-amd641704cddc44e0
tornado@5.0.2
6.5.9
1
ccrisan/motioneye:master-armhf1d7abea3e92e
tornado@4.4.3
6.5.9
1
cheyang/distributed-tf:1.6.046cc34755493
tornado@4.5.3
6.5.9
1
copyparty/ac:1.19.200a0a8605062c
tornado@6.5.1
6.5.9
1
crocodilestick/calibre-web-automated:v4.0.6c31a738b6d5e
tornado@6.5.4
6.5.9
1
daskdev/dask:1.1.04ecd7bc35500
tornado@5.1.1
6.5.9
1
daskdev/dask-notebook:1.1.0052630f5ca04
tornado@5.1.1
6.5.9
1
datagrok/grok_spawner:latest8c2d48c1545c
tornado@6.5.7
6.5.9
1
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
tornado@6.4
6.5.9
1
ddosify/selfhosted_alaz_backend:2.3.11e5be48b37348
tornado@6.4.1
6.5.9
1
errbotio/errbot:6.1.900ee4e0953ab
tornado@6.1
6.5.9
1
esphome/esphome:1.18.03f51ec10e823
tornado@6.1
6.5.9
1
esphome/esphome:2024.3.09ab8cc88b28c
tornado@6.4
6.5.9
1
esphome/esphome:2024.12.2b2c6322700ac
tornado@6.4
6.5.9
1
esphome/esphome:2025.3.0def8b6e4f517
tornado@6.4.2
6.5.9
1
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
tornado@6.2
6.5.9
1
geoscienceaustralia/dea-k8s-data:latestf4039b45572a
tornado@6.0.4
6.5.9
1
gethue/hue:4.11.011b649636e68
tornado@6.2
6.5.9
1
gethue/hue:4.10.05702b2c37ff9
tornado@6.1
6.5.9
1
gethue/hue:latest7d5c1b9f8a79
tornado@6.5.4
6.5.9
1
gmaas2/github-api:latest148fc2d9afe9
tornado@6.2
6.5.9
1
grafana/oncall:v1.13.11159b6b836fed
tornado@6.4.2
6.5.9
1
grafana/oncall:v1.16.5499851658393
tornado@6.5.1
6.5.9
1
homeassistant/home-assistant:2023.10.3021e2afc6e57
tornado@6.3.3
6.5.9
1
homeassistant/home-assistant:2022.3.5565751f33794
tornado@6.1
6.5.9
1
homeassistant/home-assistant:2023.12.48d000332b09b
tornado@6.4
6.5.9
1
ilum/streamlit-example:1.0.0ce5dcdeb22ba
tornado@6.5.2
6.5.9
1
intel/dlstreamer-pipeline-server:2022.1.1-ubuntu20aa8f5483a2ef
tornado@6.1
6.5.9
1

syft 1.42.1 · advisories as of 2 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.