StackRadar

CVE-2026-104874

Medium

Advisory

Published 5 Oct 2026In the index since 6 Oct 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.003
20th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
119
of 18,026 indexed, latest versions
Container images
113
deployed by those charts
Fix available
1 of 2
affected packages

Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Carried by container images the latest versions of 119 of 18,026 indexed charts deploy, on 113 images.

Affected packageAffected versionsFixed inImages
multidictpypi6.7.0, 6.7.1, 6.8.0, 6.9.06.9.1112
python-multidictdeb6.0.4-1.1build1no fix listed1
OSV records
GHSA-54p9-h82j-f925UBUNTU-CVE-2026-104874

Charts affected

119 by stars
ChartLatestAffected imagesRadar Score
prowlerprowler0.1.11 of 1See more

prowler prowler 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
toniblyx/prowler:stablecf1ee9fc5b67
multidict@6.7.1
6.9.1

Open the chart page →

1,790
rawfile-localpvrawfile0.15.31 of 6See more

rawfile-localpv rawfile 0.15.3

1 of the 6 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
openebs/rawfile-localpv:v0.15.396fd7987ea79
multidict@6.7.1
6.9.1

Open the chart page →

3,782
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
multidict@6.7.1
6.9.1

Open the chart page →

9,198
tandoorrtomik-helm-chartsVerified publisher0.0.11 of 1See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
vabene1111/recipes:2.3.50f8d061895e9
multidict@6.7.0
6.9.1

Open the chart page →

4,891
runwhen-localrunwhen-contribVerified publisher0.7.01 of 3See more

runwhen-local runwhen-contrib 0.7.0

1 of the 3 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/runwhen-contrib/runwhen-local:0.12.32c1ec86675d4
multidict@6.7.1
6.9.1

Open the chart page →

4,111
safe-config-servicesafe-global0.1.01 of 3See more

safe-config-service safe-global 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
safeglobal/safe-config-service:latest09a5e495c219
multidict@6.7.1
6.9.1

Open the chart page →

1,953
safe-stacksafe-global0.1.02 of 9See more

safe-stack safe-global 0.1.0

2 of the 9 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
safeglobal/safe-config-service:latest09a5e495c219
multidict@6.7.1
6.9.1
safeglobal/safe-transaction-service:latest7b576c73f865
multidict@6.7.1
6.9.1

Open the chart page →

20,820
safe-transaction-servicesafe-global0.1.01 of 6See more

safe-transaction-service safe-global 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
safeglobal/safe-transaction-service:latest7b576c73f865
multidict@6.7.1
6.9.1

Open the chart page →

17,329
seafileschmitzis13.0.131 of 4See more

seafile schmitzis 13.0.13

1 of the 4 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
schmitzis/monorepo:seafile-13.0-latestf7e51ba2fb07
multidict@6.8.0
6.9.1

Open the chart page →

43,234
search-proxysearch-proxy2026.40.01 of 1See more

search-proxy search-proxy 2026.40.0

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/unique-ag/ai/search-proxy:2026.40.02bd74586650d
multidict@6.7.1
6.9.1

Open the chart page →

1,766
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
multidict@6.7.1
6.9.1

Open the chart page →

6,095
home-assistantsmall-hack2.1.01 of 1See more

home-assistant small-hack 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
multidict@6.7.1
6.9.1

Open the chart page →

4,850
srebotsrebot0.14.01 of 2See more

srebot srebot 0.14.0

1 of the 2 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
multidict@6.7.1
6.9.1

Open the chart page →

1,832
servicexssl-hep1.8.61 of 16See more

servicex ssl-hep 1.8.6

1 of the 16 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
sslhep/servicex-did-finder:v1.8.6e15e68307d33
multidict@6.7.1
6.9.1

Open the chart page →

61,380
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
multidict@6.7.1
6.9.1

Open the chart page →

4,102
svc-lb-muxsvc-lb-mux0.1.31 of 1See more

svc-lb-mux svc-lb-mux 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/nowakeai/svc-lb-mux:0.1.37d8fb8e996b6
multidict@6.7.1
6.9.1

Open the chart page →

1,742
wasabi-s3-operatorwasabi-s3-operatorVerified publisher0.2.71 of 1See more

wasabi-s3-operator wasabi-s3-operator 0.2.7

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
kenchrcum/wasabi-s3-operator:0.2.7ce657c622ce5
multidict@6.7.1
6.9.1

Open the chart page →

743
dingtalk-botxxl-job-adminVerified publisher0.1.31 of 2See more

dingtalk-bot xxl-job-admin 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
dellnoantechnp/dingtalk-bot:v1.0.1034000bbcad5
multidict@6.7.0
6.9.1

Open the chart page →

3,752
sockpuppetbrowserzekker6Verified publisher0.1.01 of 1See more

sockpuppetbrowser zekker6 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
dgtlmoon/sockpuppetbrowser:latest1d8f72d2ce20
multidict@6.8.0
6.9.1

Open the chart page →

5,028

Container images carrying it

113 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
mindsdb/mindsdb:latest163011c09299
multidict@6.7.1
6.9.1
1
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
multidict@6.7.1
6.9.1
1
onyxdotapp/onyx-backend:latest60e83a098ae4
multidict@6.7.0
6.9.1
1
opencsghq/csgbot:v0.6.9-ee7d0271e26521
multidict@6.7.0
6.9.1
1
openebs/rawfile-localpv:v0.15.396fd7987ea79
multidict@6.7.1
6.9.1
1
opennode/waldur-mastermind:8.1.24c82b15d9042
multidict@6.7.1
6.9.1
1
polyaxon/polyaxon-api:2.17.0163707082036
multidict@6.8.0
6.9.1
1
polyaxon/polyaxon-streams:2.17.0a5fec70e757b
multidict@6.8.0
6.9.1
1
pretix/standalone:2026.7.05df3b7aa852e
multidict@6.7.1
6.9.1
1
prowlercloud/prowler-api:5.31.14f252d579be2
multidict@6.7.1
6.9.1
1
rhasspy/wyoming-speech-to-phrase:1.4.3e532f0dbc6b2
multidict@6.7.1
6.9.1
1
schmitzis/monorepo:seafile-13.0-latestf7e51ba2fb07
multidict@6.8.0
6.9.1
1
sslhep/servicex-did-finder:v1.8.6e15e68307d33
multidict@6.7.1
6.9.1
1
tock/gen-ai-orchestrator-server:25.10.7abf7880e0449
multidict@6.7.1
6.9.1
1
tombursch/kitchenowl-backend:v0.7.104a7ed693531b
multidict@6.7.1
6.9.1
1
toniblyx/prowler:stablecf1ee9fc5b67
multidict@6.7.1
6.9.1
1
trackerforce/switcher-slack-app:latest4d99efa5eb70
multidict@6.8.0
6.9.1
1
truebyteinnovationllp/jupyterhub-k8s:5.5.06bf978b96279
multidict@6.7.1
6.9.1
1
vabene1111/recipes:2.3.50f8d061895e9
multidict@6.7.0
6.9.1
1
ghcr.io/afairgiant/medikeep:v0.71.0086579173033
multidict@6.8.0
6.9.1
1
ghcr.io/argonix-io/argonix-api:0.6.188f00d2d8288
multidict@6.7.1
6.9.1
1
ghcr.io/berriai/litellm:1.102.0:main-stable32cfd7a427f6
multidict@6.7.1
6.9.1
1
ghcr.io/berriai/litellm:1.104.0625981c83410
multidict@6.7.1
6.9.1
1
ghcr.io/dask/dask-gateway-server:2026.3.0afa5a729114e
multidict@6.7.1
6.9.1
1
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
multidict@6.7.1
6.9.1
1
ghcr.io/developmentseed/titiler:latest13733707a0f8
multidict@6.8.0
6.9.1
1
ghcr.io/dmunozv04/isponsorblocktv:v2.9.05b8cfa805cb6
multidict@6.7.1
6.9.1
1
ghcr.io/eslupmi/impulse:v3.7.1186a24030e82
multidict@6.9.0
6.9.1
1
ghcr.io/feresberbeche/alertigate:2.0.07b9bba80f207
multidict@6.9.0
6.9.1
1
ghcr.io/glassflow/glassflow-notifier:v1.0.3d1b0ce10b513
multidict@6.7.1
6.9.1
1
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
multidict@6.7.0
6.9.1
1
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
multidict@6.7.1
6.9.1
1
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
multidict@6.7.1
6.9.1
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
multidict@6.7.0
6.9.1
1
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
multidict@6.8.0
6.9.1
1
ghcr.io/home-assistant/home-assistant:2026.9.3:latestd89226851697
multidict@6.8.0
6.9.1
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
multidict@6.7.1
6.9.1
1
ghcr.io/iisas/domino-rest:latest3009350bfc11
multidict@6.7.1
6.9.1
1
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
multidict@6.7.1
6.9.1
1
ghcr.io/kubevoip/kubevoip:v0.6.841c603a93642
multidict@6.7.1
6.9.1
1
ghcr.io/liturgical-app/liturgical-api:1.0.12637bdcebdd8d
multidict@6.7.1
6.9.1
1
ghcr.io/microboxlabs/miot-harness:0.1.0d548e9ae4b84
multidict@6.7.1
6.9.1
1
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
multidict@6.7.0
6.9.1
1
ghcr.io/music-assistant/server:2.10.3885872224fa5
multidict@6.8.0
6.9.1
1
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
multidict@6.7.1
6.9.1
1
ghcr.io/nowakeai/svc-lb-mux:0.1.37d8fb8e996b6
multidict@6.7.1
6.9.1
1
ghcr.io/observal/observal-api:1.14.05a20125eafd4
multidict@6.7.1
6.9.1
1
ghcr.io/open-telemetry/demo:3.1.0-mcp81db69cdd0b6
multidict@6.7.1
6.9.1
1
ghcr.io/open-telemetry/demo:3.1.0-agentd0f4ae0b32a8
multidict@6.7.1
6.9.1
1
ghcr.io/open-webui/terminals:latest6850ed976e7e
multidict@6.9.0
6.9.1
1

syft 1.42.1 · advisories as of 6 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.