StackRadar

CVE-2026-104874

Medium

Advisory

Published 5 Oct 2026In the index since 6 Oct 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.003
20th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
119
of 18,026 indexed, latest versions
Container images
113
deployed by those charts
Fix available
1 of 2
affected packages

Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction

Carried by container images the latest versions of 119 of 18,026 indexed charts deploy, on 113 images.

Affected packageAffected versionsFixed inImages
multidictpypi6.7.0, 6.7.1, 6.8.0, 6.9.06.9.1112
python-multidictdeb6.0.4-1.1build1no fix listed1
OSV records
GHSA-54p9-h82j-f925UBUNTU-CVE-2026-104874

Charts affected

119 by stars
ChartLatestAffected imagesRadar Score
titilerarlas-stackVerified publisher28.9.01 of 1See more

titiler arlas-stack 28.9.0

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/developmentseed/titiler:latest13733707a0f8
multidict@6.8.0
6.9.1

Open the chart page →

118
kitchenowlchart-kitchenowl0.1.131 of 2See more

kitchenowl chart-kitchenowl 0.1.13

1 of the 2 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
tombursch/kitchenowl-backend:v0.7.104a7ed693531b
multidict@6.7.1
6.9.1

Open the chart page →

3,131
home-assistant-otbrcharts-derwitt-devVerified publisher2.1.41 of 1See more

home-assistant-otbr charts-derwitt-dev 2.1.4

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/wittdennis/homeassistant-otbr:4.2.5282f840612d9
multidict@6.8.0
6.9.1

Open the chart page →

2,710
paperless-ngxcharts-derwitt-devVerified publisher2.1.51 of 1See more

paperless-ngx charts-derwitt-dev 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.2.15fa76604a81d
multidict@6.7.1
6.9.1

Open the chart page →

4,917
galaxycloudve6.8.81 of 3See more

galaxy cloudve 6.8.8

1 of the 3 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
multidict@6.7.1
6.9.1

Open the chart page →

7,039
authentikcluster-deploy0.3.01 of 1See more

authentik cluster-deploy 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.8.3ab9b4e8cc4ab
multidict@6.7.1
6.9.1

Open the chart page →

1,364
csghubcsghubVerified publisher2.5.01 of 34See more

csghub csghub 2.5.0

1 of the 34 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
opencsghq/csgbot:v0.6.9-ee7d0271e26521
multidict@6.7.0
6.9.1

Open the chart page →

58,956
dask-gatewaydask2026.3.01 of 2See more

dask-gateway dask 2026.3.0

1 of the 2 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-gateway-server:2026.3.0afa5a729114e
multidict@6.7.1
6.9.1

Open the chart page →

2,691
datagrokdatagrok1.0.31 of 7See more

datagrok datagrok 1.0.3

1 of the 7 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
datagrok/grok_spawner:latest8c2d48c1545c
multidict@6.7.1
6.9.1

Open the chart page →

2,720
isponsorblocktvdefault-ghVerified publisher1.0.51 of 1See more

isponsorblocktv default-gh 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/dmunozv04/isponsorblocktv:v2.9.05b8cfa805cb6
multidict@6.7.1
6.9.1

Open the chart page →

872
dominodomino-iisasVerified publisher0.3.11 of 3See more

domino domino-iisas 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/iisas/domino-rest:latest3009350bfc11
multidict@6.7.1
6.9.1

Open the chart page →

11,744
esphomeegebackVerified publisher2.0.251 of 1See more

esphome egeback 2.0.25

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
esphome/esphome:2026.7.44866347cb5b4
multidict@6.7.1
6.9.1

Open the chart page →

3,607
home-assistantegebackVerified publisher2.0.351 of 1See more

home-assistant egeback 2.0.35

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
multidict@6.7.1
6.9.1

Open the chart page →

3,056
flyteconnectorflyte2.0.01 of 1See more

flyteconnector flyte 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
multidict@6.7.1
6.9.1

Open the chart page →

4,190
flyte-devboxflyte0.1.01 of 14See more

flyte-devbox flyte 0.1.0

1 of the 14 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
multidict@6.7.1
6.9.1

Open the chart page →

10,970
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
multidict@6.7.0
6.9.1

Open the chart page →

10,718
glassflow-etlglassflowVerified publisher0.5.211 of 16See more

glassflow-etl glassflow 0.5.21

1 of the 16 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/glassflow/glassflow-notifier:v1.0.3d1b0ce10b513
multidict@6.7.1
6.9.1

Open the chart page →

15,333
helixhelix1.4.31 of 2See more

helix helix 1.4.3

1 of the 2 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
multidict@6.7.1
6.9.1

Open the chart page →

6,286
archiveboxhelmforgeVerified publisher1.1.131 of 1See more

archivebox helmforge 1.1.13

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
archivebox/archivebox:0.9.708c21bb233130
multidict@6.9.0
6.9.1

Open the chart page →

5,806
chiefonboardinghelmforgeVerified publisher1.1.151 of 3See more

chiefonboarding helmforge 1.1.15

1 of the 3 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
chiefonboarding/chiefonboarding:v2.5.0d0964135ea82
multidict@6.8.0
6.9.1

Open the chart page →

8,103
hermes-agenthelmforgeVerified publisher1.0.11 of 1See more

hermes-agent helmforge 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.9.24fca358f12efd
multidict@6.7.1
6.9.1

Open the chart page →

6,595
jupyterhubhelmforgeVerified publisher1.0.61 of 3See more

jupyterhub helmforge 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
multidict@6.7.1
6.9.1

Open the chart page →

6,062
langflowhelmforgeVerified publisher2.0.21 of 1See more

langflow helmforge 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
langflowai/langflow:1.12.334055a07d446
multidict@6.7.1
6.9.1

Open the chart page →

492
medikeephelmforgeVerified publisher2.0.21 of 3See more

medikeep helmforge 2.0.2

1 of the 3 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/afairgiant/medikeep:v0.71.0086579173033
multidict@6.8.0
6.9.1

Open the chart page →

6,249
hetzner-s3-operatorhetzner-s3-operatorVerified publisher0.1.31 of 1See more

hetzner-s3-operator hetzner-s3-operator 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
kenchrcum/hetzner-s3-operator:0.1.384dae7aeea5b
multidict@6.7.1
6.9.1

Open the chart page →

743
paperlesshpVerified publisher0.1.21 of 5See more

paperless hp 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
multidict@6.7.1
6.9.1

Open the chart page →

31,703
bluesky-pdsijmacd1.0.01 of 2See more

bluesky-pds ijmacd 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
arunvelsriram/utils:latest655ad18fd8d6
python-multidict@6.0.4-1.1build1
no fix listed

Open the chart page →

10,261
ilum-apiilumVerified publisher6.7.31 of 1See more

ilum-api ilum 6.7.3

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ilum/api:6.7.3624fd09528c8
multidict@6.7.1
6.9.1

Open the chart page →

3,007
impulseimpulse1.1.01 of 1See more

impulse impulse 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/eslupmi/impulse:v3.7.1186a24030e82
multidict@6.9.0
6.9.1

Open the chart page →

1,306
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
multidict@6.7.1
6.9.1

Open the chart page →

20,367
jupyterhub-chartk8s-jupyterhub0.1.01 of 1See more

jupyterhub-chart k8s-jupyterhub 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
truebyteinnovationllp/jupyterhub-k8s:5.5.06bf978b96279
multidict@6.7.1
6.9.1

Open the chart page →

1,896
authentikkagiso-me0.1.11 of 1See more

authentik kagiso-me 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
multidict@6.7.0
6.9.1

Open the chart page →

5,401
karbkarbVerified publisher1.0.31 of 1See more

karb karb 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/xeor/karb:main647a3c938d31
multidict@6.7.1
6.9.1

Open the chart page →

755
karb-chartkarbVerified publisher1.0.61 of 1See more

karb-chart karb 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/xeor/karb:1.0.6647a3c938d31
multidict@6.7.1
6.9.1

Open the chart page →

755
music-assistantkarljorgensen0.1.31 of 1See more

music-assistant karljorgensen 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
multidict@6.7.1
6.9.1

Open the chart page →

8,181
mindsdbkronkltdVerified publisher0.1.01 of 1See more

mindsdb kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
mindsdb/mindsdb:latest163011c09299
multidict@6.7.1
6.9.1

Open the chart page →

11,283
kubernetes-feedskubernetes-feeds0.1.11 of 3See more

kubernetes-feeds kubernetes-feeds 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
lumutools/kubernetes-feeder:lateste35ffa90b129
multidict@6.7.1
6.9.1

Open the chart page →

1,216
kubevoipkubevoipOfficialVerified publisher0.6.81 of 1See more

kubevoip kubevoip 0.6.8

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/kubevoip/kubevoip:v0.6.841c603a93642
multidict@6.7.1
6.9.1

Open the chart page →

1,425
liturgical-apiliturgical0.2.111 of 1See more

liturgical-api liturgical 0.2.11

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/liturgical-app/liturgical-api:1.0.12637bdcebdd8d
multidict@6.7.1
6.9.1

Open the chart page →

1,124
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
multidict@6.7.1
6.9.1

Open the chart page →

3,310
miot-harnessmicroboxlabs0.8.01 of 1See more

miot-harness microboxlabs 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-harness:0.1.0d548e9ae4b84
multidict@6.7.1
6.9.1

Open the chart page →

1,626
ocellusaiocellusaiVerified publisher0.1.121 of 2See more

ocellusai ocellusai 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
quay.io/ocellusai/operator:v0.10.59ff01f642e2b
multidict@6.7.1
6.9.1

Open the chart page →

1,496
octantisoctantis0.1.01 of 1See more

octantis octantis 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/vinny1892/octantis:latest45459c0910fc
multidict@6.7.1
6.9.1

Open the chart page →

3,107
paperless-ngxoli-the-devVerified publisher1.1.11 of 1See more

paperless-ngx oli-the-dev 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
multidict@6.7.1
6.9.1

Open the chart page →

5,850
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
onyxdotapp/onyx-backend:latest60e83a098ae4
multidict@6.7.0
6.9.1

Open the chart page →

8,959
terminalsopen-webui0.7.02 of 2See more

terminals open-webui 0.7.0

2 of the 2 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/open-webui/terminals:latest6850ed976e7e
multidict@6.9.0
6.9.1
ghcr.io/open-webui/terminals-operator:latest5e1ceb6b3b26
multidict@6.8.0
6.9.1

Open the chart page →

2,305
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
multidict@6.7.0
6.9.1

Open the chart page →

5,779
pieeatpieeatOfficialVerified publisher0.9.31 of 1See more

pieeat pieeat 0.9.3

1 of the 1 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
quay.io/maxiv/pieeat:0.9.3099715479210
multidict@6.7.1
6.9.1

Open the chart page →

1,766
agentpolyaxon2.17.03 of 4See more

agent polyaxon 2.17.0

3 of the 4 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
polyaxon/polyaxon-agent:2.17.0da877a2647fc
multidict@6.8.0
6.9.1
polyaxon/polyaxon-cli:2.17.0297ed47ed63a
multidict@6.8.0
6.9.1
polyaxon/polyaxon-streams:2.17.0a5fec70e757b
multidict@6.8.0
6.9.1

Open the chart page →

10,080
polyaxonpolyaxon2.17.03 of 5See more

polyaxon polyaxon 2.17.0

3 of the 5 container images this version deploys carry CVE-2026-104874.

Container imageDigestPackageFixed in
polyaxon/polyaxon-agent:2.17.0da877a2647fc
multidict@6.8.0
6.9.1
polyaxon/polyaxon-api:2.17.0163707082036
multidict@6.8.0
6.9.1
polyaxon/polyaxon-cli:2.17.0297ed47ed63a
multidict@6.8.0
6.9.1

Open the chart page →

14,094

Container images carrying it

113 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/open-webui/terminals-operator:latest5e1ceb6b3b26
multidict@6.8.0
6.9.1
1
ghcr.io/runwhen-contrib/runwhen-local:0.12.32c1ec86675d4
multidict@6.7.1
6.9.1
1
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
multidict@6.7.1
6.9.1
1
ghcr.io/unique-ag/ai/search-proxy:2026.40.02bd74586650d
multidict@6.7.1
6.9.1
1
ghcr.io/vinny1892/octantis:latest45459c0910fc
multidict@6.7.1
6.9.1
1
ghcr.io/wittdennis/homeassistant-otbr:4.2.5282f840612d9
multidict@6.8.0
6.9.1
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
multidict@6.7.1
6.9.1
1
quay.io/jupyterhub/k8s-hub:4.4.2108fbb01c3fe
multidict@6.7.1
6.9.1
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
multidict@6.7.1
6.9.1
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
multidict@6.7.1
6.9.1
1
quay.io/maxiv/pieeat:0.9.3099715479210
multidict@6.7.1
6.9.1
1
quay.io/ocellusai/operator:v0.10.59ff01f642e2b
multidict@6.7.1
6.9.1
1
quay.io/stackgres/operator:1.19.37fdfd631a281
multidict@6.7.1
6.9.1
1

syft 1.42.1 · advisories as of 6 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.