StackRadar

CVE-2026-111064

High

Advisory

Published 19 Oct 2026In the index since 20 Oct 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
247
of 18,196 indexed, latest versions
Container images
242
deployed by those charts
Fix available
1 of 1
affected package

aiohttp server lacks an initial request/header timeout

Carried by container images the latest versions of 247 of 18,196 indexed charts deploy, on 242 images.

Affected packageAffected versionsFixed inImages
aiohttppypi3.4.4, 3.5.1, 3.5.4, 3.6.2+37 more3.14.4242
OSV records
GHSA-5wr8-gcqf-gqf3

Charts affected

247 by stars
ChartLatestAffected imagesRadar Score
authentikgoauthentikOfficialVerified publisher2026.8.41 of 1See more

authentik goauthentik 2026.8.4

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.8.4e7226ae116da
aiohttp@3.14.3
3.14.4

Open the chart page →

1,377
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
aiohttp@3.9.3
3.14.4

Open the chart page →

13,034
mlflowcommunity-chartsVerified publisher1.11.71 of 1See more

mlflow community-charts 1.11.7

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
burakince/mlflow:3.16.0ab4b566644b9
aiohttp@3.14.3
3.14.4

Open the chart page →

1,060
datahubdatahubVerified publisher1.1.71 of 4See more

datahub datahub 1.1.7

1 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
acryldata/datahub-actions:v1.7.0.1c5fd70130157
aiohttp@3.14.3
3.14.4

Open the chart page →

1,616
stackgres-operatorstackgres-chartsOfficialVerified publisher1.19.31 of 2See more

stackgres-operator stackgres-charts 1.19.3

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/stackgres/operator:1.19.37fdfd631a281
aiohttp@3.14.1
3.14.4

Open the chart page →

3,243
difydify-helmVerified publisher0.39.01 of 11See more

dify dify-helm 0.39.0

1 of the 11 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
langgenius/dify-api:1.17.052be6088dd84
aiohttp@3.14.3
3.14.4

Open the chart page →

64,792
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
aiohttp@3.8.1
3.14.4

Open the chart page →

9,174
daskdask2024.1.11 of 2See more

dask dask 2024.1.1

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
aiohttp@3.9.1
3.14.4

Open the chart page →

14,626
litellm-helmlitellm1.106.01 of 2See more

litellm-helm litellm 1.106.0

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm:1.106.02e4c0371f3a8
aiohttp@3.14.3
3.14.4

Open the chart page →

5,379
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
aiohttp@3.9.1
3.14.4

Open the chart page →

7,459
ilumilumOfficialVerified publisher6.7.31 of 19See more

ilum ilum 6.7.3

1 of the 19 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ilum/api:6.7.3624fd09528c8
aiohttp@3.14.1
3.14.4

Open the chart page →

28,480
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
aiohttp@3.11.12
3.14.4

Open the chart page →

21,686
paperless-ngxpaperless-ngxVerified publisher0.3.241 of 3See more

paperless-ngx paperless-ngx 0.3.24

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.06b94799bc769
aiohttp@3.14.3
3.14.4

Open the chart page →

9,703
home-assistantandrenarchyVerified publisher14.104.01 of 1See more

home-assistant andrenarchy 14.104.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
aiohttp@3.14.3
3.14.4

Open the chart page →

3,427
cluster-secretclutersecretVerified publisher0.7.01 of 1See more

cluster-secret clutersecret 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/clustersecret/clustersecret:0.0.14a9f835d1b241
aiohttp@3.11.11
3.14.4

Open the chart page →

3,454
daskhubdask2024.1.13 of 9See more

daskhub dask 2024.1.1

3 of the 9 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
aiohttp@3.9.1
3.14.4
ghcr.io/dask/dask-gateway-server:2024.1.0881e7acfc5a0
aiohttp@3.9.1
3.14.4
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
aiohttp@3.9.1
3.14.4

Open the chart page →

17,807
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
datamate/seafile-professional:11.0.202dd66b722464
aiohttp@3.12.15
3.14.4

Open the chart page →

86,629
glpiglpi-conteiner0.1.01 of 3See more

glpi glpi-conteiner 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
vdiogov/glpi-conteiner:latest6945f84f0058
aiohttp@3.8.4
3.14.4

Open the chart page →

13,319
clustersecretpatrungel0.2.01 of 1See more

clustersecret patrungel 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
flag5/clustersecret:0.0.94ad5748bfcc6
aiohttp@3.8.1
3.14.4

Open the chart page →

2,371
alerta-webalerta-webVerified publisher0.1.121 of 2See more

alerta-web alerta-web 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
hayk96/alerta-web:9.0.486377705e9e3
aiohttp@3.10.5
3.14.4

Open the chart page →

4,837
convertigoconvertigoOfficialVerified publisher8.4.61 of 5See more

convertigo convertigo 8.4.6

1 of the 5 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
aiohttp@3.9.5
3.14.4

Open the chart page →

17,667
dask-kubernetes-operatordask2026.3.01 of 1See more

dask-kubernetes-operator dask 2026.3.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
aiohttp@3.13.3
3.14.4

Open the chart page →

11,344
deepflowdeepflow6.2.2011 of 8See more

deepflow deepflow 6.2.201

1 of the 8 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
deepflowce/deepflow-app:v6.2.2aa9468ad4d96
aiohttp@3.4.4
3.14.4

Open the chart page →

21,381
flyte-binaryflyte2.0.511 of 4See more

flyte-binary flyte 2.0.51

1 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
aiohttp@3.13.5
3.14.4

Open the chart page →

5,274
nacosgujunxiang0.1.51 of 1See more

nacos gujunxiang 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
nacos/nacos-server:latest1c191c30c8cd
aiohttp@3.14.3
3.14.4

Open the chart page →

2,837
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
aiohttp@3.13.3
3.14.4

Open the chart page →

5,944
mlflow-tracking-servermlflow-tracking-serverVerified publisher4.1.01 of 1See more

mlflow-tracking-server mlflow-tracking-server 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/mlflow-oidc/mlflow-tracking-server:3.16.1-9.0.2-20261001970ba1cc1e69
aiohttp@3.14.3
3.14.4

Open the chart page →

659
observalobservalVerified publisher1.15.11 of 8See more

observal observal 1.15.1

1 of the 8 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/observal/observal-api:1.15.1e40d18a3a739
aiohttp@3.14.3
3.14.4

Open the chart page →

6,758
skypilotskypilotOfficialVerified publisher0.14.11 of 3See more

skypilot skypilot 0.14.1

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot:0.14.125577df35586
aiohttp@3.14.3
3.14.4

Open the chart page →

6,415
pretixtechwolf12Verified publisher2026.8.01 of 3See more

pretix techwolf12 2026.8.0

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
pretix/standalone:2026.8.0ec17c2f761f7
aiohttp@3.14.3
3.14.4

Open the chart page →

10,205
paperlesszekker6Verified publisher11.13.01 of 1See more

paperless zekker6 11.13.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
aiohttp@3.14.3
3.14.4

Open the chart page →

5,530
paperless-ngxadnoctemVerified publisher0.5.11 of 5See more

paperless-ngx adnoctem 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
aiohttp@3.14.3
3.14.4

Open the chart page →

27,570
agentareaagentareaVerified publisher0.0.272 of 17See more

agentarea agentarea 0.0.27

2 of the 17 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
agentarea/agentarea-api:latestde166c910ef9
aiohttp@3.14.3
3.14.4
agentarea/agentarea-worker:latestadb761a4d103
aiohttp@3.14.3
3.14.4

Open the chart page →

17,254
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
aiohttp@3.14.3
3.14.4

Open the chart page →

7,940
siemassist-iot-cybersecurity-monitroting-siem0.1.01 of 3See more

siem assist-iot-cybersecurity-monitroting-siem 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_id-wzh:latest0aacefac9677
aiohttp@3.7.4
3.14.4

Open the chart page →

12,531
music-assistantbdclark-helm-chartsVerified publisher0.4.151 of 1See more

music-assistant bdclark-helm-charts 0.4.15

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
aiohttp@3.14.3
3.14.4

Open the chart page →

4,956
easyhaproxybyjgVerified publisher2.0.41 of 1See more

easyhaproxy byjg 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
byjg/easy-haproxy:6.1.1230fdb7b00ae
aiohttp@3.14.1
3.14.4

Open the chart page →

1,224
nacosbytectl0.1.61 of 1See more

nacos bytectl 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
nacos/nacos-server:latest1c191c30c8cd
aiohttp@3.14.3
3.14.4

Open the chart page →

2,837
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
aiohttp@3.8.5
3.14.4

Open the chart page →

13,401
dagster-cloud-agentdagster-cloudVerified publisher1.13.261 of 1See more

dagster-cloud-agent dagster-cloud 1.13.26

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
dagster/dagster-cloud-agent:1.13.26c9320c34f7ed
aiohttp@3.14.3
3.14.4

Open the chart page →

1,289
trivy-operatordevopstalesVerified publisher2.5.01 of 1See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
devopstales/trivy-operator:2.575136aa7a26e
aiohttp@3.8.3
3.14.4

Open the chart page →

6,667
dominodominoVerified publisher0.1.111 of 3See more

domino domino 0.1.11

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
aiohttp@3.8.3
3.14.4

Open the chart page →

10,234
archerydoubanVerified publisher0.4.31 of 6See more

archery douban 0.4.3

1 of the 6 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
hhyo/archery:v1.9.11aa41843419e
aiohttp@3.8.3
3.14.4

Open the chart page →

8,031
elastalert2elastalert22.31.01 of 1See more

elastalert2 elastalert2 2.31.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
jertel/elastalert2:2.31.03cbf63f9b7dc
aiohttp@3.14.2
3.14.4

Open the chart page →

2,407
genesis-generatorethereum-helm-chartsVerified publisher0.2.31 of 2See more

genesis-generator ethereum-helm-charts 0.2.3

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
skylenet/ethereum-genesis-generator:latest210353ce7c89
aiohttp@3.8.3
3.14.4

Open the chart page →

4,597
obicogabe565Verified publisher0.6.01 of 3See more

obico gabe565 0.6.0

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/gabe565/obico/web:latest6acb4a5903eb
aiohttp@3.9.1
3.14.4

Open the chart page →

2,234
appdaemongeek-cookbookVerified publisher8.4.21 of 1See more

appdaemon geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
acockburn/appdaemon:4.0.83a93281d7e94
aiohttp@3.7.4
3.14.4

Open the chart page →

3,656
greenkubegreenkubeVerified publisher0.3.01 of 3See more

greenkube greenkube 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
greenkube/greenkube:0.3.00c01932282a4
aiohttp@3.14.3
3.14.4

Open the chart page →

2,209
harp-proxyharp0.8.11 of 1See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
makersquad/harp-proxy:0.8.1a40dd258c527
aiohttp@3.11.18
3.14.4

Open the chart page →

7,189
supersetinseefrlab1.4.01 of 4See more

superset inseefrlab 1.4.0

1 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
aiohttp@3.7.4
3.14.4

Open the chart page →

9,378

Container images carrying it

242 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
aiohttp@3.14.3
3.14.4
5
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.4
4
langflowai/langflow:1.12.6:latesta0396e089eb9
aiohttp@3.14.3
3.14.4
3
quay.io/devtron/ai-agent:0.0.16545dac92173
aiohttp@3.10.10
3.14.4
3
esphome/esphome:2026.9.14ad55931c018
aiohttp@3.14.3
3.14.4
2
frinx/topology-discovery:7.0.37832e3589dba
aiohttp@3.10.5
3.14.4
2
ilum/api:6.7.3624fd09528c8
aiohttp@3.14.1
3.14.4
2
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
aiohttp@3.8.1
3.14.4
2
nacos/nacos-server:latest1c191c30c8cd
aiohttp@3.14.3
3.14.4
2
opea/embedding-tei:1.05c9639de61c1
aiohttp@3.10.5
3.14.4
2
opea/reranking-tei:1.0e48613afb191
aiohttp@3.10.5
3.14.4
2
opea/retriever-redis:1.0eb746b263705
aiohttp@3.10.5
3.14.4
2
openbas/caldera-server:5.1.0a277796d9724
aiohttp@3.10.8
3.14.4
2
polyaxon/polyaxon-agent:2.17.0da877a2647fc
aiohttp@3.14.3
3.14.4
2
polyaxon/polyaxon-cli:2.17.0297ed47ed63a
aiohttp@3.14.3
3.14.4
2
safeglobal/safe-config-service:latest09a5e495c219
aiohttp@3.13.5
3.14.4
2
safeglobal/safe-transaction-service:latest7b576c73f865
aiohttp@3.14.3
3.14.4
2
vdiogov/glpi-conteiner:latest6945f84f0058
aiohttp@3.8.4
3.14.4
2
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
aiohttp@3.13.5
3.14.4
2
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
aiohttp@3.14.3
3.14.4
2
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
aiohttp@3.14.3
3.14.4
2
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
aiohttp@3.11.13
3.14.4
2
ghcr.io/xeor/karb:1.0.6:main647a3c938d31
aiohttp@3.13.3
3.14.4
2
acockburn/appdaemon:4.0.83a93281d7e94
aiohttp@3.7.4
3.14.4
1
acryldata/datahub-actions:v1.7.0.1c5fd70130157
aiohttp@3.14.3
3.14.4
1
agentarea/agentarea-api:latestde166c910ef9
aiohttp@3.14.3
3.14.4
1
agentarea/agentarea-worker:latestadb761a4d103
aiohttp@3.14.3
3.14.4
1
alerta/alerta-web:8.5.04786b9eaa606
aiohttp@3.8.0
3.14.4
1
apache/airflow:2.8.4-python3.964e58748b6b9
aiohttp@3.9.3
3.14.4
1
apache/airflow:2.10.2-python3.9ce90bdc3d2af
aiohttp@3.10.5
3.14.4
1
apache/airflow:2.8.1e5560ad0b86e
aiohttp@3.9.1
3.14.4
1
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
aiohttp@3.7.4
3.14.4
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
aiohttp@3.11.16
3.14.4
1
archivebox/archivebox:0.9.73d4720d86c0e9
aiohttp@3.14.3
3.14.4
1
aristidetm/basic-notebook:3.6.5469dbc951224
aiohttp@3.9.5
3.14.4
1
aristidetm/k8s-hub:3.3.7ccb516cb8474
aiohttp@3.9.3
3.14.4
1
assistiot/cybersecurity-monitoring_id-wzh:latest0aacefac9677
aiohttp@3.7.4
3.14.4
1
assistiot/smart-orchestrator_mcs:latest7d6a0d534c7f
aiohttp@3.9.3
3.14.4
1
baserow/backend:1.31.1e0b3c8130b91
aiohttp@3.9.5
3.14.4
1
baserow/baserow:1.30.1df0c42eb67e8
aiohttp@3.9.5
3.14.4
1
bcgovimages/aries-cloudagent:py36-1.16-1_0.7.4faa2e2d21916
aiohttp@3.8.1
3.14.4
1
berkeleyskypilot/skypilot:0.14.125577df35586
aiohttp@3.14.3
3.14.4
1
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
aiohttp@3.13.2
3.14.4
1
burakince/mlflow:3.16.0ab4b566644b9
aiohttp@3.14.3
3.14.4
1
byjg/easy-haproxy:6.1.1230fdb7b00ae
aiohttp@3.14.1
3.14.4
1
checkmk/check-mk-community:2.5.0p6c11b422210c4
aiohttp@3.13.5
3.14.4
1
chiefonboarding/chiefonboarding:v2.5.0d0964135ea82
aiohttp@3.14.3
3.14.4
1
ciuse99/suggestarr:v1.0.20d72768245ef5
aiohttp@3.11.12
3.14.4
1
clowder/clowder2-backend:2.0.0-beta.411f3d844e4c0
aiohttp@3.11.10
3.14.4
1
clowder/clowder2-heartbeat:2.0.0-beta.414155326c7b9
aiohttp@3.11.10
3.14.4
1

syft 1.42.1 · advisories as of 20 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.