StackRadar

CVE-2026-111064

High

Advisory

Published 19 Oct 2026In the index since 20 Oct 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
247
of 18,196 indexed, latest versions
Container images
242
deployed by those charts
Fix available
1 of 1
affected package

aiohttp server lacks an initial request/header timeout

Carried by container images the latest versions of 247 of 18,196 indexed charts deploy, on 242 images.

Affected packageAffected versionsFixed inImages
aiohttppypi3.4.4, 3.5.1, 3.5.4, 3.6.2+37 more3.14.4242
OSV records
GHSA-5wr8-gcqf-gqf3

Charts affected

247 by stars
ChartLatestAffected imagesRadar Score
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
aiohttp@3.13.5
3.14.4

Open the chart page →

21,634
shynetjuniorjpdj0.1.331 of 1See more

shynet juniorjpdj 0.1.33

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
milesmcc/shynet:v0.13.1ba54f7797a6b
aiohttp@3.8.1
3.14.4

Open the chart page →

2,890
jupyterhub-chartk8s-jupyterhub0.1.01 of 1See more

jupyterhub-chart k8s-jupyterhub 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
truebyteinnovationllp/jupyterhub-k8s:5.5.06bf978b96279
aiohttp@3.14.1
3.14.4

Open the chart page →

1,928
authentikkagiso-me0.1.11 of 1See more

authentik kagiso-me 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
aiohttp@3.13.3
3.14.4

Open the chart page →

5,780
karbkarbVerified publisher1.0.31 of 1See more

karb karb 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/xeor/karb:main647a3c938d31
aiohttp@3.13.3
3.14.4

Open the chart page →

748
karb-chartkarbVerified publisher1.0.61 of 1See more

karb-chart karb 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/xeor/karb:1.0.6647a3c938d31
aiohttp@3.13.3
3.14.4

Open the chart page →

748
music-assistantkarljorgensen0.1.31 of 1See more

music-assistant karljorgensen 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
aiohttp@3.13.5
3.14.4

Open the chart page →

8,721
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
aiohttp@3.8.5
3.14.4

Open the chart page →

7,867
crate-operatorkrateo2.43.11 of 1See more

crate-operator krateo 2.43.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
crate/crate-operator:2.43.1ea396813f6f0
aiohttp@3.10.11
3.14.4

Open the chart page →

3,306
mindsdbkronkltdVerified publisher0.1.01 of 1See more

mindsdb kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
mindsdb/mindsdb:latest163011c09299
aiohttp@3.13.5
3.14.4

Open the chart page →

12,411
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
aiohttp@3.11.16
3.14.4

Open the chart page →

9,665
jupyterhubkubeblocksVerified publisher0.1.01 of 7See more

jupyterhub kubeblocks 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
jupyterhub/k8s-hub:3.0.1-0.dev.git.6287.hbfb05cd65a0ceed1300a
aiohttp@3.8.5
3.14.4

Open the chart page →

9,860
kubernetes-feedskubernetes-feeds0.1.11 of 3See more

kubernetes-feeds kubernetes-feeds 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
lumutools/kubernetes-feeder:lateste35ffa90b129
aiohttp@3.14.3
3.14.4

Open the chart page →

1,235
deepflowkubesphere-stable6.2.6061 of 8See more

deepflow kubesphere-stable 6.2.606

1 of the 8 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
deepflowce/deepflow-app:v6.2.6.5a1888d35e787
aiohttp@3.4.4
3.14.4

Open the chart page →

24,125
kubevoipkubevoipOfficialVerified publisher0.6.81 of 1See more

kubevoip kubevoip 0.6.8

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/kubevoip/kubevoip:v0.6.841c603a93642
aiohttp@3.14.1
3.14.4

Open the chart page →

1,451
legendlegend0.1.21 of 1See more

legend legend 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/grofers/legend:0.1d6e901ad0ebd
aiohttp@3.7.1
3.14.4

Open the chart page →

5,631
calendar-apiliturgical0.1.51 of 1See more

calendar-api liturgical 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/liturgical-app/calendar-api:0.0.9688a685e2bde
aiohttp@3.12.15
3.14.4

Open the chart page →

1,703
liturgical-apiliturgical0.2.111 of 1See more

liturgical-api liturgical 0.2.11

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/liturgical-app/liturgical-api:1.0.12637bdcebdd8d
aiohttp@3.13.4
3.14.4

Open the chart page →

1,149
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
aiohttp@3.14.3
3.14.4

Open the chart page →

3,724
kafka-aggregatorlsst-sqre0.1.21 of 1See more

kafka-aggregator lsst-sqre 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
lsstsqre/kafkaaggregator:masterbe1b21060854
aiohttp@3.7.4
3.14.4

Open the chart page →

4,267
nublado2lsst-sqre0.8.51 of 2See more

nublado2 lsst-sqre 0.8.5

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
lsstsqre/nublado2:2.0.1b75bf8aaafa4
aiohttp@3.8.1
3.14.4

Open the chart page →

93,162
miot-harnessmicroboxlabs0.8.01 of 1See more

miot-harness microboxlabs 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-harness:0.1.0d548e9ae4b84
aiohttp@3.14.1
3.14.4

Open the chart page →

1,649
servicesmicroslacVerified publisher0.4.01 of 8See more

services microslac 0.4.0

1 of the 8 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
microslac/chat:latest417317e4e4e8
aiohttp@3.9.3
3.14.4

Open the chart page →

34,721
buildkite-exporterminaVerified publisher0.1.41 of 1See more

buildkite-exporter mina 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
codaprotocol/buildkite-exporter:0.2.137c68e67a401
aiohttp@3.7.3
3.14.4

Open the chart page →

3,374
mum-discord-botmum-discord-botVerified publisher0.3.71 of 1See more

mum-discord-bot mum-discord-bot 0.3.7

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/drewburr-labs/mum-discord-bot:3.1.26e82914e1051
aiohttp@3.9.1
3.14.4

Open the chart page →

15,336
mlflowncsaVerified publisher1.2.11 of 4See more

mlflow ncsa 1.2.1

1 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
evk02/mlflow:2.2.1ef6ff257ef35
aiohttp@3.8.4
3.14.4

Open the chart page →

6,436
esphome-device-buildernewbenji-chartsVerified publisher0.1.11 of 1See more

esphome-device-builder newbenji-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.7.4e636269c6390
aiohttp@3.14.3
3.14.4

Open the chart page →

3,862
home-assistantnewbenji-chartsVerified publisher0.7.21 of 1See more

home-assistant newbenji-charts 0.7.2

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.8.0a21689ef0510
aiohttp@3.14.3
3.14.4

Open the chart page →

3,469
music-assistantnewbenji-chartsVerified publisher0.1.01 of 1See more

music-assistant newbenji-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.645fdb050e069
aiohttp@3.14.3
3.14.4

Open the chart page →

4,956
object-clonerobject-clonerVerified publisher2.0.01 of 1See more

object-cloner object-cloner 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/ideamixes/object-cloner:2.0.031030fd2f192
aiohttp@3.8.5
3.14.4

Open the chart page →

1,659
ocellusaiocellusaiVerified publisher0.1.121 of 2See more

ocellusai ocellusai 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/ocellusai/operator:v0.10.59ff01f642e2b
aiohttp@3.14.1
3.14.4

Open the chart page →

1,746
octantisoctantis0.1.01 of 1See more

octantis octantis 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/vinny1892/octantis:latest45459c0910fc
aiohttp@3.13.3
3.14.4

Open the chart page →

3,114
paperless-ngxoli-the-devVerified publisher1.3.21 of 1See more

paperless-ngx oli-the-dev 1.3.2

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
aiohttp@3.14.3
3.14.4

Open the chart page →

5,530
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
onyxdotapp/onyx-backend:latest92b8fab500f9
aiohttp@3.14.3
3.14.4

Open the chart page →

8,985
chatbot-ai-sampleopenshift0.1.61 of 4See more

chatbot-ai-sample openshift 0.1.6

1 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
aiohttp@3.9.5
3.14.4

Open the chart page →

21,507
terminalsopen-webui0.7.02 of 2See more

terminals open-webui 0.7.0

2 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/open-webui/terminals:latest6850ed976e7e
aiohttp@3.14.3
3.14.4
ghcr.io/open-webui/terminals-operator:latest5e1ceb6b3b26
aiohttp@3.14.3
3.14.4

Open the chart page →

2,335
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
aiohttp@3.13.2
3.14.4

Open the chart page →

6,312
email-managerphntom0.1.221 of 2See more

email-manager phntom 0.1.22

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
phntom/email-manager:0.1.22d8e2a9f2f085
aiohttp@3.8.4
3.14.4

Open the chart page →

3,564
phronetisphronetis0.1.271 of 2See more

phronetis phronetis 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
knspar/phronetis-operator:0.1.60c4f0543ee58
aiohttp@3.12.13
3.14.4

Open the chart page →

18,498
pieeatpieeatOfficialVerified publisher0.9.31 of 1See more

pieeat pieeat 0.9.3

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/maxiv/pieeat:0.9.3099715479210
aiohttp@3.13.5
3.14.4

Open the chart page →

1,787
agentpolyaxon2.17.03 of 4See more

agent polyaxon 2.17.0

3 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
polyaxon/polyaxon-agent:2.17.0da877a2647fc
aiohttp@3.14.3
3.14.4
polyaxon/polyaxon-cli:2.17.0297ed47ed63a
aiohttp@3.14.3
3.14.4
polyaxon/polyaxon-streams:2.17.0a5fec70e757b
aiohttp@3.14.3
3.14.4

Open the chart page →

10,881
polyaxonpolyaxon2.17.03 of 5See more

polyaxon polyaxon 2.17.0

3 of the 5 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
polyaxon/polyaxon-agent:2.17.0da877a2647fc
aiohttp@3.14.3
3.14.4
polyaxon/polyaxon-api:2.17.0163707082036
aiohttp@3.14.3
3.14.4
polyaxon/polyaxon-cli:2.17.0297ed47ed63a
aiohttp@3.14.3
3.14.4

Open the chart page →

14,949
prowlerprowler0.1.11 of 1See more

prowler prowler 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
toniblyx/prowler:stable9dbcc3c9abd7
aiohttp@3.14.3
3.14.4

Open the chart page →

2,317
qubivaqubiva0.3.21 of 3See more

qubiva qubiva 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
aiohttp@3.12.13
3.14.4

Open the chart page →

8,436
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
aiohttp@3.10.5
3.14.4

Open the chart page →

24,366
radar-kafkaradar-baseVerified publisher0.4.11 of 2See more

radar-kafka radar-base 0.4.1

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/lsst-sqre/strimzi-registry-operator:0.6.07e25f7048aff
aiohttp@3.8.1
3.14.4

Open the chart page →

5,084
rawfile-localpvrawfile0.15.31 of 6See more

rawfile-localpv rawfile 0.15.3

1 of the 6 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
openebs/rawfile-localpv:v0.15.396fd7987ea79
aiohttp@3.14.3
3.14.4

Open the chart page →

4,918
kube-web-viewrlex0.5.01 of 1See more

kube-web-view rlex 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
hjacobs/kube-web-view:23.8.0431f1bf013d0
aiohttp@3.8.4
3.14.4

Open the chart page →

5,410
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
aiohttp@3.10.10
3.14.4

Open the chart page →

11,228
rommromm-helm-chartVerified publisher1.5.51 of 3See more

romm romm-helm-chart 1.5.5

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
rommapp/romm:5.2.03512f2ca4557
aiohttp@3.14.3
3.14.4

Open the chart page →

4,015

Container images carrying it

242 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
clowder/clowder2-messages:2.0.0-beta.4bf146f1ca24f
aiohttp@3.11.10
3.14.4
1
codaprotocol/buildkite-exporter:0.2.137c68e67a401
aiohttp@3.7.3
3.14.4
1
crate/crate-operator:2.43.1ea396813f6f0
aiohttp@3.10.11
3.14.4
1
cznic/knot-resolver:v6.4.28a5b87ed1842
aiohttp@3.11.16
3.14.4
1
dagster/dagster-cloud-agent:1.13.26c9320c34f7ed
aiohttp@3.14.3
3.14.4
1
datagrok/grok_spawner:latestb990a4eb1d19
aiohttp@3.14.3
3.14.4
1
datamate/seafile-professional:11.0.202dd66b722464
aiohttp@3.12.15
3.14.4
1
deepflowce/deepflow-app:v6.2.6.5a1888d35e787
aiohttp@3.4.4
3.14.4
1
deepflowce/deepflow-app:v6.2.2aa9468ad4d96
aiohttp@3.4.4
3.14.4
1
dellnoantechnp/dingtalk-bot:v1.0.1034000bbcad5
aiohttp@3.13.2
3.14.4
1
devopstales/trivy-operator:2.575136aa7a26e
aiohttp@3.8.3
3.14.4
1
dgtlmoon/sockpuppetbrowser:latest1d8f72d2ce20
aiohttp@3.14.3
3.14.4
1
dserio83/velero-api:0.3.16b3d9115fee2
aiohttp@3.12.12
3.14.4
1
evk02/mlflow:2.2.1ef6ff257ef35
aiohttp@3.8.4
3.14.4
1
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
aiohttp@3.8.3
3.14.4
1
flag5/clustersecret:0.0.94ad5748bfcc6
aiohttp@3.8.1
3.14.4
1
frinx/device-induction:1.2.2a8fbdce554ad
aiohttp@3.10.5
3.14.4
1
frinx/frinx-demo-workflows:6.1.0ee29588bd238
aiohttp@3.9.5
3.14.4
1
galaxy/cloudman-server:lateste5c265fe9fcd
aiohttp@3.8.1
3.14.4
1
galaxy/pulsar-kubernetes:0.15.7e50a890e24c9
aiohttp@3.11.18
3.14.4
1
greenkube/greenkube:0.3.00c01932282a4
aiohttp@3.14.3
3.14.4
1
guillh/web3-prometheus-exporter:0.3.04fb99dbc32b2
aiohttp@3.10.3
3.14.4
1
halkeye/slack-resurrect:v0.1.477b05e95fdb5
aiohttp@3.5.4
3.14.4
1
hayk96/alerta-web:9.0.486377705e9e3
aiohttp@3.10.5
3.14.4
1
hhyo/archery:v1.9.11aa41843419e
aiohttp@3.8.3
3.14.4
1
hjacobs/kube-web-view:23.8.0431f1bf013d0
aiohttp@3.8.4
3.14.4
1
hjacobs/kube-web-view:20.10.0b44a9cf81a2f
aiohttp@3.6.2
3.14.4
1
homeassistant/home-assistant:2023.10.3021e2afc6e57
aiohttp@3.8.5
3.14.4
1
homeassistant/home-assistant:2022.3.5565751f33794
aiohttp@3.8.1
3.14.4
1
homeassistant/home-assistant:2026.75a531753cea9
aiohttp@3.14.3
3.14.4
1
homeassistant/home-assistant:2023.12.48d000332b09b
aiohttp@3.9.1
3.14.4
1
homeassistant/home-assistant:2026.8.0a21689ef0510
aiohttp@3.14.3
3.14.4
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
aiohttp@3.13.5
3.14.4
1
iosifache/wazuh-manager-filebeat:latest85df3f04b5da
aiohttp@3.7.4
3.14.4
1
jertel/elastalert2:2.31.03cbf63f9b7dc
aiohttp@3.14.2
3.14.4
1
jupyterhub/k8s-hub:3.0.1-0.dev.git.6287.hbfb05cd65a0ceed1300a
aiohttp@3.8.5
3.14.4
1
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
aiohttp@3.13.5
3.14.4
1
kenchrcum/ansible-playbook-operator:0.1.712fb213debf1
aiohttp@3.13.5
3.14.4
1
kenchrcum/hetzner-s3-operator:0.1.384dae7aeea5b
aiohttp@3.13.5
3.14.4
1
kenchrcum/wasabi-s3-operator:0.2.7ce657c622ce5
aiohttp@3.13.5
3.14.4
1
knspar/phronetis-operator:0.1.60c4f0543ee58
aiohttp@3.12.13
3.14.4
1
langgenius/dify-api:1.0.0066035f93856
aiohttp@3.11.12
3.14.4
1
langgenius/dify-api:1.17.052be6088dd84
aiohttp@3.14.3
3.14.4
1
langgenius/dify-api:0.6.11fca918260dd6
aiohttp@3.9.5
3.14.4
1
litellm/litellm-non_root:v1.82.3-stable09b217802ded
aiohttp@3.13.3
3.14.4
1
loeken/home-assistant:2026.9.2b1dff5b4c593
aiohttp@3.14.3
3.14.4
1
lsstsqre/kafkaaggregator:masterbe1b21060854
aiohttp@3.7.4
3.14.4
1
lsstsqre/nublado2:2.0.1b75bf8aaafa4
aiohttp@3.8.1
3.14.4
1
lumutools/kubernetes-feeder:lateste35ffa90b129
aiohttp@3.14.3
3.14.4
1
makersquad/harp-proxy:0.8.1a40dd258c527
aiohttp@3.11.18
3.14.4
1

syft 1.42.1 · advisories as of 20 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.