StackRadar

CVE-2026-111064

High

Advisory

Published 19 Oct 2026In the index since 20 Oct 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
247
of 18,196 indexed, latest versions
Container images
242
deployed by those charts
Fix available
1 of 1
affected package

aiohttp server lacks an initial request/header timeout

Carried by container images the latest versions of 247 of 18,196 indexed charts deploy, on 242 images.

Affected packageAffected versionsFixed inImages
aiohttppypi3.4.4, 3.5.1, 3.5.4, 3.6.2+37 more3.14.4242
OSV records
GHSA-5wr8-gcqf-gqf3

Charts affected

247 by stars
ChartLatestAffected imagesRadar Score
imgtagrotationalVerified publisher0.2.01 of 1See more

imgtag rotational 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
aiohttp@3.11.13
3.14.4

Open the chart page →

3,829
agentdatarss30.1.01 of 1See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
aiohttp@3.11.13
3.14.4

Open the chart page →

4,047
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
aiohttp@3.11.13
3.14.4

Open the chart page →

6,119
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
aiohttp@3.13.5
3.14.4

Open the chart page →

9,625
tandoorrtomik-helm-chartsVerified publisher0.0.11 of 1See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
vabene1111/recipes:2.3.50f8d061895e9
aiohttp@3.12.15
3.14.4

Open the chart page →

5,141
runwhen-localrunwhen-contribVerified publisher0.7.31 of 3See more

runwhen-local runwhen-contrib 0.7.3

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/runwhen-contrib/runwhen-local:0.12.4914e75d9f445
aiohttp@3.14.3
3.14.4

Open the chart page →

4,500
safe-config-servicesafe-global0.1.01 of 3See more

safe-config-service safe-global 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
safeglobal/safe-config-service:latest09a5e495c219
aiohttp@3.13.5
3.14.4

Open the chart page →

2,101
safe-stacksafe-global0.1.02 of 9See more

safe-stack safe-global 0.1.0

2 of the 9 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
safeglobal/safe-config-service:latest09a5e495c219
aiohttp@3.13.5
3.14.4
safeglobal/safe-transaction-service:latest7b576c73f865
aiohttp@3.14.3
3.14.4

Open the chart page →

21,805
safe-transaction-servicesafe-global0.1.01 of 6See more

safe-transaction-service safe-global 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
safeglobal/safe-transaction-service:latest7b576c73f865
aiohttp@3.14.3
3.14.4

Open the chart page →

18,298
airflowsb-helm-charts0.3.01 of 1See more

airflow sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
apache/airflow:2.8.1e5560ad0b86e
aiohttp@3.9.1
3.14.4

Open the chart page →

11,986
scapyscapy-containerised0.3.41 of 2See more

scapy scapy-containerised 0.3.4

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
saidsef/scapy-containerised:v2025.02f17f7c435891
aiohttp@3.11.12
3.14.4

Open the chart page →

3,468
seafileschmitzis13.0.131 of 4See more

seafile schmitzis 13.0.13

1 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
schmitzis/monorepo:seafile-13.0-latestc583f1be2af2
aiohttp@3.14.3
3.14.4

Open the chart page →

46,309
search-proxysearch-proxy2026.42.31 of 1See more

search-proxy search-proxy 2026.42.3

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/unique-ag/ai/search-proxy:2026.42.32f87faa4af66
aiohttp@3.14.1
3.14.4

Open the chart page →

1,790
ansible-semaphoresergiotocaliniVerified publisher1.2.01 of 1See more

ansible-semaphore sergiotocalini 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
semaphoreui/semaphore:v2.9.645b50bc11833f
aiohttp@3.8.5
3.14.4

Open the chart page →

4,057
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
aiohttp@3.13.3
3.14.4

Open the chart page →

6,066
home-assistantsmall-hack2.1.01 of 1See more

home-assistant small-hack 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
aiohttp@3.13.3
3.14.4

Open the chart page →

5,379
srebotsrebot0.14.01 of 2See more

srebot srebot 0.14.0

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
aiohttp@3.13.5
3.14.4

Open the chart page →

1,857
servicexssl-hep1.8.61 of 16See more

servicex ssl-hep 1.8.6

1 of the 16 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
sslhep/servicex-did-finder:v1.8.6e15e68307d33
aiohttp@3.14.3
3.14.4

Open the chart page →

69,065
verostakewise0.8.31 of 2See more

vero stakewise 0.8.3

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/serenita-org/vero:v0.8.3e5a7ec714acc
aiohttp@3.10.10
3.14.4

Open the chart page →

3,884
verbasubstratusVerified publisher0.4.01 of 1See more

verba substratus 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
substratusai/verba:v0.4.0-baseURL261695be635eb
aiohttp@3.9.5
3.14.4

Open the chart page →

15,090
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
aiohttp@3.13.5
3.14.4

Open the chart page →

4,489
svc-lb-muxsvc-lb-mux0.1.31 of 1See more

svc-lb-mux svc-lb-mux 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/nowakeai/svc-lb-mux:0.1.37d8fb8e996b6
aiohttp@3.13.5
3.14.4

Open the chart page →

1,826
asrtest-opea1.0.01 of 1See more

asr test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/asr:1.025dd26d9cd09
aiohttp@3.10.5
3.14.4

Open the chart page →

4,883
chatqnatest-opea1.0.05 of 11See more

chatqna test-opea 1.0.0

5 of the 11 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/chatqna:1.038c51b791efa
aiohttp@3.10.5
3.14.4
opea/embedding-tei:1.05c9639de61c1
aiohttp@3.10.5
3.14.4
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.4
opea/reranking-tei:1.0e48613afb191
aiohttp@3.10.5
3.14.4
opea/retriever-redis:1.0eb746b263705
aiohttp@3.10.5
3.14.4

Open the chart page →

43,412
codegentest-opea1.0.02 of 5See more

codegen test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/codegen:1.058f91683892d
aiohttp@3.10.5
3.14.4
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.4

Open the chart page →

32,778
codetranstest-opea1.0.02 of 5See more

codetrans test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/codetrans:1.0e2436483b73d
aiohttp@3.10.5
3.14.4
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.4

Open the chart page →

32,302
docsumtest-opea1.0.02 of 5See more

docsum test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/docsum:1.03eaa91849512
aiohttp@3.10.5
3.14.4
opea/llm-docsum-tgi:1.002f9e8fa5d71
aiohttp@3.10.5
3.14.4

Open the chart page →

32,804
embedding-usvctest-opea1.0.01 of 1See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/embedding-tei:1.05c9639de61c1
aiohttp@3.10.5
3.14.4

Open the chart page →

5,746
guardrails-usvctest-opea1.0.01 of 1See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/guardrails-tgi:1.0262c6048aab8
aiohttp@3.10.5
3.14.4

Open the chart page →

5,781
llm-uservicetest-opea1.0.01 of 1See more

llm-uservice test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.4

Open the chart page →

5,248
reranking-usvctest-opea1.0.01 of 1See more

reranking-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/reranking-tei:1.0e48613afb191
aiohttp@3.10.5
3.14.4

Open the chart page →

5,538
retriever-usvctest-opea1.0.01 of 1See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/retriever-redis:1.0eb746b263705
aiohttp@3.10.5
3.14.4

Open the chart page →

5,754
speecht5test-opea1.0.01 of 1See more

speecht5 test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/speecht5:1.0249afad3d268
aiohttp@3.10.5
3.14.4

Open the chart page →

10,631
ttstest-opea1.0.01 of 1See more

tts test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/tts:1.0257ae94709e9
aiohttp@3.10.5
3.14.4

Open the chart page →

4,867
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
aiohttp@3.10.5
3.14.4

Open the chart page →

5,969
kasa-exporterth-chartsVerified publisher0.1.01 of 1See more

kasa-exporter th-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
thelande/kasa_exporter:v0.2.3a1fdb8baa152
aiohttp@3.9.5
3.14.4

Open the chart page →

1,607
traefik-external-dns-controllertraefik-external-dns-operator2.3.01 of 1See more

traefik-external-dns-controller traefik-external-dns-operator 2.3.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ybucci/traefik-external-dns-controller:2.3.0cc22a16fac81
aiohttp@3.14.3
3.14.4

Open the chart page →

1,509
traefik-external-dns-operatortraefik-external-dns-operator1.0.11 of 1See more

traefik-external-dns-operator traefik-external-dns-operator 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ybucci/traefik-external-dns-operator:1.0.0f1fcc7c8d9fd
aiohttp@3.11.14
3.14.4

Open the chart page →

1,395
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
aiohttp@3.8.1
3.14.4

Open the chart page →

10,143
nemo-guardrailsupstreamyardVerified publisher0.1.11 of 1See more

nemo-guardrails upstreamyard 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
upstreamyard/nemo-guardrails:0.24.19f673183cfc0
aiohttp@3.14.3
3.14.4

Open the chart page →

1,446
wasabi-s3-operatorwasabi-s3-operatorVerified publisher0.2.71 of 1See more

wasabi-s3-operator wasabi-s3-operator 0.2.7

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
kenchrcum/wasabi-s3-operator:0.2.7ce657c622ce5
aiohttp@3.13.5
3.14.4

Open the chart page →

791
wazuh-manager-filebeatwazuh-manager-filebeat0.1.0-gamma1 of 1See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
iosifache/wazuh-manager-filebeat:latest85df3f04b5da
aiohttp@3.7.4
3.14.4

Open the chart page →

13,099
dingtalk-botxxl-job-adminVerified publisher0.1.31 of 2See more

dingtalk-bot xxl-job-admin 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
dellnoantechnp/dingtalk-bot:v1.0.1034000bbcad5
aiohttp@3.13.2
3.14.4

Open the chart page →

3,909
sockpuppetbrowserzekker6Verified publisher0.1.01 of 1See more

sockpuppetbrowser zekker6 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
dgtlmoon/sockpuppetbrowser:latest1d8f72d2ce20
aiohttp@3.14.3
3.14.4

Open the chart page →

5,216
alertmanager-matrix-forwarderzloi-space1.0.11 of 2See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
aiohttp@3.8.1
3.14.4

Open the chart page →

3,636
grafana-matrix-forwarderzloi-space1.0.01 of 2See more

grafana-matrix-forwarder zloi-space 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
aiohttp@3.8.1
3.14.4

Open the chart page →

2,065
zoo-project-druzoo-projectOfficialVerified publisher0.10.91 of 6See more

zoo-project-dru zoo-project 0.10.9

1 of the 6 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-51e7d55383f24594959b69e58518961c6aa66740da112e8d03f1
aiohttp@3.14.3
3.14.4

Open the chart page →

7,358

Container images carrying it

242 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
clowder/clowder2-messages:2.0.0-beta.4bf146f1ca24f
aiohttp@3.11.10
3.14.4
1
codaprotocol/buildkite-exporter:0.2.137c68e67a401
aiohttp@3.7.3
3.14.4
1
crate/crate-operator:2.43.1ea396813f6f0
aiohttp@3.10.11
3.14.4
1
cznic/knot-resolver:v6.4.28a5b87ed1842
aiohttp@3.11.16
3.14.4
1
dagster/dagster-cloud-agent:1.13.26c9320c34f7ed
aiohttp@3.14.3
3.14.4
1
datagrok/grok_spawner:latestb990a4eb1d19
aiohttp@3.14.3
3.14.4
1
datamate/seafile-professional:11.0.202dd66b722464
aiohttp@3.12.15
3.14.4
1
deepflowce/deepflow-app:v6.2.6.5a1888d35e787
aiohttp@3.4.4
3.14.4
1
deepflowce/deepflow-app:v6.2.2aa9468ad4d96
aiohttp@3.4.4
3.14.4
1
dellnoantechnp/dingtalk-bot:v1.0.1034000bbcad5
aiohttp@3.13.2
3.14.4
1
devopstales/trivy-operator:2.575136aa7a26e
aiohttp@3.8.3
3.14.4
1
dgtlmoon/sockpuppetbrowser:latest1d8f72d2ce20
aiohttp@3.14.3
3.14.4
1
dserio83/velero-api:0.3.16b3d9115fee2
aiohttp@3.12.12
3.14.4
1
evk02/mlflow:2.2.1ef6ff257ef35
aiohttp@3.8.4
3.14.4
1
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
aiohttp@3.8.3
3.14.4
1
flag5/clustersecret:0.0.94ad5748bfcc6
aiohttp@3.8.1
3.14.4
1
frinx/device-induction:1.2.2a8fbdce554ad
aiohttp@3.10.5
3.14.4
1
frinx/frinx-demo-workflows:6.1.0ee29588bd238
aiohttp@3.9.5
3.14.4
1
galaxy/cloudman-server:lateste5c265fe9fcd
aiohttp@3.8.1
3.14.4
1
galaxy/pulsar-kubernetes:0.15.7e50a890e24c9
aiohttp@3.11.18
3.14.4
1
greenkube/greenkube:0.3.00c01932282a4
aiohttp@3.14.3
3.14.4
1
guillh/web3-prometheus-exporter:0.3.04fb99dbc32b2
aiohttp@3.10.3
3.14.4
1
halkeye/slack-resurrect:v0.1.477b05e95fdb5
aiohttp@3.5.4
3.14.4
1
hayk96/alerta-web:9.0.486377705e9e3
aiohttp@3.10.5
3.14.4
1
hhyo/archery:v1.9.11aa41843419e
aiohttp@3.8.3
3.14.4
1
hjacobs/kube-web-view:23.8.0431f1bf013d0
aiohttp@3.8.4
3.14.4
1
hjacobs/kube-web-view:20.10.0b44a9cf81a2f
aiohttp@3.6.2
3.14.4
1
homeassistant/home-assistant:2023.10.3021e2afc6e57
aiohttp@3.8.5
3.14.4
1
homeassistant/home-assistant:2022.3.5565751f33794
aiohttp@3.8.1
3.14.4
1
homeassistant/home-assistant:2026.75a531753cea9
aiohttp@3.14.3
3.14.4
1
homeassistant/home-assistant:2023.12.48d000332b09b
aiohttp@3.9.1
3.14.4
1
homeassistant/home-assistant:2026.8.0a21689ef0510
aiohttp@3.14.3
3.14.4
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
aiohttp@3.13.5
3.14.4
1
iosifache/wazuh-manager-filebeat:latest85df3f04b5da
aiohttp@3.7.4
3.14.4
1
jertel/elastalert2:2.31.03cbf63f9b7dc
aiohttp@3.14.2
3.14.4
1
jupyterhub/k8s-hub:3.0.1-0.dev.git.6287.hbfb05cd65a0ceed1300a
aiohttp@3.8.5
3.14.4
1
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
aiohttp@3.13.5
3.14.4
1
kenchrcum/ansible-playbook-operator:0.1.712fb213debf1
aiohttp@3.13.5
3.14.4
1
kenchrcum/hetzner-s3-operator:0.1.384dae7aeea5b
aiohttp@3.13.5
3.14.4
1
kenchrcum/wasabi-s3-operator:0.2.7ce657c622ce5
aiohttp@3.13.5
3.14.4
1
knspar/phronetis-operator:0.1.60c4f0543ee58
aiohttp@3.12.13
3.14.4
1
langgenius/dify-api:1.0.0066035f93856
aiohttp@3.11.12
3.14.4
1
langgenius/dify-api:1.17.052be6088dd84
aiohttp@3.14.3
3.14.4
1
langgenius/dify-api:0.6.11fca918260dd6
aiohttp@3.9.5
3.14.4
1
litellm/litellm-non_root:v1.82.3-stable09b217802ded
aiohttp@3.13.3
3.14.4
1
loeken/home-assistant:2026.9.2b1dff5b4c593
aiohttp@3.14.3
3.14.4
1
lsstsqre/kafkaaggregator:masterbe1b21060854
aiohttp@3.7.4
3.14.4
1
lsstsqre/nublado2:2.0.1b75bf8aaafa4
aiohttp@3.8.1
3.14.4
1
lumutools/kubernetes-feeder:lateste35ffa90b129
aiohttp@3.14.3
3.14.4
1
makersquad/harp-proxy:0.8.1a40dd258c527
aiohttp@3.11.18
3.14.4
1

syft 1.42.1 · advisories as of 20 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.