StackRadar

CVE-2026-111064

High

Advisory

Published 19 Oct 2026In the index since 20 Oct 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
247
of 18,196 indexed, latest versions
Container images
242
deployed by those charts
Fix available
1 of 1
affected package

aiohttp server lacks an initial request/header timeout

Carried by container images the latest versions of 247 of 18,196 indexed charts deploy, on 242 images.

Affected packageAffected versionsFixed inImages
aiohttppypi3.4.4, 3.5.1, 3.5.4, 3.6.2+37 more3.14.4242
OSV records
GHSA-5wr8-gcqf-gqf3

Charts affected

247 by stars
ChartLatestAffected imagesRadar Score
csghubcsghubVerified publisher2.6.02 of 35See more

csghub csghub 2.6.0

2 of the 35 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
aiohttp@3.12.13
3.14.4
opencsghq/csgbot:v0.6.9-ee7d0271e26521
aiohttp@3.10.11
3.14.4

Open the chart page →

68,406
csgshipcsghubVerified publisher0.4.72 of 10See more

csgship csghub 0.4.7

2 of the 10 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opencsghq/csgship-agentic:v0.4.02cd29671a03e
aiohttp@3.12.15
3.14.4
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
aiohttp@3.12.15
3.14.4

Open the chart page →

14,769
wazuhcsic-charts0.1.01 of 4See more

wazuh csic-charts 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.4.121994f40e0da
aiohttp@3.8.1
3.14.4

Open the chart page →

16,260
jupyterhubd4nVerified publisher3.3.72 of 7See more

jupyterhub d4n 3.3.7

2 of the 7 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
aristidetm/basic-notebook:3.6.5469dbc951224
aiohttp@3.9.5
3.14.4
aristidetm/k8s-hub:3.3.7ccb516cb8474
aiohttp@3.9.3
3.14.4

Open the chart page →

20,252
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
aiohttp@3.8.5
3.14.4

Open the chart page →

7,598
dask-gatewaydask2026.3.01 of 2See more

dask-gateway dask 2026.3.0

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-gateway-server:2026.3.0afa5a729114e
aiohttp@3.13.4
3.14.4

Open the chart page →

2,893
datacubedatacube-charts0.18.21 of 1See more

datacube datacube-charts 0.18.2

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opendatacube/wms:latest1b90cdf68831
aiohttp@3.6.2
3.14.4

Open the chart page →

98,516
restcubedatacube-charts0.2.91 of 1See more

restcube datacube-charts 0.2.9

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opendatacube/restcube:latest91870111837c
aiohttp@3.6.2
3.14.4

Open the chart page →

95,046
datagrokdatagrok1.0.31 of 7See more

datagrok datagrok 1.0.3

1 of the 7 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
datagrok/grok_spawner:latestb990a4eb1d19
aiohttp@3.14.3
3.14.4

Open the chart page →

2,227
kube-web-viewdecayofmind0.0.41 of 1See more

kube-web-view decayofmind 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
hjacobs/kube-web-view:20.10.0b44a9cf81a2f
aiohttp@3.6.2
3.14.4

Open the chart page →

2,778
isponsorblocktvdefault-ghVerified publisher1.0.51 of 1See more

isponsorblocktv default-gh 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/dmunozv04/isponsorblocktv:v2.9.05b8cfa805cb6
aiohttp@3.13.5
3.14.4

Open the chart page →

851
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
aiohttp@3.10.10
3.14.4

Open the chart page →

11,228
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
aiohttp@3.10.10
3.14.4

Open the chart page →

11,228
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
aiohttp@3.11.12
3.14.4

Open the chart page →

57,643
dominodomino-iisasVerified publisher0.3.11 of 3See more

domino domino-iisas 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/iisas/domino-rest:latest3009350bfc11
aiohttp@3.12.15
3.14.4

Open the chart page →

12,227
esphomeegebackVerified publisher2.0.271 of 1See more

esphome egeback 2.0.27

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
esphome/esphome:2026.9.14ad55931c018
aiohttp@3.14.3
3.14.4

Open the chart page →

3,810
rommernail-romm1.0.11 of 1See more

romm ernail-romm 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
rommapp/romm:4.4.1b909e95d1aab
aiohttp@3.12.14
3.14.4

Open the chart page →

3,355
argocd-version-exporterevilmartians0.0.11 of 1See more

argocd-version-exporter evilmartians 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/evl.ms/argocd-exporter:0.0.136ea8f34aa6b
aiohttp@3.7.4.post0
3.14.4

Open the chart page →

2,540
huntingfactlyVerified publisher0.4.141 of 1See more

hunting factly 0.4.14

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
aiohttp@3.8.3
3.14.4

Open the chart page →

5,320
fauxgpufauxgpuVerified publisher0.2.41 of 4See more

fauxgpu fauxgpu 0.2.4

1 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/devops-dojo7/fauxgpu/api:0.2.428f706597c2f
aiohttp@3.14.3
3.14.4

Open the chart page →

4,061
activityrelayfedihost0.1.41 of 2See more

activityrelay fedihost 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
stratospire/activityrelay:0.2.3a4c34cb01117
aiohttp@3.8.3
3.14.4

Open the chart page →

16,277
flyteconnectorflyte2.0.01 of 1See more

flyteconnector flyte 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
aiohttp@3.13.5
3.14.4

Open the chart page →

4,307
demo-workflowsfrinx-helm-charts2.0.01 of 3See more

demo-workflows frinx-helm-charts 2.0.0

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
frinx/frinx-demo-workflows:6.1.0ee29588bd238
aiohttp@3.9.5
3.14.4

Open the chart page →

2,776
frinx-machinefrinx-helm-charts11.0.02 of 26See more

frinx-machine frinx-helm-charts 11.0.0

2 of the 26 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
frinx/device-induction:1.2.2a8fbdce554ad
aiohttp@3.10.5
3.14.4
frinx/topology-discovery:7.0.37832e3589dba
aiohttp@3.10.5
3.14.4

Open the chart page →

52,866
topology-discoveryfrinx-helm-charts4.0.01 of 2See more

topology-discovery frinx-helm-charts 4.0.0

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
frinx/topology-discovery:7.0.37832e3589dba
aiohttp@3.10.5
3.14.4

Open the chart page →

6,583
changedetection-iogabe565Verified publisher0.12.01 of 2See more

changedetection-io gabe565 0.12.0

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:latest34df3680db1c
aiohttp@3.14.3
3.14.4

Open the chart page →

3,051
esphomegabe565Verified publisher0.15.01 of 1See more

esphome gabe565 0.15.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:latest776a845d5089
aiohttp@3.14.3
3.14.4

Open the chart page →

3,810
tandoorgabe565Verified publisher0.9.91 of 2See more

tandoor gabe565 0.9.9

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
aiohttp@3.10.11
3.14.4

Open the chart page →

2,547
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
aiohttp@3.13.2
3.14.4

Open the chart page →

11,820
glassflow-etlglassflowVerified publisher0.5.211 of 16See more

glassflow-etl glassflow 0.5.21

1 of the 16 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/glassflow/glassflow-notifier:v1.0.3d1b0ce10b513
aiohttp@3.13.5
3.14.4

Open the chart page →

17,717
glpiglpi-chart0.1.11 of 3See more

glpi glpi-chart 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
vdiogov/glpi-conteiner:latest6945f84f0058
aiohttp@3.8.4
3.14.4

Open the chart page →

13,348
rag-apihajowielandVerified publisher1.0.01 of 1See more

rag-api hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat-rag-api-dev-lite:latesta62ce2221b43
aiohttp@3.14.3
3.14.4

Open the chart page →

1,496
resurrectbothalkeye0.1.51 of 1See more

resurrectbot halkeye 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
halkeye/slack-resurrect:v0.1.477b05e95fdb5
aiohttp@3.5.4
3.14.4

Open the chart page →

5,156
helixhelix1.4.31 of 2See more

helix helix 1.4.3

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
aiohttp@3.13.5
3.14.4

Open the chart page →

6,449
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
aiohttp@3.11.13
3.14.4

Open the chart page →

5,990
archiveboxhelmforgeVerified publisher1.1.151 of 1See more

archivebox helmforge 1.1.15

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
archivebox/archivebox:0.9.73d4720d86c0e9
aiohttp@3.14.3
3.14.4

Open the chart page →

6,459
chiefonboardinghelmforgeVerified publisher1.1.171 of 3See more

chiefonboarding helmforge 1.1.17

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
chiefonboarding/chiefonboarding:v2.5.0d0964135ea82
aiohttp@3.14.3
3.14.4

Open the chart page →

9,109
hermes-agenthelmforgeVerified publisher1.0.21 of 1See more

hermes-agent helmforge 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.9.24fca358f12efd
aiohttp@3.14.3
3.14.4

Open the chart page →

7,245
jupyterhubhelmforgeVerified publisher1.0.71 of 3See more

jupyterhub helmforge 1.0.7

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
aiohttp@3.13.5
3.14.4

Open the chart page →

6,250
langflowhelmforgeVerified publisher2.0.41 of 1See more

langflow helmforge 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
langflowai/langflow:1.12.6a0396e089eb9
aiohttp@3.14.3
3.14.4

Open the chart page →

144
medikeephelmforgeVerified publisher2.0.51 of 3See more

medikeep helmforge 2.0.5

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/afairgiant/medikeep:v0.72.09285e26f6d0d
aiohttp@3.14.3
3.14.4

Open the chart page →

6,501
paperless-ngxhelmforgeVerified publisher1.1.11 of 4See more

paperless-ngx helmforge 1.1.1

1 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
aiohttp@3.14.3
3.14.4

Open the chart page →

8,102
openaevhelm-openbasVerified publisher2.0.151 of 7See more

openaev helm-openbas 2.0.15

1 of the 7 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
aiohttp@3.10.8
3.14.4

Open the chart page →

21,829
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
aiohttp@3.10.8
3.14.4

Open the chart page →

26,662
hetzner-s3-operatorhetzner-s3-operatorVerified publisher0.1.31 of 1See more

hetzner-s3-operator hetzner-s3-operator 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
kenchrcum/hetzner-s3-operator:0.1.384dae7aeea5b
aiohttp@3.13.5
3.14.4

Open the chart page →

791
homeassistanthomeenterpriseinc0.3.01 of 1See more

homeassistant homeenterpriseinc 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2022.3.5565751f33794
aiohttp@3.8.1
3.14.4

Open the chart page →

9,167
paperlesshpVerified publisher0.1.21 of 5See more

paperless hp 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
aiohttp@3.14.3
3.14.4

Open the chart page →

36,286
ilum-apiilumVerified publisher6.7.31 of 1See more

ilum-api ilum 6.7.3

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ilum/api:6.7.3624fd09528c8
aiohttp@3.14.1
3.14.4

Open the chart page →

3,284
impulseimpulse1.1.11 of 1See more

impulse impulse 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/eslupmi/impulse:v3.7.1186a24030e82
aiohttp@3.13.5
3.14.4

Open the chart page →

1,321
guardrails-usvcinfracloud-chartsVerified publisher1.0.11 of 1See more

guardrails-usvc infracloud-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/guardrails-tgi:latestf68bec6a1271
aiohttp@3.11.11
3.14.4

Open the chart page →

5,623

Container images carrying it

242 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
aiohttp@3.13.5
3.14.4
1
ghcr.io/kubevoip/kubevoip:v0.6.841c603a93642
aiohttp@3.14.1
3.14.4
1
ghcr.io/lerentis/bitwarden-crd-operator:0.18.0912b19a7f09a
aiohttp@3.14.3
3.14.4
1
ghcr.io/liturgical-app/calendar-api:0.0.9688a685e2bde
aiohttp@3.12.15
3.14.4
1
ghcr.io/liturgical-app/liturgical-api:1.0.12637bdcebdd8d
aiohttp@3.13.4
3.14.4
1
ghcr.io/lsst-sqre/strimzi-registry-operator:0.6.07e25f7048aff
aiohttp@3.8.1
3.14.4
1
ghcr.io/microboxlabs/miot-harness:0.1.0d548e9ae4b84
aiohttp@3.14.1
3.14.4
1
ghcr.io/mlflow-oidc/mlflow-tracking-server:3.16.1-9.0.2-20261001970ba1cc1e69
aiohttp@3.14.3
3.14.4
1
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
aiohttp@3.13.2
3.14.4
1
ghcr.io/music-assistant/server:2.10.645fdb050e069
aiohttp@3.14.3
3.14.4
1
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
aiohttp@3.13.5
3.14.4
1
ghcr.io/nicholaswilde/odoo:version-14.07cff9672ce07
aiohttp@3.5.1
3.14.4
1
ghcr.io/nowakeai/svc-lb-mux:0.1.37d8fb8e996b6
aiohttp@3.13.5
3.14.4
1
ghcr.io/observal/observal-api:1.15.1e40d18a3a739
aiohttp@3.14.3
3.14.4
1
ghcr.io/open-telemetry/demo:3.1.0-mcp81db69cdd0b6
aiohttp@3.14.3
3.14.4
1
ghcr.io/open-telemetry/demo:3.1.0-agentd0f4ae0b32a8
aiohttp@3.14.3
3.14.4
1
ghcr.io/open-webui/terminals:latest6850ed976e7e
aiohttp@3.14.3
3.14.4
1
ghcr.io/open-webui/terminals-operator:latest5e1ceb6b3b26
aiohttp@3.14.3
3.14.4
1
ghcr.io/paperless-ngx/paperless-ngx:3.3.06b94799bc769
aiohttp@3.14.3
3.14.4
1
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
aiohttp@3.12.13
3.14.4
1
ghcr.io/runwhen-contrib/runwhen-local:0.12.4914e75d9f445
aiohttp@3.14.3
3.14.4
1
ghcr.io/serenita-org/vero:v0.8.3e5a7ec714acc
aiohttp@3.10.10
3.14.4
1
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
aiohttp@3.13.5
3.14.4
1
ghcr.io/smarter-project/audio-client:v3.1.23c8375dc5487
aiohttp@3.8.3
3.14.4
1
ghcr.io/smarter-project/image-detector:v2.5.31dcca70c6446
aiohttp@3.8.3
3.14.4
1
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
aiohttp@3.10.11
3.14.4
1
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
aiohttp@3.8.3
3.14.4
1
ghcr.io/unique-ag/ai/search-proxy:2026.42.32f87faa4af66
aiohttp@3.14.1
3.14.4
1
ghcr.io/vinny1892/octantis:latest45459c0910fc
aiohttp@3.13.3
3.14.4
1
ghcr.io/zoriya/kyoo_scanner:4.7.17dc0ee57b628
aiohttp@3.11.11
3.14.4
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
aiohttp@3.10.10
3.14.4
1
quay.io/clustersecret/clustersecret:0.0.14a9f835d1b241
aiohttp@3.11.11
3.14.4
1
quay.io/evl.ms/argocd-exporter:0.0.136ea8f34aa6b
aiohttp@3.7.4.post0
3.14.4
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
aiohttp@3.13.5
3.14.4
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
aiohttp@3.13.5
3.14.4
1
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
aiohttp@3.9.1
3.14.4
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
aiohttp@3.13.5
3.14.4
1
quay.io/maxiv/pieeat:0.9.3099715479210
aiohttp@3.13.5
3.14.4
1
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
aiohttp@3.8.1
3.14.4
1
quay.io/ocellusai/operator:v0.10.59ff01f642e2b
aiohttp@3.14.1
3.14.4
1
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
aiohttp@3.9.5
3.14.4
1
quay.io/stackgres/operator:1.19.37fdfd631a281
aiohttp@3.14.1
3.14.4
1

syft 1.42.1 · advisories as of 20 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.