StackRadar

CVE-2026-111064

High

Advisory

Published 19 Oct 2026In the index since 20 Oct 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
247
of 18,196 indexed, latest versions
Container images
242
deployed by those charts
Fix available
1 of 1
affected package

aiohttp server lacks an initial request/header timeout

Carried by container images the latest versions of 247 of 18,196 indexed charts deploy, on 242 images.

Affected packageAffected versionsFixed inImages
aiohttppypi3.4.4, 3.5.1, 3.5.4, 3.6.2+37 more3.14.4242
OSV records
GHSA-5wr8-gcqf-gqf3

Charts affected

247 by stars
ChartLatestAffected imagesRadar Score
csghubcsghubVerified publisher2.6.02 of 35See more

csghub csghub 2.6.0

2 of the 35 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
aiohttp@3.12.13
3.14.4
opencsghq/csgbot:v0.6.9-ee7d0271e26521
aiohttp@3.10.11
3.14.4

Open the chart page →

68,406
csgshipcsghubVerified publisher0.4.72 of 10See more

csgship csghub 0.4.7

2 of the 10 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opencsghq/csgship-agentic:v0.4.02cd29671a03e
aiohttp@3.12.15
3.14.4
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
aiohttp@3.12.15
3.14.4

Open the chart page →

14,769
wazuhcsic-charts0.1.01 of 4See more

wazuh csic-charts 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.4.121994f40e0da
aiohttp@3.8.1
3.14.4

Open the chart page →

16,260
jupyterhubd4nVerified publisher3.3.72 of 7See more

jupyterhub d4n 3.3.7

2 of the 7 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
aristidetm/basic-notebook:3.6.5469dbc951224
aiohttp@3.9.5
3.14.4
aristidetm/k8s-hub:3.3.7ccb516cb8474
aiohttp@3.9.3
3.14.4

Open the chart page →

20,252
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
aiohttp@3.8.5
3.14.4

Open the chart page →

7,598
dask-gatewaydask2026.3.01 of 2See more

dask-gateway dask 2026.3.0

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-gateway-server:2026.3.0afa5a729114e
aiohttp@3.13.4
3.14.4

Open the chart page →

2,893
datacubedatacube-charts0.18.21 of 1See more

datacube datacube-charts 0.18.2

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opendatacube/wms:latest1b90cdf68831
aiohttp@3.6.2
3.14.4

Open the chart page →

98,516
restcubedatacube-charts0.2.91 of 1See more

restcube datacube-charts 0.2.9

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opendatacube/restcube:latest91870111837c
aiohttp@3.6.2
3.14.4

Open the chart page →

95,046
datagrokdatagrok1.0.31 of 7See more

datagrok datagrok 1.0.3

1 of the 7 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
datagrok/grok_spawner:latestb990a4eb1d19
aiohttp@3.14.3
3.14.4

Open the chart page →

2,227
kube-web-viewdecayofmind0.0.41 of 1See more

kube-web-view decayofmind 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
hjacobs/kube-web-view:20.10.0b44a9cf81a2f
aiohttp@3.6.2
3.14.4

Open the chart page →

2,778
isponsorblocktvdefault-ghVerified publisher1.0.51 of 1See more

isponsorblocktv default-gh 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/dmunozv04/isponsorblocktv:v2.9.05b8cfa805cb6
aiohttp@3.13.5
3.14.4

Open the chart page →

851
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
aiohttp@3.10.10
3.14.4

Open the chart page →

11,228
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
aiohttp@3.10.10
3.14.4

Open the chart page →

11,228
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
aiohttp@3.11.12
3.14.4

Open the chart page →

57,643
dominodomino-iisasVerified publisher0.3.11 of 3See more

domino domino-iisas 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/iisas/domino-rest:latest3009350bfc11
aiohttp@3.12.15
3.14.4

Open the chart page →

12,227
esphomeegebackVerified publisher2.0.271 of 1See more

esphome egeback 2.0.27

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
esphome/esphome:2026.9.14ad55931c018
aiohttp@3.14.3
3.14.4

Open the chart page →

3,810
rommernail-romm1.0.11 of 1See more

romm ernail-romm 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
rommapp/romm:4.4.1b909e95d1aab
aiohttp@3.12.14
3.14.4

Open the chart page →

3,355
argocd-version-exporterevilmartians0.0.11 of 1See more

argocd-version-exporter evilmartians 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/evl.ms/argocd-exporter:0.0.136ea8f34aa6b
aiohttp@3.7.4.post0
3.14.4

Open the chart page →

2,540
huntingfactlyVerified publisher0.4.141 of 1See more

hunting factly 0.4.14

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
aiohttp@3.8.3
3.14.4

Open the chart page →

5,320
fauxgpufauxgpuVerified publisher0.2.41 of 4See more

fauxgpu fauxgpu 0.2.4

1 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/devops-dojo7/fauxgpu/api:0.2.428f706597c2f
aiohttp@3.14.3
3.14.4

Open the chart page →

4,061
activityrelayfedihost0.1.41 of 2See more

activityrelay fedihost 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
stratospire/activityrelay:0.2.3a4c34cb01117
aiohttp@3.8.3
3.14.4

Open the chart page →

16,277
flyteconnectorflyte2.0.01 of 1See more

flyteconnector flyte 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
aiohttp@3.13.5
3.14.4

Open the chart page →

4,307
demo-workflowsfrinx-helm-charts2.0.01 of 3See more

demo-workflows frinx-helm-charts 2.0.0

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
frinx/frinx-demo-workflows:6.1.0ee29588bd238
aiohttp@3.9.5
3.14.4

Open the chart page →

2,776
frinx-machinefrinx-helm-charts11.0.02 of 26See more

frinx-machine frinx-helm-charts 11.0.0

2 of the 26 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
frinx/device-induction:1.2.2a8fbdce554ad
aiohttp@3.10.5
3.14.4
frinx/topology-discovery:7.0.37832e3589dba
aiohttp@3.10.5
3.14.4

Open the chart page →

52,866
topology-discoveryfrinx-helm-charts4.0.01 of 2See more

topology-discovery frinx-helm-charts 4.0.0

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
frinx/topology-discovery:7.0.37832e3589dba
aiohttp@3.10.5
3.14.4

Open the chart page →

6,583
changedetection-iogabe565Verified publisher0.12.01 of 2See more

changedetection-io gabe565 0.12.0

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:latest34df3680db1c
aiohttp@3.14.3
3.14.4

Open the chart page →

3,051
esphomegabe565Verified publisher0.15.01 of 1See more

esphome gabe565 0.15.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:latest776a845d5089
aiohttp@3.14.3
3.14.4

Open the chart page →

3,810
tandoorgabe565Verified publisher0.9.91 of 2See more

tandoor gabe565 0.9.9

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
aiohttp@3.10.11
3.14.4

Open the chart page →

2,547
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
aiohttp@3.13.2
3.14.4

Open the chart page →

11,820
glassflow-etlglassflowVerified publisher0.5.211 of 16See more

glassflow-etl glassflow 0.5.21

1 of the 16 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/glassflow/glassflow-notifier:v1.0.3d1b0ce10b513
aiohttp@3.13.5
3.14.4

Open the chart page →

17,717
glpiglpi-chart0.1.11 of 3See more

glpi glpi-chart 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
vdiogov/glpi-conteiner:latest6945f84f0058
aiohttp@3.8.4
3.14.4

Open the chart page →

13,348
rag-apihajowielandVerified publisher1.0.01 of 1See more

rag-api hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat-rag-api-dev-lite:latesta62ce2221b43
aiohttp@3.14.3
3.14.4

Open the chart page →

1,496
resurrectbothalkeye0.1.51 of 1See more

resurrectbot halkeye 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
halkeye/slack-resurrect:v0.1.477b05e95fdb5
aiohttp@3.5.4
3.14.4

Open the chart page →

5,156
helixhelix1.4.31 of 2See more

helix helix 1.4.3

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
aiohttp@3.13.5
3.14.4

Open the chart page →

6,449
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
aiohttp@3.11.13
3.14.4

Open the chart page →

5,990
archiveboxhelmforgeVerified publisher1.1.151 of 1See more

archivebox helmforge 1.1.15

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
archivebox/archivebox:0.9.73d4720d86c0e9
aiohttp@3.14.3
3.14.4

Open the chart page →

6,459
chiefonboardinghelmforgeVerified publisher1.1.171 of 3See more

chiefonboarding helmforge 1.1.17

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
chiefonboarding/chiefonboarding:v2.5.0d0964135ea82
aiohttp@3.14.3
3.14.4

Open the chart page →

9,109
hermes-agenthelmforgeVerified publisher1.0.21 of 1See more

hermes-agent helmforge 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.9.24fca358f12efd
aiohttp@3.14.3
3.14.4

Open the chart page →

7,245
jupyterhubhelmforgeVerified publisher1.0.71 of 3See more

jupyterhub helmforge 1.0.7

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
aiohttp@3.13.5
3.14.4

Open the chart page →

6,250
langflowhelmforgeVerified publisher2.0.41 of 1See more

langflow helmforge 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
langflowai/langflow:1.12.6a0396e089eb9
aiohttp@3.14.3
3.14.4

Open the chart page →

144
medikeephelmforgeVerified publisher2.0.51 of 3See more

medikeep helmforge 2.0.5

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/afairgiant/medikeep:v0.72.09285e26f6d0d
aiohttp@3.14.3
3.14.4

Open the chart page →

6,501
paperless-ngxhelmforgeVerified publisher1.1.11 of 4See more

paperless-ngx helmforge 1.1.1

1 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
aiohttp@3.14.3
3.14.4

Open the chart page →

8,102
openaevhelm-openbasVerified publisher2.0.151 of 7See more

openaev helm-openbas 2.0.15

1 of the 7 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
aiohttp@3.10.8
3.14.4

Open the chart page →

21,829
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
aiohttp@3.10.8
3.14.4

Open the chart page →

26,662
hetzner-s3-operatorhetzner-s3-operatorVerified publisher0.1.31 of 1See more

hetzner-s3-operator hetzner-s3-operator 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
kenchrcum/hetzner-s3-operator:0.1.384dae7aeea5b
aiohttp@3.13.5
3.14.4

Open the chart page →

791
homeassistanthomeenterpriseinc0.3.01 of 1See more

homeassistant homeenterpriseinc 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2022.3.5565751f33794
aiohttp@3.8.1
3.14.4

Open the chart page →

9,167
paperlesshpVerified publisher0.1.21 of 5See more

paperless hp 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
aiohttp@3.14.3
3.14.4

Open the chart page →

36,286
ilum-apiilumVerified publisher6.7.31 of 1See more

ilum-api ilum 6.7.3

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ilum/api:6.7.3624fd09528c8
aiohttp@3.14.1
3.14.4

Open the chart page →

3,284
impulseimpulse1.1.11 of 1See more

impulse impulse 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/eslupmi/impulse:v3.7.1186a24030e82
aiohttp@3.13.5
3.14.4

Open the chart page →

1,321
guardrails-usvcinfracloud-chartsVerified publisher1.0.11 of 1See more

guardrails-usvc infracloud-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/guardrails-tgi:latestf68bec6a1271
aiohttp@3.11.11
3.14.4

Open the chart page →

5,623

Container images carrying it

242 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
aiohttp@3.14.3
3.14.4
5
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.4
4
langflowai/langflow:1.12.6:latesta0396e089eb9
aiohttp@3.14.3
3.14.4
3
quay.io/devtron/ai-agent:0.0.16545dac92173
aiohttp@3.10.10
3.14.4
3
esphome/esphome:2026.9.14ad55931c018
aiohttp@3.14.3
3.14.4
2
frinx/topology-discovery:7.0.37832e3589dba
aiohttp@3.10.5
3.14.4
2
ilum/api:6.7.3624fd09528c8
aiohttp@3.14.1
3.14.4
2
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
aiohttp@3.8.1
3.14.4
2
nacos/nacos-server:latest1c191c30c8cd
aiohttp@3.14.3
3.14.4
2
opea/embedding-tei:1.05c9639de61c1
aiohttp@3.10.5
3.14.4
2
opea/reranking-tei:1.0e48613afb191
aiohttp@3.10.5
3.14.4
2
opea/retriever-redis:1.0eb746b263705
aiohttp@3.10.5
3.14.4
2
openbas/caldera-server:5.1.0a277796d9724
aiohttp@3.10.8
3.14.4
2
polyaxon/polyaxon-agent:2.17.0da877a2647fc
aiohttp@3.14.3
3.14.4
2
polyaxon/polyaxon-cli:2.17.0297ed47ed63a
aiohttp@3.14.3
3.14.4
2
safeglobal/safe-config-service:latest09a5e495c219
aiohttp@3.13.5
3.14.4
2
safeglobal/safe-transaction-service:latest7b576c73f865
aiohttp@3.14.3
3.14.4
2
vdiogov/glpi-conteiner:latest6945f84f0058
aiohttp@3.8.4
3.14.4
2
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
aiohttp@3.13.5
3.14.4
2
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
aiohttp@3.14.3
3.14.4
2
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
aiohttp@3.14.3
3.14.4
2
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
aiohttp@3.11.13
3.14.4
2
ghcr.io/xeor/karb:1.0.6:main647a3c938d31
aiohttp@3.13.3
3.14.4
2
acockburn/appdaemon:4.0.83a93281d7e94
aiohttp@3.7.4
3.14.4
1
acryldata/datahub-actions:v1.7.0.1c5fd70130157
aiohttp@3.14.3
3.14.4
1
agentarea/agentarea-api:latestde166c910ef9
aiohttp@3.14.3
3.14.4
1
agentarea/agentarea-worker:latestadb761a4d103
aiohttp@3.14.3
3.14.4
1
alerta/alerta-web:8.5.04786b9eaa606
aiohttp@3.8.0
3.14.4
1
apache/airflow:2.8.4-python3.964e58748b6b9
aiohttp@3.9.3
3.14.4
1
apache/airflow:2.10.2-python3.9ce90bdc3d2af
aiohttp@3.10.5
3.14.4
1
apache/airflow:2.8.1e5560ad0b86e
aiohttp@3.9.1
3.14.4
1
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
aiohttp@3.7.4
3.14.4
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
aiohttp@3.11.16
3.14.4
1
archivebox/archivebox:0.9.73d4720d86c0e9
aiohttp@3.14.3
3.14.4
1
aristidetm/basic-notebook:3.6.5469dbc951224
aiohttp@3.9.5
3.14.4
1
aristidetm/k8s-hub:3.3.7ccb516cb8474
aiohttp@3.9.3
3.14.4
1
assistiot/cybersecurity-monitoring_id-wzh:latest0aacefac9677
aiohttp@3.7.4
3.14.4
1
assistiot/smart-orchestrator_mcs:latest7d6a0d534c7f
aiohttp@3.9.3
3.14.4
1
baserow/backend:1.31.1e0b3c8130b91
aiohttp@3.9.5
3.14.4
1
baserow/baserow:1.30.1df0c42eb67e8
aiohttp@3.9.5
3.14.4
1
bcgovimages/aries-cloudagent:py36-1.16-1_0.7.4faa2e2d21916
aiohttp@3.8.1
3.14.4
1
berkeleyskypilot/skypilot:0.14.125577df35586
aiohttp@3.14.3
3.14.4
1
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
aiohttp@3.13.2
3.14.4
1
burakince/mlflow:3.16.0ab4b566644b9
aiohttp@3.14.3
3.14.4
1
byjg/easy-haproxy:6.1.1230fdb7b00ae
aiohttp@3.14.1
3.14.4
1
checkmk/check-mk-community:2.5.0p6c11b422210c4
aiohttp@3.13.5
3.14.4
1
chiefonboarding/chiefonboarding:v2.5.0d0964135ea82
aiohttp@3.14.3
3.14.4
1
ciuse99/suggestarr:v1.0.20d72768245ef5
aiohttp@3.11.12
3.14.4
1
clowder/clowder2-backend:2.0.0-beta.411f3d844e4c0
aiohttp@3.11.10
3.14.4
1
clowder/clowder2-heartbeat:2.0.0-beta.414155326c7b9
aiohttp@3.11.10
3.14.4
1

syft 1.42.1 · advisories as of 20 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.