StackRadar

CVE-2026-111064

High

Advisory

Published 19 Oct 2026In the index since 20 Oct 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
247
of 18,196 indexed, latest versions
Container images
242
deployed by those charts
Fix available
1 of 1
affected package

aiohttp server lacks an initial request/header timeout

Carried by container images the latest versions of 247 of 18,196 indexed charts deploy, on 242 images.

Affected packageAffected versionsFixed inImages
aiohttppypi3.4.4, 3.5.1, 3.5.4, 3.6.2+37 more3.14.4242
OSV records
GHSA-5wr8-gcqf-gqf3

Charts affected

247 by stars
ChartLatestAffected imagesRadar Score
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
aiohttp@3.13.5
3.14.4

Open the chart page →

21,634
shynetjuniorjpdj0.1.331 of 1See more

shynet juniorjpdj 0.1.33

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
milesmcc/shynet:v0.13.1ba54f7797a6b
aiohttp@3.8.1
3.14.4

Open the chart page →

2,890
jupyterhub-chartk8s-jupyterhub0.1.01 of 1See more

jupyterhub-chart k8s-jupyterhub 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
truebyteinnovationllp/jupyterhub-k8s:5.5.06bf978b96279
aiohttp@3.14.1
3.14.4

Open the chart page →

1,928
authentikkagiso-me0.1.11 of 1See more

authentik kagiso-me 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
aiohttp@3.13.3
3.14.4

Open the chart page →

5,780
karbkarbVerified publisher1.0.31 of 1See more

karb karb 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/xeor/karb:main647a3c938d31
aiohttp@3.13.3
3.14.4

Open the chart page →

748
karb-chartkarbVerified publisher1.0.61 of 1See more

karb-chart karb 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/xeor/karb:1.0.6647a3c938d31
aiohttp@3.13.3
3.14.4

Open the chart page →

748
music-assistantkarljorgensen0.1.31 of 1See more

music-assistant karljorgensen 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
aiohttp@3.13.5
3.14.4

Open the chart page →

8,721
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
aiohttp@3.8.5
3.14.4

Open the chart page →

7,867
crate-operatorkrateo2.43.11 of 1See more

crate-operator krateo 2.43.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
crate/crate-operator:2.43.1ea396813f6f0
aiohttp@3.10.11
3.14.4

Open the chart page →

3,306
mindsdbkronkltdVerified publisher0.1.01 of 1See more

mindsdb kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
mindsdb/mindsdb:latest163011c09299
aiohttp@3.13.5
3.14.4

Open the chart page →

12,411
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
aiohttp@3.11.16
3.14.4

Open the chart page →

9,665
jupyterhubkubeblocksVerified publisher0.1.01 of 7See more

jupyterhub kubeblocks 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
jupyterhub/k8s-hub:3.0.1-0.dev.git.6287.hbfb05cd65a0ceed1300a
aiohttp@3.8.5
3.14.4

Open the chart page →

9,860
kubernetes-feedskubernetes-feeds0.1.11 of 3See more

kubernetes-feeds kubernetes-feeds 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
lumutools/kubernetes-feeder:lateste35ffa90b129
aiohttp@3.14.3
3.14.4

Open the chart page →

1,235
deepflowkubesphere-stable6.2.6061 of 8See more

deepflow kubesphere-stable 6.2.606

1 of the 8 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
deepflowce/deepflow-app:v6.2.6.5a1888d35e787
aiohttp@3.4.4
3.14.4

Open the chart page →

24,125
kubevoipkubevoipOfficialVerified publisher0.6.81 of 1See more

kubevoip kubevoip 0.6.8

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/kubevoip/kubevoip:v0.6.841c603a93642
aiohttp@3.14.1
3.14.4

Open the chart page →

1,451
legendlegend0.1.21 of 1See more

legend legend 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/grofers/legend:0.1d6e901ad0ebd
aiohttp@3.7.1
3.14.4

Open the chart page →

5,631
calendar-apiliturgical0.1.51 of 1See more

calendar-api liturgical 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/liturgical-app/calendar-api:0.0.9688a685e2bde
aiohttp@3.12.15
3.14.4

Open the chart page →

1,703
liturgical-apiliturgical0.2.111 of 1See more

liturgical-api liturgical 0.2.11

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/liturgical-app/liturgical-api:1.0.12637bdcebdd8d
aiohttp@3.13.4
3.14.4

Open the chart page →

1,149
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
aiohttp@3.14.3
3.14.4

Open the chart page →

3,724
kafka-aggregatorlsst-sqre0.1.21 of 1See more

kafka-aggregator lsst-sqre 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
lsstsqre/kafkaaggregator:masterbe1b21060854
aiohttp@3.7.4
3.14.4

Open the chart page →

4,267
nublado2lsst-sqre0.8.51 of 2See more

nublado2 lsst-sqre 0.8.5

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
lsstsqre/nublado2:2.0.1b75bf8aaafa4
aiohttp@3.8.1
3.14.4

Open the chart page →

93,162
miot-harnessmicroboxlabs0.8.01 of 1See more

miot-harness microboxlabs 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/microboxlabs/miot-harness:0.1.0d548e9ae4b84
aiohttp@3.14.1
3.14.4

Open the chart page →

1,649
servicesmicroslacVerified publisher0.4.01 of 8See more

services microslac 0.4.0

1 of the 8 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
microslac/chat:latest417317e4e4e8
aiohttp@3.9.3
3.14.4

Open the chart page →

34,721
buildkite-exporterminaVerified publisher0.1.41 of 1See more

buildkite-exporter mina 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
codaprotocol/buildkite-exporter:0.2.137c68e67a401
aiohttp@3.7.3
3.14.4

Open the chart page →

3,374
mum-discord-botmum-discord-botVerified publisher0.3.71 of 1See more

mum-discord-bot mum-discord-bot 0.3.7

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/drewburr-labs/mum-discord-bot:3.1.26e82914e1051
aiohttp@3.9.1
3.14.4

Open the chart page →

15,336
mlflowncsaVerified publisher1.2.11 of 4See more

mlflow ncsa 1.2.1

1 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
evk02/mlflow:2.2.1ef6ff257ef35
aiohttp@3.8.4
3.14.4

Open the chart page →

6,436
esphome-device-buildernewbenji-chartsVerified publisher0.1.11 of 1See more

esphome-device-builder newbenji-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.7.4e636269c6390
aiohttp@3.14.3
3.14.4

Open the chart page →

3,862
home-assistantnewbenji-chartsVerified publisher0.7.21 of 1See more

home-assistant newbenji-charts 0.7.2

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.8.0a21689ef0510
aiohttp@3.14.3
3.14.4

Open the chart page →

3,469
music-assistantnewbenji-chartsVerified publisher0.1.01 of 1See more

music-assistant newbenji-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.645fdb050e069
aiohttp@3.14.3
3.14.4

Open the chart page →

4,956
object-clonerobject-clonerVerified publisher2.0.01 of 1See more

object-cloner object-cloner 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/ideamixes/object-cloner:2.0.031030fd2f192
aiohttp@3.8.5
3.14.4

Open the chart page →

1,659
ocellusaiocellusaiVerified publisher0.1.121 of 2See more

ocellusai ocellusai 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/ocellusai/operator:v0.10.59ff01f642e2b
aiohttp@3.14.1
3.14.4

Open the chart page →

1,746
octantisoctantis0.1.01 of 1See more

octantis octantis 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/vinny1892/octantis:latest45459c0910fc
aiohttp@3.13.3
3.14.4

Open the chart page →

3,114
paperless-ngxoli-the-devVerified publisher1.3.21 of 1See more

paperless-ngx oli-the-dev 1.3.2

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
aiohttp@3.14.3
3.14.4

Open the chart page →

5,530
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
onyxdotapp/onyx-backend:latest92b8fab500f9
aiohttp@3.14.3
3.14.4

Open the chart page →

8,985
chatbot-ai-sampleopenshift0.1.61 of 4See more

chatbot-ai-sample openshift 0.1.6

1 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
aiohttp@3.9.5
3.14.4

Open the chart page →

21,507
terminalsopen-webui0.7.02 of 2See more

terminals open-webui 0.7.0

2 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/open-webui/terminals:latest6850ed976e7e
aiohttp@3.14.3
3.14.4
ghcr.io/open-webui/terminals-operator:latest5e1ceb6b3b26
aiohttp@3.14.3
3.14.4

Open the chart page →

2,335
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
aiohttp@3.13.2
3.14.4

Open the chart page →

6,312
email-managerphntom0.1.221 of 2See more

email-manager phntom 0.1.22

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
phntom/email-manager:0.1.22d8e2a9f2f085
aiohttp@3.8.4
3.14.4

Open the chart page →

3,564
phronetisphronetis0.1.271 of 2See more

phronetis phronetis 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
knspar/phronetis-operator:0.1.60c4f0543ee58
aiohttp@3.12.13
3.14.4

Open the chart page →

18,498
pieeatpieeatOfficialVerified publisher0.9.31 of 1See more

pieeat pieeat 0.9.3

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/maxiv/pieeat:0.9.3099715479210
aiohttp@3.13.5
3.14.4

Open the chart page →

1,787
agentpolyaxon2.17.03 of 4See more

agent polyaxon 2.17.0

3 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
polyaxon/polyaxon-agent:2.17.0da877a2647fc
aiohttp@3.14.3
3.14.4
polyaxon/polyaxon-cli:2.17.0297ed47ed63a
aiohttp@3.14.3
3.14.4
polyaxon/polyaxon-streams:2.17.0a5fec70e757b
aiohttp@3.14.3
3.14.4

Open the chart page →

10,881
polyaxonpolyaxon2.17.03 of 5See more

polyaxon polyaxon 2.17.0

3 of the 5 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
polyaxon/polyaxon-agent:2.17.0da877a2647fc
aiohttp@3.14.3
3.14.4
polyaxon/polyaxon-api:2.17.0163707082036
aiohttp@3.14.3
3.14.4
polyaxon/polyaxon-cli:2.17.0297ed47ed63a
aiohttp@3.14.3
3.14.4

Open the chart page →

14,949
prowlerprowler0.1.11 of 1See more

prowler prowler 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
toniblyx/prowler:stable9dbcc3c9abd7
aiohttp@3.14.3
3.14.4

Open the chart page →

2,317
qubivaqubiva0.3.21 of 3See more

qubiva qubiva 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
aiohttp@3.12.13
3.14.4

Open the chart page →

8,436
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
aiohttp@3.10.5
3.14.4

Open the chart page →

24,366
radar-kafkaradar-baseVerified publisher0.4.11 of 2See more

radar-kafka radar-base 0.4.1

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/lsst-sqre/strimzi-registry-operator:0.6.07e25f7048aff
aiohttp@3.8.1
3.14.4

Open the chart page →

5,084
rawfile-localpvrawfile0.15.31 of 6See more

rawfile-localpv rawfile 0.15.3

1 of the 6 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
openebs/rawfile-localpv:v0.15.396fd7987ea79
aiohttp@3.14.3
3.14.4

Open the chart page →

4,918
kube-web-viewrlex0.5.01 of 1See more

kube-web-view rlex 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
hjacobs/kube-web-view:23.8.0431f1bf013d0
aiohttp@3.8.4
3.14.4

Open the chart page →

5,410
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
aiohttp@3.10.10
3.14.4

Open the chart page →

11,228
rommromm-helm-chartVerified publisher1.5.51 of 3See more

romm romm-helm-chart 1.5.5

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
rommapp/romm:5.2.03512f2ca4557
aiohttp@3.14.3
3.14.4

Open the chart page →

4,015

Container images carrying it

242 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
aiohttp@3.14.3
3.14.4
5
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.4
4
langflowai/langflow:1.12.6:latesta0396e089eb9
aiohttp@3.14.3
3.14.4
3
quay.io/devtron/ai-agent:0.0.16545dac92173
aiohttp@3.10.10
3.14.4
3
esphome/esphome:2026.9.14ad55931c018
aiohttp@3.14.3
3.14.4
2
frinx/topology-discovery:7.0.37832e3589dba
aiohttp@3.10.5
3.14.4
2
ilum/api:6.7.3624fd09528c8
aiohttp@3.14.1
3.14.4
2
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
aiohttp@3.8.1
3.14.4
2
nacos/nacos-server:latest1c191c30c8cd
aiohttp@3.14.3
3.14.4
2
opea/embedding-tei:1.05c9639de61c1
aiohttp@3.10.5
3.14.4
2
opea/reranking-tei:1.0e48613afb191
aiohttp@3.10.5
3.14.4
2
opea/retriever-redis:1.0eb746b263705
aiohttp@3.10.5
3.14.4
2
openbas/caldera-server:5.1.0a277796d9724
aiohttp@3.10.8
3.14.4
2
polyaxon/polyaxon-agent:2.17.0da877a2647fc
aiohttp@3.14.3
3.14.4
2
polyaxon/polyaxon-cli:2.17.0297ed47ed63a
aiohttp@3.14.3
3.14.4
2
safeglobal/safe-config-service:latest09a5e495c219
aiohttp@3.13.5
3.14.4
2
safeglobal/safe-transaction-service:latest7b576c73f865
aiohttp@3.14.3
3.14.4
2
vdiogov/glpi-conteiner:latest6945f84f0058
aiohttp@3.8.4
3.14.4
2
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
aiohttp@3.13.5
3.14.4
2
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
aiohttp@3.14.3
3.14.4
2
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
aiohttp@3.14.3
3.14.4
2
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
aiohttp@3.11.13
3.14.4
2
ghcr.io/xeor/karb:1.0.6:main647a3c938d31
aiohttp@3.13.3
3.14.4
2
acockburn/appdaemon:4.0.83a93281d7e94
aiohttp@3.7.4
3.14.4
1
acryldata/datahub-actions:v1.7.0.1c5fd70130157
aiohttp@3.14.3
3.14.4
1
agentarea/agentarea-api:latestde166c910ef9
aiohttp@3.14.3
3.14.4
1
agentarea/agentarea-worker:latestadb761a4d103
aiohttp@3.14.3
3.14.4
1
alerta/alerta-web:8.5.04786b9eaa606
aiohttp@3.8.0
3.14.4
1
apache/airflow:2.8.4-python3.964e58748b6b9
aiohttp@3.9.3
3.14.4
1
apache/airflow:2.10.2-python3.9ce90bdc3d2af
aiohttp@3.10.5
3.14.4
1
apache/airflow:2.8.1e5560ad0b86e
aiohttp@3.9.1
3.14.4
1
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
aiohttp@3.7.4
3.14.4
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
aiohttp@3.11.16
3.14.4
1
archivebox/archivebox:0.9.73d4720d86c0e9
aiohttp@3.14.3
3.14.4
1
aristidetm/basic-notebook:3.6.5469dbc951224
aiohttp@3.9.5
3.14.4
1
aristidetm/k8s-hub:3.3.7ccb516cb8474
aiohttp@3.9.3
3.14.4
1
assistiot/cybersecurity-monitoring_id-wzh:latest0aacefac9677
aiohttp@3.7.4
3.14.4
1
assistiot/smart-orchestrator_mcs:latest7d6a0d534c7f
aiohttp@3.9.3
3.14.4
1
baserow/backend:1.31.1e0b3c8130b91
aiohttp@3.9.5
3.14.4
1
baserow/baserow:1.30.1df0c42eb67e8
aiohttp@3.9.5
3.14.4
1
bcgovimages/aries-cloudagent:py36-1.16-1_0.7.4faa2e2d21916
aiohttp@3.8.1
3.14.4
1
berkeleyskypilot/skypilot:0.14.125577df35586
aiohttp@3.14.3
3.14.4
1
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
aiohttp@3.13.2
3.14.4
1
burakince/mlflow:3.16.0ab4b566644b9
aiohttp@3.14.3
3.14.4
1
byjg/easy-haproxy:6.1.1230fdb7b00ae
aiohttp@3.14.1
3.14.4
1
checkmk/check-mk-community:2.5.0p6c11b422210c4
aiohttp@3.13.5
3.14.4
1
chiefonboarding/chiefonboarding:v2.5.0d0964135ea82
aiohttp@3.14.3
3.14.4
1
ciuse99/suggestarr:v1.0.20d72768245ef5
aiohttp@3.11.12
3.14.4
1
clowder/clowder2-backend:2.0.0-beta.411f3d844e4c0
aiohttp@3.11.10
3.14.4
1
clowder/clowder2-heartbeat:2.0.0-beta.414155326c7b9
aiohttp@3.11.10
3.14.4
1

syft 1.42.1 · advisories as of 20 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.