StackRadar

CVE-2026-111064

High

Advisory

Published 19 Oct 2026In the index since 20 Oct 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
247
of 18,196 indexed, latest versions
Container images
242
deployed by those charts
Fix available
1 of 1
affected package

aiohttp server lacks an initial request/header timeout

Carried by container images the latest versions of 247 of 18,196 indexed charts deploy, on 242 images.

Affected packageAffected versionsFixed inImages
aiohttppypi3.4.4, 3.5.1, 3.5.4, 3.6.2+37 more3.14.4242
OSV records
GHSA-5wr8-gcqf-gqf3

Charts affected

247 by stars
ChartLatestAffected imagesRadar Score
imgtagrotationalVerified publisher0.2.01 of 1See more

imgtag rotational 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
aiohttp@3.11.13
3.14.4

Open the chart page →

3,829
agentdatarss30.1.01 of 1See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
aiohttp@3.11.13
3.14.4

Open the chart page →

4,047
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
aiohttp@3.11.13
3.14.4

Open the chart page →

6,119
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
aiohttp@3.13.5
3.14.4

Open the chart page →

9,625
tandoorrtomik-helm-chartsVerified publisher0.0.11 of 1See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
vabene1111/recipes:2.3.50f8d061895e9
aiohttp@3.12.15
3.14.4

Open the chart page →

5,141
runwhen-localrunwhen-contribVerified publisher0.7.31 of 3See more

runwhen-local runwhen-contrib 0.7.3

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/runwhen-contrib/runwhen-local:0.12.4914e75d9f445
aiohttp@3.14.3
3.14.4

Open the chart page →

4,500
safe-config-servicesafe-global0.1.01 of 3See more

safe-config-service safe-global 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
safeglobal/safe-config-service:latest09a5e495c219
aiohttp@3.13.5
3.14.4

Open the chart page →

2,101
safe-stacksafe-global0.1.02 of 9See more

safe-stack safe-global 0.1.0

2 of the 9 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
safeglobal/safe-config-service:latest09a5e495c219
aiohttp@3.13.5
3.14.4
safeglobal/safe-transaction-service:latest7b576c73f865
aiohttp@3.14.3
3.14.4

Open the chart page →

21,805
safe-transaction-servicesafe-global0.1.01 of 6See more

safe-transaction-service safe-global 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
safeglobal/safe-transaction-service:latest7b576c73f865
aiohttp@3.14.3
3.14.4

Open the chart page →

18,298
airflowsb-helm-charts0.3.01 of 1See more

airflow sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
apache/airflow:2.8.1e5560ad0b86e
aiohttp@3.9.1
3.14.4

Open the chart page →

11,986
scapyscapy-containerised0.3.41 of 2See more

scapy scapy-containerised 0.3.4

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
saidsef/scapy-containerised:v2025.02f17f7c435891
aiohttp@3.11.12
3.14.4

Open the chart page →

3,468
seafileschmitzis13.0.131 of 4See more

seafile schmitzis 13.0.13

1 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
schmitzis/monorepo:seafile-13.0-latestc583f1be2af2
aiohttp@3.14.3
3.14.4

Open the chart page →

46,309
search-proxysearch-proxy2026.42.31 of 1See more

search-proxy search-proxy 2026.42.3

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/unique-ag/ai/search-proxy:2026.42.32f87faa4af66
aiohttp@3.14.1
3.14.4

Open the chart page →

1,790
ansible-semaphoresergiotocaliniVerified publisher1.2.01 of 1See more

ansible-semaphore sergiotocalini 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
semaphoreui/semaphore:v2.9.645b50bc11833f
aiohttp@3.8.5
3.14.4

Open the chart page →

4,057
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
aiohttp@3.13.3
3.14.4

Open the chart page →

6,066
home-assistantsmall-hack2.1.01 of 1See more

home-assistant small-hack 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
aiohttp@3.13.3
3.14.4

Open the chart page →

5,379
srebotsrebot0.14.01 of 2See more

srebot srebot 0.14.0

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
aiohttp@3.13.5
3.14.4

Open the chart page →

1,857
servicexssl-hep1.8.61 of 16See more

servicex ssl-hep 1.8.6

1 of the 16 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
sslhep/servicex-did-finder:v1.8.6e15e68307d33
aiohttp@3.14.3
3.14.4

Open the chart page →

69,065
verostakewise0.8.31 of 2See more

vero stakewise 0.8.3

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/serenita-org/vero:v0.8.3e5a7ec714acc
aiohttp@3.10.10
3.14.4

Open the chart page →

3,884
verbasubstratusVerified publisher0.4.01 of 1See more

verba substratus 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
substratusai/verba:v0.4.0-baseURL261695be635eb
aiohttp@3.9.5
3.14.4

Open the chart page →

15,090
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
aiohttp@3.13.5
3.14.4

Open the chart page →

4,489
svc-lb-muxsvc-lb-mux0.1.31 of 1See more

svc-lb-mux svc-lb-mux 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ghcr.io/nowakeai/svc-lb-mux:0.1.37d8fb8e996b6
aiohttp@3.13.5
3.14.4

Open the chart page →

1,826
asrtest-opea1.0.01 of 1See more

asr test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/asr:1.025dd26d9cd09
aiohttp@3.10.5
3.14.4

Open the chart page →

4,883
chatqnatest-opea1.0.05 of 11See more

chatqna test-opea 1.0.0

5 of the 11 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/chatqna:1.038c51b791efa
aiohttp@3.10.5
3.14.4
opea/embedding-tei:1.05c9639de61c1
aiohttp@3.10.5
3.14.4
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.4
opea/reranking-tei:1.0e48613afb191
aiohttp@3.10.5
3.14.4
opea/retriever-redis:1.0eb746b263705
aiohttp@3.10.5
3.14.4

Open the chart page →

43,412
codegentest-opea1.0.02 of 5See more

codegen test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/codegen:1.058f91683892d
aiohttp@3.10.5
3.14.4
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.4

Open the chart page →

32,778
codetranstest-opea1.0.02 of 5See more

codetrans test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/codetrans:1.0e2436483b73d
aiohttp@3.10.5
3.14.4
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.4

Open the chart page →

32,302
docsumtest-opea1.0.02 of 5See more

docsum test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/docsum:1.03eaa91849512
aiohttp@3.10.5
3.14.4
opea/llm-docsum-tgi:1.002f9e8fa5d71
aiohttp@3.10.5
3.14.4

Open the chart page →

32,804
embedding-usvctest-opea1.0.01 of 1See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/embedding-tei:1.05c9639de61c1
aiohttp@3.10.5
3.14.4

Open the chart page →

5,746
guardrails-usvctest-opea1.0.01 of 1See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/guardrails-tgi:1.0262c6048aab8
aiohttp@3.10.5
3.14.4

Open the chart page →

5,781
llm-uservicetest-opea1.0.01 of 1See more

llm-uservice test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.4

Open the chart page →

5,248
reranking-usvctest-opea1.0.01 of 1See more

reranking-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/reranking-tei:1.0e48613afb191
aiohttp@3.10.5
3.14.4

Open the chart page →

5,538
retriever-usvctest-opea1.0.01 of 1See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/retriever-redis:1.0eb746b263705
aiohttp@3.10.5
3.14.4

Open the chart page →

5,754
speecht5test-opea1.0.01 of 1See more

speecht5 test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/speecht5:1.0249afad3d268
aiohttp@3.10.5
3.14.4

Open the chart page →

10,631
ttstest-opea1.0.01 of 1See more

tts test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/tts:1.0257ae94709e9
aiohttp@3.10.5
3.14.4

Open the chart page →

4,867
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
aiohttp@3.10.5
3.14.4

Open the chart page →

5,969
kasa-exporterth-chartsVerified publisher0.1.01 of 1See more

kasa-exporter th-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
thelande/kasa_exporter:v0.2.3a1fdb8baa152
aiohttp@3.9.5
3.14.4

Open the chart page →

1,607
traefik-external-dns-controllertraefik-external-dns-operator2.3.01 of 1See more

traefik-external-dns-controller traefik-external-dns-operator 2.3.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ybucci/traefik-external-dns-controller:2.3.0cc22a16fac81
aiohttp@3.14.3
3.14.4

Open the chart page →

1,509
traefik-external-dns-operatortraefik-external-dns-operator1.0.11 of 1See more

traefik-external-dns-operator traefik-external-dns-operator 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
ybucci/traefik-external-dns-operator:1.0.0f1fcc7c8d9fd
aiohttp@3.11.14
3.14.4

Open the chart page →

1,395
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
aiohttp@3.8.1
3.14.4

Open the chart page →

10,143
nemo-guardrailsupstreamyardVerified publisher0.1.11 of 1See more

nemo-guardrails upstreamyard 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
upstreamyard/nemo-guardrails:0.24.19f673183cfc0
aiohttp@3.14.3
3.14.4

Open the chart page →

1,446
wasabi-s3-operatorwasabi-s3-operatorVerified publisher0.2.71 of 1See more

wasabi-s3-operator wasabi-s3-operator 0.2.7

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
kenchrcum/wasabi-s3-operator:0.2.7ce657c622ce5
aiohttp@3.13.5
3.14.4

Open the chart page →

791
wazuh-manager-filebeatwazuh-manager-filebeat0.1.0-gamma1 of 1See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
iosifache/wazuh-manager-filebeat:latest85df3f04b5da
aiohttp@3.7.4
3.14.4

Open the chart page →

13,099
dingtalk-botxxl-job-adminVerified publisher0.1.31 of 2See more

dingtalk-bot xxl-job-admin 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
dellnoantechnp/dingtalk-bot:v1.0.1034000bbcad5
aiohttp@3.13.2
3.14.4

Open the chart page →

3,909
sockpuppetbrowserzekker6Verified publisher0.1.01 of 1See more

sockpuppetbrowser zekker6 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
dgtlmoon/sockpuppetbrowser:latest1d8f72d2ce20
aiohttp@3.14.3
3.14.4

Open the chart page →

5,216
alertmanager-matrix-forwarderzloi-space1.0.11 of 2See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
aiohttp@3.8.1
3.14.4

Open the chart page →

3,636
grafana-matrix-forwarderzloi-space1.0.01 of 2See more

grafana-matrix-forwarder zloi-space 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
aiohttp@3.8.1
3.14.4

Open the chart page →

2,065
zoo-project-druzoo-projectOfficialVerified publisher0.10.91 of 6See more

zoo-project-dru zoo-project 0.10.9

1 of the 6 container images this version deploys carry CVE-2026-111064.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-51e7d55383f24594959b69e58518961c6aa66740da112e8d03f1
aiohttp@3.14.3
3.14.4

Open the chart page →

7,358

Container images carrying it

242 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
aiohttp@3.14.3
3.14.4
5
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.4
4
langflowai/langflow:1.12.6:latesta0396e089eb9
aiohttp@3.14.3
3.14.4
3
quay.io/devtron/ai-agent:0.0.16545dac92173
aiohttp@3.10.10
3.14.4
3
esphome/esphome:2026.9.14ad55931c018
aiohttp@3.14.3
3.14.4
2
frinx/topology-discovery:7.0.37832e3589dba
aiohttp@3.10.5
3.14.4
2
ilum/api:6.7.3624fd09528c8
aiohttp@3.14.1
3.14.4
2
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
aiohttp@3.8.1
3.14.4
2
nacos/nacos-server:latest1c191c30c8cd
aiohttp@3.14.3
3.14.4
2
opea/embedding-tei:1.05c9639de61c1
aiohttp@3.10.5
3.14.4
2
opea/reranking-tei:1.0e48613afb191
aiohttp@3.10.5
3.14.4
2
opea/retriever-redis:1.0eb746b263705
aiohttp@3.10.5
3.14.4
2
openbas/caldera-server:5.1.0a277796d9724
aiohttp@3.10.8
3.14.4
2
polyaxon/polyaxon-agent:2.17.0da877a2647fc
aiohttp@3.14.3
3.14.4
2
polyaxon/polyaxon-cli:2.17.0297ed47ed63a
aiohttp@3.14.3
3.14.4
2
safeglobal/safe-config-service:latest09a5e495c219
aiohttp@3.13.5
3.14.4
2
safeglobal/safe-transaction-service:latest7b576c73f865
aiohttp@3.14.3
3.14.4
2
vdiogov/glpi-conteiner:latest6945f84f0058
aiohttp@3.8.4
3.14.4
2
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
aiohttp@3.13.5
3.14.4
2
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
aiohttp@3.14.3
3.14.4
2
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
aiohttp@3.14.3
3.14.4
2
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
aiohttp@3.11.13
3.14.4
2
ghcr.io/xeor/karb:1.0.6:main647a3c938d31
aiohttp@3.13.3
3.14.4
2
acockburn/appdaemon:4.0.83a93281d7e94
aiohttp@3.7.4
3.14.4
1
acryldata/datahub-actions:v1.7.0.1c5fd70130157
aiohttp@3.14.3
3.14.4
1
agentarea/agentarea-api:latestde166c910ef9
aiohttp@3.14.3
3.14.4
1
agentarea/agentarea-worker:latestadb761a4d103
aiohttp@3.14.3
3.14.4
1
alerta/alerta-web:8.5.04786b9eaa606
aiohttp@3.8.0
3.14.4
1
apache/airflow:2.8.4-python3.964e58748b6b9
aiohttp@3.9.3
3.14.4
1
apache/airflow:2.10.2-python3.9ce90bdc3d2af
aiohttp@3.10.5
3.14.4
1
apache/airflow:2.8.1e5560ad0b86e
aiohttp@3.9.1
3.14.4
1
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
aiohttp@3.7.4
3.14.4
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
aiohttp@3.11.16
3.14.4
1
archivebox/archivebox:0.9.73d4720d86c0e9
aiohttp@3.14.3
3.14.4
1
aristidetm/basic-notebook:3.6.5469dbc951224
aiohttp@3.9.5
3.14.4
1
aristidetm/k8s-hub:3.3.7ccb516cb8474
aiohttp@3.9.3
3.14.4
1
assistiot/cybersecurity-monitoring_id-wzh:latest0aacefac9677
aiohttp@3.7.4
3.14.4
1
assistiot/smart-orchestrator_mcs:latest7d6a0d534c7f
aiohttp@3.9.3
3.14.4
1
baserow/backend:1.31.1e0b3c8130b91
aiohttp@3.9.5
3.14.4
1
baserow/baserow:1.30.1df0c42eb67e8
aiohttp@3.9.5
3.14.4
1
bcgovimages/aries-cloudagent:py36-1.16-1_0.7.4faa2e2d21916
aiohttp@3.8.1
3.14.4
1
berkeleyskypilot/skypilot:0.14.125577df35586
aiohttp@3.14.3
3.14.4
1
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
aiohttp@3.13.2
3.14.4
1
burakince/mlflow:3.16.0ab4b566644b9
aiohttp@3.14.3
3.14.4
1
byjg/easy-haproxy:6.1.1230fdb7b00ae
aiohttp@3.14.1
3.14.4
1
checkmk/check-mk-community:2.5.0p6c11b422210c4
aiohttp@3.13.5
3.14.4
1
chiefonboarding/chiefonboarding:v2.5.0d0964135ea82
aiohttp@3.14.3
3.14.4
1
ciuse99/suggestarr:v1.0.20d72768245ef5
aiohttp@3.11.12
3.14.4
1
clowder/clowder2-backend:2.0.0-beta.411f3d844e4c0
aiohttp@3.11.10
3.14.4
1
clowder/clowder2-heartbeat:2.0.0-beta.414155326c7b9
aiohttp@3.11.10
3.14.4
1

syft 1.42.1 · advisories as of 20 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.