StackRadar

CVE-2026-111497

Critical

Advisory

Published 22 Oct 2026In the index since 23 Oct 2026
Severity
Critical
worst across findings
CVSS
9.2
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
905
of 18,232 indexed, latest versions
Container images
780
deployed by those charts
Fix available
None
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 905 of 18,232 indexed charts deploy, on 780 images.

Affected packageAffected versionsFixed inImages
brotlideb1.0.9-2+b6, 1.1.0-2+b7, 1.1.0-2+dhi2, 1.2.0-3no fix listed780
nodejsdeb18.13.0+dfsg1-1, 18.19.0+dfsg-6~deb12u1, 18.19.0+dfsg-6~deb12u2, 18.20.4-1nodesource1+15 moreno fix listed26
OSV records
ECHO-1099-6733-474bDEBIAN-CVE-2026-111497

Charts affected

905 by stars
ChartLatestAffected imagesRadar Score
esphomehelm-chart-roeiVerified publisher2025.3.01 of 1See more

esphome helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
esphome/esphome:2025.3.0def8b6e4f517
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

6,883
home-assistant-matter-hubhelm-chart-roeiVerified publisher3.0.21 of 1See more

home-assistant-matter-hub helm-chart-roei 3.0.2

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
luligu/matterbridge:3.0.28f97884bebc2
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

4,235
supersethelm-charts-nr1.1.31 of 1See more

superset helm-charts-nr 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
apache/superset:latest16b50bbef664
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

30,773
hello-world-charthelm-chart-test-hello-world0.1.01 of 1See more

hello-world-chart helm-chart-test-hello-world 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
library/nginx:stablea7675fcee220
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

1,588
mywebhelmchartwebapp0.0.51 of 1See more

myweb helmchartwebapp 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
library/httpd:latesta30cd4cd57f3
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

1,294
my-apphelm-demo85640.2.71 of 2See more

my-app helm-demo8564 0.2.7

1 of the 2 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
library/nginx:latest4c41e2d0a3a5
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

1,588
chart-bookhelm-deploy-book0.1.01 of 3See more

chart-book helm-deploy-book 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
dannielkil/book-frontend:latest937993927694
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

10,700
apachehelmforgeVerified publisher1.0.81 of 1See more

apache helmforge 1.0.8

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
library/httpd:2.4.69c842ac797bd1
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

1,428
appwritehelmforgeVerified publisher2.0.71 of 5See more

appwrite helmforge 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
appwrite/new:1.2.74-self-hostedb16ee4e5c19c
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

4,412
archiveboxhelmforgeVerified publisher1.1.151 of 1See more

archivebox helmforge 1.1.15

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
archivebox/archivebox:0.9.73d4720d86c0e9
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

6,457
atuinhelmforgeVerified publisher1.1.11 of 1See more

atuin helmforge 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
ghcr.io/atuinsh/atuin:18.23.0f232feeead54
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

1,857
castopodhelmforgeVerified publisher1.2.131 of 3See more

castopod helmforge 1.2.13

1 of the 3 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
castopod/castopod:1.15.54e4f0440520f
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

10,865
changedetectionhelmforgeVerified publisher1.1.201 of 1See more

changedetection helmforge 1.1.20

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.904eaae7915ba
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

2,863
chiefonboardinghelmforgeVerified publisher1.1.171 of 3See more

chiefonboarding helmforge 1.1.17

1 of the 3 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
chiefonboarding/chiefonboarding:v2.5.0d0964135ea82
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

8,859
ckanhelmforgeVerified publisher1.3.131 of 6See more

ckan helmforge 1.3.13

1 of the 6 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
ckan/ckan-base:2.12.087ecf3f27ad6
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

11,578
dawarichhelmforgeVerified publisher1.0.82 of 4See more

dawarich helmforge 1.0.8

2 of the 4 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
freikin/dawarich:1.16.0b533e6eac446
brotli@1.1.0-2+b7
nodejs@20.19.2+dfsg-1+deb13u3
no fix listed
no fix listed
postgis/postgis:18-3.67e00e8c3539f
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

12,134
discount-bandithelmforgeVerified publisher2.0.121 of 3See more

discount-bandit helmforge 2.0.12

1 of the 3 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
cybrarist/discount-bandit:v4.0.5bc327406db74
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

38,899
druidhelmforgeVerified publisher1.3.91 of 4See more

druid helmforge 1.3.9

1 of the 4 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
apache/druid:38.0.04156a8ca87b8
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

8,632
drupalhelmforgeVerified publisher1.2.181 of 2See more

drupal helmforge 1.2.18

1 of the 2 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
library/drupal:11.4.10-php8.5-apache-bookworm116fbf35120e
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

17,647
entehelmforgeVerified publisher1.0.41 of 4See more

ente helmforge 1.0.4

1 of the 4 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
ghcr.io/ente/web:5ab0c5b4c7a89c4e470ef6f793600da33cebf35d3f4864eb7f11
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

5,203
fastmcp-serverhelmforgeVerified publisher1.7.51 of 1See more

fastmcp-server helmforge 1.7.5

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.11.2fcb7017327d6
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

3,968
generichelmforgeVerified publisher3.1.71 of 1See more

generic helmforge 3.1.7

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
library/nginx:1.31.7956eac231bb3
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

1,661
ghostfoliohelmforgeVerified publisher1.1.21 of 4See more

ghostfolio helmforge 1.1.2

1 of the 4 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
ghostfolio/ghostfolio:3.88.0256c524a6116
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

5,086
hermes-agenthelmforgeVerified publisher1.0.21 of 1See more

hermes-agent helmforge 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.9.24fca358f12efd
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

7,568
immichhelmforgeVerified publisher1.2.131 of 5See more

immich helmforge 1.2.13

1 of the 5 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

13,292
jenkinshelmforgeVerified publisher1.0.111 of 1See more

jenkins helmforge 1.0.11

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
jenkins/jenkins:2.580.1-lts-jdk21a660310e39ad
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

2,187
jupyterhubhelmforgeVerified publisher1.0.71 of 3See more

jupyterhub helmforge 1.0.7

1 of the 3 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

6,232
mcp-serverhelmforgeVerified publisher1.0.01 of 1See more

mcp-server helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.2.061f759a1421f
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

4,104
medikeephelmforgeVerified publisher2.0.51 of 3See more

medikeep helmforge 2.0.5

1 of the 3 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
ghcr.io/afairgiant/medikeep:v0.72.09285e26f6d0d
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

6,754
middlewarehelmforgeVerified publisher1.2.111 of 4See more

middleware helmforge 1.2.11

1 of the 4 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
middlewareeng/middleware:0.3.1747d880812f1
brotli@1.0.9-2+b6
nodejs@22.16.0-1nodesource1
no fix listed
no fix listed

Open the chart page →

63,658
moodlehelmforgeVerified publisher1.1.51 of 2See more

moodle helmforge 1.1.5

1 of the 2 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
moodlehq/moodle-php-apache:8.4-bookworm922af5166835
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

34,608
nextcloudhelmforgeVerified publisher2.0.41 of 3See more

nextcloud helmforge 2.0.4

1 of the 3 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
library/nextcloud:35.0.2-apachea588aa535370
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

6,675
openhumanhelmforgeVerified publisher1.1.01 of 1See more

openhuman helmforge 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
ghcr.io/tinyhumansai/openhuman-core:v0.64.15c694baccddb4
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

2,941
opensignhelmforgeVerified publisher1.0.01 of 3See more

opensign helmforge 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
opensign/opensigndigest-pinned0ebc230eed21
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

69,398
paperless-ngxhelmforgeVerified publisher1.1.11 of 4See more

paperless-ngx helmforge 1.1.1

1 of the 4 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

8,299
phpmyadminhelmforgeVerified publisher2.1.21 of 1See more

phpmyadmin helmforge 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
phpmyadmin/phpmyadmin:5.2.342a200db07b4
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

5,494
ryothelmforgeVerified publisher1.0.21 of 2See more

ryot helmforge 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

7,255
stalwarthelmforgeVerified publisher1.1.11 of 1See more

stalwart helmforge 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
stalwartlabs/stalwart:v0.16.27c429b311c93d
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

1,176
supersethelmforgeVerified publisher1.4.21 of 5See more

superset helmforge 1.4.2

1 of the 5 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
apache/superset:6.1.016b50bbef664
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

34,576
text-embeddings-inferencehelmforgeVerified publisher1.0.21 of 2See more

text-embeddings-inference helmforge 1.0.2

1 of the 2 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
ghcr.io/huggingface/text-embeddings-inference:cpu-1.9.42538ea1c9640
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

2,169
mywebhelm-httpdVerified publisher0.3.01 of 1See more

myweb helm-httpd 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
library/httpd:latest46a65814cc05
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

1,428
myapphelmingapp0.1.01 of 1See more

myapp helmingapp 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
muhammedgamal/fp23:latest74b4cd69b6fa
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

83,122
jellyfinhelm-l3st86Verified publisher0.1.81 of 1See more

jellyfin helm-l3st86 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
jellyfin/jellyfin:latest357724bf0ae2
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

1,554
openaevhelm-openbasVerified publisher2.0.162 of 7See more

openaev helm-openbas 2.0.16

2 of the 7 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
bitnamilegacy/rabbitmq:4.1.2-debian-12-r1fac502149c40
brotli@1.0.9-2+b6
no fix listed
openbas/caldera-server:5.1.0a277796d9724
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

79,083
openbashelm-openbasVerified publisher1.8.142 of 7See more

openbas helm-openbas 1.8.14

2 of the 7 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
bitnamilegacy/rabbitmq:4.1.2-debian-12-r1fac502149c40
brotli@1.0.9-2+b6
no fix listed
openbas/caldera-server:5.1.0a277796d9724
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

83,954
steampipehelm-steampipeVerified publisher2.4.11 of 1See more

steampipe helm-steampipe 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
ghcr.io/devops-ia/steampipe:v2.4.1a982103d91d3
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

3,905
my-nginxhelmtaiwo0.1.01 of 1See more

my-nginx helmtaiwo 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
library/nginx:latestf9ea18bfa4fa
brotli@1.1.0-2+b7
no fix listed

Open the chart page →

1,722
samplehelmapphelmtraining3.0.01 of 1See more

samplehelmapp helmtraining 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
praravind1801/helmimages:3.0.0f29d637b9ce1
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

6,356
home-ha-mockhome-ha-mockVerified publisher2.0.51 of 1See more

home-ha-mock home-ha-mock 2.0.5

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
ghcr.io/smarter-project/home-ha-mock:main95ee018cf558
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

3,361
paperlesshomelabcihelmchartstestVerified publisher9.1.91 of 1See more

paperless homelabcihelmchartstest 9.1.9

1 of the 1 container images this version deploys carry CVE-2026-111497.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
brotli@1.0.9-2+b6
no fix listed

Open the chart page →

19,066

Container images carrying it

780 by charts deploying them

A fixed version is listed for 0 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
public.ecr.aws/jtekt-corporation/shinsei-manager-front:v1.5.5f8fb4eea4071
brotli@1.0.9-2+b6
no fix listed
1
public.ecr.aws/jtekt-corporation/time-series-storage-service:v1.5.1046ef5c9ed50
brotli@1.0.9-2+b6
no fix listed
1
public.ecr.aws/k2x0t8t6/kubeadapt/app/kubeadapt-k8s-pulse:v3.0.1dc5a516c2333
brotli@1.0.9-2+b6
no fix listed
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
brotli@1.0.9-2+b6
no fix listed
1
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
brotli@1.0.9-2+b6
no fix listed
1
quay.io/argoprojlabs/gitops-promoter:v0.45.05ac7b6178ddc
brotli@1.1.0-2+b7
no fix listed
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
brotli@1.1.0-2+b7
no fix listed
1
quay.io/groundcover/tools:20260929e8a79ea4cf39
brotli@1.1.0-2+b7
no fix listed
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
brotli@1.0.9-2+b6
no fix listed
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
brotli@1.0.9-2+b6
no fix listed
1
quay.io/jupyterhub/k8s-hub:4.4.4bbce7a924eac
brotli@1.0.9-2+b6
no fix listed
1
quay.io/jupyterhub/k8s-singleuser-sample:4.4.41ce06452047d
brotli@1.0.9-2+b6
no fix listed
1
quay.io/kannika/kannika-api:0.19.18c66427d6d57
brotli@1.1.0-2+b7
no fix listed
1
quay.io/mittwald/kube-httpcache:stable2169032c5840
brotli@1.0.9-2+b6
no fix listed
1
quay.io/opsmxpublic/ubi8-oes-datascience:isd-spin-2025.10.01-af26a30d4-202511261054d8f66f4117fe
brotli@1.1.0-2+b7
no fix listed
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
brotli@1.0.9-2+b6
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-frontend:1.0.3166353ce9bf98
brotli@1.1.0-2+b7
no fix listed
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
brotli@1.0.9-2+b6
no fix listed
1
registry.gitlab.com/gitlab-org/build/cng/certificates:v19.5.1277c0c7dd09d
brotli@1.1.0-2+b7
no fix listed
1
registry.gitlab.com/gitlab-org/build/cng/gitaly:v19.5.13e17b952d90f
brotli@1.1.0-2+b7
no fix listed
1
registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v19.5.1e56f0bd5b96c
brotli@1.1.0-2+b7
no fix listed
1
registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry:v4.42.0-gitlabb194be2ff740
brotli@1.1.0-2+b7
no fix listed
1
registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:17.0.22542811ac831
brotli@1.1.0-2+b7
no fix listed
1
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao:v2.6.2-gitlab1295422a492cf
brotli@1.1.0-2+b7
no fix listed
1
registry.gitlab.com/gitlab-org/build/cng/gitlab-shell:v14.58.08f1028df33aa
brotli@1.1.0-2+b7
no fix listed
1
registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ee:v19.5.14863be916c31
brotli@1.1.0-2+b7
no fix listed
1
registry.gitlab.com/gitlab-org/build/cng/kubectl:v19.5.15cf0f354870d
brotli@1.1.0-2+b7
no fix listed
1
registry.gitlab.com/school_guy/docker-typo3:13.4.36-f6d9c8816f322770697e
brotli@1.0.9-2+b6
no fix listed
1
registry.k8s.io/git-sync/git-sync:v4.5.00e64aedb0d0a
brotli@1.1.0-2+b7
no fix listed
1
registry.k8s.io/git-sync/git-sync:v4.1.0fd9722fd02e3
brotli@1.0.9-2+b6
no fix listed
1

syft 1.42.1 · advisories as of 23 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.