StackRadar

CVE-2026-111750

Medium

Advisory

Published 20 Oct 2026In the index since 21 Oct 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.003
22nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
247
of 18,208 indexed, latest versions
Container images
241
deployed by those charts
Fix available
1 of 2
affected packages

AIOHTTP: Pure-Python parser request smuggling

Carried by container images the latest versions of 247 of 18,208 indexed charts deploy, on 241 images.

Affected packageAffected versionsFixed inImages
aiohttppypi3.4.4, 3.5.1, 3.5.4, 3.6.2+37 more3.14.4241
python-aiohttpdeb3.8.4-1, 3.11.16-1+deb13u1no fix listed2
OSV records
DEBIAN-CVE-2026-111750GHSA-pqxq-w44r-73xw

Charts affected

247 by stars
ChartLatestAffected imagesRadar Score
imgtagrotationalVerified publisher0.2.01 of 1See more

imgtag rotational 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
aiohttp@3.11.13
3.14.4

Open the chart page →

3,800
agentdatarss30.1.01 of 1See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
aiohttp@3.11.13
3.14.4

Open the chart page →

4,019
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
aiohttp@3.11.13
3.14.4

Open the chart page →

6,095
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
aiohttp@3.13.5
3.14.4

Open the chart page →

9,801
tandoorrtomik-helm-chartsVerified publisher0.0.11 of 1See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
vabene1111/recipes:2.3.50f8d061895e9
aiohttp@3.12.15
3.14.4

Open the chart page →

5,379
runwhen-localrunwhen-contribVerified publisher0.7.31 of 3See more

runwhen-local runwhen-contrib 0.7.3

1 of the 3 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
ghcr.io/runwhen-contrib/runwhen-local:0.12.4914e75d9f445
aiohttp@3.14.3
3.14.4

Open the chart page →

4,503
safe-config-servicesafe-global0.1.01 of 3See more

safe-config-service safe-global 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
safeglobal/safe-config-service:latest09a5e495c219
aiohttp@3.13.5
3.14.4

Open the chart page →

2,239
safe-stacksafe-global0.1.02 of 9See more

safe-stack safe-global 0.1.0

2 of the 9 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
safeglobal/safe-config-service:latest09a5e495c219
aiohttp@3.13.5
3.14.4
safeglobal/safe-transaction-service:latest7b576c73f865
aiohttp@3.14.3
3.14.4

Open the chart page →

21,739
safe-transaction-servicesafe-global0.1.01 of 6See more

safe-transaction-service safe-global 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
safeglobal/safe-transaction-service:latest7b576c73f865
aiohttp@3.14.3
3.14.4

Open the chart page →

18,094
airflowsb-helm-charts0.3.01 of 1See more

airflow sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
apache/airflow:2.8.1e5560ad0b86e
aiohttp@3.9.1
3.14.4

Open the chart page →

11,937
scapyscapy-containerised0.3.41 of 2See more

scapy scapy-containerised 0.3.4

1 of the 2 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
saidsef/scapy-containerised:v2025.02f17f7c435891
aiohttp@3.11.12
3.14.4

Open the chart page →

3,703
seafileschmitzis13.0.131 of 4See more

seafile schmitzis 13.0.13

1 of the 4 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
schmitzis/monorepo:seafile-13.0-latestc583f1be2af2
aiohttp@3.14.3
3.14.4

Open the chart page →

45,170
search-proxysearch-proxy2026.42.31 of 1See more

search-proxy search-proxy 2026.42.3

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
ghcr.io/unique-ag/ai/search-proxy:2026.42.32f87faa4af66
aiohttp@3.14.1
3.14.4

Open the chart page →

1,920
ansible-semaphoresergiotocaliniVerified publisher1.2.01 of 1See more

ansible-semaphore sergiotocalini 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
semaphoreui/semaphore:v2.9.645b50bc11833f
aiohttp@3.8.5
3.14.4

Open the chart page →

4,112
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
aiohttp@3.13.3
3.14.4

Open the chart page →

6,235
home-assistantsmall-hack2.1.01 of 1See more

home-assistant small-hack 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
aiohttp@3.13.3
3.14.4

Open the chart page →

5,631
srebotsrebot0.14.01 of 2See more

srebot srebot 0.14.0

1 of the 2 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
aiohttp@3.13.5
3.14.4

Open the chart page →

1,880
servicexssl-hep1.8.61 of 16See more

servicex ssl-hep 1.8.6

1 of the 16 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
sslhep/servicex-did-finder:v1.8.6e15e68307d33
aiohttp@3.14.3
3.14.4

Open the chart page →

66,440
verostakewise0.8.31 of 2See more

vero stakewise 0.8.3

1 of the 2 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
ghcr.io/serenita-org/vero:v0.8.3e5a7ec714acc
aiohttp@3.10.10
3.14.4

Open the chart page →

3,847
verbasubstratusVerified publisher0.4.01 of 1See more

verba substratus 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
substratusai/verba:v0.4.0-baseURL261695be635eb
aiohttp@3.9.5
3.14.4

Open the chart page →

14,805
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
aiohttp@3.13.5
3.14.4

Open the chart page →

4,478
svc-lb-muxsvc-lb-mux0.1.31 of 1See more

svc-lb-mux svc-lb-mux 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
ghcr.io/nowakeai/svc-lb-mux:0.1.37d8fb8e996b6
aiohttp@3.13.5
3.14.4

Open the chart page →

1,857
asrtest-opea1.0.01 of 1See more

asr test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
opea/asr:1.025dd26d9cd09
aiohttp@3.10.5
3.14.4

Open the chart page →

4,961
chatqnatest-opea1.0.05 of 11See more

chatqna test-opea 1.0.0

5 of the 11 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
opea/chatqna:1.038c51b791efa
aiohttp@3.10.5
3.14.4
opea/embedding-tei:1.05c9639de61c1
aiohttp@3.10.5
3.14.4
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.4
opea/reranking-tei:1.0e48613afb191
aiohttp@3.10.5
3.14.4
opea/retriever-redis:1.0eb746b263705
aiohttp@3.10.5
3.14.4

Open the chart page →

43,151
codegentest-opea1.0.02 of 5See more

codegen test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
opea/codegen:1.058f91683892d
aiohttp@3.10.5
3.14.4
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.4

Open the chart page →

32,273
codetranstest-opea1.0.02 of 5See more

codetrans test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
opea/codetrans:1.0e2436483b73d
aiohttp@3.10.5
3.14.4
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.4

Open the chart page →

31,797
docsumtest-opea1.0.02 of 5See more

docsum test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
opea/docsum:1.03eaa91849512
aiohttp@3.10.5
3.14.4
opea/llm-docsum-tgi:1.002f9e8fa5d71
aiohttp@3.10.5
3.14.4

Open the chart page →

32,300
embedding-usvctest-opea1.0.01 of 1See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
opea/embedding-tei:1.05c9639de61c1
aiohttp@3.10.5
3.14.4

Open the chart page →

5,744
guardrails-usvctest-opea1.0.01 of 1See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
opea/guardrails-tgi:1.0262c6048aab8
aiohttp@3.10.5
3.14.4

Open the chart page →

5,778
llm-uservicetest-opea1.0.01 of 1See more

llm-uservice test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.4

Open the chart page →

5,246
reranking-usvctest-opea1.0.01 of 1See more

reranking-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
opea/reranking-tei:1.0e48613afb191
aiohttp@3.10.5
3.14.4

Open the chart page →

5,536
retriever-usvctest-opea1.0.01 of 1See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
opea/retriever-redis:1.0eb746b263705
aiohttp@3.10.5
3.14.4

Open the chart page →

5,752
speecht5test-opea1.0.01 of 1See more

speecht5 test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
opea/speecht5:1.0249afad3d268
aiohttp@3.10.5
3.14.4

Open the chart page →

10,503
ttstest-opea1.0.01 of 1See more

tts test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
opea/tts:1.0257ae94709e9
aiohttp@3.10.5
3.14.4

Open the chart page →

4,945
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
aiohttp@3.10.5
3.14.4

Open the chart page →

5,966
kasa-exporterth-chartsVerified publisher0.1.01 of 1See more

kasa-exporter th-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
thelande/kasa_exporter:v0.2.3a1fdb8baa152
aiohttp@3.9.5
3.14.4

Open the chart page →

1,657
traefik-external-dns-controllertraefik-external-dns-operator2.3.01 of 1See more

traefik-external-dns-controller traefik-external-dns-operator 2.3.0

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
ybucci/traefik-external-dns-controller:2.3.0cc22a16fac81
aiohttp@3.14.3
3.14.4

Open the chart page →

1,513
traefik-external-dns-operatortraefik-external-dns-operator1.0.11 of 1See more

traefik-external-dns-operator traefik-external-dns-operator 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
ybucci/traefik-external-dns-operator:1.0.0f1fcc7c8d9fd
aiohttp@3.11.14
3.14.4

Open the chart page →

1,455
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
aiohttp@3.8.1
3.14.4

Open the chart page →

10,123
nemo-guardrailsupstreamyardVerified publisher0.1.11 of 1See more

nemo-guardrails upstreamyard 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
upstreamyard/nemo-guardrails:0.24.19f673183cfc0
aiohttp@3.14.3
3.14.4

Open the chart page →

1,525
wasabi-s3-operatorwasabi-s3-operatorVerified publisher0.2.71 of 1See more

wasabi-s3-operator wasabi-s3-operator 0.2.7

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
kenchrcum/wasabi-s3-operator:0.2.7ce657c622ce5
aiohttp@3.13.5
3.14.4

Open the chart page →

851
wazuh-manager-filebeatwazuh-manager-filebeat0.1.0-gamma1 of 1See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
iosifache/wazuh-manager-filebeat:latest85df3f04b5da
aiohttp@3.7.4
3.14.4

Open the chart page →

13,203
dingtalk-botxxl-job-adminVerified publisher0.1.31 of 2See more

dingtalk-bot xxl-job-admin 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
dellnoantechnp/dingtalk-bot:v1.0.1034000bbcad5
aiohttp@3.13.2
3.14.4

Open the chart page →

3,937
sockpuppetbrowserzekker6Verified publisher0.1.01 of 1See more

sockpuppetbrowser zekker6 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
dgtlmoon/sockpuppetbrowser:latest1d8f72d2ce20
aiohttp@3.14.3
3.14.4

Open the chart page →

4,982
alertmanager-matrix-forwarderzloi-space1.0.11 of 2See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
aiohttp@3.8.1
3.14.4

Open the chart page →

3,687
grafana-matrix-forwarderzloi-space1.0.01 of 2See more

grafana-matrix-forwarder zloi-space 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
aiohttp@3.8.1
3.14.4

Open the chart page →

2,115
zoo-project-druzoo-projectOfficialVerified publisher0.10.91 of 6See more

zoo-project-dru zoo-project 0.10.9

1 of the 6 container images this version deploys carry CVE-2026-111750.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-51e7d55383f24594959b69e58518961c6aa66740da112e8d03f1
aiohttp@3.14.3
3.14.4

Open the chart page →

7,561

Container images carrying it

241 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.4
4
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
aiohttp@3.14.3
3.14.4
4
langflowai/langflow:1.12.6:latesta0396e089eb9
aiohttp@3.14.3
3.14.4
3
ghcr.io/paperless-ngx/paperless-ngx:3.3.3dba0242c1df1
aiohttp@3.14.3
3.14.4
3
quay.io/devtron/ai-agent:0.0.16545dac92173
aiohttp@3.10.10
3.14.4
3
esphome/esphome:2026.9.14ad55931c018
aiohttp@3.14.3
3.14.4
2
frinx/topology-discovery:7.0.37832e3589dba
aiohttp@3.10.5
3.14.4
2
ilum/api:6.7.3624fd09528c8
aiohttp@3.14.1
3.14.4
2
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
aiohttp@3.8.1
3.14.4
2
nacos/nacos-server:latest1c191c30c8cd
aiohttp@3.14.3
3.14.4
2
opea/embedding-tei:1.05c9639de61c1
aiohttp@3.10.5
3.14.4
2
opea/reranking-tei:1.0e48613afb191
aiohttp@3.10.5
3.14.4
2
opea/retriever-redis:1.0eb746b263705
aiohttp@3.10.5
3.14.4
2
openbas/caldera-server:5.1.0a277796d9724
aiohttp@3.10.8
3.14.4
2
polyaxon/polyaxon-agent:2.17.0da877a2647fc
aiohttp@3.14.3
3.14.4
2
polyaxon/polyaxon-cli:2.17.0297ed47ed63a
aiohttp@3.14.3
3.14.4
2
safeglobal/safe-config-service:latest09a5e495c219
aiohttp@3.13.5
3.14.4
2
safeglobal/safe-transaction-service:latest7b576c73f865
aiohttp@3.14.3
3.14.4
2
vdiogov/glpi-conteiner:latest6945f84f0058
aiohttp@3.8.4
python-aiohttp@3.8.4-1
3.14.4
no fix listed
2
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
aiohttp@3.13.5
3.14.4
2
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
aiohttp@3.14.3
3.14.4
2
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
aiohttp@3.14.3
3.14.4
2
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
aiohttp@3.11.13
3.14.4
2
ghcr.io/xeor/karb:1.0.6:main647a3c938d31
aiohttp@3.13.3
3.14.4
2
acockburn/appdaemon:4.0.83a93281d7e94
aiohttp@3.7.4
3.14.4
1
acryldata/datahub-actions:v1.7.0.1c5fd70130157
aiohttp@3.14.3
3.14.4
1
agentarea/agentarea-api:0.1.1:latestde166c910ef9
aiohttp@3.14.3
3.14.4
1
agentarea/agentarea-worker:0.1.1:latestadb761a4d103
aiohttp@3.14.3
3.14.4
1
alerta/alerta-web:8.5.04786b9eaa606
aiohttp@3.8.0
3.14.4
1
apache/airflow:2.8.4-python3.964e58748b6b9
aiohttp@3.9.3
3.14.4
1
apache/airflow:2.10.2-python3.9ce90bdc3d2af
aiohttp@3.10.5
3.14.4
1
apache/airflow:2.8.1e5560ad0b86e
aiohttp@3.9.1
3.14.4
1
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
aiohttp@3.7.4
3.14.4
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
aiohttp@3.11.16
3.14.4
1
archivebox/archivebox:0.9.73d4720d86c0e9
aiohttp@3.14.3
3.14.4
1
aristidetm/basic-notebook:3.6.5469dbc951224
aiohttp@3.9.5
3.14.4
1
aristidetm/k8s-hub:3.3.7ccb516cb8474
aiohttp@3.9.3
3.14.4
1
assistiot/cybersecurity-monitoring_id-wzh:latest0aacefac9677
aiohttp@3.7.4
3.14.4
1
assistiot/smart-orchestrator_mcs:latest7d6a0d534c7f
aiohttp@3.9.3
3.14.4
1
baserow/backend:1.31.1e0b3c8130b91
aiohttp@3.9.5
3.14.4
1
baserow/baserow:1.30.1df0c42eb67e8
aiohttp@3.9.5
3.14.4
1
bcgovimages/aries-cloudagent:py36-1.16-1_0.7.4faa2e2d21916
aiohttp@3.8.1
3.14.4
1
berkeleyskypilot/skypilot:0.14.125577df35586
aiohttp@3.14.3
3.14.4
1
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
aiohttp@3.13.2
3.14.4
1
burakince/mlflow:3.16.0ab4b566644b9
aiohttp@3.14.3
3.14.4
1
byjg/easy-haproxy:6.1.1230fdb7b00ae
aiohttp@3.14.1
3.14.4
1
checkmk/check-mk-community:2.5.0p6c11b422210c4
aiohttp@3.13.5
3.14.4
1
chiefonboarding/chiefonboarding:v2.5.0d0964135ea82
aiohttp@3.14.3
3.14.4
1
ciuse99/suggestarr:v1.0.20d72768245ef5
aiohttp@3.11.12
3.14.4
1
clowder/clowder2-backend:2.0.0-beta.411f3d844e4c0
aiohttp@3.11.10
3.14.4
1

syft 1.42.1 · advisories as of 21 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.