StackRadar

CVE-2026-111997

Medium

Advisory

Published 22 Oct 2026In the index since 23 Oct 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.003
16th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
574
of 18,232 indexed, latest versions
Container images
591
deployed by those charts
Fix available
1 of 1
affected package

ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process

Carried by container images the latest versions of 574 of 18,232 indexed charts deploy, on 591 images.

Affected packageAffected versionsFixed inImages
ip-addressnpm5.9.4, 6.1.0, 6.4.0, 7.1.0+13 more10.7.4591
OSV records
GHSA-rxp7-6hxx-x8q5

Charts affected

574 by stars
ChartLatestAffected imagesRadar Score
librechatlibrechat1.8.101 of 3See more

librechat librechat 1.8.10

1 of the 3 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
ip-address@9.0.5
10.7.4

Open the chart page →

3,477
headplanenbcloudVerified publisher0.1.21 of 4See more

headplane nbcloud 0.1.2

1 of the 4 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
ghcr.io/tale/headplane:0.5.50dbc52cffc19
ip-address@9.0.5
10.7.4

Open the chart page →

10,369
wg-easywg-easyVerified publisher0.1.61 of 1See more

wg-easy wg-easy 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
ghcr.io/wg-easy/wg-easy:150e7bc9d34e86
ip-address@10.2.0
10.7.4

Open the chart page →

1,319
ghostcloudpirates-ghostVerified publisher0.20.321 of 3See more

ghost cloudpirates-ghost 0.20.32

1 of the 3 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
library/ghost:6.72.0c0d83a8d4522
ip-address@10.1.0
10.7.4

Open the chart page →

8,837
codetogethercodetogether1.4.251 of 1See more

codetogether codetogether 1.4.25

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
codetogether/codetogether:latest4348c8a38752
ip-address@9.0.5
10.7.4

Open the chart page →

8,226
foremancontane-githubOfficialVerified publisher0.6.01 of 1See more

foreman contane-github 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
contane/foreman:0.5.2efb98bdcc4e9
ip-address@9.0.5
10.7.4

Open the chart page →

1,567
convertigoconvertigoOfficialVerified publisher8.4.61 of 5See more

convertigo convertigo 8.4.6

1 of the 5 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
ip-address@9.0.5
10.7.4

Open the chart page →

78,071
cosmocosmo-platformOfficialVerified publisher0.22.13 of 10See more

cosmo cosmo-platform 0.22.1

3 of the 10 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/cdn:0.14.1d86fcf169f15
ip-address@9.0.5
10.7.4
ghcr.io/wundergraph/cosmo/controlplane:0.133.149800ff775f3
ip-address@9.0.5
10.7.4
ghcr.io/wundergraph/cosmo/studio:0.111.0454f4384713a
ip-address@9.0.5
10.7.4

Open the chart page →

93,166
hoppscotchdeliveryheroVerified publisher0.3.21 of 1See more

hoppscotch deliveryhero 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
ip-address@9.0.5
10.7.4

Open the chart page →

4,457
duplistatusduplistatusVerified publisher1.3.01 of 2See more

duplistatus duplistatus 1.3.0

1 of the 2 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
wsjbr/duplistatus:1.5.0bede86cf183f
ip-address@10.2.0
10.7.4

Open the chart page →

1,209
rsshubgabe565Verified publisher0.8.01 of 3See more

rsshub gabe565 0.8.0

1 of the 3 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
diygod/rsshub:latest9cd681008232
ip-address@10.7.0
10.7.4

Open the chart page →

1,505
home-assistanthome-assistantVerified publisher0.5.141 of 3See more

home-assistant home-assistant 0.5.14

1 of the 3 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
koenkk/zigbee2mqtt:2.14.2addbfb08fcef
ip-address@10.7.0
10.7.4

Open the chart page →

3,799
dynamodbkeyporttech0.1.271 of 2See more

dynamodb keyporttech 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
aaronshaf/dynamodb-admin:latestac41724cd997
ip-address@10.1.0
10.7.4

Open the chart page →

1,479
kubebadgeskubebadges0.1.31 of 2See more

kubebadges kubebadges 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
shieldsio/shields:next014ce8f6c41b
ip-address@10.5.0
10.7.4

Open the chart page →

2,315
activepiecesmeyerchartsVerified publisher0.1.61 of 1See more

activepieces meyercharts 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
activepieces/activepieces:0.23.0c26188b44e62
ip-address@9.0.5
10.7.4

Open the chart page →

3,434
pacmanpacmanVerified publisher2.0.21 of 2See more

pacman pacman 2.0.2

1 of the 2 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
ghcr.io/shuguet/pacman:latesta0ec71732c3c
ip-address@10.1.0
10.7.4

Open the chart page →

778
overseerrpree-helm-chartsVerified publisher1.2.01 of 1See more

overseerr pree-helm-charts 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
ghcr.io/sct/overseerr:1.35.06197516c9d7b
ip-address@9.0.5
10.7.4

Open the chart page →

2,945
hedgedocrobertobochetVerified publisher1.4.01 of 1See more

hedgedoc robertobochet 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.12.0cd66986a2a49
ip-address@10.5.0
10.7.4

Open the chart page →

2,825
pretixtechwolf12Verified publisher2026.8.01 of 3See more

pretix techwolf12 2026.8.0

1 of the 3 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
pretix/standalone:2026.8.0ec17c2f761f7
ip-address@10.1.0
10.7.4

Open the chart page →

10,704
feedbacksystemthm-mni-iiVerified publisher0.48.33 of 14See more

feedbacksystem thm-mni-ii 0.48.3

3 of the 14 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
ghcr.io/thm-mni-ii/fbs-collab:v2.0.9c07fb0c17bc0
ip-address@10.1.0
10.7.4
ghcr.io/thm-mni-ii/fbs-qcm-backend:v2.0.9575f448818e1
ip-address@9.0.5
10.7.4
ghcr.io/thm-mni-ii/fbs-qcm-frontend:v2.0.9083d81d517e7
ip-address@9.0.5
10.7.4

Open the chart page →

30,435
wgerwgerOfficialVerified publisher2.0.01 of 7See more

wger wger 2.0.0

1 of the 7 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
journeyapps/powersync-service:latest15b8e4dbbab1
ip-address@10.2.0
10.7.4

Open the chart page →

9,402
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
ip-address@9.0.5
10.7.4

Open the chart page →

5,712
aapbaapbVerified publisher0.1.31 of 1See more

aapb aapb 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/dream-aapb:main23a86c7a0b8a
ip-address@10.5.0
10.7.4

Open the chart page →

1,026
agentareaagentareaVerified publisher0.0.293 of 17See more

agentarea agentarea 0.0.29

3 of the 17 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
agentarea/agentarea-frontend:0.1.1066e740df4d7
ip-address@10.1.0
10.7.4
agentarea/agentarea-mcp-base:0.1.18b80f30570ff
ip-address@10.1.0
10.7.4
agentarea/agentarea-mcp-runner:0.1.1066fa4a71695
ip-address@10.1.0
10.7.4

Open the chart page →

12,660
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
ip-address@10.2.0
10.7.4

Open the chart page →

8,258
dbgateappscodeVerified publisher2026.3.301 of 1See more

dbgate appscode 2026.3.30

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
dbgate/dbgate:7.2.0-alpine287077002446
ip-address@9.0.5
10.7.4

Open the chart page →

946
kinesisaws-kinesis-local0.8.01 of 1See more

kinesis aws-kinesis-local 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
saidsef/aws-kinesis-local:v2026.0667025e3a163e
ip-address@10.2.0
10.7.4

Open the chart page →

518
seerrbdclark-helm-chartsVerified publisher0.1.61 of 1See more

seerr bdclark-helm-charts 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.5.027602401178d
ip-address@9.0.5
10.7.4

Open the chart page →

2,370
betterdb-monitorbetterdb-monitorOfficialVerified publisher0.51.11 of 1See more

betterdb-monitor betterdb-monitor 0.51.1

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
betterdb/monitor:0.51.1-no-aic4910692b3fc
ip-address@10.4.0
10.7.4

Open the chart page →

391
opensearch-dashboardscaptnbpVerified publisher2.2.11 of 1See more

opensearch-dashboards captnbp 2.2.1

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.15.0b7c26c60bfaf
ip-address@6.4.0
10.7.4

Open the chart page →

2,037
home-assistant-matter-servercharts-derwitt-devVerified publisher4.4.11 of 2See more

home-assistant-matter-server charts-derwitt-dev 4.4.1

1 of the 2 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
ghcr.io/matter-js/matterjs-server:1.5.247bc4d8354ba
ip-address@10.5.0
10.7.4

Open the chart page →

1,750
node-redcharts-derwitt-devVerified publisher2.1.41 of 1See more

node-red charts-derwitt-dev 2.1.4

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
nodered/node-red:5.0.9e085d4a06591
ip-address@10.7.2
10.7.4

Open the chart page →

140
maildevchristianhuthVerified publisher1.6.11 of 1See more

maildev christianhuth 1.6.1

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
maildev/maildev:2.2.1180ef51f65ee
ip-address@9.0.5
10.7.4

Open the chart page →

1,568
claude-code-hubclaude-code-hub0.1.01 of 4See more

claude-code-hub claude-code-hub 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
ghcr.io/ding113/claude-code-hub:latestfa7c6f5428c2
ip-address@10.5.0
10.7.4

Open the chart page →

2,370
data-fairdata354-helmVerified publisher1.1.22 of 12See more

data-fair data354-helm 1.1.2

2 of the 12 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
ghcr.io/data-fair/notify:3c739b74dabb0
ip-address@9.0.5
10.7.4
ghcr.io/data-fair/portals:18b621866ceb2
ip-address@10.2.0
10.7.4

Open the chart page →

43,759
kubedashdevopstalesOfficialVerified publisher4.0.01 of 8See more

kubedash devopstales 4.0.0

1 of the 8 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
patrikx3/p3x-redis-ui:latestf19eb45b0694
ip-address@10.2.0
10.7.4

Open the chart page →

12,937
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
ip-address@10.2.0
10.7.4

Open the chart page →

9,932
jellystatdjjudas21Verified publisher1.0.21 of 1See more

jellystat djjudas21 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
cyfershepard/jellystat:1.1.12e61c759ec706
ip-address@10.2.0
10.7.4

Open the chart page →

2,174
joplin-serverdjjudas21Verified publisher6.0.01 of 1See more

joplin-server djjudas21 6.0.0

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
joplin/server:3.7.23f7b852959aa
ip-address@10.2.0
10.7.4

Open the chart page →

2,987
domain-lockerdomain-locker0.3.51 of 2See more

domain-locker domain-locker 0.3.5

1 of the 2 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
lissy93/domain-locker:latest830bc2978462
ip-address@10.2.0
10.7.4

Open the chart page →

1,223
rstudiodsri-helm-charts0.1.281 of 1See more

rstudio dsri-helm-charts 0.1.28

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
ghcr.io/maastrichtu-ids/rstudio:latest981aa4c109e1
ip-address@9.0.5
10.7.4

Open the chart page →

76,136
enbuildenbuildVerified publisher0.0.503 of 6See more

enbuild enbuild 0.0.50

3 of the 6 container images this version deploys carry CVE-2026-111997.

Open the chart page →

76,510
ethereumjsethereum-helm-chartsVerified publisher0.1.21 of 2See more

ethereumjs ethereum-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
ethpandaops/ethereumjs:masterfb84b718500f
ip-address@9.0.5
10.7.4

Open the chart page →

2,338
iobrokereugen0.2.61 of 1See more

iobroker eugen 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
ip-address@9.0.5
10.7.4

Open the chart page →

79,213
gentlemangentlemanOfficialVerified publisher0.2.01 of 1See more

gentleman gentleman 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
ghcr.io/madebyman/gentleman:0.4.18ff2cffd180b
ip-address@10.5.0
10.7.4

Open the chart page →

1,155
ghostfolioghostfolioVerified publisher0.5.41 of 3See more

ghostfolio ghostfolio 0.5.4

1 of the 3 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
ip-address@10.1.0
10.7.4

Open the chart page →

3,689
globalpingglobalpingVerified publisher1.0.111 of 1See more

globalping globalping 1.0.11

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
globalping/globalping-probe:latest5a278ae9579e
ip-address@10.1.0
10.7.4

Open the chart page →

657
ghostgroundhog2k0.212.181 of 1See more

ghost groundhog2k 0.212.18

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
library/ghost:6.71.000032f157262
ip-address@10.1.0
10.7.4

Open the chart page →

1,993
growthbookgrowthbook5.1.01 of 2See more

growthbook growthbook 5.1.0

1 of the 2 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
growthbook/growthbook:5.1.0c8a124f55dca
ip-address@10.5.0
10.7.4

Open the chart page →

1,390
uptime-kumahelmforgeVerified publisher1.5.171 of 1See more

uptime-kuma helmforge 1.5.17

1 of the 1 container images this version deploys carry CVE-2026-111997.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.69912da7d7d9b
ip-address@10.1.0
10.7.4

Open the chart page →

39,295

Container images carrying it

591 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
n8nio/n8n:2.44.4c72fa9f1bd9b
ip-address@10.3.1
10.7.4
1
n8nio/n8n:2.36.8cfe2704ff858
ip-address@10.3.1
10.7.4
1
n8nio/n8n:2.43.3d4eca183959b
ip-address@10.3.1
10.7.4
1
n8nio/n8n:1.33.1dd171d45102a
ip-address@9.0.5
10.7.4
1
n8nio/n8n:1.115.1ed16e560c40e
ip-address@9.0.5
10.7.4
1
neoskop/ixy:3.1.0326a4d2db1c9
ip-address@10.5.0
10.7.4
1
nocodb/nocodb:latest27d2fd14670d
ip-address@10.7.2
10.7.4
1
nocodb/nocodb:0.258.06779a4ddedf2
ip-address@9.0.5
10.7.4
1
nocodb/nocodb:0.301.5d9516f0bf546
ip-address@9.0.5
10.7.4
1
nodered/node-red:5.0.410f40d0a83e7
ip-address@10.3.1
10.7.4
1
nodered/node-red:4.1.2216e7403aab9
ip-address@10.1.0
10.7.4
1
nodered/node-red:4.1.10-minimald73ae167cb9b
ip-address@10.1.0
10.7.4
1
nodered/node-red:5.0.9e085d4a06591
ip-address@10.7.2
10.7.4
1
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
ip-address@10.2.0
10.7.4
1
nousresearch/hermes-agent:v2026.9.24fca358f12efd
ip-address@10.2.0
10.7.4
1
oada/auth:4.0.0c0d077e79ef4
ip-address@9.0.5
10.7.4
1
oada/http-handler:4.0.0d87efe8ba4b0
ip-address@9.0.5
10.7.4
1
oada/rev-graph-update:4.0.0ebc8343f05ff
ip-address@9.0.5
10.7.4
1
oada/shares:4.0.0c6ffb4e8ed63
ip-address@9.0.5
10.7.4
1
oada/startup:4.0.0fc09495e2f3c
ip-address@9.0.5
10.7.4
1
oada/sync-handler:4.0.0b7a2cfc137cf
ip-address@9.0.5
10.7.4
1
oada/users:4.0.0b6c562fa5b1b
ip-address@9.0.5
10.7.4
1
oada/webhooks:4.0.06590c60de347
ip-address@9.0.5
10.7.4
1
oada/well-known:4.0.07943fde43b19
ip-address@9.0.5
10.7.4
1
oada/write-handler:4.0.08464c7f48aae
ip-address@9.0.5
10.7.4
1
obolnetwork/charon-dkg-sidecar:main87902178f0e7
ip-address@10.1.0
10.7.4
1
oneuptime/probe:release9502ee0cf3f5
ip-address@10.7.2
10.7.4
1
opencloudeu/yjs:1.1.099c6ce4688b0
ip-address@10.2.0
10.7.4
1
opencti/platform:7.261021.18f85a05cfc18
ip-address@10.1.0
10.7.4
1
opendatacube/wps:latest80df355a660b
ip-address@9.0.5
10.7.4
1
openmined/syft-frontend:0.9.5d11524a3854a
ip-address@9.0.5
10.7.4
1
openproject/hocuspocus:release-338001b288dc1359dfb5
ip-address@9.0.5
10.7.4
1
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
ip-address@6.4.0
10.7.4
1
opensearchproject/opensearch-dashboards:2.10.0485a0019e5d6
ip-address@6.4.0
10.7.4
1
opensearchproject/opensearch-dashboards:2.15.0b7c26c60bfaf
ip-address@6.4.0
10.7.4
1
opensign/opensign0ebc230eed21
ip-address@9.0.5
10.7.4
1
oryd/hydra-login-consent-node:v26.2.06465e95993b5
ip-address@9.0.5
10.7.4
1
outlinewiki/outline:1.11.008ee9ffdb847
ip-address@10.2.0
10.7.4
1
outlinewiki/outline:0.82.0494dfb9249a6
ip-address@9.0.5
10.7.4
1
penpotapp/exporter:2.18.3418232d6ca31
ip-address@10.3.1
10.7.4
1
penpotapp/exporter:2.2.15c835ffd87ab
ip-address@9.0.5
10.7.4
1
penpotapp/mcp:2.18.35e811e6eeb17
ip-address@10.5.0
10.7.4
1
phpdockerio/readability-js-server:1.8.0ea8354b42600
ip-address@10.0.1
10.7.4
1
polonel/trudesk:1.2.60cf6513f6fe3
ip-address@8.1.0
10.7.4
1
pretix/standalone:2026.8.0ec17c2f761f7
ip-address@10.1.0
10.7.4
1
prowlercloud/prowler-ui:5.31.179ee83c8e702
ip-address@10.0.1
10.7.4
1
pschiffe/pdns-admin:0.4.137ebba8c2b8f
ip-address@9.0.5
10.7.4
1
qxip/qryn:3.2.3977acc9c7a9fd
ip-address@9.0.5
10.7.4
1
rahulbhiwagade122/desishowbiz:latest08490b70998c
ip-address@9.0.5
10.7.4
1
rajnandan1/kener:3.2.1930407afca731
ip-address@9.0.5
10.7.4
1

syft 1.42.1 · advisories as of 23 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.