StackRadar

CVE-2026-112399

High

Advisory

Published 20 Oct 2026In the index since 21 Oct 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.003
21st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
275
of 18,219 indexed, latest versions
Container images
254
deployed by those charts
Fix available
1 of 2
affected packages

Pillow: APNG background disposal allocates full canvas before decompression bomb check

Carried by container images the latest versions of 275 of 18,219 indexed charts deploy, on 254 images.

Affected packageAffected versionsFixed inImages
pillowpypi8.1.0, 8.1.2, 8.2.0, 8.3.1+24 more13.0.0254
pillowdeb9.4.0-1.1+b1, 9.4.0-1.1+deb12u1, 11.1.0-5+deb13u4no fix listed6
OSV records
DEBIAN-CVE-2026-112399GHSA-5xm2-6676-qcp9

Charts affected

275 by stars
ChartLatestAffected imagesRadar Score
esphomegabe565Verified publisher0.15.01 of 1See more

esphome gabe565 0.15.0

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:latest776a845d5089
pillow@12.3.0
13.0.0

Open the chart page →

4,025
tandoorgabe565Verified publisher0.9.91 of 2See more

tandoor gabe565 0.9.9

1 of the 2 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
pillow@10.4.0
13.0.0

Open the chart page →

2,910
babybuddygeek-cookbookVerified publisher1.2.21 of 1See more

babybuddy geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
linuxserver/babybuddy:1.10.2f7d7c7704249
pillow@9.0.1
13.0.0

Open the chart page →

1,821
beetsgeek-cookbookVerified publisher1.4.21 of 1See more

beets geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
linuxserver/beets:1.5.0e36d16f7341c
pillow@8.4.0
13.0.0

Open the chart page →

1,519
seafilegeek-cookbookVerified publisher3.2.01 of 1See more

seafile geek-cookbook 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:8.0.7ed0fcda5e6a9
pillow@8.3.1
13.0.0

Open the chart page →

100,574
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
pillow@12.0.0
13.0.0

Open the chart page →

12,151
geomapfishgeomapfish0.8.01 of 3See more

geomapfish geomapfish 0.8.0

1 of the 3 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
camptocamp/geomapfishapp-geoportal:latest3f916d5d2f62
pillow@12.3.0
13.0.0

Open the chart page →

7,468
rag-apihajowielandVerified publisher1.0.01 of 1See more

rag-api hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat-rag-api-dev-lite:latesta62ce2221b43
pillow@12.3.0
13.0.0

Open the chart page →

1,808
esphomehelm-chart-roeiVerified publisher2025.3.01 of 1See more

esphome helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
esphome/esphome:2025.3.0def8b6e4f517
pillow@10.4.0
13.0.0

Open the chart page →

6,800
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
pillow@11.1.0
13.0.0

Open the chart page →

6,590
supersethelm-charts-nr1.1.31 of 1See more

superset helm-charts-nr 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
apache/superset:latest16b50bbef664
pillow@11.3.0
13.0.0

Open the chart page →

30,618
changedetectionhelmforgeVerified publisher1.1.201 of 1See more

changedetection helmforge 1.1.20

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.904eaae7915ba
pillow@12.3.0
13.0.0

Open the chart page →

2,728
hermes-agenthelmforgeVerified publisher1.0.21 of 1See more

hermes-agent helmforge 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.9.24fca358f12efd
pillow@12.3.0
13.0.0

Open the chart page →

7,429
immichhelmforgeVerified publisher1.2.131 of 5See more

immich helmforge 1.2.13

1 of the 5 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-machine-learning:v3.1.05a0839dc5303
pillow@12.2.0
13.0.0

Open the chart page →

13,173
langflowhelmforgeVerified publisher2.0.41 of 1See more

langflow helmforge 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
langflowai/langflow:1.12.6a0396e089eb9
pillow@12.3.0
13.0.0

Open the chart page →

578
medikeephelmforgeVerified publisher2.0.51 of 3See more

medikeep helmforge 2.0.5

1 of the 3 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
ghcr.io/afairgiant/medikeep:v0.72.09285e26f6d0d
pillow@12.3.0
13.0.0

Open the chart page →

6,624
netboxhelmforgeVerified publisher2.0.51 of 4See more

netbox helmforge 2.0.5

1 of the 4 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v4.6.10-5.0.291b823a05cb5
pillow@12.3.0
13.0.0

Open the chart page →

5,414
paperless-ngxhelmforgeVerified publisher1.1.11 of 4See more

paperless-ngx helmforge 1.1.1

1 of the 4 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
pillow@12.3.0
13.0.0

Open the chart page →

8,142
supersethelmforgeVerified publisher1.4.21 of 5See more

superset helmforge 1.4.2

1 of the 5 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
apache/superset:6.1.016b50bbef664
pillow@11.3.0
13.0.0

Open the chart page →

34,432
webodmhelmforgeVerified publisher1.1.21 of 4See more

webodm helmforge 1.1.2

1 of the 4 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
opendronemap/nodeodm:3.6.2fcd99eb23d8d
pillow@11.3.0
13.0.0

Open the chart page →

13,271
openaevhelm-openbasVerified publisher2.0.151 of 7See more

openaev helm-openbas 2.0.15

1 of the 7 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
pillow@11.1.0
13.0.0

Open the chart page →

79,005
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
pillow@11.1.0
13.0.0

Open the chart page →

83,823
changedetectionhomeenterpriseinc0.2.01 of 2See more

changedetection homeenterpriseinc 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.44534b9bc5c46e
pillow@10.0.0
13.0.0

Open the chart page →

2,558
homeassistanthomeenterpriseinc0.3.01 of 1See more

homeassistant homeenterpriseinc 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2022.3.5565751f33794
pillow@9.0.1
13.0.0

Open the chart page →

9,543
paperlesshomelabcihelmchartstestVerified publisher9.1.91 of 1See more

paperless homelabcihelmchartstest 9.1.9

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
pillow@10.1.0
13.0.0

Open the chart page →

18,925
paperlesshpVerified publisher0.1.21 of 5See more

paperless hp 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
pillow@12.3.0
13.0.0

Open the chart page →

38,296
ilum-streamlitilumVerified publisher0.1.01 of 1See more

ilum-streamlit ilum 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
ilum/streamlit-example:1.0.0ce5dcdeb22ba
pillow@12.0.0
13.0.0

Open the chart page →

3,484
erpnextimprowisedVerified publisher3.3.01 of 3See more

erpnext improwised 3.3.0

1 of the 3 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
improwised/erpnext-worker:v13.4.197280b55cbd4
pillow@8.2.0
13.0.0

Open the chart page →

8,414
frigateimprowisedVerified publisher1.1.01 of 1See more

frigate improwised 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
ghcr.io/blakeblackshear/frigate:0.13.07a5244e4c8dc
pillow@10.2.0
13.0.0

Open the chart page →

3,408
guardrails-usvcinfracloud-chartsVerified publisher1.0.11 of 1See more

guardrails-usvc infracloud-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
opea/guardrails-tgi:latestf68bec6a1271
pillow@11.1.0
13.0.0

Open the chart page →

5,813
label-studioinseefrlab2.3.11 of 3See more

label-studio inseefrlab 2.3.1

1 of the 3 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
heartexlabs/label-studio:latestafcc516a2277
pillow@12.3.0
13.0.0

Open the chart page →

597
pgadmininseefrlab3.2.01 of 1See more

pgadmin inseefrlab 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
dpage/pgadmin4:latestc332c5f6dfba
pillow@12.3.0
13.0.0

Open the chart page →

449
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
pillow@11.0.0
13.0.0

Open the chart page →

96,413
inventreeinventreeOfficialVerified publisher0.4.341 of 2See more

inventree inventree 0.4.34

1 of the 2 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
inventree/inventree:1.6.17c1e251a6c52
pillow@11.1.0-5+deb13u4
pillow@11.1.0
no fix listed
13.0.0

Open the chart page →

5,919
twitch-channel-points-minerjacobcolvinVerified publisher0.1.01 of 1See more

twitch-channel-points-miner jacobcolvin 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
rdavidoff/twitch-channel-points-miner-v2:1.8.67ae4c5135771
pillow@10.0.0
13.0.0

Open the chart page →

1,632
deconzjanip81-helm-chartsVerified publisher0.1.11 of 1See more

deconz janip81-helm-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
deconzcommunity/deconz:2.29.2062de2362641
pillow@9.4.0-1.1+deb12u1
pillow@9.4.0
no fix listed
13.0.0

Open the chart page →

12,652
esphomejeffrescVerified publisher0.2.21 of 1See more

esphome jeffresc 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.4.078a82d810709
pillow@12.2.0
13.0.0

Open the chart page →

50,047
beetsjmmaloney40.9.61 of 1See more

beets jmmaloney4 0.9.6

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/beets:1.4.9-ls94826263aebec3
pillow@8.2.0
13.0.0

Open the chart page →

1,538
bazarrk8s-home-lab-repo11.3.21 of 1See more

bazarr k8s-home-lab-repo 11.3.2

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
pillow@12.2.0
13.0.0

Open the chart page →

2,409
beetsk8s-home-lab-repo3.1.11 of 1See more

beets k8s-home-lab-repo 3.1.1

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
ghcr.io/home-operations/beets:2.3.1cc4975f1a0be
pillow@11.2.1
13.0.0

Open the chart page →

3,668
frigatek8s-home-lab-repo9.1.11 of 1See more

frigate k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
blakeblackshear/frigate:0.11.18330b0a265b8
pillow@8.1.2
13.0.0

Open the chart page →

3,002
paperlessk8s-home-lab-repo11.0.11 of 1See more

paperless k8s-home-lab-repo 11.0.1

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
pillow@11.3.0
13.0.0

Open the chart page →

11,681
librephotosk8sonlabVerified publisher1.1.71 of 7See more

librephotos k8sonlab 1.1.7

1 of the 7 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
reallibrephotos/librephotos:1.2.1ecd7052f2b5f
pillow@12.3.0
13.0.0

Open the chart page →

18,508
music-assistantkarljorgensen0.1.31 of 1See more

music-assistant karljorgensen 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
pillow@12.1.1
13.0.0

Open the chart page →

8,999
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
pillow@10.0.1
13.0.0

Open the chart page →

8,283
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
pillow@10.4.0
13.0.0

Open the chart page →

10,010
delugelinkding0.2.31 of 1See more

deluge linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
linuxserver/deluge:libtorrentv1-2.2.0-ls40052eac68ccc0
pillow@11.2.1
13.0.0

Open the chart page →

2,300
calendar-apiliturgical0.1.51 of 1See more

calendar-api liturgical 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
ghcr.io/liturgical-app/calendar-api:0.0.9688a685e2bde
pillow@11.3.0
13.0.0

Open the chart page →

2,077
liturgical-apiliturgical0.2.111 of 1See more

liturgical-api liturgical 0.2.11

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
ghcr.io/liturgical-app/liturgical-api:1.0.12637bdcebdd8d
pillow@12.1.1
13.0.0

Open the chart page →

1,535
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry CVE-2026-112399.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
pillow@12.2.0
13.0.0

Open the chart page →

4,282

Container images carrying it

254 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
litellm/litellm-non_root:v1.82.3-stable09b217802ded
pillow@12.1.1
13.0.0
1
loeken/home-assistant:2026.9.2b1dff5b4c593
pillow@12.3.0
13.0.0
1
lsstsqre/exposurelog:0.8.079b00fb67a65
pillow@9.0.1
13.0.0
1
maponyacharles/sceptreai:mlflow-0.1.1242d418654ebd
pillow@12.3.0
13.0.0
1
maponyacharles/sceptreai:api-0.1.127b37b092130a
pillow@12.3.0
13.0.0
1
mathesar/mathesar:0.12.0091757cb01fe
pillow@12.1.1
13.0.0
1
matrixdotorg/synapse:v1.127.1c3c4a9de2a0b
pillow@11.1.0
13.0.0
1
matrixdotorg/synapse:v1.53.0cb89c0f17ba1
pillow@9.0.1
13.0.0
1
matrixdotorg/synapse:v1.78.0def97fd537d8
pillow@9.4.0
13.0.0
1
matrixdotorg/synapse:v1.163.0e98ab72138d9
pillow@12.3.0
13.0.0
1
mcp/kubernetes:latest5ffbf7f0a8aa
pillow@9.4.0-1.1+deb12u1
pillow@9.4.0
no fix listed
13.0.0
1
microslac/users:latest216ea6832a56
pillow@10.2.0
13.0.0
1
mide/minecraft-overviewer:latest4eee0dcb715f
pillow@8.1.2
13.0.0
1
mondata/mlflow:v2.3.0.s3.gc6f94c6caf8bf
pillow@9.5.0
13.0.0
1
moreillon/face-recognition-fastapi:x86bacb2ddd8394
pillow@8.4.0
13.0.0
1
netboxcommunity/netbox:v3.2.83d652dca5351
pillow@9.2.0
13.0.0
1
netboxcommunity/netbox:v4.6.10-5.0.291b823a05cb5
pillow@12.3.0
13.0.0
1
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
pillow@10.3.0
13.0.0
1
networktocode/nautobot:3.0-py3.13ed484336b1ad
pillow@12.2.0
13.0.0
1
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
pillow@12.3.0
13.0.0
1
nousresearch/hermes-agent:v2026.9.24fca358f12efd
pillow@12.3.0
13.0.0
1
onyxdotapp/onyx-backend:latest92b8fab500f9
pillow@12.3.0
13.0.0
1
opea/asr:1.025dd26d9cd09
pillow@10.2.0
13.0.0
1
opea/chatqna:1.038c51b791efa
pillow@10.4.0
13.0.0
1
opea/codegen:1.058f91683892d
pillow@10.4.0
13.0.0
1
opea/codetrans:1.0e2436483b73d
pillow@10.4.0
13.0.0
1
opea/docsum:1.03eaa91849512
pillow@10.4.0
13.0.0
1
opea/guardrails-tgi:1.0262c6048aab8
pillow@10.4.0
13.0.0
1
opea/guardrails-tgi:latestf68bec6a1271
pillow@11.1.0
13.0.0
1
opea/llm-docsum-tgi:1.002f9e8fa5d71
pillow@10.2.0
13.0.0
1
opea/speecht5:1.0249afad3d268
pillow@10.2.0
13.0.0
1
opea/tts:1.0257ae94709e9
pillow@10.2.0
13.0.0
1
opea/web-retriever-chroma:1.0fe08165d7770
pillow@10.4.0
13.0.0
1
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
pillow@11.2.1
13.0.0
1
opencsghq/csgbot:v0.6.9-ee7d0271e26521
pillow@12.1.0
13.0.0
1
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
pillow@11.3.0
13.0.0
1
opendatacube/ows:latest668cbb41473c
pillow@10.2.0
13.0.0
1
opendatacube/wps:latest80df355a660b
pillow@9.0.1
13.0.0
1
opendronemap/nodeodm:3.6.2fcd99eb23d8d
pillow@11.3.0
13.0.0
1
openmined/syft-backend:0.9.5b72f74a68b32
pillow@11.1.0
13.0.0
1
opennode/waldur-mastermind:8.1.382e8f276c5ed
pillow@12.3.0
13.0.0
1
pangeo/base-notebook:2024.01.155fbe688a4f80
pillow@10.2.0
13.0.0
1
pretix/standalone:2026.8.0ec17c2f761f7
pillow@12.3.0
13.0.0
1
prowlercloud/prowler-api:5.31.14f252d579be2
pillow@12.2.0
13.0.0
1
pschiffe/pdns-admin:0.4.137ebba8c2b8f
pillow@11.3.0
13.0.0
1
psono/psono-server:5.0.03b974b43ea03
pillow@10.3.0
13.0.0
1
rdavidoff/twitch-channel-points-miner-v2:1.8.67ae4c5135771
pillow@10.0.0
13.0.0
1
reallibrephotos/librephotos:1.2.1ecd7052f2b5f
pillow@12.3.0
13.0.0
1
redimp/otterwiki:21435c8cc536d
pillow@12.3.0
13.0.0
1
robmarkcole/deepstack-ui:latest410275726459
pillow@8.3.2
13.0.0
1

syft 1.42.1 · advisories as of 22 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.