StackRadar

CVE-2026-112400

High

Advisory

Published 20 Oct 2026In the index since 21 Oct 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.003
20th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
252
of 18,208 indexed, latest versions
Container images
230
deployed by those charts
Fix available
1 of 2
affected packages

Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS

Carried by container images the latest versions of 252 of 18,208 indexed charts deploy, on 230 images.

Affected packageAffected versionsFixed inImages
pillowpypi9.2.0, 9.3.0, 9.4.0, 9.5.0+15 more13.0.0230
pillowdeb9.4.0-1.1+b1, 9.4.0-1.1+deb12u1, 11.1.0-5+deb13u4no fix listed6
OSV records
DEBIAN-CVE-2026-112400GHSA-65qm-jvmh-6pqg

Charts affected

252 by stars
ChartLatestAffected imagesRadar Score
pgadmin4runixVerified publisher1.70.41 of 1See more

pgadmin4 runix 1.70.4

1 of the 1 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
dpage/pgadmin4:9.18c332c5f6dfba
pillow@12.3.0
13.0.0

Open the chart page →

229
home-assistanthelm-hassVerified publisher0.3.871 of 1See more

home-assistant helm-hass 0.3.87

1 of the 1 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.233afb0659d78
pillow@12.3.0
13.0.0

Open the chart page →

3,196
mlflowcommunity-chartsVerified publisher1.11.71 of 1See more

mlflow community-charts 1.11.7

1 of the 1 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
burakince/mlflow:3.16.0ab4b566644b9
pillow@12.3.0
13.0.0

Open the chart page →

1,190
netboxnetboxOfficialVerified publisher8.3.931 of 5See more

netbox netbox 8.3.93

1 of the 5 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
ghcr.io/netbox-community/netbox:v4.7.31d6e0b5fbd48
pillow@12.3.0
13.0.0

Open the chart page →

1,666
netboxbootcVerified publisher4.1.11 of 4See more

netbox bootc 4.1.1

1 of the 4 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.2.83d652dca5351
pillow@9.2.0
13.0.0

Open the chart page →

10,077
clearmlallegroaiOfficialVerified publisher7.15.01 of 4See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
allegroai/clearml:2.0.0-613713ae38f7daf
pillow@11.0.0
13.0.0

Open the chart page →

12,160
weblateweblateOfficialVerified publisher0.5.431 of 3See more

weblate weblate 0.5.43

1 of the 3 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
weblate/weblate:2026.10.1.1b0f200f38d70
pillow@12.3.0
13.0.0

Open the chart page →

7,734
difydify-helmVerified publisher0.39.02 of 11See more

dify dify-helm 0.39.0

2 of the 11 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
langgenius/dify-agent-backend:1.17.0bdb2ed516bd3
pillow@12.3.0
13.0.0
langgenius/dify-api:1.17.052be6088dd84
pillow@12.3.0
13.0.0

Open the chart page →

63,506
synapsehalkeye0.40.01 of 2See more

synapse halkeye 0.40.0

1 of the 2 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
pillow@10.4.0
13.0.0

Open the chart page →

7,729
daskdask2024.1.12 of 2See more

dask dask 2024.1.1

2 of the 2 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
ghcr.io/dask/dask:2024.1.0080150de7d86
pillow@10.0.1
13.0.0
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
pillow@10.2.0
13.0.0

Open the chart page →

14,949
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
pillow@10.1.0
13.0.0

Open the chart page →

7,629
frigateblakeblackshear7.8.01 of 1See more

frigate blakeblackshear 7.8.0

1 of the 1 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
ghcr.io/blakeblackshear/frigate:0.14.122e3d0b486df
pillow@10.4.0
13.0.0

Open the chart page →

4,463
paperless-ngxfmjstudios0.2.81 of 5See more

paperless-ngx fmjstudios 0.2.8

1 of the 5 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.10.1a132c2ac7c57
pillow@10.3.0
13.0.0

Open the chart page →

35,475
nautobotnautobotOfficialVerified publisher3.1.21 of 1See more

nautobot nautobot 3.1.2

1 of the 1 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
networktocode/nautobot:3.0-py3.13ed484336b1ad
pillow@12.2.0
13.0.0

Open the chart page →

5,471
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
pillow@11.1.0
13.0.0

Open the chart page →

21,802
paperless-ngxpaperless-ngxVerified publisher0.3.251 of 3See more

paperless-ngx paperless-ngx 0.3.25

1 of the 3 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.3dba0242c1df1
pillow@12.3.0
13.0.0

Open the chart page →

9,536
home-assistantalekcVerified publisher2.12.21 of 1See more

home-assistant alekc 2.12.2

1 of the 1 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.233afb0659d78
pillow@12.3.0
13.0.0

Open the chart page →

3,196
home-assistantandrenarchyVerified publisher14.104.01 of 1See more

home-assistant andrenarchy 14.104.0

1 of the 1 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
pillow@12.3.0
13.0.0

Open the chart page →

3,705
baserowbaserow-chartVerified publisher1.1.11 of 6See more

baserow baserow-chart 1.1.1

1 of the 6 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
baserow/backend:2.4.1497347d0ba74
pillow@12.3.0
13.0.0

Open the chart page →

19,235
pgadmincetic0.1.121 of 1See more

pgadmin cetic 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
dpage/pgadmin4:latestc332c5f6dfba
pillow@12.3.0
13.0.0

Open the chart page →

229
daskhubdask2024.1.11 of 9See more

daskhub dask 2024.1.1

1 of the 9 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
pillow@10.2.0
13.0.0

Open the chart page →

18,133
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
datamate/seafile-professional:11.0.202dd66b722464
pillow@10.2.0
13.0.0

Open the chart page →

84,871
netboxstartechnicaVerified publisher5.1.01 of 4See more

netbox startechnica 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
pillow@10.3.0
13.0.0

Open the chart page →

2,028
grafana-pdf-exporterwiremindVerified publisher2.1.11 of 1See more

grafana-pdf-exporter wiremind 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
ghcr.io/wiremind/grafana-pdf-exporter:v1.7dbaa8527bf4c
pillow@9.4.0-1.1+b1
pillow@9.4.0
no fix listed
13.0.0

Open the chart page →

10,798
matrixzekker6Verified publisher3.33.01 of 4See more

matrix zekker6 3.33.0

1 of the 4 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.163.0e98ab72138d9
pillow@12.3.0
13.0.0

Open the chart page →

6,075
changedetectionalekcVerified publisher0.14.71 of 1See more

changedetection alekc 0.14.7

1 of the 1 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.904eaae7915ba
pillow@12.3.0
13.0.0

Open the chart page →

2,534
convertigoconvertigoOfficialVerified publisher8.4.61 of 5See more

convertigo convertigo 8.4.6

1 of the 5 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
pillow@10.3.0
13.0.0

Open the chart page →

17,635
defectdojodefectdojo1.9.581 of 4See more

defectdojo defectdojo 1.9.58

1 of the 4 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
defectdojo/defectdojo-django:3.4.200e391fb1d6975
pillow@12.3.0
13.0.0

Open the chart page →

2,305
openshift-secured-pgadmineximiaitVerified publisher0.2.01 of 2See more

openshift-secured-pgadmin eximiait 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
dpage/pgadmin4:7.537946e4f3e7b
pillow@9.5.0
13.0.0

Open the chart page →

15,763
mlflowgetindataVerified publisher0.1.21 of 1See more

mlflow getindata 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
gcr.io/getindata-images-public/mlflow:latest25d6975951f1
pillow@10.3.0
13.0.0

Open the chart page →

2,775
simple-krr-dashboardhelm-simple-krr-dashboardVerified publisher1.6.21 of 3See more

simple-krr-dashboard helm-simple-krr-dashboard 1.6.2

1 of the 3 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
robustadev/krr:v1.30.0b8d782e568c7
pillow@12.3.0
13.0.0

Open the chart page →

3,130
home-assistanthome-assistantVerified publisher0.5.141 of 3See more

home-assistant home-assistant 0.5.14

1 of the 3 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.233afb0659d78
pillow@12.3.0
13.0.0

Open the chart page →

3,420
calibre-webk8s-home-lab-repo9.1.11 of 1See more

calibre-web k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
pillow@12.3.0
13.0.0

Open the chart page →

6,871
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
pillow@12.1.1
13.0.0

Open the chart page →

6,252
mlflow-tracking-servermlflow-tracking-serverVerified publisher4.1.01 of 1See more

mlflow-tracking-server mlflow-tracking-server 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
ghcr.io/mlflow-oidc/mlflow-tracking-server:3.16.1-9.0.2-20261001970ba1cc1e69
pillow@12.3.0
13.0.0

Open the chart page →

789
oesopsmxVerified publisher4.0.321 of 25See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/ubi8-oes-datascience:isd-spin-2025.10.01-af26a30d4-202511261054d8f66f4117fe
pillow@12.0.0
13.0.0

Open the chart page →

113,160
skypilotskypilotOfficialVerified publisher0.14.11 of 3See more

skypilot skypilot 0.14.1

1 of the 3 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot:0.14.125577df35586
pillow@12.3.0
13.0.0

Open the chart page →

6,484
pretixtechwolf12Verified publisher2026.8.01 of 3See more

pretix techwolf12 2026.8.0

1 of the 3 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
pretix/standalone:2026.8.0ec17c2f761f7
pillow@12.3.0
13.0.0

Open the chart page →

10,080
mealieth-chartsVerified publisher0.5.11 of 1See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
pillow@12.0.0
13.0.0

Open the chart page →

4,889
wgerwgerOfficialVerified publisher2.0.01 of 7See more

wger wger 2.0.0

1 of the 7 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
wger/server:2.71c5789b93bfe
pillow@12.3.0
13.0.0

Open the chart page →

9,140
paperlesszekker6Verified publisher11.13.01 of 1See more

paperless zekker6 11.13.0

1 of the 1 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
pillow@12.3.0
13.0.0

Open the chart page →

5,509
paperless-ngxadnoctemVerified publisher0.5.11 of 5See more

paperless-ngx adnoctem 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
pillow@12.3.0
13.0.0

Open the chart page →

27,329
agentareaagentareaVerified publisher0.0.281 of 17See more

agentarea agentarea 0.0.28

1 of the 17 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
agentarea/agentarea-mcp-runner:0.1.1066fa4a71695
pillow@12.3.0
13.0.0

Open the chart page →

12,172
paperless-ngxalexmorbo-paperless-ngxVerified publisher0.2.01 of 2See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
pillow@11.3.0
13.0.0

Open the chart page →

14,774
clearml-servingallegroaiVerified publisher1.6.22 of 9See more

clearml-serving allegroai 1.6.2

2 of the 9 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
allegroai/clearml-serving-inference:1.3.0fca885e8cfc6
pillow@9.4.0
13.0.0
allegroai/clearml-serving-statistics:1.3.0c58d9da7bdf8
pillow@9.4.0
13.0.0

Open the chart page →

26,263
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
pillow@12.3.0
13.0.0

Open the chart page →

7,885
psonoankra-chartsVerified publisher1.2.01 of 2See more

psono ankra-charts 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
psono/psono-server:5.0.03b974b43ea03
pillow@10.3.0
13.0.0

Open the chart page →

2,659
music-assistantbdclark-helm-chartsVerified publisher0.4.151 of 1See more

music-assistant bdclark-helm-charts 0.4.15

1 of the 1 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
pillow@12.3.0
13.0.0

Open the chart page →

5,023
squestchristianhuthVerified publisher7.0.21 of 4See more

squest christianhuth 7.0.2

1 of the 4 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
pillow@10.3.0
13.0.0

Open the chart page →

5,149
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-112400.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
pillow@10.2.0
13.0.0

Open the chart page →

13,290

Container images carrying it

230 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
netboxcommunity/netbox:v3.2.83d652dca5351
pillow@9.2.0
13.0.0
1
netboxcommunity/netbox:v4.6.10-5.0.291b823a05cb5
pillow@12.3.0
13.0.0
1
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
pillow@10.3.0
13.0.0
1
networktocode/nautobot:3.0-py3.13ed484336b1ad
pillow@12.2.0
13.0.0
1
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
pillow@12.3.0
13.0.0
1
nousresearch/hermes-agent:v2026.9.24fca358f12efd
pillow@12.3.0
13.0.0
1
onyxdotapp/onyx-backend:latest92b8fab500f9
pillow@12.3.0
13.0.0
1
opea/asr:1.025dd26d9cd09
pillow@10.2.0
13.0.0
1
opea/chatqna:1.038c51b791efa
pillow@10.4.0
13.0.0
1
opea/codegen:1.058f91683892d
pillow@10.4.0
13.0.0
1
opea/codetrans:1.0e2436483b73d
pillow@10.4.0
13.0.0
1
opea/docsum:1.03eaa91849512
pillow@10.4.0
13.0.0
1
opea/guardrails-tgi:1.0262c6048aab8
pillow@10.4.0
13.0.0
1
opea/guardrails-tgi:latestf68bec6a1271
pillow@11.1.0
13.0.0
1
opea/llm-docsum-tgi:1.002f9e8fa5d71
pillow@10.2.0
13.0.0
1
opea/speecht5:1.0249afad3d268
pillow@10.2.0
13.0.0
1
opea/tts:1.0257ae94709e9
pillow@10.2.0
13.0.0
1
opea/web-retriever-chroma:1.0fe08165d7770
pillow@10.4.0
13.0.0
1
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
pillow@11.2.1
13.0.0
1
opencsghq/csgbot:v0.6.9-ee7d0271e26521
pillow@12.1.0
13.0.0
1
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
pillow@11.3.0
13.0.0
1
opendatacube/ows:latest668cbb41473c
pillow@10.2.0
13.0.0
1
opendronemap/nodeodm:3.6.2fcd99eb23d8d
pillow@11.3.0
13.0.0
1
openmined/syft-backend:0.9.5b72f74a68b32
pillow@11.1.0
13.0.0
1
opennode/waldur-mastermind:8.1.382e8f276c5ed
pillow@12.3.0
13.0.0
1
pangeo/base-notebook:2024.01.155fbe688a4f80
pillow@10.2.0
13.0.0
1
pretix/standalone:2026.8.0ec17c2f761f7
pillow@12.3.0
13.0.0
1
prowlercloud/prowler-api:5.31.14f252d579be2
pillow@12.2.0
13.0.0
1
pschiffe/pdns-admin:0.4.137ebba8c2b8f
pillow@11.3.0
13.0.0
1
psono/psono-server:5.0.03b974b43ea03
pillow@10.3.0
13.0.0
1
rdavidoff/twitch-channel-points-miner-v2:1.8.67ae4c5135771
pillow@10.0.0
13.0.0
1
reallibrephotos/librephotos:1.2.1ecd7052f2b5f
pillow@12.3.0
13.0.0
1
redimp/otterwiki:21435c8cc536d
pillow@12.3.0
13.0.0
1
robustadev/krr:v1.30.0b8d782e568c7
pillow@12.3.0
13.0.0
1
rommapp/romm:5.2.03512f2ca4557
pillow@12.3.0
13.0.0
1
rommapp/romm:4.4.1b909e95d1aab
pillow@10.4.0
13.0.0
1
saidsef/scapy-containerised:v2025.02f17f7c435891
pillow@11.1.0
13.0.0
1
schmitzis/monorepo:seafile-13.0-latestc583f1be2af2
pillow@11.3.0
13.0.0
1
seafileltd/seafile-mc:9.0.106693911bcc40
pillow@9.3.0
13.0.0
1
seafileltd/seafile-mc:10.0.170628f29c663
pillow@9.3.0
13.0.0
1
seafileltd/seafile-mc:9.0.97ac833196f60
pillow@9.2.0
13.0.0
1
signalen/backend:2.50.1826bb090bc4e4
pillow@12.3.0
13.0.0
1
sirrend/helmup-engine:0.1.13699e79e3d4e2
pillow@10.4.0
13.0.0
1
sirrend/helmup-github-scraper:0.1.47ca688c7abf5
pillow@10.3.0
13.0.0
1
sruthitanneru/pi-sample:ui-lateste565ea454ffd
pillow@11.0.0
13.0.0
1
szurubooru/server:2.5accf2ad9fbc3
pillow@11.2.1
13.0.0
1
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
pillow@9.4.0
13.0.0
1
taigaio/taiga-back:latest4beed8f62c9f
pillow@12.0.0
13.0.0
1
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
pillow@11.1.0
13.0.0
1
tombursch/kitchenowl-backend:v0.7.104a7ed693531b
pillow@12.3.0
13.0.0
1

syft 1.42.1 · advisories as of 21 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.