StackRadar

CVE-2026-112406

High

Advisory

Published 20 Oct 2026In the index since 21 Oct 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.003
21st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
300
of 18,219 indexed, latest versions
Container images
279
deployed by those charts
Fix available
1 of 2
affected packages

Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

Carried by container images the latest versions of 300 of 18,219 indexed charts deploy, on 279 images.

Affected packageAffected versionsFixed inImages
pillowpypi5.1.0, 5.2.0, 5.3.0, 5.4.1+32 more13.0.0279
pillowdeb9.4.0-1.1+b1, 9.4.0-1.1+deb12u1, 11.1.0-5+deb13u4no fix listed6
OSV records
DEBIAN-CVE-2026-112406GHSA-f2g6-542v-9j58

Charts affected

300 by stars
ChartLatestAffected imagesRadar Score
pgadmin4runixVerified publisher1.70.41 of 1See more

pgadmin4 runix 1.70.4

1 of the 1 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
dpage/pgadmin4:9.18c332c5f6dfba
pillow@12.3.0
13.0.0

Open the chart page →

449
home-assistanthelm-hassVerified publisher0.3.871 of 1See more

home-assistant helm-hass 0.3.87

1 of the 1 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.233afb0659d78
pillow@12.3.0
13.0.0

Open the chart page →

3,436
mlflowcommunity-chartsVerified publisher1.11.71 of 1See more

mlflow community-charts 1.11.7

1 of the 1 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
burakince/mlflow:3.16.0ab4b566644b9
pillow@12.3.0
13.0.0

Open the chart page →

1,404
netboxnetboxOfficialVerified publisher8.3.931 of 5See more

netbox netbox 8.3.93

1 of the 5 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
ghcr.io/netbox-community/netbox:v4.7.31d6e0b5fbd48
pillow@12.3.0
13.0.0

Open the chart page →

1,889
netboxbootcVerified publisher4.1.11 of 4See more

netbox bootc 4.1.1

1 of the 4 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.2.83d652dca5351
pillow@9.2.0
13.0.0

Open the chart page →

10,225
clearmlallegroaiOfficialVerified publisher7.15.01 of 4See more

clearml allegroai 7.15.0

1 of the 4 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
allegroai/clearml:2.0.0-613713ae38f7daf
pillow@11.0.0
13.0.0

Open the chart page →

72,464
weblateweblateOfficialVerified publisher0.5.441 of 3See more

weblate weblate 0.5.44

1 of the 3 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
weblate/weblate:2026.10.1.26663a7c8b444
pillow@12.3.0
13.0.0

Open the chart page →

7,687
difydify-helmVerified publisher0.39.02 of 11See more

dify dify-helm 0.39.0

2 of the 11 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
langgenius/dify-agent-backend:1.17.0bdb2ed516bd3
pillow@12.3.0
13.0.0
langgenius/dify-api:1.17.052be6088dd84
pillow@12.3.0
13.0.0

Open the chart page →

63,621
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
pillow@9.1.0
13.0.0

Open the chart page →

9,560
synapsehalkeye0.40.01 of 2See more

synapse halkeye 0.40.0

1 of the 2 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
pillow@10.4.0
13.0.0

Open the chart page →

7,931
daskdask2024.1.12 of 2See more

dask dask 2024.1.1

2 of the 2 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
ghcr.io/dask/dask:2024.1.0080150de7d86
pillow@10.0.1
13.0.0
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
pillow@10.2.0
13.0.0

Open the chart page →

15,300
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
pillow@10.1.0
13.0.0

Open the chart page →

7,875
frigateblakeblackshear7.8.01 of 1See more

frigate blakeblackshear 7.8.0

1 of the 1 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
ghcr.io/blakeblackshear/frigate:0.14.122e3d0b486df
pillow@10.4.0
13.0.0

Open the chart page →

4,661
paperless-ngxfmjstudios0.2.81 of 5See more

paperless-ngx fmjstudios 0.2.8

1 of the 5 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.10.1a132c2ac7c57
pillow@10.3.0
13.0.0

Open the chart page →

35,732
nautobotnautobotOfficialVerified publisher3.2.01 of 1See more

nautobot nautobot 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
networktocode/nautobot:3.0-py3.13ed484336b1ad
pillow@12.2.0
13.0.0

Open the chart page →

5,723
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
pillow@11.1.0
13.0.0

Open the chart page →

22,008
paperless-ngxpaperless-ngxVerified publisher0.3.251 of 3See more

paperless-ngx paperless-ngx 0.3.25

1 of the 3 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.3dba0242c1df1
pillow@12.3.0
13.0.0

Open the chart page →

9,700
home-assistantalekcVerified publisher2.12.21 of 1See more

home-assistant alekc 2.12.2

1 of the 1 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.233afb0659d78
pillow@12.3.0
13.0.0

Open the chart page →

3,436
home-assistantandrenarchyVerified publisher14.104.01 of 1See more

home-assistant andrenarchy 14.104.0

1 of the 1 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
pillow@12.3.0
13.0.0

Open the chart page →

3,985
minecraft-overvieweralphani-helm-chartsVerified publisher0.1.01 of 3See more

minecraft-overviewer alphani-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
mide/minecraft-overviewer:latest4eee0dcb715f
pillow@8.1.2
13.0.0

Open the chart page →

4,004
baserowbaserow-chartVerified publisher1.1.11 of 6See more

baserow baserow-chart 1.1.1

1 of the 6 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
baserow/backend:2.4.1497347d0ba74
pillow@12.3.0
13.0.0

Open the chart page →

19,474
pgadmincetic0.1.121 of 1See more

pgadmin cetic 0.1.12

1 of the 1 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
dpage/pgadmin4:latestc332c5f6dfba
pillow@12.3.0
13.0.0

Open the chart page →

449
daskhubdask2024.1.11 of 9See more

daskhub dask 2024.1.1

1 of the 9 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
pillow@10.2.0
13.0.0

Open the chart page →

18,364
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
datamate/seafile-professional:11.0.202dd66b722464
pillow@10.2.0
13.0.0

Open the chart page →

84,774
taigarc-helm-charts0.1.01 of 7See more

taiga rc-helm-charts 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
taigaio/taiga-back:6.4.29f97323cc150
pillow@8.2.0
13.0.0

Open the chart page →

8,697
netboxstartechnicaVerified publisher5.1.01 of 4See more

netbox startechnica 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
pillow@10.3.0
13.0.0

Open the chart page →

2,234
grafana-pdf-exporterwiremindVerified publisher2.1.11 of 1See more

grafana-pdf-exporter wiremind 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
ghcr.io/wiremind/grafana-pdf-exporter:v1.7dbaa8527bf4c
pillow@9.4.0-1.1+b1
pillow@9.4.0
no fix listed
13.0.0

Open the chart page →

10,945
matrixzekker6Verified publisher3.33.01 of 4See more

matrix zekker6 3.33.0

1 of the 4 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.163.0e98ab72138d9
pillow@12.3.0
13.0.0

Open the chart page →

6,303
changedetectionalekcVerified publisher0.14.71 of 1See more

changedetection alekc 0.14.7

1 of the 1 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.904eaae7915ba
pillow@12.3.0
13.0.0

Open the chart page →

2,728
convertigoconvertigoOfficialVerified publisher8.4.61 of 5See more

convertigo convertigo 8.4.6

1 of the 5 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
pillow@10.3.0
13.0.0

Open the chart page →

77,918
openshift-secured-pgadmineximiaitVerified publisher0.2.01 of 2See more

openshift-secured-pgadmin eximiait 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
dpage/pgadmin4:7.537946e4f3e7b
pillow@9.5.0
13.0.0

Open the chart page →

15,951
deconzgeek-cookbookVerified publisher6.5.21 of 1See more

deconz geek-cookbook 6.5.2

1 of the 1 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
deconzcommunity/deconz:2.12.066541bbb78952
pillow@5.4.1
13.0.0

Open the chart page →

4,511
frigategeek-cookbookVerified publisher8.2.21 of 1See more

frigate geek-cookbook 8.2.2

1 of the 1 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
blakeblackshear/frigate:0.10.0-amd64ae269270ad9e
pillow@8.1.0
13.0.0

Open the chart page →

11,488
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
hkotel/mealie:api-v1.0.0beta-2a7e6b6abe087
pillow@8.4.0
13.0.0

Open the chart page →

9,791
mlflowgetindataVerified publisher0.1.21 of 1See more

mlflow getindata 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
gcr.io/getindata-images-public/mlflow:latest25d6975951f1
pillow@10.3.0
13.0.0

Open the chart page →

2,972
simple-krr-dashboardhelm-simple-krr-dashboardVerified publisher1.6.21 of 3See more

simple-krr-dashboard helm-simple-krr-dashboard 1.6.2

1 of the 3 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
robustadev/krr:v1.30.0b8d782e568c7
pillow@12.3.0
13.0.0

Open the chart page →

3,403
home-assistanthome-assistantVerified publisher0.5.141 of 3See more

home-assistant home-assistant 0.5.14

1 of the 3 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.10.233afb0659d78
pillow@12.3.0
13.0.0

Open the chart page →

3,661
calibre-webk8s-home-lab-repo9.1.11 of 1See more

calibre-web k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
pillow@12.3.0
13.0.0

Open the chart page →

7,133
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
pillow@12.1.1
13.0.0

Open the chart page →

6,533
mlflow-tracking-servermlflow-tracking-serverVerified publisher4.1.01 of 1See more

mlflow-tracking-server mlflow-tracking-server 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
ghcr.io/mlflow-oidc/mlflow-tracking-server:3.16.1-9.0.2-20261001970ba1cc1e69
pillow@12.3.0
13.0.0

Open the chart page →

1,003
kobotoolboxone-acre-fundVerified publisher0.7.42 of 9See more

kobotoolbox one-acre-fund 0.7.4

2 of the 9 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
kobotoolbox/kobocat:2.022.24ab15679454415
pillow@9.1.0
13.0.0
kobotoolbox/kpi:2.022.24dbcacc01bccd4
pillow@9.1.0
13.0.0

Open the chart page →

24,738
oesopsmxVerified publisher4.0.321 of 25See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/ubi8-oes-datascience:isd-spin-2025.10.01-af26a30d4-202511261054d8f66f4117fe
pillow@12.0.0
13.0.0

Open the chart page →

113,367
skypilotskypilotOfficialVerified publisher0.14.11 of 3See more

skypilot skypilot 0.14.1

1 of the 3 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot:0.14.125577df35586
pillow@12.3.0
13.0.0

Open the chart page →

6,695
pretixtechwolf12Verified publisher2026.8.01 of 3See more

pretix techwolf12 2026.8.0

1 of the 3 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
pretix/standalone:2026.8.0ec17c2f761f7
pillow@12.3.0
13.0.0

Open the chart page →

10,388
mealieth-chartsVerified publisher0.5.11 of 1See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
pillow@12.0.0
13.0.0

Open the chart page →

5,163
wgerwgerOfficialVerified publisher2.0.01 of 7See more

wger wger 2.0.0

1 of the 7 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
wger/server:2.71c5789b93bfe
pillow@12.3.0
13.0.0

Open the chart page →

9,278
paperlesszekker6Verified publisher11.14.01 of 1See more

paperless zekker6 11.14.0

1 of the 1 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.3dba0242c1df1
pillow@12.3.0
13.0.0

Open the chart page →

5,685
paperless-ngxadnoctemVerified publisher0.5.11 of 5See more

paperless-ngx adnoctem 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
pillow@12.3.0
13.0.0

Open the chart page →

29,566
agentareaagentareaVerified publisher0.0.291 of 17See more

agentarea agentarea 0.0.29

1 of the 17 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
agentarea/agentarea-mcp-runner:0.1.1066fa4a71695
pillow@12.3.0
13.0.0

Open the chart page →

12,411
paperless-ngxalexmorbo-paperless-ngxVerified publisher0.2.01 of 2See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-112406.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
pillow@11.3.0
13.0.0

Open the chart page →

14,932

Container images carrying it

279 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
beanbag/reviewboard:latest6b840f546e1c
pillow@12.3.0
13.0.0
1
berkeleyskypilot/skypilot:0.14.125577df35586
pillow@12.3.0
13.0.0
1
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
pillow@12.0.0
13.0.0
1
blackducksoftware/bdba-frontend:2026.9.29d7730e506c0
pillow@12.3.0
13.0.0
1
blakeblackshear/frigate:0.10.0-amd64ae269270ad9e
pillow@8.1.0
13.0.0
1
bmeares/meerschaum:2.8.48e9c5bacaa82
pillow@11.1.0
13.0.0
1
bnjbvr/kresus:0.22.137e216b182c8
pillow@11.0.0
13.0.0
1
buntha/mlflow:2.1.1154542cc3083
pillow@9.3.0
13.0.0
1
burakince/mlflow:3.16.0ab4b566644b9
pillow@12.3.0
13.0.0
1
camerahub/camerahub:0.36.23a5af37dd6e1b
pillow@9.5.0
13.0.0
1
camptocamp/geomapfishapp-geoportal:latest3f916d5d2f62
pillow@12.3.0
13.0.0
1
ccrisan/motioneye:master-amd641704cddc44e0
pillow@5.2.0
13.0.0
1
checkmk/check-mk-community:2.5.0p6c11b422210c4
pillow@12.2.0
13.0.0
1
copyparty/ac:1.19.200a0a8605062c
pillow@11.2.1
13.0.0
1
crocodilestick/calibre-web-automated:v4.0.6c31a738b6d5e
pillow@12.1.0
13.0.0
1
daskdev/dask:1.1.04ecd7bc35500
pillow@5.3.0
13.0.0
1
daskdev/dask-notebook:1.1.0052630f5ca04
pillow@5.4.1
13.0.0
1
datamate/seafile-professional:11.0.202dd66b722464
pillow@10.2.0
13.0.0
1
deconzcommunity/deconz:2.29.2062de2362641
pillow@9.4.0-1.1+deb12u1
pillow@9.4.0
no fix listed
13.0.0
1
deconzcommunity/deconz:2.26.123c86008d73f
pillow@9.4.0-1.1+b1
pillow@9.4.0
no fix listed
13.0.0
1
deconzcommunity/deconz:2.12.066541bbb78952
pillow@5.4.1
13.0.0
1
dpage/pgadmin4:7.537946e4f3e7b
pillow@9.5.0
13.0.0
1
dpage/pgadmin4:9.11.050700ac17936
pillow@12.0.0
13.0.0
1
dpage/pgadmin4:9.252cb72a9e3da
pillow@11.1.0
13.0.0
1
dpage/pgadmin4:8.13561c1f8f99f2
pillow@11.0.0
13.0.0
1
esphome/esphome:2026.10.03a32372dfbd6
pillow@12.3.0
13.0.0
1
esphome/esphome:1.18.03f51ec10e823
pillow@5.4.1
13.0.0
1
esphome/esphome:2026.9.14ad55931c018
pillow@12.3.0
13.0.0
1
esphome/esphome:2024.3.09ab8cc88b28c
pillow@10.2.0
13.0.0
1
esphome/esphome:2024.12.2b2c6322700ac
pillow@10.4.0
13.0.0
1
esphome/esphome:2025.3.0def8b6e4f517
pillow@10.4.0
13.0.0
1
evk02/mlflow:2.2.1ef6ff257ef35
pillow@9.4.0
13.0.0
1
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
pillow@9.3.0
13.0.0
1
galaxy/pulsar-kubernetes:0.15.7e50a890e24c9
pillow@11.2.1
13.0.0
1
geoscienceaustralia/dea-k8s-data:latestf4039b45572a
pillow@7.2.0
13.0.0
1
heartexlabs/label-studio:latestafcc516a2277
pillow@12.3.0
13.0.0
1
hhyo/archery:v1.9.11aa41843419e
pillow@9.0.1
13.0.0
1
hkotel/mealie:api-v1.0.0beta-2a7e6b6abe087
pillow@8.4.0
13.0.0
1
homeassistant/home-assistant:2023.10.3021e2afc6e57
pillow@10.0.1
13.0.0
1
homeassistant/home-assistant:2022.3.5565751f33794
pillow@9.0.1
13.0.0
1
homeassistant/home-assistant:2026.75a531753cea9
pillow@12.2.0
13.0.0
1
homeassistant/home-assistant:2023.12.48d000332b09b
pillow@10.1.0
13.0.0
1
homeassistant/home-assistant:2026.8.0a21689ef0510
pillow@12.3.0
13.0.0
1
huginn/huginn:4df1217d3055db980a04f293e28016b77826e3caeab0db98264e
pillow@5.1.0
13.0.0
1
ilum/streamlit-example:1.0.0ce5dcdeb22ba
pillow@12.0.0
13.0.0
1
improwised/erpnext-worker:v13.4.197280b55cbd4
pillow@8.2.0
13.0.0
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
pillow@11.0.0
13.0.0
1
inventree/inventree:1.6.17c1e251a6c52
pillow@11.1.0-5+deb13u4
pillow@11.1.0
no fix listed
13.0.0
1
kobotoolbox/kobocat:2.022.24ab15679454415
pillow@9.1.0
13.0.0
1
kobotoolbox/kpi:2.022.24dbcacc01bccd4
pillow@9.1.0
13.0.0
1

syft 1.42.1 · advisories as of 22 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.