StackRadar

CVE-2026-112898

Medium

Advisory

Published 20 Oct 2026In the index since 21 Oct 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.003
21st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
253
of 18,219 indexed, latest versions
Container images
233
deployed by those charts
Fix available
1 of 2
affected packages

Pillow: Image.quantize() with empty palette leaks uninitialized stack memory

Carried by container images the latest versions of 253 of 18,219 indexed charts deploy, on 233 images.

Affected packageAffected versionsFixed inImages
pillowpypi9.1.0, 9.2.0, 9.3.0, 9.4.0+16 more13.0.0233
pillowdeb9.4.0-1.1+b1, 9.4.0-1.1+deb12u1, 11.1.0-5+deb13u4no fix listed6
OSV records
DEBIAN-CVE-2026-112898GHSA-rfgq-q3w2-pmv2

Charts affected

253 by stars
ChartLatestAffected imagesRadar Score
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-112898.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
pillow@11.3.0
13.0.0

Open the chart page →

10,394
supersetwbstack0.1.01 of 1See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-112898.

Container imageDigestPackageFixed in
apache/superset:4.0.1ab9467fd712c
pillow@10.2.0
13.0.0

Open the chart page →

78,184
changedetection-iozekker6Verified publisher1.104.01 of 1See more

changedetection-io zekker6 1.104.0

1 of the 1 container images this version deploys carry CVE-2026-112898.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.904eaae7915ba
pillow@12.3.0
13.0.0

Open the chart page →

2,728

Container images carrying it

233 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
pillow@11.1.0
13.0.0
1
tombursch/kitchenowl-backend:v0.7.104a7ed693531b
pillow@12.3.0
13.0.0
1
upstreamyard/nemo-guardrails:0.24.19f673183cfc0
pillow@12.3.0
13.0.0
1
vabene1111/recipes:2.3.50f8d061895e9
pillow@11.3.0
13.0.0
1
weblate/weblate:2026.10.1.26663a7c8b444
pillow@12.3.0
13.0.0
1
wger/server:2.71c5789b93bfe
pillow@12.3.0
13.0.0
1
zurdi15/romm:2.3.12db88fe44c89
pillow@10.1.0
13.0.0
1
gcr.io/getindata-images-public/mlflow:latest25d6975951f1
pillow@10.3.0
13.0.0
1
ghcr.io/afairgiant/medikeep:v0.72.09285e26f6d0d
pillow@12.3.0
13.0.0
1
ghcr.io/argonix-io/argonix-api:0.6.5431abcce7c1e
pillow@12.3.0
13.0.0
1
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
pillow@11.0.0
13.0.0
1
ghcr.io/blakeblackshear/frigate:0.14.122e3d0b486df
pillow@10.4.0
13.0.0
1
ghcr.io/blakeblackshear/frigate:0.13.07a5244e4c8dc
pillow@10.2.0
13.0.0
1
ghcr.io/blakeblackshear/frigate:0.12.0c862771e38e8
pillow@9.5.0
13.0.0
1
ghcr.io/colenio/slo-reporting:0.3.316b64d194a27d
pillow@11.0.0
13.0.0
1
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
pillow@10.2.0
13.0.0
1
ghcr.io/ctfd/ctfd:3.8.2870e396fddf8
pillow@11.3.0
13.0.0
1
ghcr.io/danny-avila/librechat-rag-api-dev-lite:latesta62ce2221b43
pillow@12.3.0
13.0.0
1
ghcr.io/dask/dask:2024.1.0080150de7d86
pillow@10.0.1
13.0.0
1
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
pillow@10.2.0
13.0.0
1
ghcr.io/dfir-iris/iriswebapp_app:v2.4.26e59ebde55709
pillow@11.3.0
13.0.0
1
ghcr.io/dgtlmoon/changedetection.io:0.44534b9bc5c46e
pillow@10.0.0
13.0.0
1
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
pillow@10.4.0
13.0.0
1
ghcr.io/esphome/esphome:latest776a845d5089
pillow@12.3.0
13.0.0
1
ghcr.io/esphome/esphome:2026.4.078a82d810709
pillow@12.2.0
13.0.0
1
ghcr.io/esphome/esphome:2026.7.4e636269c6390
pillow@12.3.0
13.0.0
1
ghcr.io/facebook/threatexchange/hma:1.0.1784d09c6b75a7
pillow@11.2.1
13.0.0
1
ghcr.io/gabe565/obico/web:latest6acb4a5903eb
pillow@11.1.0
13.0.0
1
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
pillow@12.2.0
13.0.0
1
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
pillow@12.1.1
13.0.0
1
ghcr.io/home-assistant/home-assistant:2026.10.1130241f28d01
pillow@12.3.0
13.0.0
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
pillow@11.1.0
13.0.0
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
pillow@12.0.0
13.0.0
1
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
pillow@12.3.0
13.0.0
1
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
pillow@9.1.0
13.0.0
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
pillow@10.1.0
13.0.0
1
ghcr.io/home-operations/bazarr:1.6.217dc1cff22e9
pillow@12.3.0
13.0.0
1
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
pillow@12.2.0
13.0.0
1
ghcr.io/home-operations/beets:2.3.1cc4975f1a0be
pillow@11.2.1
13.0.0
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
pillow@12.1.1
13.0.0
1
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
pillow@12.1.1
13.0.0
1
ghcr.io/immich-app/immich-machine-learning:v3.3.41ab8674e7cec
pillow@12.3.0
13.0.0
1
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
pillow@12.3.0
13.0.0
1
ghcr.io/liturgical-app/calendar-api:0.0.9688a685e2bde
pillow@11.3.0
13.0.0
1
ghcr.io/liturgical-app/liturgical-api:1.0.12637bdcebdd8d
pillow@12.1.1
13.0.0
1
ghcr.io/m0nsterrr/hyperglass:v2.0.4f7b5d20c5e42
pillow@10.2.0
13.0.0
1
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
pillow@11.3.0
13.0.0
1
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
pillow@10.3.0
13.0.0
1
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
pillow@12.0.0
13.0.0
1
ghcr.io/mirio/verbacap:v1.5.084928e2fc4f2
pillow@10.3.0
13.0.0
1

syft 1.42.1 · advisories as of 22 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.