StackRadar

CVE-2026-113794

Medium

Advisory

Published 21 Oct 2026In the index since 22 Oct 2026
Severity
Medium
worst across findings
CVSS
6.0
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
23
of 18,219 indexed, latest versions
Container images
21
deployed by those charts
Fix available
1 of 1
affected package

pypdf: Possible infinite loop when hitting EOF in standard xref table

Carried by container images the latest versions of 23 of 18,219 indexed charts deploy, on 21 images.

Affected packageAffected versionsFixed inImages
pypdfpypi5.0.1, 5.1.0, 5.3.0, 5.4.0+9 more6.20.021
OSV records
GHSA-39mj-jf6j-2qj3

Charts affected

23 by stars
ChartLatestAffected imagesRadar Score
datahubdatahubVerified publisher1.1.71 of 4See more

datahub datahub 1.1.7

1 of the 4 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
acryldata/datahub-actions:v1.7.0.1c5fd70130157
pypdf@6.16.2
6.20.0

Open the chart page →

1,774
difydify-helmVerified publisher0.39.02 of 11See more

dify dify-helm 0.39.0

2 of the 11 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
langgenius/dify-agent-backend:1.17.0bdb2ed516bd3
pypdf@6.14.2
6.20.0
langgenius/dify-api:1.17.052be6088dd84
pypdf@6.15.0
6.20.0

Open the chart page →

63,621
litellm-helmlitellm1.106.21 of 2See more

litellm-helm litellm 1.106.2

1 of the 2 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm:1.106.27294b90f868c
pypdf@6.19.0
6.20.0

Open the chart page →

5,381
calibre-webk8s-home-lab-repo9.1.11 of 1See more

calibre-web k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
pypdf@6.4.2
6.20.0

Open the chart page →

7,133
pretixtechwolf12Verified publisher2026.8.01 of 3See more

pretix techwolf12 2026.8.0

1 of the 3 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
pretix/standalone:2026.8.0ec17c2f761f7
pypdf@6.19.0
6.20.0

Open the chart page →

10,388
agentareaagentareaVerified publisher0.0.291 of 17See more

agentarea agentarea 0.0.29

1 of the 17 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
agentarea/agentarea-mcp-runner:0.1.1066fa4a71695
pypdf@6.19.0
6.20.0

Open the chart page →

12,411
langflow-idelangflow0.1.21 of 2See more

langflow-ide langflow 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
langflowai/langflow:latesta0396e089eb9
pypdf@6.19.0
6.20.0

Open the chart page →

4,790
langflow-runtimelangflow0.1.11 of 1See more

langflow-runtime langflow 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
langflowai/langflow:latesta0396e089eb9
pypdf@6.19.0
6.20.0

Open the chart page →

578
litellmalareira0.3.01 of 1See more

litellm alareira 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm:main-stable7294b90f868c
pypdf@6.19.0
6.20.0

Open the chart page →

188
argonix-apiargonix0.6.51 of 4See more

argonix-api argonix 0.6.5

1 of the 4 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
ghcr.io/argonix-io/argonix-api:0.6.5431abcce7c1e
pypdf@6.14.2
6.20.0

Open the chart page →

6,780
calibre-web-automatedcalibre-web-automatedVerified publisher1.2.31 of 1See more

calibre-web-automated calibre-web-automated 1.2.3

1 of the 1 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
crocodilestick/calibre-web-automated:v4.0.6c31a738b6d5e
pypdf@6.6.2
6.20.0

Open the chart page →

8,893
calibre-webcharts-derwitt-devVerified publisher1.1.41 of 1See more

calibre-web charts-derwitt-dev 1.1.4

1 of the 1 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
ghcr.io/wittdennis/calibre-web:1.1.31086aac67a05
pypdf@6.10.2
6.20.0

Open the chart page →

6,428
csghubcsghubVerified publisher2.6.01 of 35See more

csghub csghub 2.6.0

1 of the 35 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
pypdf@5.1.0
6.20.0

Open the chart page →

68,963
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
pypdf@5.3.0
6.20.0

Open the chart page →

56,433
rag-apihajowielandVerified publisher1.0.01 of 1See more

rag-api hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat-rag-api-dev-lite:latesta62ce2221b43
pypdf@6.19.0
6.20.0

Open the chart page →

1,808
langflowhelmforgeVerified publisher2.0.41 of 1See more

langflow helmforge 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
langflowai/langflow:1.12.6a0396e089eb9
pypdf@6.19.0
6.20.0

Open the chart page →

578
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
pypdf@5.4.0
6.20.0

Open the chart page →

10,010
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
onyxdotapp/onyx-backend:latest92b8fab500f9
pypdf@6.19.0
6.20.0

Open the chart page →

9,240
opds-shelfopds-shelfVerified publisher0.4.01 of 3See more

opds-shelf opds-shelf 0.4.0

1 of the 3 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/calibre-web:latestb206b791d77b
pypdf@6.10.2
6.20.0

Open the chart page →

6,279
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
pypdf@6.10.2
6.20.0

Open the chart page →

9,934
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
pypdf@6.9.0
6.20.0

Open the chart page →

6,456
backendsignalen4.25.01 of 4See more

backend signalen 4.25.0

1 of the 4 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
signalen/backend:2.50.1826bb090bc4e4
pypdf@6.18.0
6.20.0

Open the chart page →

36,570
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-113794.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
pypdf@5.0.1
6.20.0

Open the chart page →

10,394

Container images carrying it

21 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
langflowai/langflow:1.12.6:latesta0396e089eb9
pypdf@6.19.0
6.20.0
3
ghcr.io/berriai/litellm:1.106.2:main-stable7294b90f868c
pypdf@6.19.0
6.20.0
2
acryldata/datahub-actions:v1.7.0.1c5fd70130157
pypdf@6.16.2
6.20.0
1
agentarea/agentarea-mcp-runner:0.1.1:latest066fa4a71695
pypdf@6.19.0
6.20.0
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
pypdf@5.4.0
6.20.0
1
checkmk/check-mk-community:2.5.0p6c11b422210c4
pypdf@6.10.2
6.20.0
1
crocodilestick/calibre-web-automated:v4.0.6c31a738b6d5e
pypdf@6.6.2
6.20.0
1
langgenius/dify-agent-backend:1.17.0bdb2ed516bd3
pypdf@6.14.2
6.20.0
1
langgenius/dify-api:1.0.0066035f93856
pypdf@5.3.0
6.20.0
1
langgenius/dify-api:1.17.052be6088dd84
pypdf@6.15.0
6.20.0
1
linuxserver/calibre-web:0.6.24241009026e6f
pypdf@5.0.1
6.20.0
1
litellm/litellm-non_root:v1.82.3-stable09b217802ded
pypdf@6.9.0
6.20.0
1
onyxdotapp/onyx-backend:latest92b8fab500f9
pypdf@6.19.0
6.20.0
1
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
pypdf@5.1.0
6.20.0
1
pretix/standalone:2026.8.0ec17c2f761f7
pypdf@6.19.0
6.20.0
1
signalen/backend:2.50.1826bb090bc4e4
pypdf@6.18.0
6.20.0
1
ghcr.io/argonix-io/argonix-api:0.6.5431abcce7c1e
pypdf@6.14.2
6.20.0
1
ghcr.io/danny-avila/librechat-rag-api-dev-lite:latesta62ce2221b43
pypdf@6.19.0
6.20.0
1
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
pypdf@6.4.2
6.20.0
1
ghcr.io/linuxserver/calibre-web:latestb206b791d77b
pypdf@6.10.2
6.20.0
1
ghcr.io/wittdennis/calibre-web:1.1.31086aac67a05
pypdf@6.10.2
6.20.0
1

syft 1.42.1 · advisories as of 22 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.