StackRadar

CVE-2026-114095

High

Advisory

Published 2 Oct 2026In the index since 22 Oct 2026
Severity
High
worst across findings
CVSS
7.1
base score, highest
EPSS
0.003
16th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
44
of 18,232 indexed, latest versions
Container images
57
deployed by those charts
Fix available
1 of 2
affected packages

Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution

Carried by container images the latest versions of 44 of 18,232 indexed charts deploy, on 57 images.

Affected packageAffected versionsFixed inImages
dulwichdeb0.22.7-1no fix listed2
dulwichpypi0.20.31, 0.20.50, 0.21.3, 0.21.5+7 more1.2.957
OSV records
DEBIAN-CVE-2026-114095GHSA-35mr-4567-66vg

Charts affected

44 by stars
ChartLatestAffected imagesRadar Score
kube-downscalerdeliveryheroVerified publisher0.7.61 of 1See more

kube-downscaler deliveryhero 0.7.6

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
dulwich@0.21.5
1.2.9

Open the chart page →

88,040
redashredash4.2.01 of 3See more

redash redash 4.2.0

1 of the 3 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
redash/redash:25.8.000d813437db5
dulwich@0.21.7
1.2.9

Open the chart page →

60,066
dependabot-gitlabdependabot-gitlabVerified publisher6.4.01 of 3See more

dependabot-gitlab dependabot-gitlab 6.4.0

1 of the 3 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
andrcuns/dependabot-gitlab:7.11.0-alpha.1a783b497f3f8
dulwich@0.21.6
1.2.9

Open the chart page →

38,342
netscaler-ingress-controllernetscalerOfficialVerified publisher4.2.261 of 1See more

netscaler-ingress-controller netscaler 4.2.26

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
quay.io/netscaler/netscaler-k8s-ingress-controller:4.2.26a68453858339
dulwich@0.22.8
1.2.9

Open the chart page →

226
netboxstartechnicaVerified publisher5.1.01 of 4See more

netbox startechnica 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
dulwich@0.21.7
1.2.9

Open the chart page →

2,376
machinarislib42Verified publisher0.2.01 of 1See more

machinaris lib42 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
ghcr.io/guydavis/machinaris:testf77fa53b89cb
dulwich@0.21.7
1.2.9

Open the chart page →

26,641
netscaler-cpx-with-ingress-controllernetscalerOfficialVerified publisher4.2.261 of 2See more

netscaler-cpx-with-ingress-controller netscaler 4.2.26

1 of the 2 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
quay.io/netscaler/netscaler-k8s-ingress-controller:4.2.26a68453858339
dulwich@0.22.8
1.2.9

Open the chart page →

421
squestchristianhuthVerified publisher7.0.41 of 4See more

squest christianhuth 7.0.4

1 of the 4 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
dulwich@0.21.7
1.2.9

Open the chart page →

5,257
hpe-greenlake-file-csi-driverhpe-storageVerified publisher2.6.41 of 7See more

hpe-greenlake-file-csi-driver hpe-storage 2.6.4

1 of the 7 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
quay.io/hpestorage/filex-csi-driver:2.6.4b7f960bbf472
dulwich@0.21.7
1.2.9

Open the chart page →

9,688
kuma-ingress-watcherkuma-ingress-watcherVerified publisher1.4.01 of 1See more

kuma-ingress-watcher kuma-ingress-watcher 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
ghcr.io/squent/kuma-ingress-watcher:1.7.014d45b2a1f00
dulwich@0.22.7
1.2.9

Open the chart page →

3,083
locustlocustVerified publisher0.1.41 of 1See more

locust locust 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
hansehe/locust:1.1.0bc8e45262bc4
dulwich@0.21.7
1.2.9

Open the chart page →

3,146
mend-renovate-enterprise-editionmend-renovateVerified publisher10.8.01 of 2See more

mend-renovate-enterprise-edition mend-renovate 10.8.0

1 of the 2 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
ghcr.io/mend/renovate-ee-server:15.8.02df8d6bb970b
dulwich@0.21.6
1.2.9

Open the chart page →

26,012
redminemt1905027.3.41 of 3See more

redmine mt190502 7.3.4

1 of the 3 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
library/redmine:6.1.204ac44a2595b
dulwich@0.22.7-1
dulwich@0.22.7
no fix listed
1.2.9

Open the chart page →

9,547
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
dulwich@1.2.5
1.2.9

Open the chart page →

50,277
redmineredmine-helm-chartVerified publisher0.2.61 of 1See more

redmine redmine-helm-chart 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
library/redmine:6.1.3-trixief474a901faec
dulwich@0.22.7-1
dulwich@0.22.7
no fix listed
1.2.9

Open the chart page →

6,063
kube-resource-reportrlex0.10.11 of 2See more

kube-resource-report rlex 0.10.1

1 of the 2 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
hjacobs/kube-resource-report:22.11.0c173cd02f5af
dulwich@0.20.50
1.2.9

Open the chart page →

1,612
airbyteairbyte-v2Verified publisher2.4.01 of 10See more

airbyte airbyte-v2 2.4.0

1 of the 10 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
airbyte/manifest-server:7.28.2deec511b51c3
dulwich@0.22.8
1.2.9

Open the chart page →

15,874
camerahubcamerahub0.10.211 of 2See more

camerahub camerahub 0.10.21

1 of the 2 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
camerahub/camerahub:0.36.23a5af37dd6e1b
dulwich@0.21.3
1.2.9

Open the chart page →

3,508
kube-ops-viewchristianhuthVerified publisher9.0.01 of 1See more

kube-ops-view christianhuth 9.0.0

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
hjacobs/kube-ops-view:23.5.0a4fae38f93d7
dulwich@0.21.5
1.2.9

Open the chart page →

1,522
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
dulwich@0.22.8
1.2.9

Open the chart page →

50,727
deployhubdeployhubVerified publisher10.0.4157 of 11See more

deployhub deployhub 10.0.415

7 of the 11 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
dulwich@0.24.10
1.2.9
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
dulwich@0.24.10
1.2.9
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
dulwich@0.24.10
1.2.9
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
dulwich@0.24.10
1.2.9
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
dulwich@0.24.10
1.2.9
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
dulwich@0.24.10
1.2.9
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
dulwich@0.24.10
1.2.9

Open the chart page →

13,808
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
dulwich@0.21.7
1.2.9

Open the chart page →

11,029
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
dulwich@0.21.7
1.2.9

Open the chart page →

11,029
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
dulwich@0.22.7
1.2.9

Open the chart page →

18,929
autonodelabeldjjudas21Verified publisher0.0.101 of 1See more

autonodelabel djjudas21 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
djjudas21/autonodelabel:0.0.6f17233350c4f
dulwich@0.21.5
1.2.9

Open the chart page →

1,487
huntingfactlyVerified publisher0.4.141 of 1See more

hunting factly 0.4.14

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
dulwich@0.20.50
1.2.9

Open the chart page →

5,808
kube-downscalerhelm-charts-nr0.7.61 of 1See more

kube-downscaler helm-charts-nr 0.7.6

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
dulwich@0.21.5
1.2.9

Open the chart page →

88,040
shynetjuniorjpdj0.1.331 of 1See more

shynet juniorjpdj 0.1.33

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
milesmcc/shynet:v0.13.1ba54f7797a6b
dulwich@0.20.50
1.2.9

Open the chart page →

3,022
lnbitskronkltdVerified publisher0.1.01 of 1See more

lnbits kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
lnbitsdocker/lnbits-legend:latest26fae6327477
dulwich@0.21.7
1.2.9

Open the chart page →

2,072
kube-janitorkube-janitor0.3.31 of 1See more

kube-janitor kube-janitor 0.3.3

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
hjacobs/kube-janitor:23.7.0fbb303ed463c
dulwich@0.21.5
1.2.9

Open the chart page →

88,046
lnbitslnbits0.2.11 of 1See more

lnbits lnbits 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
lnbitsdocker/lnbits-legend:0.10.6a11aaa6d2b21
dulwich@0.21.5
1.2.9

Open the chart page →

2,833
servicesmicroslacVerified publisher0.4.01 of 8See more

services microslac 0.4.0

1 of the 8 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
microslac/auth:latest5c1eb1f5c64d
dulwich@0.21.7
1.2.9

Open the chart page →

358,351
errbotmidokura-communityVerified publisher0.0.51 of 1See more

errbot midokura-community 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
errbotio/errbot:6.1.900ee4e0953ab
dulwich@0.20.31
1.2.9

Open the chart page →

2,782
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.04 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

4 of the 40 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
dulwich@0.21.6
1.2.9
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestbd496fa8c9df
dulwich@0.21.6
1.2.9
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
dulwich@0.21.6
1.2.9
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
dulwich@0.21.6
1.2.9

Open the chart page →

307,187
phronetisphronetis0.1.271 of 2See more

phronetis phronetis 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
knspar/phronetis:0.1.4609499d2dc91a
dulwich@0.22.8
1.2.9

Open the chart page →

87,521
prowlerprowler0.1.11 of 1See more

prowler prowler 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
toniblyx/prowler:stable9dbcc3c9abd7
dulwich@1.2.5
1.2.9

Open the chart page →

2,403
redminerestic-pvc-backupVerified publisher0.2.61 of 1See more

redmine restic-pvc-backup 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
library/redmine:6.1.3-trixief474a901faec
dulwich@0.22.7-1
dulwich@0.22.7
no fix listed
1.2.9

Open the chart page →

6,063
kube-web-viewrlex0.5.01 of 1See more

kube-web-view rlex 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
hjacobs/kube-web-view:23.8.0431f1bf013d0
dulwich@0.21.5
1.2.9

Open the chart page →

86,216
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
dulwich@0.21.7
1.2.9

Open the chart page →

11,029
agentdatarss30.1.01 of 1See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
dulwich@0.22.8
1.2.9

Open the chart page →

4,093
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
dulwich@0.22.8
1.2.9

Open the chart page →

6,170
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
dulwich@0.20.50
1.2.9

Open the chart page →

7,126
downscalersqream-chartsVerified publisher1.0.01 of 1See more

downscaler sqream-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
hjacobs/kube-downscaler:23.2.05d328c003efe
dulwich@0.20.50
1.2.9

Open the chart page →

1,293
servicexssl-hep1.8.611 of 16See more

servicex ssl-hep 1.8.6

11 of the 16 container images this version deploys carry CVE-2026-114095.

Container imageDigestPackageFixed in
sslhep/servicex_app:v1.8.6c935e123030d
dulwich@0.22.8
1.2.9
sslhep/servicex_code_gen_atlas_xaod:v1.8.67827e689caa5
dulwich@0.22.8
1.2.9
sslhep/servicex_code_gen_func_adl_uproot:v1.8.62d6843be2d8d
dulwich@0.22.8
1.2.9
sslhep/servicex_code_gen_python:v1.8.696805be717ff
dulwich@0.22.8
1.2.9
sslhep/servicex_code_gen_raw_uproot:v1.8.61494a81a474b
dulwich@0.22.8
1.2.9
sslhep/servicex_code_gen_topcp:v1.8.6f7faf8c6c3e4
dulwich@0.22.8
1.2.9
sslhep/servicex-did-finder:v1.8.6e15e68307d33
dulwich@0.22.8
1.2.9
sslhep/servicex-did-finder-atlasopenmagic:v1.8.6bd738c952e72
dulwich@0.25.2
1.2.9
sslhep/servicex-did-finder-cernopendata:v1.8.623a80e40ab18
dulwich@0.22.8
1.2.9
sslhep/servicex-did-finder-xrootd:v1.8.69a9fb17458f1
dulwich@0.22.8
1.2.9
sslhep/x509-secrets:v1.8.634e1c87cea8a
dulwich@0.22.8
1.2.9

Open the chart page →

67,074

Container images carrying it

57 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
dulwich@0.24.10
1.2.9
1
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
dulwich@0.24.10
1.2.9
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
dulwich@0.24.10
1.2.9
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
dulwich@0.24.10
1.2.9
1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
dulwich@0.24.10
1.2.9
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
dulwich@0.24.10
1.2.9
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
dulwich@0.24.10
1.2.9
1

syft 1.42.1 · advisories as of 23 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.