StackRadar

CVE-2026-114138

High

Advisory

Published 22 Oct 2026In the index since 23 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
36th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
107
of 18,232 indexed, latest versions
Container images
102
deployed by those charts
Fix available
1 of 1
affected package

Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation

Carried by container images the latest versions of 107 of 18,232 indexed charts deploy, on 102 images.

Affected packageAffected versionsFixed inImages
djangorestframeworkpypi3.7.7, 3.11.0, 3.11.1, 3.12.1+13 more3.18.2102
OSV records
GHSA-33wh-fxxf-88vv

Charts affected

107 by stars
ChartLatestAffected imagesRadar Score
authentikgoauthentikOfficialVerified publisher2026.8.51 of 1See more

authentik goauthentik 2026.8.5

1 of the 1 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.8.5602227a86455
djangorestframework@3.17.1
3.18.2

Open the chart page →

1,454
netboxnetboxOfficialVerified publisher8.3.941 of 5See more

netbox netbox 8.3.94

1 of the 5 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
ghcr.io/netbox-community/netbox:v4.7.31d6e0b5fbd48
djangorestframework@3.18.0
3.18.2

Open the chart page →

2,046
netboxbootcVerified publisher4.1.11 of 4See more

netbox bootc 4.1.1

1 of the 4 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.2.83d652dca5351
djangorestframework@3.13.1
3.18.2

Open the chart page →

10,425
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
grafana/oncall:v1.16.5499851658393
djangorestframework@3.15.2
3.18.2

Open the chart page →

24,639
paperless-ngxfmjstudios0.2.81 of 5See more

paperless-ngx fmjstudios 0.2.8

1 of the 5 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.10.1a132c2ac7c57
djangorestframework@3.14.0
3.18.2

Open the chart page →

37,307
nautobotnautobotOfficialVerified publisher3.2.01 of 1See more

nautobot nautobot 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
networktocode/nautobot:3.0-py3.13ed484336b1ad
djangorestframework@3.16.1
3.18.2

Open the chart page →

6,065
paperless-ngxpaperless-ngxVerified publisher0.3.251 of 3See more

paperless-ngx paperless-ngx 0.3.25

1 of the 3 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.3dba0242c1df1
djangorestframework@3.18.1
3.18.2

Open the chart page →

10,438
baserowbaserow-chartVerified publisher1.1.11 of 6See more

baserow baserow-chart 1.1.1

1 of the 6 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
baserow/backend:2.4.1497347d0ba74
djangorestframework@3.17.2
3.18.2

Open the chart page →

20,099
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
datamate/seafile-professional:11.0.202dd66b722464
djangorestframework@3.14.0
3.18.2

Open the chart page →

85,274
netboxstartechnicaVerified publisher5.1.01 of 4See more

netbox startechnica 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v3.7.8-2.8.09bf83b350a89
djangorestframework@3.14.0
3.18.2

Open the chart page →

2,402
convertigoconvertigoOfficialVerified publisher8.4.61 of 5See more

convertigo convertigo 8.4.6

1 of the 5 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
djangorestframework@3.15.1
3.18.2

Open the chart page →

79,283
openshift-secured-redisInsighteximiaitVerified publisher0.9.21 of 2See more

openshift-secured-redisInsight eximiait 0.9.2

1 of the 2 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
redislabs/redisinsight:1.14.0b03ab1426d0d
djangorestframework@3.13.1
3.18.2

Open the chart page →

15,170
flagsmithone-acre-fundVerified publisher0.1.51 of 6See more

flagsmith one-acre-fund 0.1.5

1 of the 6 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
flagsmith/flagsmith-api:v2.6.0fd58556339a4
djangorestframework@3.12.1
3.18.2

Open the chart page →

8,183
kobotoolboxone-acre-fundVerified publisher0.7.42 of 9See more

kobotoolbox one-acre-fund 0.7.4

2 of the 9 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
kobotoolbox/kobocat:2.022.24ab15679454415
djangorestframework@3.13.1
3.18.2
kobotoolbox/kpi:2.022.24dbcacc01bccd4
djangorestframework@3.13.1
3.18.2

Open the chart page →

24,982
open-zaakopen-zaak0.8.01 of 3See more

open-zaak open-zaak 0.8.0

1 of the 3 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
openzaak/open-zaak:1.6.02ca2ea6e0ae9
djangorestframework@3.12.4
3.18.2

Open the chart page →

5,604
pretixtechwolf12Verified publisher2026.8.01 of 3See more

pretix techwolf12 2026.8.0

1 of the 3 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
pretix/standalone:2026.8.0ec17c2f761f7
djangorestframework@3.17.2
3.18.2

Open the chart page →

11,400
wgerwgerOfficialVerified publisher2.0.01 of 7See more

wger wger 2.0.0

1 of the 7 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
wger/server:2.71c5789b93bfe
djangorestframework@3.17.2
3.18.2

Open the chart page →

9,774
paperlesszekker6Verified publisher11.15.01 of 1See more

paperless zekker6 11.15.0

1 of the 1 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.49bc6e8248891
djangorestframework@3.18.1
3.18.2

Open the chart page →

5,588
paperless-ngxadnoctemVerified publisher0.5.11 of 5See more

paperless-ngx adnoctem 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
djangorestframework@3.18.1
3.18.2

Open the chart page →

33,726
paperless-ngxalexmorbo-paperless-ngxVerified publisher0.2.01 of 2See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
djangorestframework@3.16.1
3.18.2

Open the chart page →

15,607
psonoankra-chartsVerified publisher1.2.01 of 2See more

psono ankra-charts 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
psono/psono-server:5.0.03b974b43ea03
djangorestframework@3.15.2
3.18.2

Open the chart page →

3,034
anteonanteonVerified publisher2.6.43 of 13See more

anteon anteon 2.6.4

3 of the 13 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
ddosify/selfhosted_alaz_backend:2.3.11e5be48b37348
djangorestframework@3.15.2
3.18.2
ddosify/selfhosted_backend:3.2.93c11e3182652
djangorestframework@3.15.1
3.18.2
ddosify/selfhosted_hammermanager:2.0.2b796b8c73011
djangorestframework@3.15.1
3.18.2

Open the chart page →

99,577
squestchristianhuthVerified publisher7.0.41 of 4See more

squest christianhuth 7.0.4

1 of the 4 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
djangorestframework@3.16.0
3.18.2

Open the chart page →

5,373
paperless-ngxcrystalnetVerified publisher0.2.221 of 3See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
djangorestframework@3.15.2
3.18.2

Open the chart page →

17,068
weblatedeliveryheroVerified publisher0.3.21 of 3See more

weblate deliveryhero 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
weblate/weblate:4.2.2-169c160d37a3c
djangorestframework@3.11.1
3.18.2

Open the chart page →

11,294
archerydoubanVerified publisher0.4.31 of 6See more

archery douban 0.4.3

1 of the 6 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
hhyo/archery:v1.9.11aa41843419e
djangorestframework@3.13.1
3.18.2

Open the chart page →

8,618
seafiledr300481Verified publisher0.12.11 of 1See more

seafile dr300481 0.12.1

1 of the 1 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:11.0.12d0c66e4621bd
djangorestframework@3.14.0
3.18.2

Open the chart page →

76,611
obicogabe565Verified publisher0.6.01 of 3See more

obico gabe565 0.6.0

1 of the 3 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
ghcr.io/gabe565/obico/web:latest6acb4a5903eb
djangorestframework@3.15.1
3.18.2

Open the chart page →

2,913
paperlessgeek-cookbookVerified publisher9.2.01 of 1See more

paperless geek-cookbook 9.2.0

1 of the 1 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:1.8.09bbc9a90641e
djangorestframework@3.13.1
3.18.2

Open the chart page →

5,317
recipesgeek-cookbookVerified publisher6.6.21 of 2See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
vabene1111/recipes:1.0.5.2ec4e9e2905b0
djangorestframework@3.13.1
3.18.2

Open the chart page →

9,201
huehue1.0.31 of 3See more

hue hue 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
gethue/hue:latest7d5c1b9f8a79
djangorestframework@3.15.2
3.18.2

Open the chart page →

67,295
aralib42Verified publisher0.4.61 of 1See more

ara lib42 0.4.6

1 of the 1 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
recordsansible/ara-api:latest9dfd6e18f474
djangorestframework@3.17.1
3.18.2

Open the chart page →

222
plane-enterprisemakeplaneOfficialVerified publisher3.10.121 of 13See more

plane-enterprise makeplane 3.10.12

1 of the 13 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
makeplane/backend-commercial:v3.3.39f650887385e
djangorestframework@3.18.0
3.18.2

Open the chart page →

7,782
papermergenicholaswildeVerified publisher1.0.21 of 1See more

papermerge nicholaswilde 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/papermerge:version-v2.0.198ba2dd3f0bd
djangorestframework@3.13.1
3.18.2

Open the chart page →

21,954
openvaultopenvaultVerified publisher0.9.01 of 2See more

openvault openvault 0.9.0

1 of the 2 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-wag:v1.1.06df27f944fe8
djangorestframework@3.16.0
3.18.2

Open the chart page →

62,631
open-notificatiesopen-zaak0.7.01 of 4See more

open-notificaties open-zaak 0.7.0

1 of the 4 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
openzaak/open-notificaties:1.3.02e65313b9b10
djangorestframework@3.12.4
3.18.2

Open the chart page →

3,630
paperless-ngxpaperlessVerified publisher0.4.11 of 3See more

paperless-ngx paperless 0.4.1

1 of the 3 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngxdigest-pinned9bc6e8248891
djangorestframework@3.18.1
3.18.2

Open the chart page →

10,012
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
djangorestframework@3.15.2
3.18.2

Open the chart page →

51,238
sentry-k8ssentry-k8sVerified publisher1.4.11 of 11See more

sentry-k8s sentry-k8s 1.4.1

1 of the 11 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
djangorestframework@3.16.1
3.18.2

Open the chart page →

55,145
verbacapverbacapVerified publisher1.0.71 of 1See more

verbacap verbacap 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
ghcr.io/mirio/verbacap:v1.5.084928e2fc4f2
djangorestframework@3.15.1
3.18.2

Open the chart page →

3,054
waldurwaldur-chartsVerified publisher8.1.31 of 3See more

waldur waldur-charts 8.1.3

1 of the 3 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
opennode/waldur-mastermind:8.1.382e8f276c5ed
djangorestframework@3.18.0
3.18.2

Open the chart page →

5,065
qleverzazukoVerified publisher0.7.21 of 2See more

qlever zazuko 0.7.2

1 of the 2 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
ghcr.io/zazukoians/qlever-ui:v0.10.3c27e20f7a2ca
djangorestframework@3.17.1
3.18.2

Open the chart page →

2,816
tubearchivistalexmorbo-tubearchivistVerified publisher0.1.01 of 2See more

tubearchivist alexmorbo-tubearchivist 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
bbilly1/tubearchivist:v0.5.9b827a713f55b
djangorestframework@3.16.1
3.18.2

Open the chart page →

6,711
ddosifyanteonVerified publisher1.7.53 of 13See more

ddosify anteon 1.7.5

3 of the 13 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
djangorestframework@3.14.0
3.18.2
ddosify/selfhosted_backend:2.6.11ac323d52bfb4
djangorestframework@3.15.0
3.18.2
ddosify/selfhosted_hammermanager:1.2.471b8768f49bc
djangorestframework@3.12.4
3.18.2

Open the chart page →

181,358
argonix-apiargonix0.6.51 of 4See more

argonix-api argonix 0.6.5

1 of the 4 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
ghcr.io/argonix-io/argonix-api:0.6.5431abcce7c1e
djangorestframework@3.17.1
3.18.2

Open the chart page →

7,438
huebigdata-chartsVerified publisher1.0.41 of 2See more

hue bigdata-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
gethue/hue:4.10.05702b2c37ff9
djangorestframework@3.12.2
3.18.2

Open the chart page →

85,358
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
djangorestframework@3.15.1
3.18.2

Open the chart page →

70,860
bdbablackduck2026.9.11 of 9See more

bdba blackduck 2026.9.1

1 of the 9 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
blackducksoftware/bdba-frontend:2026.9.29d7730e506c0
djangorestframework@3.18.0
3.18.2

Open the chart page →

9,829
camerahubcamerahub0.10.211 of 2See more

camerahub camerahub 0.10.21

1 of the 2 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
camerahub/camerahub:0.36.23a5af37dd6e1b
djangorestframework@3.14.0
3.18.2

Open the chart page →

3,572
opencvecfi20170.1.21 of 7See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-114138.

Container imageDigestPackageFixed in
ghcr.io/cfi2017/opencve-web:3.0.06961eab190a2
djangorestframework@3.15.2
3.18.2

Open the chart page →

18,779

Container images carrying it

102 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/zazukoians/qlever-ui:v0.10.3c27e20f7a2ca
djangorestframework@3.17.1
3.18.2
1
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
djangorestframework@3.16.0
3.18.2
1

syft 1.42.1 · advisories as of 24 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.