StackRadarChart IndexLive demo

CVE-2026-115580

High

Advisory

Published 23 Oct 2026In the index since 24 Oct 2026

Severity: High; worst across findings
CVSS: 7.1; base score, highest
EPSS: —; probability of exploitation
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 25; of 18,232 indexed, latest versions
Container images: 23; deployed by those charts
Fix available: 1 of 1; affected package

pypdf: Possible long runtimes for large xref table header limits

Carried by container images the latest versions of 25 of 18,232 indexed charts deploy, on 23 images.

Affected package	Affected versions	Fixed in	Images
pypdfpypi	5.0.1, 5.1.0, 5.3.0, 5.4.0+11 more	6.21.2	23

OSV records: GHSA-gmh7-3g9r-mjh5

Charts affected

25 by stars

Chart

Latest

Affected images

Radar Score

difydify-helm

2 of 11 See more

dify dify-helm 0.39.0

2 of the 11 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
langgenius/dify-agent-backend :1.17.0	bdb2ed516bd3	pypdf@6.14.2	6.21.2
langgenius/dify-api :1.17.0	52be6088dd84	pypdf@6.15.0	6.21.2

Open the chart page →

64,891

litellm-helmlitellm

1 of 2 See more

litellm-helm litellm 1.106.2

1 of the 2 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
ghcr.io/berriai/litellm :1.106.2	7294b90f868c	pypdf@6.19.0	6.21.2

Open the chart page →

5,544

calibre-webk8s-home-lab-repo

1 of 1 See more

calibre-web k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
ghcr.io/linuxserver/calibre-web :0.6.26	7c0464228f2f	pypdf@6.4.2	6.21.2

Open the chart page →

7,392

pretixtechwolf12

1 of 3 See more

pretix techwolf12 2026.8.0

1 of the 3 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
pretix/standalone :2026.8.0	ec17c2f761f7	pypdf@6.19.0	6.21.2

Open the chart page →

11,400

agentareaagentarea

1 of 17 See more

agentarea agentarea 0.0.29

1 of the 17 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
agentarea/agentarea-mcp-runner :0.1.1	066fa4a71695	pypdf@6.19.0	6.21.2

Open the chart page →

13,394

langflow-idelangflow

1 of 2 See more

langflow-ide langflow 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
langflowai/langflow :latest	a0396e089eb9	pypdf@6.19.0	6.21.2

Open the chart page →

5,289

langflow-runtimelangflow

1 of 1 See more

langflow-runtime langflow 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
langflowai/langflow :latest	a0396e089eb9	pypdf@6.19.0	6.21.2

Open the chart page →

861

securosecuro

1 of 4 See more

securo securo 0.16.5

1 of the 4 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
ghcr.io/securo-finance/securo-backend :0.16.5	0e40c6858fb3	pypdf@6.20.1	6.21.2

Open the chart page →

4,488

litellmalareira

1 of 1 See more

litellm alareira 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
ghcr.io/berriai/litellm :main-stable	7294b90f868c	pypdf@6.19.0	6.21.2

Open the chart page →

277

argonix-apiargonix

1 of 4 See more

argonix-api argonix 0.6.5

1 of the 4 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
ghcr.io/argonix-io/argonix-api :0.6.5	431abcce7c1e	pypdf@6.14.2	6.21.2

Open the chart page →

7,438

calibre-web-automatedcalibre-web-automated

1 of 1 See more

calibre-web-automated calibre-web-automated 1.2.3

1 of the 1 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
crocodilestick/calibre-web-automated :v4.0.6	c31a738b6d5e	pypdf@6.6.2	6.21.2

Open the chart page →

9,152

calibre-webcharts-derwitt-dev

1 of 1 See more

calibre-web charts-derwitt-dev 1.1.5

1 of the 1 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
ghcr.io/wittdennis/calibre-web :1.1.4	378f1d4adbfa	pypdf@6.10.2	6.21.2

Open the chart page →

6,569

csghubcsghub

1 of 35 See more

csghub csghub 2.6.1

1 of the 35 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
opencsghq/agenticflow :ee-v0.6.5-2	41cba9c366f1	pypdf@5.1.0	6.21.2

Open the chart page →

71,615

difydify

1 of 4 See more

46,852

rag-apihajowieland

1 of 1 See more

rag-api hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
ghcr.io/danny-avila/librechat-rag-api-dev-lite :latest	a62ce2221b43	pypdf@6.19.0	6.21.2

Open the chart page →

2,165

langflowhelmforge

1 of 1 See more

langflow helmforge 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
langflowai/langflow :1.12.6	a0396e089eb9	pypdf@6.19.0	6.21.2

Open the chart page →

861

inventreeinventree

1 of 2 See more

inventree inventree 0.4.34

1 of the 2 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
inventree/inventree :1.6.1	7c1e251a6c52	pypdf@6.20.0	6.21.2

Open the chart page →

6,610

aperagkubeblocks

1 of 3 See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
apecloud/aperag :v0.0.0-nightly	8ac9947a2c84	pypdf@5.4.0	6.21.2

Open the chart page →

10,309

1 of 12 See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
onyxdotapp/onyx-backend :latest	f76bfd1f3c18	pypdf@6.19.0	6.21.2

Open the chart page →

9,294

opds-shelfopds-shelf

1 of 3 See more

opds-shelf opds-shelf 0.4.0

1 of the 3 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
ghcr.io/linuxserver/calibre-web :latest	b206b791d77b	pypdf@6.10.2	6.21.2

Open the chart page →

6,399

open-terminalqaoru

1 of 1 See more

open-terminal qaoru 0.2.8

1 of the 1 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
ghcr.io/open-webui/open-terminal :0.14.2-slim	fb53967318c5	pypdf@6.21.1	6.21.2

Open the chart page →

2,684

checkmkrtomik-helm-charts

1 of 1 See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
checkmk/check-mk-community :2.5.0p6	c11b422210c4	pypdf@6.10.2	6.21.2

Open the chart page →

10,318

showroom-docs-mcpshowroom-docs-mcp

1 of 4 See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
litellm/litellm-non_root :v1.82.3-stable	09b217802ded	pypdf@6.9.0	6.21.2

Open the chart page →

6,719

backendsignalen

1 of 4 See more

backend signalen 4.25.0

1 of the 4 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
signalen/backend :2.50.18	26bb090bc4e4	pypdf@6.18.0	6.21.2

Open the chart page →

38,204

calibre-webvista

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-115580.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	pypdf@5.0.1	6.21.2

Open the chart page →

10,663

Container images carrying it

23 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
langflowai/langflow :1.12.6 :latest	a0396e089eb9	pypdf@6.19.0	6.21.2	3
ghcr.io/berriai/litellm :1.106.2 :main-stable	7294b90f868c	pypdf@6.19.0	6.21.2	2
agentarea/agentarea-mcp-runner :0.1.1 :latest	066fa4a71695	pypdf@6.19.0	6.21.2	1
apecloud/aperag :v0.0.0-nightly	8ac9947a2c84	pypdf@5.4.0	6.21.2	1
checkmk/check-mk-community :2.5.0p6	c11b422210c4	pypdf@6.10.2	6.21.2	1
crocodilestick/calibre-web-automated :v4.0.6	c31a738b6d5e	pypdf@6.6.2	6.21.2	1
inventree/inventree :1.6.1	7c1e251a6c52	pypdf@6.20.0	6.21.2	1
langgenius/dify-agent-backend :1.17.0	bdb2ed516bd3	pypdf@6.14.2	6.21.2	1
langgenius/dify-api :1.0.0	066035f93856	pypdf@5.3.0	6.21.2	1
langgenius/dify-api :1.17.0	52be6088dd84	pypdf@6.15.0	6.21.2	1
linuxserver/calibre-web :0.6.24	241009026e6f	pypdf@5.0.1	6.21.2	1
litellm/litellm-non_root :v1.82.3-stable	09b217802ded	pypdf@6.9.0	6.21.2	1
onyxdotapp/onyx-backend :latest	f76bfd1f3c18	pypdf@6.19.0	6.21.2	1
opencsghq/agenticflow :ee-v0.6.5-2	41cba9c366f1	pypdf@5.1.0	6.21.2	1
pretix/standalone :2026.8.0	ec17c2f761f7	pypdf@6.19.0	6.21.2	1
signalen/backend :2.50.18	26bb090bc4e4	pypdf@6.18.0	6.21.2	1
ghcr.io/argonix-io/argonix-api :0.6.5	431abcce7c1e	pypdf@6.14.2	6.21.2	1
ghcr.io/danny-avila/librechat-rag-api-dev-lite :latest	a62ce2221b43	pypdf@6.19.0	6.21.2	1
ghcr.io/linuxserver/calibre-web :0.6.26	7c0464228f2f	pypdf@6.4.2	6.21.2	1
ghcr.io/linuxserver/calibre-web :latest	b206b791d77b	pypdf@6.10.2	6.21.2	1
ghcr.io/open-webui/open-terminal :0.14.2-slim	fb53967318c5	pypdf@6.21.1	6.21.2	1
ghcr.io/securo-finance/securo-backend :0.16.5	0e40c6858fb3	pypdf@6.20.1	6.21.2	1
ghcr.io/wittdennis/calibre-web :1.1.4	378f1d4adbfa	pypdf@6.10.2	6.21.2	1