StackRadarChart IndexLive demo

CVE-2026-115585

High

Advisory

Published 23 Oct 2026In the index since 24 Oct 2026

Severity: High; worst across findings
CVSS: 7.1; base score, highest
EPSS: —; probability of exploitation
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 25; of 18,232 indexed, latest versions
Container images: 23; deployed by those charts
Fix available: 1 of 1; affected package

pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)

Carried by container images the latest versions of 25 of 18,232 indexed charts deploy, on 23 images.

Affected package	Affected versions	Fixed in	Images
pypdfpypi	5.0.1, 5.1.0, 5.3.0, 5.4.0+11 more	6.21.2	23

OSV records: GHSA-jr96-gvgh-j3r4

Charts affected

25 by stars

Chart

Latest

Affected images

Radar Score

difydify-helm

2 of 11 See more

dify dify-helm 0.39.0

2 of the 11 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
langgenius/dify-agent-backend :1.17.0	bdb2ed516bd3	pypdf@6.14.2	6.21.2
langgenius/dify-api :1.17.0	52be6088dd84	pypdf@6.15.0	6.21.2

Open the chart page →

64,891

litellm-helmlitellm

1 of 2 See more

litellm-helm litellm 1.106.2

1 of the 2 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
ghcr.io/berriai/litellm :1.106.2	7294b90f868c	pypdf@6.19.0	6.21.2

Open the chart page →

5,544

calibre-webk8s-home-lab-repo

1 of 1 See more

calibre-web k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
ghcr.io/linuxserver/calibre-web :0.6.26	7c0464228f2f	pypdf@6.4.2	6.21.2

Open the chart page →

7,392

pretixtechwolf12

1 of 3 See more

pretix techwolf12 2026.8.0

1 of the 3 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
pretix/standalone :2026.8.0	ec17c2f761f7	pypdf@6.19.0	6.21.2

Open the chart page →

11,400

agentareaagentarea

1 of 17 See more

agentarea agentarea 0.0.29

1 of the 17 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
agentarea/agentarea-mcp-runner :0.1.1	066fa4a71695	pypdf@6.19.0	6.21.2

Open the chart page →

13,394

langflow-idelangflow

1 of 2 See more

langflow-ide langflow 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
langflowai/langflow :latest	a0396e089eb9	pypdf@6.19.0	6.21.2

Open the chart page →

5,289

langflow-runtimelangflow

1 of 1 See more

langflow-runtime langflow 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
langflowai/langflow :latest	a0396e089eb9	pypdf@6.19.0	6.21.2

Open the chart page →

861

securosecuro

1 of 4 See more

securo securo 0.16.5

1 of the 4 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
ghcr.io/securo-finance/securo-backend :0.16.5	0e40c6858fb3	pypdf@6.20.1	6.21.2

Open the chart page →

4,488

litellmalareira

1 of 1 See more

litellm alareira 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
ghcr.io/berriai/litellm :main-stable	7294b90f868c	pypdf@6.19.0	6.21.2

Open the chart page →

277

argonix-apiargonix

1 of 4 See more

argonix-api argonix 0.6.5

1 of the 4 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
ghcr.io/argonix-io/argonix-api :0.6.5	431abcce7c1e	pypdf@6.14.2	6.21.2

Open the chart page →

7,438

calibre-web-automatedcalibre-web-automated

1 of 1 See more

calibre-web-automated calibre-web-automated 1.2.3

1 of the 1 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
crocodilestick/calibre-web-automated :v4.0.6	c31a738b6d5e	pypdf@6.6.2	6.21.2

Open the chart page →

9,152

calibre-webcharts-derwitt-dev

1 of 1 See more

calibre-web charts-derwitt-dev 1.1.5

1 of the 1 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
ghcr.io/wittdennis/calibre-web :1.1.4	378f1d4adbfa	pypdf@6.10.2	6.21.2

Open the chart page →

6,569

csghubcsghub

1 of 35 See more

csghub csghub 2.6.1

1 of the 35 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
opencsghq/agenticflow :ee-v0.6.5-2	41cba9c366f1	pypdf@5.1.0	6.21.2

Open the chart page →

71,615

difydify

1 of 4 See more

46,852

rag-apihajowieland

1 of 1 See more

rag-api hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
ghcr.io/danny-avila/librechat-rag-api-dev-lite :latest	a62ce2221b43	pypdf@6.19.0	6.21.2

Open the chart page →

2,165

langflowhelmforge

1 of 1 See more

langflow helmforge 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
langflowai/langflow :1.12.6	a0396e089eb9	pypdf@6.19.0	6.21.2

Open the chart page →

861

inventreeinventree

1 of 2 See more

inventree inventree 0.4.34

1 of the 2 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
inventree/inventree :1.6.1	7c1e251a6c52	pypdf@6.20.0	6.21.2

Open the chart page →

6,610

aperagkubeblocks

1 of 3 See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
apecloud/aperag :v0.0.0-nightly	8ac9947a2c84	pypdf@5.4.0	6.21.2

Open the chart page →

10,309

1 of 12 See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
onyxdotapp/onyx-backend :latest	f76bfd1f3c18	pypdf@6.19.0	6.21.2

Open the chart page →

9,294

opds-shelfopds-shelf

1 of 3 See more

opds-shelf opds-shelf 0.4.0

1 of the 3 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
ghcr.io/linuxserver/calibre-web :latest	b206b791d77b	pypdf@6.10.2	6.21.2

Open the chart page →

6,399

open-terminalqaoru

1 of 1 See more

open-terminal qaoru 0.2.8

1 of the 1 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
ghcr.io/open-webui/open-terminal :0.14.2-slim	fb53967318c5	pypdf@6.21.1	6.21.2

Open the chart page →

2,684

checkmkrtomik-helm-charts

1 of 1 See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
checkmk/check-mk-community :2.5.0p6	c11b422210c4	pypdf@6.10.2	6.21.2

Open the chart page →

10,318

showroom-docs-mcpshowroom-docs-mcp

1 of 4 See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
litellm/litellm-non_root :v1.82.3-stable	09b217802ded	pypdf@6.9.0	6.21.2

Open the chart page →

6,719

backendsignalen

1 of 4 See more

backend signalen 4.25.0

1 of the 4 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
signalen/backend :2.50.18	26bb090bc4e4	pypdf@6.18.0	6.21.2

Open the chart page →

38,204

calibre-webvista

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-115585.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	pypdf@5.0.1	6.21.2

Open the chart page →

10,663

Container images carrying it

23 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
langflowai/langflow :1.12.6 :latest	a0396e089eb9	pypdf@6.19.0	6.21.2	3
ghcr.io/berriai/litellm :1.106.2 :main-stable	7294b90f868c	pypdf@6.19.0	6.21.2	2
agentarea/agentarea-mcp-runner :0.1.1 :latest	066fa4a71695	pypdf@6.19.0	6.21.2	1
apecloud/aperag :v0.0.0-nightly	8ac9947a2c84	pypdf@5.4.0	6.21.2	1
checkmk/check-mk-community :2.5.0p6	c11b422210c4	pypdf@6.10.2	6.21.2	1
crocodilestick/calibre-web-automated :v4.0.6	c31a738b6d5e	pypdf@6.6.2	6.21.2	1
inventree/inventree :1.6.1	7c1e251a6c52	pypdf@6.20.0	6.21.2	1
langgenius/dify-agent-backend :1.17.0	bdb2ed516bd3	pypdf@6.14.2	6.21.2	1
langgenius/dify-api :1.0.0	066035f93856	pypdf@5.3.0	6.21.2	1
langgenius/dify-api :1.17.0	52be6088dd84	pypdf@6.15.0	6.21.2	1
linuxserver/calibre-web :0.6.24	241009026e6f	pypdf@5.0.1	6.21.2	1
litellm/litellm-non_root :v1.82.3-stable	09b217802ded	pypdf@6.9.0	6.21.2	1
onyxdotapp/onyx-backend :latest	f76bfd1f3c18	pypdf@6.19.0	6.21.2	1
opencsghq/agenticflow :ee-v0.6.5-2	41cba9c366f1	pypdf@5.1.0	6.21.2	1
pretix/standalone :2026.8.0	ec17c2f761f7	pypdf@6.19.0	6.21.2	1
signalen/backend :2.50.18	26bb090bc4e4	pypdf@6.18.0	6.21.2	1
ghcr.io/argonix-io/argonix-api :0.6.5	431abcce7c1e	pypdf@6.14.2	6.21.2	1
ghcr.io/danny-avila/librechat-rag-api-dev-lite :latest	a62ce2221b43	pypdf@6.19.0	6.21.2	1
ghcr.io/linuxserver/calibre-web :0.6.26	7c0464228f2f	pypdf@6.4.2	6.21.2	1
ghcr.io/linuxserver/calibre-web :latest	b206b791d77b	pypdf@6.10.2	6.21.2	1
ghcr.io/open-webui/open-terminal :0.14.2-slim	fb53967318c5	pypdf@6.21.1	6.21.2	1
ghcr.io/securo-finance/securo-backend :0.16.5	0e40c6858fb3	pypdf@6.20.1	6.21.2	1
ghcr.io/wittdennis/calibre-web :1.1.4	378f1d4adbfa	pypdf@6.10.2	6.21.2	1