CVE-2026-1299

Medium

Advisory

Published 23 Jan 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.0; base score, highest
EPSS: 0.005; 44th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 512; of 17,781 indexed, latest versions
Container images: 494; deployed by those charts
Fix available: 9 of 14; affected packages

email BytesGenerator header injection due to unquoted newlines

Carried by container images the latest versions of 512 of 17,781 indexed charts deploy, on 494 images.

Affected package	Affected versions	Fixed in	Images
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+4 more	3.11.2-6+deb12u7	145
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	no fix listed	100
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+14 more	3.10.12-1~22.04.16	71
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+12 more	no fix listed	54
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3, 3.12.3-1ubuntu0.4+8 more	3.12.3-1ubuntu0.15	48
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	no fix listed	44
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	no fix listed	25
python3.13deb	3.13.5-2, 3.13.5-2+e30, 3.13.7-1ubuntu0.1	3.13.5-2+deb13u1, 3.13.5-2+e36	23
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	no fix listed	7
python-3.14apk	3.14.2-r2	3.14.3-r1	4
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	3.10.20	3
python-3.12apk	3.12.0-r1, 3.12.9-r1	3.12.12-r5	2
python-3.13apk	3.13.7-r0, 3.13.10-r0	3.13.12-r1	2
python3-corerpm	3.6.15-150300.10.97.1	3.6.15-150300.10.109.1	1

OSV records: BIT-python-2026-1299 CGA-3hhm-jg5q-r9v7 CGA-c9h2-43g4-m56x CGA-cgx7-5h45-6xr5 DEBIAN-CVE-2026-1299 UBUNTU-CVE-2026-1299 ECHO-addc-a9aa-706b SUSE-SU-2026:1090-1
Also known as: BIT-libpython-2026-1299, BIT-python-min-2026-1299, CGA-hw3w-x7mm-rxvx, CGA-jhj2-w2wm-p9wv, CGA-mg73-w7j6-v3ff, PSF-2026-8, USN-8509-1

Charts affected

512 by stars

Chart

Latest

Affected images

Radar Score

browserlessvictorlane

0.2.0

1 of 1 See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	python3.12@3.12.3-1ubuntu0.12	3.12.3-1ubuntu0.15

Open the chart page →

4,305

twenty-crmvictorlane

0.0.1

2 of 3 See more

twenty-crm victorlane 0.0.1

2 of the 3 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
redis/redis-stack-server :latest	798ab84d9f26	python3.10@3.10.12-1~22.04.11	3.10.12-1~22.04.16
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

13,459

calibre-webvista

0.1.3

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.15

Open the chart page →

7,628

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed

Open the chart page →

11,119

myweatherhelmwebapp1

1.3.50

2 of 8 See more

myweatherhelm webapp1 1.3.50

2 of the 8 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.15
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	no fix listed

Open the chart page →

9,130

myweatherhelm-schedulingwebapp1

1.3.92

2 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

2 of the 9 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.15
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	no fix listed

Open the chart page →

9,130

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	no fix listed

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	no fix listed

Open the chart page →

28,605

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	python3.6@3.6.9-1~18.04ubuntu1.1	no fix listed

Open the chart page →

10,843

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed

Open the chart page →

15,230

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

9,248

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

14,100

Container images carrying it

494 by charts deploying them

A fixed version is listed for 9 of the 14 affected packages.

Container image	Digest	Package	Fixed in	Used by
checkmk/check-mk-community :2.5.0p6	c11b422210c4	python3.10@3.10.12-1~22.04.15	3.10.12-1~22.04.16	1
chetangautamm/repo :Opensips_Build	b4b94155ff5a	python3.4@3.4.3-1ubuntu1~14.04.7	no fix listed	1
chetangautamm/repo :sipp.v3	e7f7049e1544	python3.8@3.8.5-1~20.04	no fix listed	1
cheyang/distributed-tf :1.6.0	46cc34755493	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	no fix listed no fix listed	1
chiefonboarding/chiefonboarding :v2.4.1	59bc7aa60fe7	python3.13@3.13.5-2	3.13.5-2+deb13u1	1
chriseaton/adventureworks :latest	54c3384ce701	python3.10@3.10.12-1~22.04.9	3.10.12-1~22.04.16	1
citizenstig/httpbin :latest	b81c818ccb86	python3.5@3.5.2-2ubuntu0~16.04.1	no fix listed	1
cloudve/janis-terminal :latest	af56e77ca587	python3.6@3.6.9-1~18.04ubuntu1	no fix listed	1
cloudve/ttyd :latest	d79c1c5881c0	python3.6@3.6.9-1~18.04ubuntu1	no fix listed	1
countly/countly-server :25.05.4	e3c238248f99	python2.7@2.7.18-1~20.04.4 python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed no fix listed	1
danialnabiyan1382/lsdisk :v2.0.8	f96a7ebf1f42	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
dariomader/twampy :v0.0.2	d2f4a8c5e690	python-3.12@3.12.0-r1	3.12.12-r5	1
daskdev/dask-notebook :1.1.0	052630f5ca04	python3.6@3.6.7-1~18.04	no fix listed	1
datamate/seafile-professional :11.0.20	2dd66b722464	python3.10@3.10.12-1~22.04.11	3.10.12-1~22.04.16	1
deconzcommunity/deconz :2.29.2	062de2362641	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u7	1
deimosfr/dnsmasq-k8s :1.4.1	284c4040fc6d	python3.13@3.13.5-2	3.13.5-2+deb13u1	1
dongjiang1989/lxcfs :v6.0.3	4bf9ae391948	python3.8@3.8.10-0ubuntu1~20.04.18	no fix listed	1
dragonflyoss/client :v0.1.82	edf3e921f4e0	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
drumsergio/genieacs :1.2.16.0	28244054e1bf	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
dserio83/velero-api :0.3.1	6b3d9115fee2	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
eclipseaerios/iota-messages-api :latest	e7f5ba0bc64d	python3.13@3.13.5-2	3.13.5-2+deb13u1	1
elastictranscoder/transcoder :627e21dc	b4a0327029e6	python3.6@3.6.9-1~18.04ubuntu1.4	no fix listed	1
elastictranscoder/transcoder-handler :627e21dc	5b75d19e2733	python3.6@3.6.9-1~18.04ubuntu1.4	no fix listed	1
esphome/esphome :2024.3.0	9ab8cc88b28c	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
esphome/esphome :2024.12.2	b2c6322700ac	python3.11@3.11.2-6+deb12u4	3.11.2-6+deb12u7	1
esphome/esphome :2025.3.0	def8b6e4f517	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u7	1
ethereumex/eth-stats-dashboard :v0.0.1	a7603aa8df4c	python2.7@2.7.12-1ubuntu0~16.04.2	no fix listed	1
felipecs8/app-db-connection-test :v1	29e06c9c6385	python3.11@3.11.2-6+deb12u4	3.11.2-6+deb12u7	1
firefart/requesttracker :5.0.4	0d6249906d8c	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
fiware/biz-ecosystem-charging-backend :11.7.0	29456835bb2c	python3.8@3.8.10-0ubuntu1~20.04.18	no fix listed	1
fiware/biz-ecosystem-logic-proxy :11.20.3	d551a13e8278	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
flanksource/batch-runner :v1.0.44	689687a7cf95	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.15	1
flashcatcloud/categraf :latest	42e6ab16472e	python3.12@3.12.3-1ubuntu0.12	3.12.3-1ubuntu0.15	1
fluent/fluent-bit :4.0-debug	e76397ef3983	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
flyway/flyway :9.15	45b5d7cdc75a	python3.8@3.8.10-0ubuntu1~20.04.6	no fix listed	1
frankescobar/allure-docker-service :2.21.0	8a4d7e9308de	python3.6@3.6.9-1~18.04ubuntu1.9	no fix listed	1
frankescobar/allure-docker-service :2.19.0	cafa03b94dac	python3.6@3.6.9-1~18.04ubuntu1.8	no fix listed	1
freeradius/freeradius-server :3.2.8	af6fd34a5b78	python2.7@2.7.18-13ubuntu1.5 python3.10@3.10.12-1~22.04.10	no fix listed 3.10.12-1~22.04.16	1
galaxy/cloudman-server :latest	e5c265fe9fcd	python3.8@3.8.10-0ubuntu1~20.04.5	no fix listed	1
galaxy/galaxy-init :v18.01	0267bad550e6	python2.7@2.7.6-8ubuntu0.4 python3.4@3.4.3-1ubuntu1~14.04.6	no fix listed no fix listed	1
galaxy/galaxy-stable :v18.01	8e577a626dfd	python2.7@2.7.6-8ubuntu0.4 python3.4@3.4.3-1ubuntu1~14.04.6	no fix listed no fix listed	1
galaxy/pulsar-kubernetes :0.15.7	e50a890e24c9	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u7	1
geonode/geoserver :2.28.4-latest	81b1d431b7e9	python3.10@3.10.12-1~22.04.15	3.10.12-1~22.04.16	1
geopython/pycsw :3.0.0-beta2	84662ea6b78b	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
geoscienceaustralia/dea-k8s-data :latest	f4039b45572a	python3.6@3.6.9-1~18.04ubuntu1.1	no fix listed	1
gethue/hue :4.11.0	11b649636e68	python3.8@3.8.10-0ubuntu1~20.04.6	no fix listed	1
gethue/hue :4.10.0	5702b2c37ff9	python2.7@2.7.17-1~18.04ubuntu1.6 python3.6@3.6.9-1~18.04ubuntu1.4	no fix listed no fix listed	1
gethue/hue :latest	7d5c1b9f8a79	python3.10@3.10.12-1~22.04.10 python3.11@3.11.0~rc1-1~22.04	3.10.12-1~22.04.16 no fix listed	1
gotenberg/gotenberg :8.30	206a6c708fc6	python3.13@3.13.5-2	3.13.5-2+deb13u1	1
gpappsoft/privacyidea-docker :3.12.2	af7841adad26	python-3.13@3.13.10-r0	3.13.12-r1	1