CVE-2026-1299

Medium

Advisory

Published 23 Jan 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.0; base score, highest
EPSS: 0.005; 44th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 512; of 17,787 indexed, latest versions
Container images: 494; deployed by those charts
Fix available: 9 of 14; affected packages

email BytesGenerator header injection due to unquoted newlines

Carried by container images the latest versions of 512 of 17,787 indexed charts deploy, on 494 images.

Affected package	Affected versions	Fixed in	Images
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+4 more	3.11.2-6+deb12u7	145
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	no fix listed	100
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+14 more	3.10.12-1~22.04.16	71
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+12 more	no fix listed	54
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3, 3.12.3-1ubuntu0.4+8 more	3.12.3-1ubuntu0.15	48
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	no fix listed	44
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	no fix listed	25
python3.13deb	3.13.5-2, 3.13.5-2+e30, 3.13.7-1ubuntu0.1	3.13.5-2+deb13u1, 3.13.5-2+e36	23
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	no fix listed	7
python-3.14apk	3.14.2-r2	3.14.3-r1	4
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	3.10.20	3
python-3.12apk	3.12.0-r1, 3.12.9-r1	3.12.12-r5	2
python-3.13apk	3.13.7-r0, 3.13.10-r0	3.13.12-r1	2
python3-corerpm	3.6.15-150300.10.97.1	3.6.15-150300.10.109.1	1

OSV records: BIT-python-2026-1299 CGA-3hhm-jg5q-r9v7 CGA-c9h2-43g4-m56x CGA-cgx7-5h45-6xr5 DEBIAN-CVE-2026-1299 UBUNTU-CVE-2026-1299 ECHO-addc-a9aa-706b SUSE-SU-2026:1090-1
Also known as: BIT-libpython-2026-1299, BIT-python-min-2026-1299, CGA-hw3w-x7mm-rxvx, CGA-jhj2-w2wm-p9wv, CGA-mg73-w7j6-v3ff, PSF-2026-8, USN-8509-1

Charts affected

512 by stars

Chart

Latest

Affected images

Radar Score

browserlessvictorlane

0.2.0

1 of 1 See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	python3.12@3.12.3-1ubuntu0.12	3.12.3-1ubuntu0.15

Open the chart page →

4,305

twenty-crmvictorlane

0.0.1

2 of 3 See more

twenty-crm victorlane 0.0.1

2 of the 3 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
redis/redis-stack-server :latest	798ab84d9f26	python3.10@3.10.12-1~22.04.11	3.10.12-1~22.04.16
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

13,459

calibre-webvista

0.1.3

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.15

Open the chart page →

7,628

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed

Open the chart page →

11,119

myweatherhelmwebapp1

1.3.50

2 of 8 See more

myweatherhelm webapp1 1.3.50

2 of the 8 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.15
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	no fix listed

Open the chart page →

9,130

myweatherhelm-schedulingwebapp1

1.3.92

2 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

2 of the 9 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.15
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	no fix listed

Open the chart page →

9,130

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	no fix listed

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	no fix listed

Open the chart page →

28,605

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	python3.6@3.6.9-1~18.04ubuntu1.1	no fix listed

Open the chart page →

10,843

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed

Open the chart page →

15,230

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

9,248

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

14,100

Container images carrying it

494 by charts deploying them

A fixed version is listed for 9 of the 14 affected packages.

Container image	Digest	Package	Fixed in	Used by
knspar/phronetis-operator :0.1.6	0c4f0543ee58	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
kong/httpbin :latest	a6ac46531193	python3.10@3.10.12-1~22.04.7	3.10.12-1~22.04.16	1
kubeoperator/webkubectl :v2.4.0	be8f0d624640	python3.6@3.6.9-1~18.04ubuntu1	no fix listed	1
kubeovn/kube-ovn :v1.14.0	6722b54eb5c0	python3.12@3.12.3-1ubuntu0.7	3.12.3-1ubuntu0.15	1
kusionstack/kusion :v0.14.0	126c8f0b0976	python3.10@3.10.12-1~22.04.8	3.10.12-1~22.04.16	1
laly9999/node-app :1	dd0e503913e1	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
langgenius/dify-plugin-daemon :0.6.3-local	3c694329357b	python3.12@3.12.3-1ubuntu0.13	3.12.3-1ubuntu0.15	1
langgenius/dify-plugin-daemon :0.5.1-local	8269050f192e	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.15	1
library/cassandra :3.11.10	b095ff3248c6	python2.7@2.7.18-1~20.04.1	no fix listed	1
library/nextcloud :31.0.6-apache	588609d76b21	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
library/nextcloud :31.0.10-apache	b7faa1653c39	python3.13@3.13.5-2	3.13.5-2+deb13u1	1
library/node :20	8f693eaa7e0a	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
library/python :3.8	d41127070014	python3.11@3.11.2-6+deb12u3	3.11.2-6+deb12u7	1
library/python :3.9	da5aee29682d	python3.13@3.13.5-2	3.13.5-2+deb13u1	1
library/rabbitmq :3.11.5-management	1b0f675d2f24	python3.8@3.8.10-0ubuntu1~20.04.6	no fix listed	1
library/rabbitmq :3.7-management	b6dd45cc35b3	python3.6@3.6.9-1~18.04ubuntu1.1	no fix listed	1
library/varnish :7.5.0	4d0bb287d87b	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u7	1
library/wordpress :6.4.3-apache	8ae66efb09a2	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
linuxserver/calibre :version-v5.21.0	a847b5b2d860	python2.7@2.7.17-1~18.04ubuntu1.6 python3.6@3.6.9-1~18.04ubuntu1.4	no fix listed no fix listed	1
linuxserver/calibre-web :0.6.24	241009026e6f	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.15	1
linuxserver/calibre-web :version-0.6.12	938810eca3d3	python3.8@3.8.10-0ubuntu1~20.04	no fix listed	1
linuxserver/codimd :latest	b801bbcf6386	python2.7@2.7.17-1~18.04ubuntu1.2	no fix listed	1
linuxserver/deluge :18.04.1	0ac871624394	python3.6@3.6.9-1~18.04ubuntu1.4	no fix listed	1
linuxserver/deluge :version-2.0.3-2201906121747ubuntu18.04.1	2ce561a95e7b	python3.6@3.6.9-1~18.04ubuntu1.4	no fix listed	1
linuxserver/lazylibrarian :version-1152df82	f93d2560e233	python3.6@3.6.9-1~18.04ubuntu1.4	no fix listed	1
logiqai/flash :v3.10.2	65b996bc7bdc	python3.11@3.11.2-6+deb12u3	3.11.2-6+deb12u7	1
longhornio/longhorn-manager :v1.10.0	5b0bc1b88f0c	python3-core@3.6.15-150300.10.97.1	3.6.15-150300.10.109.1	1
longhornio/longhorn-manager :v1.2.3	dca34321452c	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed	1
longhornio/longhorn-manager :v1.1.1	ede61fe2a472	python3.6@3.6.9-1~18.04ubuntu1.4	no fix listed	1
louislam/uptime-kuma :2.2.1-slim	059b49d64739	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
louislam/uptime-kuma :2.0.2	4c364ef96aad	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
louislam/uptime-kuma :2.0.2-slim-rootless	9865163f92c1	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
lsstsqre/nublado2 :2.0.1	b75bf8aaafa4	python2.7@2.7.18-1~20.04.1 python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed no fix listed	1
makersquad/harp-proxy :0.8.1	a40dd258c527	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u7	1
mbround18/valheim :3.1.0	70bd4da591cd	python3.10@3.10.12-1~22.04.9	3.10.12-1~22.04.16	1
mediagis/nominatim :5.3.2	7923a8e67197	python3.12@3.12.3-1ubuntu0.13	3.12.3-1ubuntu0.15	1
mediagis/nominatim :3.7	c15e941485ef	python3.8@3.8.10-0ubuntu1~20.04.5	no fix listed	1
mediagis/nominatim :4.2	d0eae7b51374	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16	1
middlewareeng/middleware :0.3.1	747d880812f1	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
mindsdb/mindsdb :latest	163011c09299	python3.13@3.13.5-2	3.13.5-2+deb13u1	1
mintproject/model-catalog-fastapi :7dd88dc5bf1fe6a6d4703ea0a077afee45cb2561	02260d20a21f	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u7	1
mlikiowa/napcat-docker :latest	1336a777f9a4	python3.10@3.10.12-1~22.04.6	3.10.12-1~22.04.16	1
moreillon/api-proxy :latest	d7d4a5463525	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
moreillon/food-manager :latest	e8fd856e593d	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
moreillon/group-manager :latest	3caa8f710ee0	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
moreillon/user-manager-mongoose :v5.0.1	d2ee0423b797	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
mshanley80/httpbin2022 :latest	5b189a70c0fb	python3.8@3.8.10-0ubuntu1~20.04.6	no fix listed	1
muhammedgamal/fp23 :latest	74b4cd69b6fa	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
muluder/prograncontrollermcord :0.1.8	43b597a93da7	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	no fix listed no fix listed	1
netboxcommunity/netbox :v3.2.8	3d652dca5351	python3.10@3.10.4-3ubuntu0.1	3.10.12-1~22.04.16	1