CVE-2026-1299

Medium

Advisory

Published 23 Jan 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.0; base score, highest
EPSS: 0.005; 44th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 512; of 17,787 indexed, latest versions
Container images: 494; deployed by those charts
Fix available: 9 of 14; affected packages

email BytesGenerator header injection due to unquoted newlines

Carried by container images the latest versions of 512 of 17,787 indexed charts deploy, on 494 images.

Affected package	Affected versions	Fixed in	Images
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+4 more	3.11.2-6+deb12u7	145
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	no fix listed	100
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+14 more	3.10.12-1~22.04.16	71
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+12 more	no fix listed	54
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3, 3.12.3-1ubuntu0.4+8 more	3.12.3-1ubuntu0.15	48
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	no fix listed	44
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	no fix listed	25
python3.13deb	3.13.5-2, 3.13.5-2+e30, 3.13.7-1ubuntu0.1	3.13.5-2+deb13u1, 3.13.5-2+e36	23
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	no fix listed	7
python-3.14apk	3.14.2-r2	3.14.3-r1	4
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	3.10.20	3
python-3.12apk	3.12.0-r1, 3.12.9-r1	3.12.12-r5	2
python-3.13apk	3.13.7-r0, 3.13.10-r0	3.13.12-r1	2
python3-corerpm	3.6.15-150300.10.97.1	3.6.15-150300.10.109.1	1

OSV records: BIT-python-2026-1299 CGA-3hhm-jg5q-r9v7 CGA-c9h2-43g4-m56x CGA-cgx7-5h45-6xr5 DEBIAN-CVE-2026-1299 UBUNTU-CVE-2026-1299 ECHO-addc-a9aa-706b SUSE-SU-2026:1090-1
Also known as: BIT-libpython-2026-1299, BIT-python-min-2026-1299, CGA-hw3w-x7mm-rxvx, CGA-jhj2-w2wm-p9wv, CGA-mg73-w7j6-v3ff, PSF-2026-8, USN-8509-1

Charts affected

512 by stars

Chart

Latest

Affected images

Radar Score

browserlessvictorlane

0.2.0

1 of 1 See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	python3.12@3.12.3-1ubuntu0.12	3.12.3-1ubuntu0.15

Open the chart page →

4,305

twenty-crmvictorlane

0.0.1

2 of 3 See more

twenty-crm victorlane 0.0.1

2 of the 3 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
redis/redis-stack-server :latest	798ab84d9f26	python3.10@3.10.12-1~22.04.11	3.10.12-1~22.04.16
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

13,459

calibre-webvista

0.1.3

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.15

Open the chart page →

7,628

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed

Open the chart page →

11,119

myweatherhelmwebapp1

1.3.50

2 of 8 See more

myweatherhelm webapp1 1.3.50

2 of the 8 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.15
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	no fix listed

Open the chart page →

9,130

myweatherhelm-schedulingwebapp1

1.3.92

2 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

2 of the 9 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.15
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	no fix listed

Open the chart page →

9,130

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	no fix listed

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	no fix listed

Open the chart page →

28,605

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	python3.6@3.6.9-1~18.04ubuntu1.1	no fix listed

Open the chart page →

10,843

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed

Open the chart page →

15,230

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

9,248

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-1299.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

14,100

Container images carrying it

494 by charts deploying them

A fixed version is listed for 9 of the 14 affected packages.

Container image	Digest	Package	Fixed in	Used by
santisbon/evworker :latest	e807283f8d69	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
santisbon/speedtest :latest	8ee3a1697227	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
sashafefler/spacecapybara_app :latest	f96d7804c0ca	python3.11@3.11.2-6+deb12u3	3.11.2-6+deb12u7	1
scholtz2/algorand-participation-aramidmain-extended :4.4.1-stable	f12ce1cfb72e	python3.10@3.10.12-1~22.04.6	3.10.12-1~22.04.16	1
scholtz2/algorand-participation-mainnet-extended :4.4.1-stable	5aaa5d4ab8b8	python3.10@3.10.12-1~22.04.6	3.10.12-1~22.04.16	1
scholtz2/algorand-participation-voimain-extended :4.4.1-stable	64966de56d9f	python3.10@3.10.12-1~22.04.6	3.10.12-1~22.04.16	1
scholtz2/algorand-relay-mainnet :4.4.1-stable	e9af7d8ff6bb	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.15	1
scholtz2/aramid-algo-follow-node :v4.3.0-stable	1ec63eca86b6	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.15	1
scholtz2/aramid-algo-node :v4.4.1-stable	70263d8fab5b	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.15	1
scrapinghub/splash :3.4.1	a5f89bc84606	python3.6@3.6.9-1~18.04	no fix listed	1
seafileltd/seafile-mc :9.0.10	6693911bcc40	python3.8@3.8.10-0ubuntu1~20.04.5	no fix listed	1
seafileltd/seafile-mc :10.0.1	70628f29c663	python3.8@3.8.10-0ubuntu1~20.04.8	no fix listed	1
seafileltd/seafile-mc :9.0.9	7ac833196f60	python3.8@3.8.10-0ubuntu1~20.04.5	no fix listed	1
seafileltd/seafile-mc :11.0.12	d0c66e4621bd	python3.10@3.10.12-1~22.04.5	3.10.12-1~22.04.16	1
seafileltd/seafile-mc :8.0.7	ed0fcda5e6a9	python3.8@3.8.10-0ubuntu1~20.04	no fix listed	1
seldonio/locust-core :0.8	1d0da98a2d76	python2.7@2.7.12-1ubuntu0~16.04.4	no fix listed	1
shaowenchen/ops-server :latest	315444f703f4	python3.10@3.10.12-1~22.04.11	3.10.12-1~22.04.16	1
sismics/docs :v1.10	f4b0ef019cf1	python3.6@3.6.6-1~18.04	no fix listed	1
sissbruecker/linkding :1.41.0-plus	a222fb777e1f	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u7	1
snipe/snipe-it :v8.3.1	141ebf2386fe	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.15	1
snipe/snipe-it :v6.0.14	55fb7636a98c	python3.8@3.8.10-0ubuntu1~20.04.5	no fix listed	1
socialmediamacroscope/autophrase :0.1.5	70fb11d4f531	python3.8@3.8.10-0ubuntu1~20.04.8	no fix listed	1
socialmediamacroscope/collect_reddit_comment :0.1.2	19d3d26d53ee	python3.6@3.6.9-1~18.04ubuntu1.12	no fix listed	1
socialmediamacroscope/histogram :0.1.2	6418f9bdb4d2	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
socialmediamacroscope/image_crawler :0.1.2	f508216be63c	python3.6@3.6.9-1~18.04ubuntu1.12	no fix listed	1
socialmediamacroscope/network_analysis :0.1.3	b351c21422e6	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
socialmediamacroscope/preprocessing :0.1.3	ca863306314b	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
socialmediamacroscope/topic_modeling :0.1.3	fa490acac2f8	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
someblackmagic/k8s-testing-multitool :v0.1.0	6eca64b6b440	python3.8@3.8.10-0ubuntu1~20.04.4	no fix listed	1
sonroyaalmerol/docker-sogo :5.12.4	3f60f3abe990	python3.13@3.13.5-2	3.13.5-2+deb13u1	1
speckle/speckle-monitor-deployment :2.20.3-branch.hotfix-2.20.2.149555-37ea0cb	2faf1508c1d3	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
speckle/speckle-monitor-deployment :2.20.2-branch.testing4.134160-9fad4b2	3c8fbe855665	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
speckle/speckle-monitor-deployment :2.20.6-branch.testing1.154030-9b09114	738c77eb6f97	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
speckle/speckle-monitor-deployment :2.18.12-branch.testing3.88744-f55b341	81335b40696a	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
speckle/speckle-monitor-deployment :2.19.2-branch.hotfix-2.19.1.124125-665e7e1	b696ac5022ab	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
speckle/speckle-monitor-deployment :2.21.3-branch.testing5.219631-2153bef	cf72ad0f25fb	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
speckle/speckle-monitor-deployment :2.18.11-branch.testing2.88634-335d469	d6790a97ad47	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
speckle/speckle-monitor-deployment :2.17.14-branch.testing.72707.921a5f8	ff1641ac3f1b	python3.11@3.11.2-6	3.11.2-6+deb12u7	1
stackstorm/st2actionrunner :3.8	88235ba70cad	python3.8@3.8.10-0ubuntu1~20.04.9	no fix listed	1
stackstorm/st2api :3.8	6f56d239d280	python3.8@3.8.10-0ubuntu1~20.04.9	no fix listed	1
stackstorm/st2auth :3.8	33ecfda16608	python3.8@3.8.10-0ubuntu1~20.04.9	no fix listed	1
stackstorm/st2garbagecollector :3.8	4e3f8c7ca52d	python3.8@3.8.10-0ubuntu1~20.04.9	no fix listed	1
stackstorm/st2notifier :3.8	f190a6212195	python3.8@3.8.10-0ubuntu1~20.04.9	no fix listed	1
stackstorm/st2rulesengine :3.8	259503496ff9	python3.8@3.8.10-0ubuntu1~20.04.9	no fix listed	1
stackstorm/st2scheduler :3.8	b1de2055c362	python3.8@3.8.10-0ubuntu1~20.04.9	no fix listed	1
stackstorm/st2sensorcontainer :3.8	b1a338f64773	python3.8@3.8.10-0ubuntu1~20.04.9	no fix listed	1
stackstorm/st2stream :3.8	1c8904a3bf67	python3.8@3.8.10-0ubuntu1~20.04.9	no fix listed	1
stackstorm/st2timersengine :3.8	1bf35bfaf00c	python3.8@3.8.10-0ubuntu1~20.04.9	no fix listed	1
stackstorm/st2workflowengine :3.8	19fdfffdbba8	python3.8@3.8.10-0ubuntu1~20.04.9	no fix listed	1
stashapp/stash :latest	24dbd7607174	python3.8@3.8.5-1~20.04.2	no fix listed	1