StackRadar

CVE-2026-22815

Medium

Advisory

Published 1 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.004
37th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
128
of 17,781 indexed, latest versions
Container images
131
deployed by those charts
Fix available
1 of 2
affected packages

aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage

Carried by container images the latest versions of 128 of 17,781 indexed charts deploy, on 131 images.

Affected packageAffected versionsFixed inImages
aiohttppypi3.4.4, 3.5.4, 3.6.2, 3.7.1+30 more3.13.4131
python-aiohttpdeb3.8.4-1, 3.11.16-1+deb13u1no fix listed2
OSV records
DEBIAN-CVE-2026-22815GHSA-w2fm-2cpv-w7v5
Also known as
PYSEC-2026-2094

Charts affected

128 by stars
ChartLatestAffected imagesRadar Score
csgshipcsghubVerified publisher0.4.62 of 10See more

csgship csghub 0.4.6

2 of the 10 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
opencsghq/csgship-agentic:v0.4.02cd29671a03e
aiohttp@3.12.15
3.13.4
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
aiohttp@3.12.15
3.13.4

Open the chart page →

11,335
wazuhcsic-charts0.1.01 of 4See more

wazuh csic-charts 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.4.121994f40e0da
aiohttp@3.8.1
3.13.4

Open the chart page →

13,852
jupyterhubd4nVerified publisher3.3.72 of 7See more

jupyterhub d4n 3.3.7

2 of the 7 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
aristidetm/basic-notebook:3.6.5469dbc951224
aiohttp@3.9.5
3.13.4
aristidetm/k8s-hub:3.3.7ccb516cb8474
aiohttp@3.9.3
3.13.4

Open the chart page →

16,604
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
aiohttp@3.8.5
3.13.4

Open the chart page →

6,179
datacubedatacube-charts0.18.21 of 1See more

datacube datacube-charts 0.18.2

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
opendatacube/wms:latest1b90cdf68831
aiohttp@3.6.2
3.13.4

Open the chart page →

27,728
restcubedatacube-charts0.2.91 of 1See more

restcube datacube-charts 0.2.9

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
opendatacube/restcube:latest91870111837c
aiohttp@3.6.2
3.13.4

Open the chart page →

24,335
kube-web-viewdecayofmind0.0.41 of 1See more

kube-web-view decayofmind 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
hjacobs/kube-web-view:20.10.0b44a9cf81a2f
aiohttp@3.6.2
3.13.4

Open the chart page →

2,264
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
aiohttp@3.10.10
3.13.4

Open the chart page →

9,607
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
aiohttp@3.10.10
3.13.4

Open the chart page →

9,607
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
aiohttp@3.11.12
3.13.4

Open the chart page →

19,224
dominodomino-iisasVerified publisher0.3.11 of 3See more

domino domino-iisas 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
ghcr.io/iisas/domino-rest:latest3009350bfc11
aiohttp@3.12.15
3.13.4

Open the chart page →

10,270
rommernail-romm1.0.11 of 1See more

romm ernail-romm 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
rommapp/romm:4.4.1b909e95d1aab
aiohttp@3.12.14
3.13.4

Open the chart page →

2,896
argocd-version-exporterevilmartians0.0.11 of 1See more

argocd-version-exporter evilmartians 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
quay.io/evl.ms/argocd-exporter:0.0.136ea8f34aa6b
aiohttp@3.7.4.post0
3.13.4

Open the chart page →

2,401
huntingfactlyVerified publisher0.4.141 of 1See more

hunting factly 0.4.14

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
aiohttp@3.8.3
3.13.4

Open the chart page →

4,085
activityrelayfedihost0.1.41 of 2See more

activityrelay fedihost 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
stratospire/activityrelay:0.2.3a4c34cb01117
aiohttp@3.8.3
3.13.4

Open the chart page →

13,450
tandoorgabe565Verified publisher0.9.91 of 2See more

tandoor gabe565 0.9.9

1 of the 2 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
aiohttp@3.10.11
3.13.4

Open the chart page →

2,183
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
aiohttp@3.13.2
3.13.4

Open the chart page →

8,923
glpiglpi-chart0.1.11 of 3See more

glpi glpi-chart 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
vdiogov/glpi-conteiner:latest6945f84f0058
aiohttp@3.8.4
python-aiohttp@3.8.4-1
3.13.4
no fix listed

Open the chart page →

12,170
resurrectbothalkeye0.1.51 of 1See more

resurrectbot halkeye 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
halkeye/slack-resurrect:v0.1.477b05e95fdb5
aiohttp@3.5.4
3.13.4

Open the chart page →

3,809
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
aiohttp@3.11.13
3.13.4

Open the chart page →

4,647
chiefonboardinghelmforgeVerified publisher1.1.141 of 3See more

chiefonboarding helmforge 1.1.14

1 of the 3 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
chiefonboarding/chiefonboarding:v2.4.159bc7aa60fe7
aiohttp@3.13.3
3.13.4

Open the chart page →

10,849
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
aiohttp@3.10.8
3.13.4

Open the chart page →

25,017
guardrails-usvcinfracloud-chartsVerified publisher1.0.11 of 1See more

guardrails-usvc infracloud-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
opea/guardrails-tgi:latestf68bec6a1271
aiohttp@3.11.11
3.13.4

Open the chart page →

5,062
shynetjuniorjpdj0.1.301 of 1See more

shynet juniorjpdj 0.1.30

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
milesmcc/shynet:v0.13.1ba54f7797a6b
aiohttp@3.8.1
3.13.4

Open the chart page →

2,581
authentikkagiso-me0.1.11 of 1See more

authentik kagiso-me 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
aiohttp@3.13.3
3.13.4

Open the chart page →

4,568
karbkarbVerified publisher1.0.31 of 1See more

karb karb 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
ghcr.io/xeor/karb:main647a3c938d31
aiohttp@3.13.3
3.13.4

Open the chart page →

625
karb-chartkarbVerified publisher1.0.61 of 1See more

karb-chart karb 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
ghcr.io/xeor/karb:1.0.6647a3c938d31
aiohttp@3.13.3
3.13.4

Open the chart page →

625
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
aiohttp@3.8.5
3.13.4

Open the chart page →

6,447
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
aiohttp@3.11.16
3.13.4

Open the chart page →

8,405
jupyterhubkubeblocksVerified publisher0.1.01 of 7See more

jupyterhub kubeblocks 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
jupyterhub/k8s-hub:3.0.1-0.dev.git.6287.hbfb05cd65a0ceed1300a
aiohttp@3.8.5
3.13.4

Open the chart page →

7,356
deepflowkubesphere-stable6.2.6061 of 8See more

deepflow kubesphere-stable 6.2.606

1 of the 8 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
deepflowce/deepflow-app:v6.2.6.5a1888d35e787
aiohttp@3.4.4
3.13.4

Open the chart page →

18,316
legendlegend0.1.21 of 1See more

legend legend 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
ghcr.io/grofers/legend:0.1d6e901ad0ebd
aiohttp@3.7.1
3.13.4

Open the chart page →

4,067
calendar-apiliturgical0.1.51 of 1See more

calendar-api liturgical 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
ghcr.io/liturgical-app/calendar-api:0.0.9688a685e2bde
aiohttp@3.12.15
3.13.4

Open the chart page →

1,556
kafka-aggregatorlsst-sqre0.1.21 of 1See more

kafka-aggregator lsst-sqre 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
lsstsqre/kafkaaggregator:masterbe1b21060854
aiohttp@3.7.4
3.13.4

Open the chart page →

3,052
nublado2lsst-sqre0.8.51 of 2See more

nublado2 lsst-sqre 0.8.5

1 of the 2 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
lsstsqre/nublado2:2.0.1b75bf8aaafa4
aiohttp@3.8.1
3.13.4

Open the chart page →

17,779
buildkite-exporterminaVerified publisher0.1.41 of 1See more

buildkite-exporter mina 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
codaprotocol/buildkite-exporter:0.2.137c68e67a401
aiohttp@3.7.3
3.13.4

Open the chart page →

2,599
mum-discord-botmum-discord-botVerified publisher0.3.71 of 1See more

mum-discord-bot mum-discord-bot 0.3.7

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
ghcr.io/drewburr-labs/mum-discord-bot:3.1.26e82914e1051
aiohttp@3.9.1
3.13.4

Open the chart page →

13,686
mlflowncsaVerified publisher1.2.11 of 4See more

mlflow ncsa 1.2.1

1 of the 4 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
evk02/mlflow:2.2.1ef6ff257ef35
aiohttp@3.8.4
3.13.4

Open the chart page →

5,456
object-clonerobject-clonerVerified publisher2.0.01 of 1See more

object-cloner object-cloner 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
ghcr.io/ideamixes/object-cloner:2.0.031030fd2f192
aiohttp@3.8.5
3.13.4

Open the chart page →

1,588
octantisoctantis0.1.01 of 1See more

octantis octantis 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
ghcr.io/vinny1892/octantis:latest45459c0910fc
aiohttp@3.13.3
3.13.4

Open the chart page →

2,555
chatbot-ai-sampleopenshift0.1.61 of 4See more

chatbot-ai-sample openshift 0.1.6

1 of the 4 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
aiohttp@3.9.5
3.13.4

Open the chart page →

18,922
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
aiohttp@3.13.2
3.13.4

Open the chart page →

4,749
email-managerphntom0.1.221 of 2See more

email-manager phntom 0.1.22

1 of the 2 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
phntom/email-manager:0.1.22d8e2a9f2f085
aiohttp@3.8.4
3.13.4

Open the chart page →

2,565
phronetisphronetis0.1.271 of 2See more

phronetis phronetis 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
knspar/phronetis-operator:0.1.60c4f0543ee58
aiohttp@3.12.13
3.13.4

Open the chart page →

16,196
qubivaqubiva0.3.21 of 3See more

qubiva qubiva 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
aiohttp@3.12.13
3.13.4

Open the chart page →

4,272
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
aiohttp@3.10.5
3.13.4

Open the chart page →

21,211
radar-kafkaradar-baseVerified publisher0.4.11 of 2See more

radar-kafka radar-base 0.4.1

1 of the 2 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
ghcr.io/lsst-sqre/strimzi-registry-operator:0.6.07e25f7048aff
aiohttp@3.8.1
3.13.4

Open the chart page →

4,219
kube-web-viewrlex0.5.01 of 1See more

kube-web-view rlex 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
hjacobs/kube-web-view:23.8.0431f1bf013d0
aiohttp@3.8.4
3.13.4

Open the chart page →

4,908
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
aiohttp@3.10.10
3.13.4

Open the chart page →

9,607
imgtagrotationalVerified publisher0.2.01 of 1See more

imgtag rotational 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-22815.

Container imageDigestPackageFixed in
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
aiohttp@3.11.13
3.13.4

Open the chart page →

3,312

Container images carrying it

131 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
langgenius/dify-api:1.0.0066035f93856
aiohttp@3.11.12
3.13.4
1
langgenius/dify-api:0.6.11fca918260dd6
aiohttp@3.9.5
3.13.4
1
litellm/litellm-non_root:v1.82.3-stable09b217802ded
aiohttp@3.13.3
3.13.4
1
lsstsqre/kafkaaggregator:masterbe1b21060854
aiohttp@3.7.4
3.13.4
1
lsstsqre/nublado2:2.0.1b75bf8aaafa4
aiohttp@3.8.1
3.13.4
1
makersquad/harp-proxy:0.8.1a40dd258c527
aiohttp@3.11.18
3.13.4
1
milesmcc/shynet:v0.13.1ba54f7797a6b
aiohttp@3.8.1
3.13.4
1
milesmcc/shynet:v0.12.0e821e31140f7
aiohttp@3.8.1
3.13.4
1
opea/asr:1.025dd26d9cd09
aiohttp@3.10.5
3.13.4
1
opea/chatqna:1.038c51b791efa
aiohttp@3.10.5
3.13.4
1
opea/codegen:1.058f91683892d
aiohttp@3.10.5
3.13.4
1
opea/codetrans:1.0e2436483b73d
aiohttp@3.10.5
3.13.4
1
opea/docsum:1.03eaa91849512
aiohttp@3.10.5
3.13.4
1
opea/guardrails-tgi:1.0262c6048aab8
aiohttp@3.10.5
3.13.4
1
opea/guardrails-tgi:latestf68bec6a1271
aiohttp@3.11.11
3.13.4
1
opea/llm-docsum-tgi:1.002f9e8fa5d71
aiohttp@3.10.5
3.13.4
1
opea/speecht5:1.0249afad3d268
aiohttp@3.10.5
3.13.4
1
opea/tts:1.0257ae94709e9
aiohttp@3.10.5
3.13.4
1
opea/web-retriever-chroma:1.0fe08165d7770
aiohttp@3.10.5
3.13.4
1
openbas/caldera-server:5.1.0a277796d9724
aiohttp@3.10.8
3.13.4
1
opencsghq/agenticflow:ee-v0.6-52f03fead54db
aiohttp@3.12.13
3.13.4
1
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
aiohttp@3.10.11
3.13.4
1
opencsghq/csgship-agentic:v0.4.02cd29671a03e
aiohttp@3.12.15
3.13.4
1
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
aiohttp@3.12.15
3.13.4
1
opendatacube/restcube:latest91870111837c
aiohttp@3.6.2
3.13.4
1
opendatacube/wms:latest1b90cdf68831
aiohttp@3.6.2
3.13.4
1
openmined/syft-backend:0.9.5b72f74a68b32
aiohttp@3.11.12
3.13.4
1
pangeo/base-notebook:2024.01.155fbe688a4f80
aiohttp@3.9.1
3.13.4
1
phntom/email-manager:0.1.22d8e2a9f2f085
aiohttp@3.8.4
3.13.4
1
rommapp/romm:4.4.1b909e95d1aab
aiohttp@3.12.14
3.13.4
1
runx1/opta-agent:latest0ca3867d3200
aiohttp@3.8.1
3.13.4
1
saidsef/scapy-containerised:v2025.02f17f7c435891
aiohttp@3.11.12
3.13.4
1
salehmir/jesse:1.10.101afa95f979e9
aiohttp@3.12.12
3.13.4
1
semaphoreui/semaphore:v2.9.645b50bc11833f
aiohttp@3.8.5
3.13.4
1
skylenet/ethereum-genesis-generator:latest210353ce7c89
aiohttp@3.8.3
3.13.4
1
sruthitanneru/pi-sample:ui-lateste565ea454ffd
aiohttp@3.11.8
3.13.4
1
stratospire/activityrelay:0.2.3a4c34cb01117
aiohttp@3.8.3
3.13.4
1
substratusai/verba:v0.4.0-baseURL261695be635eb
aiohttp@3.9.5
3.13.4
1
thelande/kasa_exporter:v0.2.3a1fdb8baa152
aiohttp@3.9.5
3.13.4
1
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
aiohttp@3.11.13
3.13.4
1
tock/gen-ai-orchestrator-server:25.10.7abf7880e0449
aiohttp@3.13.3
3.13.4
1
vabene1111/recipes:2.3.50f8d061895e9
aiohttp@3.12.15
3.13.4
1
wazuh/wazuh-manager:4.4.121994f40e0da
aiohttp@3.8.1
3.13.4
1
ybucci/traefik-external-dns-operator:1.0.0f1fcc7c8d9fd
aiohttp@3.11.14
3.13.4
1
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
aiohttp@3.11.13
3.13.4
1
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
aiohttp@3.10.11
3.13.4
1
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
aiohttp@3.10.11
3.13.4
1
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
aiohttp@3.8.5
3.13.4
1
ghcr.io/dask/dask-gateway-server:2024.1.0881e7acfc5a0
aiohttp@3.9.1
3.13.4
1
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
aiohttp@3.13.3
3.13.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.