StackRadar

CVE-2026-34993

High

Advisory

Published 2 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.3
base score, highest
EPSS
0.002
8th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
156
of 17,781 indexed, latest versions
Container images
157
deployed by those charts
Fix available
1 of 2
affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 156 of 17,781 indexed charts deploy, on 157 images.

Affected packageAffected versionsFixed inImages
aiohttppypi3.4.4, 3.5.4, 3.6.2, 3.7.1+32 more3.14.0157
python-aiohttpdeb3.8.4-1, 3.11.16-1+deb13u1no fix listed2
OSV records
DEBIAN-CVE-2026-34993PYSEC-2026-2104
Also known as
GHSA-jg22-mg44-37j8

Charts affected

156 by stars
ChartLatestAffected imagesRadar Score
traefik-external-dns-operatortraefik-external-dns-operator1.0.11 of 1See more

traefik-external-dns-operator traefik-external-dns-operator 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-34993.

Container imageDigestPackageFixed in
ybucci/traefik-external-dns-operator:1.0.0f1fcc7c8d9fd
aiohttp@3.11.14
3.14.0

Open the chart page →

1,083
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2026-34993.

Container imageDigestPackageFixed in
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
aiohttp@3.8.1
3.14.0

Open the chart page →

8,607
wasabi-s3-operatorwasabi-s3-operatorVerified publisher0.2.71 of 1See more

wasabi-s3-operator wasabi-s3-operator 0.2.7

1 of the 1 container images this version deploys carry CVE-2026-34993.

Container imageDigestPackageFixed in
kenchrcum/wasabi-s3-operator:0.2.7ce657c622ce5
aiohttp@3.13.5
3.14.0

Open the chart page →

628
wazuh-manager-filebeatwazuh-manager-filebeat0.1.0-gamma1 of 1See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-34993.

Container imageDigestPackageFixed in
iosifache/wazuh-manager-filebeat:latest85df3f04b5da
aiohttp@3.7.4
3.14.0

Open the chart page →

11,119
alertmanager-matrix-forwarderzloi-space1.0.11 of 2See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-34993.

Container imageDigestPackageFixed in
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
aiohttp@3.8.1
3.14.0

Open the chart page →

3,118
grafana-matrix-forwarderzloi-space1.0.01 of 2See more

grafana-matrix-forwarder zloi-space 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-34993.

Container imageDigestPackageFixed in
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
aiohttp@3.8.1
3.14.0

Open the chart page →

1,636

Container images carrying it

157 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
tock/gen-ai-orchestrator-server:25.10.7abf7880e0449
aiohttp@3.13.3
3.14.0
1
tombursch/kitchenowl-backend:v0.7.8b48e4ab727cd
aiohttp@3.13.4
3.14.0
1
vabene1111/recipes:2.3.50f8d061895e9
aiohttp@3.12.15
3.14.0
1
wazuh/wazuh-manager:4.4.121994f40e0da
aiohttp@3.8.1
3.14.0
1
ybucci/traefik-external-dns-operator:1.0.0f1fcc7c8d9fd
aiohttp@3.11.14
3.14.0
1
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
aiohttp@3.11.13
3.14.0
1
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
aiohttp@3.10.11
3.14.0
1
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
aiohttp@3.10.11
3.14.0
1
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
aiohttp@3.8.5
3.14.0
1
ghcr.io/dask/dask-gateway-server:2024.1.0881e7acfc5a0
aiohttp@3.9.1
3.14.0
1
ghcr.io/dask/dask-gateway-server:2026.3.0afa5a729114e
aiohttp@3.13.4
3.14.0
1
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
aiohttp@3.13.3
3.14.0
1
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
aiohttp@3.9.1
3.14.0
1
ghcr.io/dmunozv04/isponsorblocktv:v2.9.05b8cfa805cb6
aiohttp@3.13.5
3.14.0
1
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter:0.1.38b472877847f5
aiohttp@3.9.5
3.14.0
1
ghcr.io/drewburr-labs/mum-discord-bot:3.1.26e82914e1051
aiohttp@3.9.1
3.14.0
1
ghcr.io/eslupmi/impulse:v3.7.03ded1b7ebca0
aiohttp@3.13.5
3.14.0
1
ghcr.io/gabe565/obico/web:latesta5c1daef46c0
aiohttp@3.9.1
3.14.0
1
ghcr.io/glassflow/glassflow-notifier:v1.0.3d1b0ce10b513
aiohttp@3.13.5
3.14.0
1
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
aiohttp@3.13.3
3.14.0
1
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
aiohttp@3.13.5
3.14.0
1
ghcr.io/grofers/legend:0.1d6e901ad0ebd
aiohttp@3.7.1
3.14.0
1
ghcr.io/hemslo/chat-search:latest39d48995a5bd
aiohttp@3.9.5
3.14.0
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
aiohttp@3.11.13
3.14.0
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
aiohttp@3.13.2
3.14.0
1
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
aiohttp@3.8.1
3.14.0
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
aiohttp@3.8.5
3.14.0
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
aiohttp@3.13.3
3.14.0
1
ghcr.io/ideamixes/object-cloner:2.0.031030fd2f192
aiohttp@3.8.5
3.14.0
1
ghcr.io/iisas/domino-rest:latest3009350bfc11
aiohttp@3.12.15
3.14.0
1
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
aiohttp@3.13.5
3.14.0
1
ghcr.io/lerentis/bitwarden-crd-operator:0.17.00a608c6ead85
aiohttp@3.13.5
3.14.0
1
ghcr.io/liturgical-app/calendar-api:0.0.9688a685e2bde
aiohttp@3.12.15
3.14.0
1
ghcr.io/liturgical-app/liturgical-api:1.0.12637bdcebdd8d
aiohttp@3.13.4
3.14.0
1
ghcr.io/lsst-sqre/strimzi-registry-operator:0.6.07e25f7048aff
aiohttp@3.8.1
3.14.0
1
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
aiohttp@3.13.2
3.14.0
1
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
aiohttp@3.13.5
3.14.0
1
ghcr.io/nowakeai/svc-lb-mux:0.1.37d8fb8e996b6
aiohttp@3.13.5
3.14.0
1
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
aiohttp@3.12.13
3.14.0
1
ghcr.io/serenita-org/vero:v0.8.3e5a7ec714acc
aiohttp@3.10.10
3.14.0
1
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
aiohttp@3.13.5
3.14.0
1
ghcr.io/smarter-project/audio-client:v3.1.23c8375dc5487
aiohttp@3.8.3
3.14.0
1
ghcr.io/smarter-project/image-detector:v2.5.31dcca70c6446
aiohttp@3.8.3
3.14.0
1
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
aiohttp@3.10.11
3.14.0
1
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
aiohttp@3.8.3
3.14.0
1
ghcr.io/vinny1892/octantis:latest45459c0910fc
aiohttp@3.13.3
3.14.0
1
ghcr.io/zoriya/kyoo_scanner:4.7.17dc0ee57b628
aiohttp@3.11.11
3.14.0
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
aiohttp@3.10.10
3.14.0
1
quay.io/clustersecret/clustersecret:0.0.14a9f835d1b241
aiohttp@3.11.11
3.14.0
1
quay.io/evl.ms/argocd-exporter:0.0.136ea8f34aa6b
aiohttp@3.7.4.post0
3.14.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.