CVE-2026-3644

High

Advisory

Published 16 Mar 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.005; 40th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 618; of 17,781 indexed, latest versions
Container images: 596; deployed by those charts
Fix available: 13 of 14; affected packages

CVE-2026-3644 affecting package python3 for versions less than 3.12.9-14

Carried by container images the latest versions of 618 of 17,781 indexed charts deploy, on 596 images.

Affected package	Affected versions	Fixed in	Images
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+6 more	3.11.0~rc1-1~22.04.1+esm2	181
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	3.8.10-0ubuntu1~20.04.18+esm7	100
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+14 more	3.10.12-1~22.04.16	71
python3apk	3.11.12-r1, 3.12.8-r1, 3.12.9-r0, 3.12.10-r0+5 more	3.12.14-r0, 3.14.5-r0	66
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3, 3.12.3-1ubuntu0.4+8 more	3.12.3-1ubuntu0.15	48
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	3.6.9-1~18.04ubuntu1.13+esm10	44
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+9 more	2.7.6-8ubuntu0.6+esm30, 2.7.12-1ubuntu0~16.04.18+esm22, 2.7.17-1~18.04ubuntu1.13+esm15, 2.7.18-13ubuntu1.5+esm9	43
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	3.5.2-2ubuntu0~16.04.13+esm25	25
python3.13deb	3.13.5-2, 3.13.5-2+e30, 3.13.7-1ubuntu0.1	3.13.5-2+deb13u2, 3.13.5-2+e36	23
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	3.4.3-1ubuntu1~14.04.7+esm21	7
python-3.12apk	3.12.0-r1, 3.12.9-r1, 3.12.14-r2, 3.12.14-r6	no fix listed	8
python-3.14apk	3.14.2-r2	3.14.3-r6	4
python-3.13apk	3.13.7-r0, 3.13.10-r0, 3.13.12-r2	3.13.12-r7	3
python3rpm	3.12.9-13.azl3	3.12.9-14	1

OSV records: ALPINE-CVE-2026-3644 DEBIAN-CVE-2026-3644 UBUNTU-CVE-2026-3644 CGA-3rjg-h44j-w26v CGA-6q68-qxxc-rv68 CGA-9vxg-2373-8rm4 AZL-80055 ECHO-6a47-d40a-2c76
Also known as: CGA-975c-63xh-w2w9, CGA-977h-c34r-5v9j, CGA-vr9r-627r-wx6c, USN-8509-1, USN-8744-1

Charts affected

618 by stars

Chart

Latest

Affected images

Radar Score

lightstepupdater-lightstep-satellite

1.2.2

1 of 1 See more

lightstep updater-lightstep-satellite 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-3644.

Container image	Digest	Package	Fixed in
lightstep/collector :2021-01-26_23-02-36Z	11c5569aaf3b	python3.5@3.5.2-2ubuntu0~16.04.5	3.5.2-2ubuntu0~16.04.13+esm25

Open the chart page →

15,330

demo-backendv2fly

0.0.3

1 of 1 See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-3644.

Container image	Digest	Package	Fixed in
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	python3.11@3.11.2-6	no fix listed

Open the chart page →

14,358

simple-prima-notavcnngr

0.5.3

1 of 4 See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-3644.

Container image	Digest	Package	Fixed in
dpage/pgadmin4 :9.2	52cb72a9e3da	python3@3.12.9-r0	3.12.14-r0

Open the chart page →

4,768

unmanicvhdirk

0.1.4

1 of 1 See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-3644.

Container image	Digest	Package	Fixed in
josh5/unmanic :0.2.6	4d49c4816260	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

9,347

browserlessvictorlane

0.2.0

1 of 1 See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-3644.

Container image	Digest	Package	Fixed in
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	python3.12@3.12.3-1ubuntu0.12	3.12.3-1ubuntu0.15

Open the chart page →

4,305

twenty-crmvictorlane

0.0.1

2 of 3 See more

twenty-crm victorlane 0.0.1

2 of the 3 container images this version deploys carry CVE-2026-3644.

Container image	Digest	Package	Fixed in
redis/redis-stack-server :latest	798ab84d9f26	python3.10@3.10.12-1~22.04.11	3.10.12-1~22.04.16
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

13,459

calibre-webvista

0.1.3

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-3644.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.15

Open the chart page →

7,628

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-3644.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

11,119

myweatherhelmwebapp1

1.3.50

2 of 8 See more

myweatherhelm webapp1 1.3.50

2 of the 8 container images this version deploys carry CVE-2026-3644.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.15
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

9,130

myweatherhelm-schedulingwebapp1

1.3.92

2 of 9 See more

myweatherhelm-scheduling webapp1 1.3.92

2 of the 9 container images this version deploys carry CVE-2026-3644.

Container image	Digest	Package	Fixed in
library/rabbitmq :3-management	e582c0bc7766	python3.12@3.12.3-1ubuntu0.9	3.12.3-1ubuntu0.15
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	python3.8@3.8.10-0ubuntu1~20.04.8	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

9,130

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-3644.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-3644.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	python3.8@3.8.10-0ubuntu1~20.04.1	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

28,605

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-3644.

Container image	Digest	Package	Fixed in
istio/kubectl :1.5.10	dbb7726d1bf0	python3.6@3.6.9-1~18.04ubuntu1.1	3.6.9-1~18.04ubuntu1.13+esm10

Open the chart page →

10,843

juicefs-csi-driverwenerme

0.32.5

1 of 5 See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2026-3644.

Container image	Digest	Package	Fixed in
juicedata/juicefs-csi-driver :v0.32.5	95008ba63318	python3.11@3.11.2-6+deb12u8	no fix listed

Open the chart page →

9,117

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-3644.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	python3.8@3.8.10-0ubuntu1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7

Open the chart page →

15,230

wexa-studiowexa-studio

1.2.0

1 of 15 See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2026-3644.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.29.1-tctl-1.18.4-cli-1.5.0	a3a52e6ca122	python3@3.12.11-r0	3.12.14-r0

Open the chart page →

14,983

jaegerwikimedia

3.1.2

1 of 4 See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2026-3644.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-cassandra-schema :1.53.0	d48d6dab2c65	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

9,248

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-3644.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

14,100

Container images carrying it

596 by charts deploying them

A fixed version is listed for 13 of the 14 affected packages.

Container image	Digest	Package	Fixed in	Used by
esphome/esphome :2024.3.0	9ab8cc88b28c	python3.11@3.11.2-6	no fix listed	1
esphome/esphome :2024.12.2	b2c6322700ac	python3.11@3.11.2-6+deb12u4	no fix listed	1
esphome/esphome :2025.3.0	def8b6e4f517	python3.11@3.11.2-6+deb12u5	no fix listed	1
ethereumex/eth-stats-dashboard :v0.0.1	a7603aa8df4c	python2.7@2.7.12-1ubuntu0~16.04.2	2.7.12-1ubuntu0~16.04.18+esm22	1
extrim/perlite :1.5.9	9cb7eb5598b6	python3@3.12.9-r0	3.12.14-r0	1
felipecs8/app-db-connection-test :v1	29e06c9c6385	python3.11@3.11.2-6+deb12u4	no fix listed	1
firefart/requesttracker :5.0.4	0d6249906d8c	python3.11@3.11.2-6	no fix listed	1
fiware/biz-ecosystem-charging-backend :11.7.0	29456835bb2c	python3.8@3.8.10-0ubuntu1~20.04.18	3.8.10-0ubuntu1~20.04.18+esm7	1
fiware/biz-ecosystem-logic-proxy :11.20.3	d551a13e8278	python3.11@3.11.2-6+deb12u6	no fix listed	1
flanksource/batch-runner :v1.0.44	689687a7cf95	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.15	1
flashcatcloud/categraf :latest	42e6ab16472e	python3.12@3.12.3-1ubuntu0.12	3.12.3-1ubuntu0.15	1
fluent/fluent-bit :4.0-debug	e76397ef3983	python3.11@3.11.2-6+deb12u6	no fix listed	1
flyway/flyway :9.15	45b5d7cdc75a	python3.8@3.8.10-0ubuntu1~20.04.6	3.8.10-0ubuntu1~20.04.18+esm7	1
fosrl/pangolin :1.13.0	c32ad797ab96	python3@3.12.12-r0	3.12.14-r0	1
frankescobar/allure-docker-service :2.21.0	8a4d7e9308de	python3.6@3.6.9-1~18.04ubuntu1.9	3.6.9-1~18.04ubuntu1.13+esm10	1
frankescobar/allure-docker-service :2.19.0	cafa03b94dac	python3.6@3.6.9-1~18.04ubuntu1.8	3.6.9-1~18.04ubuntu1.13+esm10	1
freeradius/freeradius-server :3.2.8	af6fd34a5b78	python2.7@2.7.18-13ubuntu1.5 python3.10@3.10.12-1~22.04.10	2.7.18-13ubuntu1.5+esm9 3.10.12-1~22.04.16	1
galaxy/cloudman-server :latest	e5c265fe9fcd	python3.8@3.8.10-0ubuntu1~20.04.5	3.8.10-0ubuntu1~20.04.18+esm7	1
galaxy/galaxy-init :v18.01	0267bad550e6	python2.7@2.7.6-8ubuntu0.4 python3.4@3.4.3-1ubuntu1~14.04.6	2.7.6-8ubuntu0.6+esm30 3.4.3-1ubuntu1~14.04.7+esm21	1
galaxy/galaxy-stable :v18.01	8e577a626dfd	python2.7@2.7.6-8ubuntu0.4 python3.4@3.4.3-1ubuntu1~14.04.6	2.7.6-8ubuntu0.6+esm30 3.4.3-1ubuntu1~14.04.7+esm21	1
galaxy/pulsar-kubernetes :0.15.7	e50a890e24c9	python3.11@3.11.2-6+deb12u5	no fix listed	1
geonode/geoserver :2.28.4-latest	81b1d431b7e9	python3.10@3.10.12-1~22.04.15	3.10.12-1~22.04.16	1
geopython/pycsw :3.0.0-beta2	84662ea6b78b	python3.11@3.11.2-6+deb12u6	no fix listed	1
geoscienceaustralia/dea-k8s-data :latest	f4039b45572a	python3.6@3.6.9-1~18.04ubuntu1.1	3.6.9-1~18.04ubuntu1.13+esm10	1
gethue/hue :4.11.0	11b649636e68	python3.8@3.8.10-0ubuntu1~20.04.6	3.8.10-0ubuntu1~20.04.18+esm7	1
gethue/hue :4.10.0	5702b2c37ff9	python2.7@2.7.17-1~18.04ubuntu1.6 python3.6@3.6.9-1~18.04ubuntu1.4	2.7.17-1~18.04ubuntu1.13+esm15 3.6.9-1~18.04ubuntu1.13+esm10	1
gethue/hue :latest	7d5c1b9f8a79	python3.10@3.10.12-1~22.04.10 python3.11@3.11.0~rc1-1~22.04	3.10.12-1~22.04.16 3.11.0~rc1-1~22.04.1+esm2	1
gomods/athens :v0.17.1	0f61d1e62359	python3@3.12.13-r0	3.12.14-r0	1
gomods/athens :v0.18.1	97cc113b34b0	python3@3.12.13-r0	3.12.14-r0	1
gotenberg/gotenberg :8.30	206a6c708fc6	python3.13@3.13.5-2	3.13.5-2+deb13u2	1
gpappsoft/privacyidea-docker :3.12.2	af7841adad26	python-3.13@3.13.10-r0	3.13.12-r7	1
grafana/oncall :v1.16.5	499851658393	python3@3.12.11-r0	3.12.14-r0	1
hasura/graphql-engine :v2.34.0-ce	0111b0204136	python3.10@3.10.6-1~22.04.2ubuntu1.1	3.10.12-1~22.04.16	1
hasura/graphql-engine :v2.48.10	f6c1c4b957d2	python3.10@3.10.12-1~22.04.11	3.10.12-1~22.04.16	1
haugene/transmission-openvpn :4.0	059216cfae4b	python3.8@3.8.10-0ubuntu1~20.04	3.8.10-0ubuntu1~20.04.18+esm7	1
haveagitgat/tdarr :2.00.18	1256348872ce	python3.8@3.8.10-0ubuntu1~20.04.4	3.8.10-0ubuntu1~20.04.18+esm7	1
haveagitgat/tdarr_node :2.00.10	1e3f9328327d	python3.8@3.8.5-1~20.04	3.8.10-0ubuntu1~20.04.18+esm7	1
haveagitgat/tdarr_node :2.17.01	3ff0913202dd	python3.8@3.8.10-0ubuntu1~20.04.8	3.8.10-0ubuntu1~20.04.18+esm7	1
helicone/clickhouse-migration-runner :v2025.03.05-1	4c69b971a7e4	python3.8@3.8.10-0ubuntu1~20.04.13	3.8.10-0ubuntu1~20.04.18+esm7	1
helicone/supabase-migration-runner :v2025.03.05-1	4a913936c97b	python3.11@3.11.2-6	no fix listed	1
hyperglance/init :wildfly	467ad8491bc3	python3.10@3.10.12-1~22.04.15	3.10.12-1~22.04.16	1
hyperglance/init :postgres	9fd5faf1fe80	python3.10@3.10.12-1~22.04.15	3.10.12-1~22.04.16	1
hyperglance/init :apache	b2f8c6d52623	python3.10@3.10.12-1~22.04.15	3.10.12-1~22.04.16	1
hyperledger/fabric-couchdb :0.4.10	c65891b6c237	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	1
ibmcom/ibm-workload-scheduler-agent-dynamic-dev :9.4.0.04	7e4dc1e27cdf	python3.5@3.5.2-2ubuntu0~16.04.4	3.5.2-2ubuntu0~16.04.13+esm25	1
ibmcom/icp-swift-sample :latest	b5d8c6714dbc	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	1
ibmcom/microclimate-theia :latest	e17bdccc5030	python2.7@2.7.12-1ubuntu0~16.04.2	2.7.12-1ubuntu0~16.04.18+esm22	1
ibmcom/skydive :0.22.0	395e60cc6e3d	python2.7@2.7.15~rc1-1ubuntu0.1	2.7.17-1~18.04ubuntu1.13+esm15	1
ildarmukhametzyanov/priceapp :0.1	15d23720a3ee	python3.11@3.11.2-6	no fix listed	1
inseefrlab/shelly :cloudshell	31f04ca7436b	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16	1