StackRadar

CVE-2026-42304

High

Advisory

Published 5 May 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
37th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
35
of 17,781 indexed, latest versions
Container images
41
deployed by those charts
Fix available
1 of 2
affected packages

Twisted has a Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains

Carried by container images the latest versions of 35 of 17,781 indexed charts deploy, on 41 images.

Affected packageAffected versionsFixed inImages
twistedpypi16.6.0, 17.9.0, 18.9.0, 19.7.0+11 more26.4.0rc241
twisteddeb17.9.0-2ubuntu0.1no fix listed2
OSV records
GHSA-grgv-6hw6-v9g4UBUNTU-CVE-2026-42304
Also known as
PYSEC-2026-160

Charts affected

35 by stars
ChartLatestAffected imagesRadar Score
synapsehalkeye0.40.01 of 2See more

synapse halkeye 0.40.0

1 of the 2 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
twisted@24.3.0
26.4.0rc2

Open the chart page →

6,543
netris-controllernetrisai2.8.21 of 14See more

netris-controller netrisai 2.8.2

1 of the 14 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
graphiteapp/graphite-statsd:1.1.7-604a0037cc2ae
twisted@20.3.0
26.4.0rc2

Open the chart page →

30,326
openvpn-asas-helm-chartOfficialVerified publisher0.2.11 of 1See more

openvpn-as as-helm-chart 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
openvpn/openvpn-as:latest2253c10ec652
twisted@25.5.0
26.4.0rc2

Open the chart page →

2,668
matrixzekker6Verified publisher3.30.01 of 4See more

matrix zekker6 3.30.0

1 of the 4 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.160.078de1d10bef0
twisted@25.5.0
26.4.0rc2

Open the chart page →

5,557
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
twisted@24.3.0
26.4.0rc2

Open the chart page →

17,404
psonoankra-chartsVerified publisher1.2.01 of 2See more

psono ankra-charts 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
psono/psono-server:5.0.03b974b43ea03
twisted@24.7.0
26.4.0rc2

Open the chart page →

2,388
anteonanteonVerified publisher2.6.42 of 13See more

anteon anteon 2.6.4

2 of the 13 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
ddosify/selfhosted_alaz_backend:2.3.11e5be48b37348
twisted@24.7.0
26.4.0rc2
ddosify/selfhosted_backend:3.2.93c11e3182652
twisted@24.3.0
26.4.0rc2

Open the chart page →

22,202
obicogabe565Verified publisher0.6.01 of 3See more

obico gabe565 0.6.0

1 of the 3 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
ghcr.io/gabe565/obico/web:latesta5c1daef46c0
twisted@24.11.0
26.4.0rc2

Open the chart page →

1,965
paperlessgeek-cookbookVerified publisher9.2.01 of 1See more

paperless geek-cookbook 9.2.0

1 of the 1 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:1.8.09bbc9a90641e
twisted@22.4.0
26.4.0rc2

Open the chart page →

3,924
huehue1.0.31 of 3See more

hue hue 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
gethue/hue:latest7d5c1b9f8a79
twisted@25.5.0
26.4.0rc2

Open the chart page →

12,397
vmware-exporterkremers2.3.01 of 1See more

vmware-exporter kremers 2.3.0

1 of the 1 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
pryorda/vmware_exporter:v0.18.479925e63e59f
twisted@22.8.0
26.4.0rc2

Open the chart page →

1,180
delugerubxkubeVerified publisher1.2.11 of 1See more

deluge rubxkube 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
linuxserver/deluge:18.04.10ac871624394
twisted@17.9.0-2ubuntu0.1
twisted@17.9.0
no fix listed
26.4.0rc2

Open the chart page →

13,541
prometheus-pve-exporterstenicVerified publisher0.1.11 of 1See more

prometheus-pve-exporter stenic 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
prompve/prometheus-pve-exporter:2.0.1ff6749eb03b0
twisted@20.3.0
26.4.0rc2

Open the chart page →

2,469
synapsesudermanjr1.1.51 of 1See more

synapse sudermanjr 1.1.5

1 of the 1 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.53.0cb89c0f17ba1
twisted@22.1.0
26.4.0rc2

Open the chart page →

3,332
ddosifyanteonVerified publisher1.7.52 of 13See more

ddosify anteon 1.7.5

2 of the 13 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
twisted@24.3.0
26.4.0rc2
ddosify/selfhosted_backend:2.6.11ac323d52bfb4
twisted@24.3.0
26.4.0rc2

Open the chart page →

25,669
huebigdata-chartsVerified publisher1.0.41 of 2See more

hue bigdata-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
gethue/hue:4.10.05702b2c37ff9
twisted@21.2.0
26.4.0rc2

Open the chart page →

22,891
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
twisted@24.3.0
26.4.0rc2

Open the chart page →

10,145
duoauthproxy-radius-simplecaerus0.1.01 of 1See more

duoauthproxy-radius-simple caerus 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
ethanbergstrom/duoauthproxy:5.5.0345c2a46c103
twisted@20.3.0
26.4.0rc2

Open the chart page →

2,974
vmware-exporterdniel0.0.11 of 1See more

vmware-exporter dniel 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
pryorda/vmware_exporter:v0.18.3e0f5ba8b7856
twisted@22.2.0
26.4.0rc2

Open the chart page →

1,351
pritunldysnixVerified publisher0.2.71 of 3See more

pritunl dysnix 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
dysnix/pritunl:v1.29-r819951e3e7a32
twisted@20.3.0
26.4.0rc2

Open the chart page →

5,055
delugegeek-cookbookVerified publisher5.4.21 of 1See more

deluge geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
linuxserver/deluge:version-2.0.3-2201906121747ubuntu18.04.12ce561a95e7b
twisted@17.9.0-2ubuntu0.1
twisted@17.9.0
no fix listed
26.4.0rc2

Open the chart page →

13,551
librechat-exporterhajowielandVerified publisher1.0.01 of 1See more

librechat-exporter hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
ghcr.io/virtuos/librechat_exporter:2.0.050ea1cf0086f
twisted@24.11.0
26.4.0rc2

Open the chart page →

2,284
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
twisted@25.5.0
26.4.0rc2

Open the chart page →

17,852
jx-app-anchorejenkins-x0.0.41 of 2See more

jx-app-anchore jenkins-x 0.0.4

1 of the 2 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
anchore/anchore-engine:v0.7.1ed9b3badd17c
twisted@20.3.0
26.4.0rc2

Open the chart page →

9,854
huekatool1.0.81 of 1See more

hue katool 1.0.8

1 of the 1 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
gethue/hue:4.11.011b649636e68
twisted@22.10.0
26.4.0rc2

Open the chart page →

16,417
delugelib42Verified publisher1.3.01 of 1See more

deluge lib42 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
lib42/deluge:20c4d1d326f95
twisted@22.10.0
26.4.0rc2

Open the chart page →

898
delugelinkding0.2.31 of 1See more

deluge linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
linuxserver/deluge:libtorrentv1-2.2.0-ls40052eac68ccc0
twisted@24.11.0
26.4.0rc2

Open the chart page →

1,433
splashntppoolVerified publisher1.0.41 of 1See more

splash ntppool 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
scrapinghub/splash:3.4.1a5f89bc84606
twisted@19.7.0
26.4.0rc2

Open the chart page →

27,633
anchore-engineopencloudcx1.13.01 of 2See more

anchore-engine opencloudcx 1.13.0

1 of the 2 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
anchore/anchore-engine:v0.10.0bde9eedf639d
twisted@20.3.0
26.4.0rc2

Open the chart page →

18,023
comacopencord1.0.03 of 9See more

comac opencord 1.0.0

3 of the 9 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
omecproject/kubernetes-synchronizer:comac-1.0.07c17a7b1d1ef
twisted@18.9.0
26.4.0rc2
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
twisted@16.6.0
26.4.0rc2
omecproject/progran-synchronizer:comac-1.0.0d109a8e57e71
twisted@16.6.0
26.4.0rc2

Open the chart page →

88,546
comac-platformopencord0.0.172 of 11See more

comac-platform opencord 0.0.17

2 of the 11 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
omecproject/kubernetes-synchronizer:comac-1.0.07c17a7b1d1ef
twisted@18.9.0
26.4.0rc2
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
twisted@16.6.0
26.4.0rc2

Open the chart page →

26,211
ponsimv2opencord1.2.31 of 2See more

ponsimv2 opencord 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
voltha/voltha-tester:1.7.0655c3048a602
twisted@17.9.0
26.4.0rc2

Open the chart page →

12,609
sebaopencord1.0.04 of 17See more

seba opencord 1.0.0

4 of the 17 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
voltha/voltha-cli:1.6.0c4e41e92f046
twisted@17.9.0
26.4.0rc2
voltha/voltha-netconf:1.6.037f80524c207
twisted@17.9.0
26.4.0rc2
voltha/voltha-ofagent:1.6.09ee8c1f4428c
twisted@17.9.0
26.4.0rc2
voltha/voltha-voltha:1.6.0ff596b62de59
twisted@17.9.0
26.4.0rc2

Open the chart page →

93,855
matrix-stackrock8sVerified publisher0.8.11 of 7See more

matrix-stack rock8s 0.8.1

1 of the 7 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.127.1c3c4a9de2a0b
twisted@24.7.0
26.4.0rc2

Open the chart page →

9,256
synapsetranhailongVerified publisher0.1.01 of 2See more

synapse tranhailong 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-42304.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.78.0def97fd537d8
twisted@22.10.0
26.4.0rc2

Open the chart page →

3,164

Container images carrying it

41 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
omecproject/kubernetes-synchronizer:comac-1.0.07c17a7b1d1ef
twisted@18.9.0
26.4.0rc2
2
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
twisted@16.6.0
26.4.0rc2
2
anchore/anchore-engine:v0.10.0bde9eedf639d
twisted@20.3.0
26.4.0rc2
1
anchore/anchore-engine:v0.7.1ed9b3badd17c
twisted@20.3.0
26.4.0rc2
1
baserow/backend:1.31.1e0b3c8130b91
twisted@24.3.0
26.4.0rc2
1
baserow/baserow:1.30.1df0c42eb67e8
twisted@24.3.0
26.4.0rc2
1
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
twisted@24.3.0
26.4.0rc2
1
ddosify/selfhosted_alaz_backend:2.3.11e5be48b37348
twisted@24.7.0
26.4.0rc2
1
ddosify/selfhosted_backend:3.2.93c11e3182652
twisted@24.3.0
26.4.0rc2
1
ddosify/selfhosted_backend:2.6.11ac323d52bfb4
twisted@24.3.0
26.4.0rc2
1
dysnix/pritunl:v1.29-r819951e3e7a32
twisted@20.3.0
26.4.0rc2
1
ethanbergstrom/duoauthproxy:5.5.0345c2a46c103
twisted@20.3.0
26.4.0rc2
1
gethue/hue:4.11.011b649636e68
twisted@22.10.0
26.4.0rc2
1
gethue/hue:4.10.05702b2c37ff9
twisted@21.2.0
26.4.0rc2
1
gethue/hue:latest7d5c1b9f8a79
twisted@25.5.0
26.4.0rc2
1
graphiteapp/graphite-statsd:1.1.7-604a0037cc2ae
twisted@20.3.0
26.4.0rc2
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
twisted@25.5.0
26.4.0rc2
1
lib42/deluge:20c4d1d326f95
twisted@22.10.0
26.4.0rc2
1
linuxserver/deluge:libtorrentv1-2.2.0-ls40052eac68ccc0
twisted@24.11.0
26.4.0rc2
1
linuxserver/deluge:18.04.10ac871624394
twisted@17.9.0-2ubuntu0.1
twisted@17.9.0
no fix listed
26.4.0rc2
1
linuxserver/deluge:version-2.0.3-2201906121747ubuntu18.04.12ce561a95e7b
twisted@17.9.0-2ubuntu0.1
twisted@17.9.0
no fix listed
26.4.0rc2
1
matrixdotorg/synapse:v1.160.078de1d10bef0
twisted@25.5.0
26.4.0rc2
1
matrixdotorg/synapse:v1.127.1c3c4a9de2a0b
twisted@24.7.0
26.4.0rc2
1
matrixdotorg/synapse:v1.53.0cb89c0f17ba1
twisted@22.1.0
26.4.0rc2
1
matrixdotorg/synapse:v1.78.0def97fd537d8
twisted@22.10.0
26.4.0rc2
1
omecproject/progran-synchronizer:comac-1.0.0d109a8e57e71
twisted@16.6.0
26.4.0rc2
1
openvpn/openvpn-as:latest2253c10ec652
twisted@25.5.0
26.4.0rc2
1
prompve/prometheus-pve-exporter:2.0.1ff6749eb03b0
twisted@20.3.0
26.4.0rc2
1
pryorda/vmware_exporter:v0.18.479925e63e59f
twisted@22.8.0
26.4.0rc2
1
pryorda/vmware_exporter:v0.18.3e0f5ba8b7856
twisted@22.2.0
26.4.0rc2
1
psono/psono-server:5.0.03b974b43ea03
twisted@24.7.0
26.4.0rc2
1
scrapinghub/splash:3.4.1a5f89bc84606
twisted@19.7.0
26.4.0rc2
1
voltha/voltha-cli:1.6.0c4e41e92f046
twisted@17.9.0
26.4.0rc2
1
voltha/voltha-netconf:1.6.037f80524c207
twisted@17.9.0
26.4.0rc2
1
voltha/voltha-ofagent:1.6.09ee8c1f4428c
twisted@17.9.0
26.4.0rc2
1
voltha/voltha-tester:1.7.0655c3048a602
twisted@17.9.0
26.4.0rc2
1
voltha/voltha-voltha:1.6.0ff596b62de59
twisted@17.9.0
26.4.0rc2
1
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
twisted@24.3.0
26.4.0rc2
1
ghcr.io/gabe565/obico/web:latesta5c1daef46c0
twisted@24.11.0
26.4.0rc2
1
ghcr.io/paperless-ngx/paperless-ngx:1.8.09bbc9a90641e
twisted@22.4.0
26.4.0rc2
1
ghcr.io/virtuos/librechat_exporter:2.0.050ea1cf0086f
twisted@24.11.0
26.4.0rc2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.