StackRadar

CVE-2026-49476

High

Advisory

Published 9 Jul 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
43rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
79
of 17,781 indexed, latest versions
Container images
88
deployed by those charts
Fix available
1 of 2
affected packages

Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists

Carried by container images the latest versions of 79 of 17,781 indexed charts deploy, on 88 images.

Affected packageAffected versionsFixed inImages
soupsievepypi1.9.5, 1.9.6, 2.2, 2.2.1+10 more2.8.488
soupsievedeb2.5-1no fix listed1
OSV records
GHSA-2wc2-fm75-p42xUBUNTU-CVE-2026-49476
Also known as
PYSEC-2026-3071

Charts affected

79 by stars
ChartLatestAffected imagesRadar Score
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
soupsieve@2.5
2.8.4

Open the chart page →

11,367
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
langgenius/dify-agent-backend:1.16.1097d3fd27a7b
soupsieve@2.8.3
2.8.4

Open the chart page →

22,002
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
grafana/oncall:v1.16.5499851658393
soupsieve@2.7
2.8.4

Open the chart page →

16,251
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
soupsieve@2.3.2.post1
2.8.4

Open the chart page →

7,705
daskdask2024.1.11 of 2See more

dask dask 2024.1.1

1 of the 2 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
soupsieve@2.5
2.8.4

Open the chart page →

12,746
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
soupsieve@2.5
2.8.4

Open the chart page →

6,041
stackstorm-hastackstormVerified publisher1.1.011 of 17See more

stackstorm-ha stackstorm 1.1.0

11 of the 17 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
stackstorm/st2actionrunner:3.888235ba70cad
soupsieve@2.5
2.8.4
stackstorm/st2api:3.86f56d239d280
soupsieve@2.5
2.8.4
stackstorm/st2auth:3.833ecfda16608
soupsieve@2.5
2.8.4
stackstorm/st2garbagecollector:3.84e3f8c7ca52d
soupsieve@2.5
2.8.4
stackstorm/st2notifier:3.8f190a6212195
soupsieve@2.5
2.8.4
stackstorm/st2rulesengine:3.8259503496ff9
soupsieve@2.5
2.8.4
stackstorm/st2scheduler:3.8b1de2055c362
soupsieve@2.5
2.8.4
stackstorm/st2sensorcontainer:3.8b1a338f64773
soupsieve@2.5
2.8.4
stackstorm/st2stream:3.81c8904a3bf67
soupsieve@2.5
2.8.4
stackstorm/st2timersengine:3.81bf35bfaf00c
soupsieve@2.5
2.8.4
stackstorm/st2workflowengine:3.819fdfffdbba8
soupsieve@2.5
2.8.4

Open the chart page →

96,419
openvpn-asas-helm-chartOfficialVerified publisher0.2.11 of 1See more

openvpn-as as-helm-chart 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
openvpn/openvpn-as:latest2253c10ec652
soupsieve@2.5-1
soupsieve@2.5
no fix listed
2.8.4

Open the chart page →

2,668
daskhubdask2024.1.11 of 9See more

daskhub dask 2024.1.1

1 of the 9 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
soupsieve@2.5
2.8.4

Open the chart page →

14,094
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
hkotel/mealie:api-v1.0.0beta-2a7e6b6abe087
soupsieve@2.3.2.post1
2.8.4

Open the chart page →

7,579
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
soupsieve@2.8.3
2.8.4

Open the chart page →

4,634
mealieth-chartsVerified publisher0.5.11 of 1See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
soupsieve@2.8
2.8.4

Open the chart page →

3,804
squestchristianhuthVerified publisher6.6.71 of 4See more

squest christianhuth 6.6.7

1 of the 4 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
soupsieve@2.7
2.8.4

Open the chart page →

9,971
syncstorage-rschristianhuthVerified publisher6.1.11 of 2See more

syncstorage-rs christianhuth 6.1.1

1 of the 2 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/porelli/firefox-sync:syncstorage-rs-mysql-0.18.27d244e514216
soupsieve@2.7
2.8.4

Open the chart page →

693
recipesgeek-cookbookVerified publisher6.6.21 of 2See more

recipes geek-cookbook 6.6.2

1 of the 2 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
vabene1111/recipes:1.0.5.2ec4e9e2905b0
soupsieve@2.3.1
2.8.4

Open the chart page →

7,801
jupyterhub-outpostjupyter-jscVerified publisher2.4.11 of 1See more

jupyterhub-outpost jupyter-jsc 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
soupsieve@2.8.3
2.8.4

Open the chart page →

1,678
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
soupsieve@2.5
2.8.4

Open the chart page →

20,403
music-assistant-serverlmatfyVerified publisher0.1.91 of 1See more

music-assistant-server lmatfy 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
soupsieve@2.8.1
2.8.4

Open the chart page →

7,201
mlflow-controllermlflow-deployment-controller0.1.82 of 2See more

mlflow-controller mlflow-deployment-controller 0.1.8

2 of the 2 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
tachyongroup/mlflow-deployment-controller:mlflow-controller-0.1.87e79b9000856
soupsieve@2.4
2.8.4
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
soupsieve@2.4
2.8.4

Open the chart page →

8,957
openvaultopenvaultVerified publisher0.8.11 of 2See more

openvault openvault 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-wag:v1.1.06df27f944fe8
soupsieve@2.7
2.8.4

Open the chart page →

6,873
privacyideaprivacyidea1.0.61 of 2See more

privacyidea privacyidea 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
gpappsoft/privacyidea-docker:3.12.2af7841adad26
soupsieve@2.6
2.8.4

Open the chart page →

5,440
mealiertomik-helm-chartsVerified publisher0.0.21 of 1See more

mealie rtomik-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
soupsieve@2.3.2.post1
2.8.4

Open the chart page →

3,929
devpisb-helm-charts0.3.01 of 1See more

devpi sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
jonasal/devpi-server:6.17.0-alpineec1eee99a18d
soupsieve@2.8.1
2.8.4

Open the chart page →

920
verbacapverbacapVerified publisher1.0.71 of 1See more

verbacap verbacap 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/mirio/verbacap:v1.5.084928e2fc4f2
soupsieve@2.5
2.8.4

Open the chart page →

2,233
keystonearzu0.2.291 of 4See more

keystone arzu 0.2.29

1 of the 4 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
openstackhelm/heat:wallaby-ubuntu_focalf728510bab3c
soupsieve@2.2
2.8.4

Open the chart page →

22,568
trainingcollectorassist-iot-fl-training-collector1.1.01 of 1See more

trainingcollector assist-iot-fl-training-collector 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
assistiot/fl_training_collector:latest792715dd3084
soupsieve@2.2.1
2.8.4

Open the chart page →

1,719
sickchillbryanalves0.3.01 of 1See more

sickchill bryanalves 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
soupsieve@1.9.6
2.8.4

Open the chart page →

2,504
kitchenowlchart-kitchenowl0.1.121 of 2See more

kitchenowl chart-kitchenowl 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
tombursch/kitchenowl-backend:v0.7.8b48e4ab727cd
soupsieve@2.8.3
2.8.4

Open the chart page →

4,803
chat-searchchat-searchVerified publisher0.1.71 of 1See more

chat-search chat-search 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/hemslo/chat-search:latest39d48995a5bd
soupsieve@2.5
2.8.4

Open the chart page →

4,042
syncserverchristianhuthVerified publisher1.3.01 of 1See more

syncserver christianhuth 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
mozilla/syncserver:latest016162bf39d8
soupsieve@1.9.5
2.8.4

Open the chart page →

1,382
csghubcsghubVerified publisher2.4.32 of 34See more

csghub csghub 2.4.3

2 of the 34 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
soupsieve@2.7
2.8.4
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
soupsieve@2.8.3
2.8.4

Open the chart page →

58,897
csgshipcsghubVerified publisher0.4.61 of 10See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
soupsieve@2.7
2.8.4

Open the chart page →

11,335
jupyterhubd4nVerified publisher3.3.71 of 7See more

jupyterhub d4n 3.3.7

1 of the 7 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
aristidetm/basic-notebook:3.6.5469dbc951224
soupsieve@2.5
2.8.4

Open the chart page →

16,604
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
soupsieve@2.5
2.8.4

Open the chart page →

6,179
linkdingdeimosfr-charts1.0.31 of 1See more

linkding deimosfr-charts 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
sissbruecker/linkding:1.35.00c5dddf0b37c
soupsieve@2.6
2.8.4

Open the chart page →

6,075
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
soupsieve@2.6
2.8.4

Open the chart page →

9,607
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
soupsieve@2.6
2.8.4

Open the chart page →

9,607
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
soupsieve@2.6
2.8.4

Open the chart page →

19,224
datadog-apmfairwinds-incubator2.0.01 of 1See more

datadog-apm fairwinds-incubator 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
public.ecr.aws/datadog/agent:7.73.0f4925b15ce94
soupsieve@2.8
2.8.4

Open the chart page →

2,785
tandoorgabe565Verified publisher0.9.91 of 2See more

tandoor gabe565 0.9.9

1 of the 2 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
soupsieve@2.6
2.8.4

Open the chart page →

2,183
beetsgeek-cookbookVerified publisher1.4.21 of 1See more

beets geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
linuxserver/beets:1.5.0e36d16f7341c
soupsieve@2.3.1
2.8.4

Open the chart page →

1,150
changedetection-iogeek-cookbookVerified publisher1.5.21 of 1See more

changedetection-io geek-cookbook 1.5.2

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.39.4f1ce4c56ccaa
soupsieve@2.3.1
2.8.4

Open the chart page →

1,950
mopidygeek-cookbookVerified publisher0.1.21 of 1See more

mopidy geek-cookbook 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
jaedb/iris:latest048cfbf58d57
soupsieve@2.7
2.8.4

Open the chart page →

12,958
mylargeek-cookbookVerified publisher4.4.21 of 1See more

mylar geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/mylar3:version-v0.5.3b96f0e97ab3f
soupsieve@2.2.1
2.8.4

Open the chart page →

1,423
whooglegeek-cookbookVerified publisher3.4.21 of 1See more

whoogle geek-cookbook 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
benbusby/whoogle-search:0.5.4f77f7e6e4ad2
soupsieve@1.9.5
2.8.4

Open the chart page →

2,061
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
soupsieve@2.6
2.8.4

Open the chart page →

4,647
erpnextimprowisedVerified publisher3.3.01 of 3See more

erpnext improwised 3.3.0

1 of the 3 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
improwised/erpnext-worker:v13.4.197280b55cbd4
soupsieve@2.2.1
2.8.4

Open the chart page →

6,501
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
soupsieve@2.8.3
2.8.4

Open the chart page →

17,852
13ftjeffrescVerified publisher0.2.01 of 1See more

13ft jeffresc 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/wasi-master/13ft:0.3.4563ce7794a71
soupsieve@2.6
2.8.4

Open the chart page →

888
jx-app-datadogjenkins-x0.0.101 of 2See more

jx-app-datadog jenkins-x 0.0.10

1 of the 2 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
datadog/agent:6aad9994de6a7
soupsieve@1.9.6
2.8.4

Open the chart page →

3,999

Container images carrying it

88 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
stackstorm/st2rulesengine:3.8259503496ff9
soupsieve@2.5
2.8.4
1
stackstorm/st2scheduler:3.8b1de2055c362
soupsieve@2.5
2.8.4
1
stackstorm/st2sensorcontainer:3.8b1a338f64773
soupsieve@2.5
2.8.4
1
stackstorm/st2stream:3.81c8904a3bf67
soupsieve@2.5
2.8.4
1
stackstorm/st2timersengine:3.81bf35bfaf00c
soupsieve@2.5
2.8.4
1
stackstorm/st2workflowengine:3.819fdfffdbba8
soupsieve@2.5
2.8.4
1
stashapp/stash:v0.31.1df744af5a0c9
soupsieve@2.8.3
2.8.4
1
tachyongroup/mlflow-deployment-controller:mlflow-controller-0.1.87e79b9000856
soupsieve@2.4
2.8.4
1
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
soupsieve@2.4
2.8.4
1
tombursch/kitchenowl-backend:v0.7.8b48e4ab727cd
soupsieve@2.8.3
2.8.4
1
vabene1111/recipes:2.3.50f8d061895e9
soupsieve@2.8
2.8.4
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
soupsieve@2.3.1
2.8.4
1
yetiplatform/yeti:2.9.09bcbe2650a14
soupsieve@2.6
2.8.4
1
yetiplatform/yeti:latest9c3006cedcca
soupsieve@2.6
2.8.4
1
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
soupsieve@2.5
2.8.4
1
ghcr.io/dgtlmoon/changedetection.io:0.39.4f1ce4c56ccaa
soupsieve@2.3.1
2.8.4
1
ghcr.io/hemslo/chat-search:latest39d48995a5bd
soupsieve@2.5
2.8.4
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
soupsieve@2.6
2.8.4
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
soupsieve@2.8.1
2.8.4
1
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
soupsieve@2.3.2.post1
2.8.4
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
soupsieve@2.5
2.8.4
1
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
soupsieve@2.3.2.post1
2.8.4
1
ghcr.io/home-operations/beets:2.3.1cc4975f1a0be
soupsieve@2.7
2.8.4
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
soupsieve@2.8.3
2.8.4
1
ghcr.io/linuxserver/mylar3:version-v0.5.3b96f0e97ab3f
soupsieve@2.2.1
2.8.4
1
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
soupsieve@2.3.2.post1
2.8.4
1
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
soupsieve@2.3.2.post1
2.8.4
1
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
soupsieve@2.8
2.8.4
1
ghcr.io/mirio/verbacap:v1.5.084928e2fc4f2
soupsieve@2.5
2.8.4
1
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
soupsieve@2.8.1
2.8.4
1
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
soupsieve@2.8.3
2.8.4
1
ghcr.io/porelli/firefox-sync:syncstorage-rs-mysql-0.18.27d244e514216
soupsieve@2.7
2.8.4
1
ghcr.io/sissbruecker/linkding:1.45.061b2eb9eed8e
soupsieve@2.8.1
2.8.4
1
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
soupsieve@2.6
2.8.4
1
ghcr.io/wasi-master/13ft:0.3.4563ce7794a71
soupsieve@2.6
2.8.4
1
ghcr.io/wgbh-mla/ov-wag:v1.1.06df27f944fe8
soupsieve@2.7
2.8.4
1
public.ecr.aws/datadog/agent:7.73.0f4925b15ce94
soupsieve@2.8
2.8.4
1
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
soupsieve@2.7
2.8.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.