StackRadar

CVE-2026-49476

High

Advisory

Published 9 Jul 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
43rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
79
of 17,781 indexed, latest versions
Container images
88
deployed by those charts
Fix available
1 of 2
affected packages

Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists

Carried by container images the latest versions of 79 of 17,781 indexed charts deploy, on 88 images.

Affected packageAffected versionsFixed inImages
soupsievepypi1.9.5, 1.9.6, 2.2, 2.2.1+10 more2.8.488
soupsievedeb2.5-1no fix listed1
OSV records
GHSA-2wc2-fm75-p42xUBUNTU-CVE-2026-49476
Also known as
PYSEC-2026-3071

Charts affected

79 by stars
ChartLatestAffected imagesRadar Score
bazarrk8s-home-lab-repo11.3.21 of 1See more

bazarr k8s-home-lab-repo 11.3.2

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
soupsieve@2.3.2.post1
2.8.4

Open the chart page →

1,794
beetsk8s-home-lab-repo3.1.11 of 1See more

beets k8s-home-lab-repo 3.1.1

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/home-operations/beets:2.3.1cc4975f1a0be
soupsieve@2.7
2.8.4

Open the chart page →

2,733
music-assistantkarljorgensen0.1.31 of 1See more

music-assistant karljorgensen 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
soupsieve@2.8.3
2.8.4

Open the chart page →

7,081
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
soupsieve@2.5
2.8.4

Open the chart page →

6,447
mindsdbkronkltdVerified publisher0.1.01 of 1See more

mindsdb kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
mindsdb/mindsdb:latest163011c09299
soupsieve@2.8.3
2.8.4

Open the chart page →

9,620
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
soupsieve@2.6
2.8.4

Open the chart page →

8,405
jupyterhubkubeblocksVerified publisher0.1.01 of 7See more

jupyterhub kubeblocks 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
soupsieve@2.4.1
2.8.4

Open the chart page →

7,356
kyso-nbdimekyso1.0.01 of 1See more

kyso-nbdime kyso 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
kyso/kyso-nbdime:latest4aa9d38ee81d
soupsieve@2.3.2.post1
2.8.4

Open the chart page →

2,765
linkdinglinkding0.2.31 of 1See more

linkding linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
sissbruecker/linkding:1.41.0-plusa222fb777e1f
soupsieve@2.6
2.8.4

Open the chart page →

37,942
errbotmidokura-communityVerified publisher0.0.51 of 1See more

errbot midokura-community 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
errbotio/errbot:6.1.900ee4e0953ab
soupsieve@2.3.2.post1
2.8.4

Open the chart page →

2,233
fossologymidokura-communityVerified publisher0.2.21 of 2See more

fossology midokura-community 0.2.2

1 of the 2 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
fossology/fossology:4.2.18bd1f22ba7bb
soupsieve@2.3.2.post1
2.8.4

Open the chart page →

3,294
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.01 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

1 of the 40 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
yetiplatform/yeti:2.9.09bcbe2650a14
soupsieve@2.6
2.8.4

Open the chart page →

71,208
yetiosdfir-infrastructureVerified publisher1.0.51 of 4See more

yeti osdfir-infrastructure 1.0.5

1 of the 4 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
yetiplatform/yeti:latest9c3006cedcca
soupsieve@2.6
2.8.4

Open the chart page →

6,583
devpiowan-charts0.1.01 of 1See more

devpi owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
owanio1992/devpi:6.16.04ade8e1e4d7e
soupsieve@2.7
2.8.4

Open the chart page →

510
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
soupsieve@2.8.1
2.8.4

Open the chart page →

4,749
linkdingpascaliskeVerified publisher3.0.01 of 1See more

linkding pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/sissbruecker/linkding:1.45.061b2eb9eed8e
soupsieve@2.8.1
2.8.4

Open the chart page →

3,854
email-managerphntom0.1.221 of 2See more

email-manager phntom 0.1.22

1 of the 2 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
phntom/email-manager:0.1.22d8e2a9f2f085
soupsieve@2.4
2.8.4

Open the chart page →

2,565
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
soupsieve@2.6
2.8.4

Open the chart page →

21,211
kresusrm3lVerified publisher0.2.11 of 3See more

kresus rm3l 0.2.1

1 of the 3 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
bnjbvr/kresus:0.22.137e216b182c8
soupsieve@2.6
2.8.4

Open the chart page →

15,591
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
soupsieve@2.6
2.8.4

Open the chart page →

9,607
agentdatarss30.1.01 of 1See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
soupsieve@2.6
2.8.4

Open the chart page →

3,512
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
soupsieve@2.6
2.8.4

Open the chart page →

4,718
tandoorrtomik-helm-chartsVerified publisher0.0.11 of 1See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
vabene1111/recipes:2.3.50f8d061895e9
soupsieve@2.8
2.8.4

Open the chart page →

4,499
airflowsb-helm-charts0.3.01 of 1See more

airflow sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
apache/airflow:2.8.1e5560ad0b86e
soupsieve@2.5
2.8.4

Open the chart page →

10,209
syncstorageschichtelVerified publisher0.1.11 of 1See more

syncstorage schichtel 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
mozilla/syncstorage-rs:0.15.893752877dced
soupsieve@2.5
2.8.4

Open the chart page →

1,318
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
soupsieve@2.3.2.post1
2.8.4

Open the chart page →

5,565
stashswuuper-githubVerified publisher0.1.161 of 1See more

stash swuuper-github 0.1.16

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
stashapp/stash:v0.31.1df744af5a0c9
soupsieve@2.8.3
2.8.4

Open the chart page →

2,396
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
soupsieve@2.6
2.8.4

Open the chart page →

5,350
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-49476.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
soupsieve@2.7
2.8.4

Open the chart page →

7,628

Container images carrying it

88 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
stackstorm/st2rulesengine:3.8259503496ff9
soupsieve@2.5
2.8.4
1
stackstorm/st2scheduler:3.8b1de2055c362
soupsieve@2.5
2.8.4
1
stackstorm/st2sensorcontainer:3.8b1a338f64773
soupsieve@2.5
2.8.4
1
stackstorm/st2stream:3.81c8904a3bf67
soupsieve@2.5
2.8.4
1
stackstorm/st2timersengine:3.81bf35bfaf00c
soupsieve@2.5
2.8.4
1
stackstorm/st2workflowengine:3.819fdfffdbba8
soupsieve@2.5
2.8.4
1
stashapp/stash:v0.31.1df744af5a0c9
soupsieve@2.8.3
2.8.4
1
tachyongroup/mlflow-deployment-controller:mlflow-controller-0.1.87e79b9000856
soupsieve@2.4
2.8.4
1
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
soupsieve@2.4
2.8.4
1
tombursch/kitchenowl-backend:v0.7.8b48e4ab727cd
soupsieve@2.8.3
2.8.4
1
vabene1111/recipes:2.3.50f8d061895e9
soupsieve@2.8
2.8.4
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
soupsieve@2.3.1
2.8.4
1
yetiplatform/yeti:2.9.09bcbe2650a14
soupsieve@2.6
2.8.4
1
yetiplatform/yeti:latest9c3006cedcca
soupsieve@2.6
2.8.4
1
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
soupsieve@2.5
2.8.4
1
ghcr.io/dgtlmoon/changedetection.io:0.39.4f1ce4c56ccaa
soupsieve@2.3.1
2.8.4
1
ghcr.io/hemslo/chat-search:latest39d48995a5bd
soupsieve@2.5
2.8.4
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
soupsieve@2.6
2.8.4
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
soupsieve@2.8.1
2.8.4
1
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
soupsieve@2.3.2.post1
2.8.4
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
soupsieve@2.5
2.8.4
1
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
soupsieve@2.3.2.post1
2.8.4
1
ghcr.io/home-operations/beets:2.3.1cc4975f1a0be
soupsieve@2.7
2.8.4
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
soupsieve@2.8.3
2.8.4
1
ghcr.io/linuxserver/mylar3:version-v0.5.3b96f0e97ab3f
soupsieve@2.2.1
2.8.4
1
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
soupsieve@2.3.2.post1
2.8.4
1
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
soupsieve@2.3.2.post1
2.8.4
1
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
soupsieve@2.8
2.8.4
1
ghcr.io/mirio/verbacap:v1.5.084928e2fc4f2
soupsieve@2.5
2.8.4
1
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
soupsieve@2.8.1
2.8.4
1
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
soupsieve@2.8.3
2.8.4
1
ghcr.io/porelli/firefox-sync:syncstorage-rs-mysql-0.18.27d244e514216
soupsieve@2.7
2.8.4
1
ghcr.io/sissbruecker/linkding:1.45.061b2eb9eed8e
soupsieve@2.8.1
2.8.4
1
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
soupsieve@2.6
2.8.4
1
ghcr.io/wasi-master/13ft:0.3.4563ce7794a71
soupsieve@2.6
2.8.4
1
ghcr.io/wgbh-mla/ov-wag:v1.1.06df27f944fe8
soupsieve@2.7
2.8.4
1
public.ecr.aws/datadog/agent:7.73.0f4925b15ce94
soupsieve@2.8
2.8.4
1
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
soupsieve@2.7
2.8.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.