StackRadar

CVE-2026-49855

High

Advisory

Published 15 Jun 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
103
of 17,781 indexed, latest versions
Container images
108
deployed by those charts
Fix available
1 of 2
affected packages

tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

Carried by container images the latest versions of 103 of 17,781 indexed charts deploy, on 108 images.

Affected packageAffected versionsFixed inImages
tornadopypi2.4.1, 4.5.3, 5.1.1, 6.0.2+12 more6.5.6108
python-tornadodeb6.2.0-3+deb12u1no fix listed1
OSV records
DEBIAN-CVE-2026-49855GHSA-mgf9-4vpg-hj56
Also known as
PYSEC-2026-3389

Charts affected

103 by stars
ChartLatestAffected imagesRadar Score
unmanicvhdirkVerified publisher0.1.41 of 1See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-49855.

Container imageDigestPackageFixed in
josh5/unmanic:0.2.64d49c4816260
tornado@6.0.2
6.5.6

Open the chart page →

9,347
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-49855.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
tornado@6.4.2
6.5.6

Open the chart page →

7,628
webapp-chartwebappchart1.0.01 of 1See more

webapp-chart webappchart 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-49855.

Container imageDigestPackageFixed in
amagdi888/my-repo:hello-appd8a10fc8faf6
tornado@5.1.1
6.5.6

Open the chart page →

1,201

Container images carrying it

108 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
kyso/kyso-nbdime:latest4aa9d38ee81d
tornado@6.2
6.5.6
1
linuxserver/calibre-web:0.6.24241009026e6f
tornado@6.4.2
6.5.6
1
linuxserver/calibre-web:version-0.6.12938810eca3d3
tornado@6.1
6.5.6
1
linuxserver/medusa:v1.0.26-ls2884477fb1ce3ca
tornado@6.5.2
6.5.6
1
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
tornado@5.1.1
6.5.6
1
litellm/litellm-non_root:v1.82.3-stable09b217802ded
tornado@6.5.5
6.5.6
1
lsstsqre/nublado2:2.0.1b75bf8aaafa4
tornado@6.1
6.5.6
1
lsstsqre/prepuller:latest19c2dfc4e4ff
tornado@6.1
6.5.6
1
lsstsqre/sciplat-hub:latest5e0ade6bed1c
tornado@6.1
6.5.6
1
lsstsqre/wfdispatcher:lateste9feb99f524d
tornado@6.1
6.5.6
1
matrixdotorg/synapse:v1.127.1c3c4a9de2a0b
tornado@6.4.2
6.5.6
1
matrixdotorg/synapse:v1.53.0cb89c0f17ba1
tornado@6.1
6.5.6
1
matrixdotorg/synapse:v1.78.0def97fd537d8
tornado@6.1
6.5.6
1
mher/flower:2.051c3c3db5be3
tornado@6.3.3
6.5.6
1
mnaggar3396/python-app:latest371d8ed84b15
tornado@6.2
6.5.6
1
mohameddev006/web-app:v50fbc7360ecf4
tornado@5.1.1
6.5.6
1
octoprint/octoprint:1.4.0106c26efcd8a
tornado@4.5.3
6.5.6
1
octoprint/octoprint:1.6.1ea3bffae2470
tornado@5.1.1
6.5.6
1
opencsghq/agenticflow:ee-v0.6-52f03fead54db
tornado@6.5.1
6.5.6
1
opendatacube/explorer:latest120457ffcd69
tornado@6.5.2
6.5.6
1
opendatacube/wps:latest80df355a660b
tornado@6.4.2
6.5.6
1
openzaak/open-notificaties:1.3.02e65313b9b10
tornado@6.1
6.5.6
1
oxheadalpha/tezos-k8s-utils:5.3.4d9faed45bf1c
tornado@6.1
6.5.6
1
pangeo/base-notebook:2024.01.155fbe688a4f80
tornado@6.3.3
6.5.6
1
roadiehq/community-backstage-image:latestef355bf5b639
tornado@5.1.1
6.5.6
1
robmarkcole/deepstack-ui:latest410275726459
tornado@6.1
6.5.6
1
seldonio/seldon-request-logger:1.11.24e985d2006a8
tornado@6.1
6.5.6
1
sruthitanneru/pi-sample:ui-lateste565ea454ffd
tornado@6.4.2
6.5.6
1
stakater/restful-distributed-lock-manager:0.5.34f8e409f30c2
tornado@2.4.1
6.5.6
1
tensorflow/tensorflow:1.6.0-devel1e3172090703
tornado@4.5.3
6.5.6
1
thijsvanloef/palworld-server-docker:v2.7.1401d3eb5c053
tornado@6.5.5
6.5.6
1
thijsvanloef/palworld-server-docker:v2.5.0b4ac9ee22483
tornado@6.5.5
6.5.6
1
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
tornado@4.5.3
6.5.6
1
treskon/portrait-web-setup:DEV-latesta475d80e4ecf
tornado@6.4.2
6.5.6
1
trungkien210493/icinga2-report:v1.7.12cc8c3763c4c
tornado@5.1.1
6.5.6
1
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
tornado@6.4
6.5.6
1
ghcr.io/dask/dask:2024.1.0080150de7d86
tornado@6.3.3
6.5.6
1
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
tornado@6.5.4
6.5.6
1
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
tornado@6.3.3
6.5.6
1
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
tornado@6.4.1
6.5.6
1
ghcr.io/esphome/esphome:2026.4.078a82d810709
tornado@6.5.5
6.5.6
1
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
tornado@6.1
6.5.6
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
tornado@6.3.3
6.5.6
1
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
tornado@6.5.4
6.5.6
1
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
tornado@6.4.1
6.5.6
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
tornado@6.5.2
6.5.6
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
tornado@6.5.2
6.5.6
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
tornado@6.5.2
6.5.6
1
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
tornado@6.3.3
6.5.6
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
tornado@6.5.2
6.5.6
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.