StackRadar

CVE-2026-59881

Medium

Advisory

Published 30 Jul 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.003
23rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
175
of 17,781 indexed, latest versions
Container images
176
deployed by those charts
Fix available
1 of 2
affected packages

AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

Carried by container images the latest versions of 175 of 17,781 indexed charts deploy, on 176 images.

Affected packageAffected versionsFixed inImages
aiohttppypi3.4.4, 3.5.4, 3.6.2, 3.7.1+34 more3.14.2176
python-aiohttpdeb3.8.4-1, 3.11.16-1+deb13u1no fix listed2
OSV records
DEBIAN-CVE-2026-59881GHSA-mq44-7p77-q5h7
Also known as
PYSEC-2026-3547

Charts affected

175 by stars
ChartLatestAffected imagesRadar Score
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
aiohttp@3.9.3
3.14.2

Open the chart page →

11,367
stackgres-operatorstackgres-chartsOfficialVerified publisher1.19.11 of 2See more

stackgres-operator stackgres-charts 1.19.1

1 of the 2 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
quay.io/stackgres/operator:1.19.1f241b0b20326
aiohttp@3.14.1
3.14.2

Open the chart page →

2,119
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
langgenius/dify-api:1.16.1dcefa5f7c47c
aiohttp@3.14.1
3.14.2

Open the chart page →

22,002
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
aiohttp@3.8.1
3.14.2

Open the chart page →

7,705
daskdask2024.1.11 of 2See more

dask dask 2024.1.1

1 of the 2 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
aiohttp@3.9.1
3.14.2

Open the chart page →

12,746
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
aiohttp@3.9.1
3.14.2

Open the chart page →

6,041
ilumilumOfficialVerified publisher6.7.31 of 19See more

ilum ilum 6.7.3

1 of the 19 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
ilum/api:6.7.3624fd09528c8
aiohttp@3.14.1
3.14.2

Open the chart page →

23,228
syftopenmined0.9.51 of 6See more

syft openmined 0.9.5

1 of the 6 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
aiohttp@3.11.12
3.14.2

Open the chart page →

17,245
cluster-secretclutersecretVerified publisher0.7.01 of 1See more

cluster-secret clutersecret 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
quay.io/clustersecret/clustersecret:0.0.14a9f835d1b241
aiohttp@3.11.11
3.14.2

Open the chart page →

3,033
daskhubdask2024.1.13 of 9See more

daskhub dask 2024.1.1

3 of the 9 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
aiohttp@3.9.1
3.14.2
ghcr.io/dask/dask-gateway-server:2024.1.0881e7acfc5a0
aiohttp@3.9.1
3.14.2
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
aiohttp@3.9.1
3.14.2

Open the chart page →

14,094
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
datamate/seafile-professional:11.0.202dd66b722464
aiohttp@3.12.15
3.14.2

Open the chart page →

27,267
glpiglpi-conteiner0.1.01 of 3See more

glpi glpi-conteiner 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
vdiogov/glpi-conteiner:latest6945f84f0058
aiohttp@3.8.4
python-aiohttp@3.8.4-1
3.14.2
no fix listed

Open the chart page →

12,170
clustersecretpatrungel0.2.01 of 1See more

clustersecret patrungel 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
flag5/clustersecret:0.0.94ad5748bfcc6
aiohttp@3.8.1
3.14.2

Open the chart page →

1,841
alerta-webalerta-webVerified publisher0.1.121 of 2See more

alerta-web alerta-web 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
hayk96/alerta-web:9.0.486377705e9e3
aiohttp@3.10.5
3.14.2

Open the chart page →

3,569
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
aiohttp@3.9.5
3.14.2

Open the chart page →

17,404
dask-kubernetes-operatordask2026.3.01 of 1See more

dask-kubernetes-operator dask 2026.3.0

1 of the 1 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
aiohttp@3.13.3
3.14.2

Open the chart page →

9,316
flyte-binaryflyte2.0.481 of 4See more

flyte-binary flyte 2.0.48

1 of the 4 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
aiohttp@3.13.5
3.14.2

Open the chart page →

4,641
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
aiohttp@3.13.3
3.14.2

Open the chart page →

4,634
bitwarden-crd-operatorlerentisVerified publisher0.18.01 of 1See more

bitwarden-crd-operator lerentis 0.18.0

1 of the 1 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
ghcr.io/lerentis/bitwarden-crd-operator:0.17.00a608c6ead85
aiohttp@3.13.5
3.14.2

Open the chart page →

2,003
skypilotskypilotOfficialVerified publisher0.13.01 of 3See more

skypilot skypilot 0.13.0

1 of the 3 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot:0.13.03bc8bf8f4d83
aiohttp@3.14.1
3.14.2

Open the chart page →

5,852
agentareaagentareaVerified publisher0.0.182 of 16See more

agentarea agentarea 0.0.18

2 of the 16 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
agentarea/agentarea-api:latest9e15e16fa758
aiohttp@3.14.1
3.14.2
agentarea/agentarea-worker:latest1e5cb68ee77a
aiohttp@3.14.1
3.14.2

Open the chart page →

14,914
siemassist-iot-cybersecurity-monitroting-siem0.1.01 of 3See more

siem assist-iot-cybersecurity-monitroting-siem 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
assistiot/cybersecurity-monitoring_id-wzh:latest0aacefac9677
aiohttp@3.7.4
3.14.2

Open the chart page →

10,730
easyhaproxybyjgVerified publisher2.0.41 of 1See more

easyhaproxy byjg 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
byjg/easy-haproxy:6.1.1230fdb7b00ae
aiohttp@3.14.1
3.14.2

Open the chart page →

933
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
aiohttp@3.8.5
3.14.2

Open the chart page →

11,205
aibrixdanchevVerified publisher0.7.01 of 5See more

aibrix danchev 0.7.0

1 of the 5 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
aibrix/metadata-service:v0.7.063fb81a64377
aiohttp@3.14.1
3.14.2

Open the chart page →

5,274
trivy-operatordevopstalesVerified publisher2.5.01 of 1See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
devopstales/trivy-operator:2.575136aa7a26e
aiohttp@3.8.3
3.14.2

Open the chart page →

5,598
dominodominoVerified publisher0.1.111 of 3See more

domino domino 0.1.11

1 of the 3 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
aiohttp@3.8.3
3.14.2

Open the chart page →

8,823
archerydoubanVerified publisher0.4.31 of 6See more

archery douban 0.4.3

1 of the 6 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
hhyo/archery:v1.9.11aa41843419e
aiohttp@3.8.3
3.14.2

Open the chart page →

5,853
genesis-generatorethereum-helm-chartsVerified publisher0.2.31 of 2See more

genesis-generator ethereum-helm-charts 0.2.3

1 of the 2 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
skylenet/ethereum-genesis-generator:latest210353ce7c89
aiohttp@3.8.3
3.14.2

Open the chart page →

3,135
obicogabe565Verified publisher0.6.01 of 3See more

obico gabe565 0.6.0

1 of the 3 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
ghcr.io/gabe565/obico/web:latesta5c1daef46c0
aiohttp@3.9.1
3.14.2

Open the chart page →

1,965
appdaemongeek-cookbookVerified publisher8.4.21 of 1See more

appdaemon geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
acockburn/appdaemon:4.0.83a93281d7e94
aiohttp@3.7.4
3.14.2

Open the chart page →

3,461
harp-proxyharp0.8.11 of 1See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
makersquad/harp-proxy:0.8.1a40dd258c527
aiohttp@3.11.18
3.14.2

Open the chart page →

6,374
supersetinseefrlab1.4.01 of 4See more

superset inseefrlab 1.4.0

1 of the 4 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
aiohttp@3.7.4
3.14.2

Open the chart page →

7,129
jessejesse-chartVerified publisher0.0.461 of 6See more

jesse jesse-chart 0.0.46

1 of the 6 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
salehmir/jesse:1.10.101afa95f979e9
aiohttp@3.12.12
3.14.2

Open the chart page →

3,421
jupyterhub-outpostjupyter-jscVerified publisher2.4.11 of 1See more

jupyterhub-outpost jupyter-jsc 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
aiohttp@3.13.5
3.14.2

Open the chart page →

1,678
knot-resolverknot-resolverVerified publisher1.0.51 of 1See more

knot-resolver knot-resolver 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
cznic/knot-resolver:v6.4.2fe71c5214fdc
aiohttp@3.11.16
python-aiohttp@3.11.16-1+deb13u1
3.14.2
no fix listed

Open the chart page →

2,049
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
aiohttp@3.9.5
3.14.2

Open the chart page →

20,403
litellmlitellm-helm0.2.01 of 1See more

litellm litellm-helm 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
aiohttp@3.10.11
3.14.2

Open the chart page →

4,292
music-assistant-serverlmatfyVerified publisher0.1.91 of 1See more

music-assistant-server lmatfy 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
aiohttp@3.13.2
3.14.2

Open the chart page →

7,201
clowder2ncsaVerified publisher1.9.73 of 12See more

clowder2 ncsa 1.9.7

3 of the 12 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
clowder/clowder2-backend:2.0.0-beta.411f3d844e4c0
aiohttp@3.11.10
3.14.2
clowder/clowder2-heartbeat:2.0.0-beta.414155326c7b9
aiohttp@3.11.10
3.14.2
clowder/clowder2-messages:2.0.0-beta.4bf146f1ca24f
aiohttp@3.11.10
3.14.2

Open the chart page →

37,373
opentelemetry-demoopentelemetry-helmVerified publisher0.41.11 of 34See more

opentelemetry-demo opentelemetry-helm 0.41.1

1 of the 34 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.0.0-mcp654f860148ba
aiohttp@3.14.1
3.14.2

Open the chart page →

22,420
opta-agentopta-agentVerified publisher0.1.31 of 1See more

opta-agent opta-agent 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
runx1/opta-agent:latest0ca3867d3200
aiohttp@3.8.1
3.14.2

Open the chart page →

1,543
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
aiohttp@3.14.0
3.14.2

Open the chart page →

8,158
kyoorubxkubeVerified publisher0.1.101 of 9See more

kyoo rubxkube 0.1.10

1 of the 9 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
ghcr.io/zoriya/kyoo_scanner:4.7.17dc0ee57b628
aiohttp@3.11.11
3.14.2

Open the chart page →

30,234
vuiseriohub1.0.61 of 3See more

vui seriohub 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
dserio83/velero-api:0.3.16b3d9115fee2
aiohttp@3.12.12
3.14.2

Open the chart page →

11,532
smarter-demosmarterOfficialVerified publisher0.1.52 of 7See more

smarter-demo smarter 0.1.5

2 of the 7 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
ghcr.io/smarter-project/audio-client:v3.1.23c8375dc5487
aiohttp@3.8.3
3.14.2
ghcr.io/smarter-project/image-detector:v2.5.31dcca70c6446
aiohttp@3.8.3
3.14.2

Open the chart page →

45,832
alertasomeblackmagic0.2.31 of 2See more

alerta someblackmagic 0.2.3

1 of the 2 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
alerta/alerta-web:8.5.04786b9eaa606
aiohttp@3.8.0
3.14.2

Open the chart page →

3,162
streamlit-appstreamlit-appVerified publisher0.2.01 of 1See more

streamlit-app streamlit-app 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
sruthitanneru/pi-sample:ui-lateste565ea454ffd
aiohttp@3.11.8
3.14.2

Open the chart page →

1,696
tocktock0.6.31 of 9See more

tock tock 0.6.3

1 of the 9 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
tock/gen-ai-orchestrator-server:25.10.7abf7880e0449
aiohttp@3.13.3
3.14.2

Open the chart page →

12,907
music-assistant-serverandibraeuVerified publisher2.1.21 of 1See more

music-assistant-server andibraeu 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-59881.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.9.950666a6f8d7f
aiohttp@3.14.1
3.14.2

Open the chart page →

5,817

Container images carrying it

176 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
aiohttp@3.13.5
3.14.2
1
ghcr.io/nowakeai/svc-lb-mux:0.1.37d8fb8e996b6
aiohttp@3.13.5
3.14.2
1
ghcr.io/open-telemetry/demo:3.0.0-mcp654f860148ba
aiohttp@3.14.1
3.14.2
1
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
aiohttp@3.12.13
3.14.2
1
ghcr.io/serenita-org/vero:v0.8.3e5a7ec714acc
aiohttp@3.10.10
3.14.2
1
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
aiohttp@3.13.5
3.14.2
1
ghcr.io/smarter-project/audio-client:v3.1.23c8375dc5487
aiohttp@3.8.3
3.14.2
1
ghcr.io/smarter-project/image-detector:v2.5.31dcca70c6446
aiohttp@3.8.3
3.14.2
1
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
aiohttp@3.10.11
3.14.2
1
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
aiohttp@3.8.3
3.14.2
1
ghcr.io/tremolosecurity/python-slim-nonroot/python3:1.0.079bb14620fe9
aiohttp@3.14.0
3.14.2
1
ghcr.io/unique-ag/ai/search-proxy:2026.38.0aa6699b027bb
aiohttp@3.14.1
3.14.2
1
ghcr.io/vinny1892/octantis:latest45459c0910fc
aiohttp@3.13.3
3.14.2
1
ghcr.io/zoriya/kyoo_scanner:4.7.17dc0ee57b628
aiohttp@3.11.11
3.14.2
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
aiohttp@3.10.10
3.14.2
1
quay.io/clustersecret/clustersecret:0.0.14a9f835d1b241
aiohttp@3.11.11
3.14.2
1
quay.io/evl.ms/argocd-exporter:0.0.136ea8f34aa6b
aiohttp@3.7.4.post0
3.14.2
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
aiohttp@3.13.5
3.14.2
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
aiohttp@3.13.5
3.14.2
1
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
aiohttp@3.9.1
3.14.2
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
aiohttp@3.13.5
3.14.2
1
quay.io/maxiv/pieeat:0.9.3099715479210
aiohttp@3.13.5
3.14.2
1
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
aiohttp@3.8.1
3.14.2
1
quay.io/ocellusai/operator:v0.10.59ff01f642e2b
aiohttp@3.14.1
3.14.2
1
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
aiohttp@3.9.5
3.14.2
1
quay.io/stackgres/operator:1.19.1f241b0b20326
aiohttp@3.14.1
3.14.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.