StackRadar

CVE-2026-59980

Medium

Advisory

Published 24 Sept 2026In the index since 25 Sept 2026
Severity
Medium
worst across findings
CVSS
6.3
base score, highest
EPSS
0.003
21st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
53
of 17,926 indexed, latest versions
Container images
52
deployed by those charts
Fix available
1 of 2
affected packages

hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

Carried by container images the latest versions of 53 of 17,926 indexed charts deploy, on 52 images.

Affected packageAffected versionsFixed inImages
hpackpypi3.0.0, 4.0.0, 4.1.04.2.052
python-hpackdeb4.0.0-2no fix listed1
OSV records
GHSA-8v8h-hg4w-mvq2UBUNTU-CVE-2026-59980

Charts affected

53 by stars
ChartLatestAffected imagesRadar Score
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
langgenius/dify-api:1.16.1dcefa5f7c47c
hpack@4.1.0
4.2.0

Open the chart page →

70,949
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
hpack@4.0.0
4.2.0

Open the chart page →

6,248
paperless-ngxfmjstudios0.2.81 of 5See more

paperless-ngx fmjstudios 0.2.8

1 of the 5 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.10.1a132c2ac7c57
hpack@4.0.0
4.2.0

Open the chart page →

32,454
openvpn-asas-helm-chartOfficialVerified publisher0.2.11 of 1See more

openvpn-as as-helm-chart 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
openvpn/openvpn-as:latest2253c10ec652
hpack@4.0.0
python-hpack@4.0.0-2
4.2.0
no fix listed

Open the chart page →

3,034
dns-exporterchristianhuthVerified publisher2.6.11 of 1See more

dns-exporter christianhuth 2.6.1

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
tykling/dns_exporter:1.2.3cd6d650c01c1
hpack@4.1.0
4.2.0

Open the chart page →

510
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
hpack@4.1.0
4.2.0

Open the chart page →

5,064
paperless-ngxalexmorbo-paperless-ngxVerified publisher0.2.01 of 2See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
hpack@4.1.0
4.2.0

Open the chart page →

13,044
paperless-ngxcrystalnetVerified publisher0.2.221 of 3See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
hpack@4.0.0
4.2.0

Open the chart page →

14,608
obicogabe565Verified publisher0.6.01 of 3See more

obico gabe565 0.6.0

1 of the 3 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
ghcr.io/gabe565/obico/web:latest122456be28c9
hpack@4.0.0
4.2.0

Open the chart page →

2,078
harp-proxyharp0.8.11 of 1See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
makersquad/harp-proxy:0.8.1a40dd258c527
hpack@4.1.0
4.2.0

Open the chart page →

6,820
huehue1.0.31 of 3See more

hue hue 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
gethue/hue:latest7d5c1b9f8a79
hpack@3.0.0
4.2.0

Open the chart page →

68,689
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
hpack@4.0.0
4.2.0

Open the chart page →

21,376
music-assistant-serverlmatfyVerified publisher0.1.91 of 1See more

music-assistant-server lmatfy 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
hpack@4.1.0
4.2.0

Open the chart page →

7,778
home-assistantloeken-at-homeVerified publisher2026.5.11 of 1See more

home-assistant loeken-at-home 2026.5.1

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
loeken/home-assistant:2026.5.14ce6abc553b3
hpack@4.1.0
4.2.0

Open the chart page →

3,378
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
hpack@4.1.0
4.2.0

Open the chart page →

8,981
sentry-k8ssentry-k8sVerified publisher1.4.11 of 11See more

sentry-k8s sentry-k8s 1.4.1

1 of the 11 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
hpack@4.1.0
4.2.0

Open the chart page →

17,487
asya-playgroundasya1.1.31 of 1See more

asya-playground asya 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
localstack/localstack:3.19d278167f2b7
hpack@4.0.0
4.2.0

Open the chart page →

9,744
azure-app-exporterazure-app-exporterVerified publisher0.4.21 of 2See more

azure-app-exporter azure-app-exporter 0.4.2

1 of the 2 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter:0.1.38b472877847f5
hpack@4.0.0
4.2.0

Open the chart page →

1,872
huebigdata-chartsVerified publisher1.0.41 of 2See more

hue bigdata-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
gethue/hue:4.10.05702b2c37ff9
hpack@3.0.0
4.2.0

Open the chart page →

90,476
catpagecatpage2.2.11 of 1See more

catpage catpage 2.2.1

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
ghcr.io/radiorabe/catpage:2.2.17a37fc471447
hpack@4.1.0
4.2.0

Open the chart page →

130
authentikcluster-deploy0.2.01 of 1See more

authentik cluster-deploy 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
hpack@4.1.0
4.2.0

Open the chart page →

2,720
csghubcsghubVerified publisher2.5.02 of 34See more

csghub csghub 2.5.0

2 of the 34 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
hpack@4.1.0
4.2.0
opencsghq/csgbot:v0.6.9-ee7d0271e26521
hpack@4.1.0
4.2.0

Open the chart page →

52,275
csgshipcsghubVerified publisher0.4.61 of 10See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
opencsghq/csgship-agentic:v0.4.02cd29671a03e
hpack@4.1.0
4.2.0

Open the chart page →

12,404
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
hpack@4.0.0
4.2.0

Open the chart page →

6,387
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
hpack@4.0.0
4.2.0

Open the chart page →

10,094
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
hpack@4.0.0
4.2.0

Open the chart page →

10,094
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
hpack@4.1.0
4.2.0

Open the chart page →

55,957
self-awarenesseclipse-aeriosVerified publisher1.4.42 of 2See more

self-awareness eclipse-aerios 1.4.4

2 of the 2 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
eclipseaerios/self-awareness-hardware-info:1.4.434b72f45b46a
hpack@4.1.0
4.2.0
eclipseaerios/self-awareness-power-consumption:1.3.3c8af377c709f
hpack@4.1.0
4.2.0

Open the chart page →

2,404
searxgeek-cookbookVerified publisher5.6.21 of 4See more

searx geek-cookbook 5.6.2

1 of the 4 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
searx/searx:1.0.0-211-968b28993dbb3a6d9419
hpack@4.0.0
4.2.0

Open the chart page →

7,534
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
hpack@4.1.0
4.2.0

Open the chart page →

9,501
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
hpack@4.1.0
4.2.0

Open the chart page →

5,037
paperlesshomelabcihelmchartstestVerified publisher9.1.91 of 1See more

paperless homelabcihelmchartstest 9.1.9

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
hpack@4.0.0
4.2.0

Open the chart page →

17,236
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
hpack@4.1.0
4.2.0

Open the chart page →

19,357
paperlessk8s-home-lab-repo11.0.11 of 1See more

paperless k8s-home-lab-repo 11.0.1

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
hpack@4.1.0
4.2.0

Open the chart page →

9,889
authentikkagiso-me0.1.11 of 1See more

authentik kagiso-me 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
hpack@4.1.0
4.2.0

Open the chart page →

4,873
music-assistantkarljorgensen0.1.31 of 1See more

music-assistant karljorgensen 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
hpack@4.1.0
4.2.0

Open the chart page →

7,660
huekatool1.0.81 of 1See more

hue katool 1.0.8

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
gethue/hue:4.11.011b649636e68
hpack@3.0.0
4.2.0

Open the chart page →

87,020
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
hpack@4.0.0
4.2.0

Open the chart page →

6,655
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
hpack@4.1.0
4.2.0

Open the chart page →

8,924
searxnglbenicio-communityVerified publisher0.1.11 of 1See more

searxng lbenicio-community 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
searxng/searxng:2026.6.22-952896d293f52dca114d9
hpack@4.1.0
4.2.0

Open the chart page →

46
paperless-ngxmt1905027.6.141 of 4See more

paperless-ngx mt190502 7.6.14

1 of the 4 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
hpack@4.1.0
4.2.0

Open the chart page →

12,498
splashntppoolVerified publisher1.0.41 of 1See more

splash ntppool 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
scrapinghub/splash:3.4.1a5f89bc84606
hpack@3.0.0
4.2.0

Open the chart page →

98,495
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
hpack@4.1.0
4.2.0

Open the chart page →

5,223
prefect-agentprefectVerified publisher2024.8.301638221 of 1See more

prefect-agent prefect 2024.8.30163822

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
prefecthq/prefect:2.20.4-python3.101df4b5b6238a
hpack@4.0.0
4.2.0

Open the chart page →

5,771
prowlerprowler0.1.11 of 1See more

prowler prowler 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
toniblyx/prowler:stablecf1ee9fc5b67
hpack@4.1.0
4.2.0

Open the chart page →

1,329
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
hpack@4.0.0
4.2.0

Open the chart page →

22,066
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
hpack@4.0.0
4.2.0

Open the chart page →

10,094
imgtagrotationalVerified publisher0.2.01 of 1See more

imgtag rotational 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
hpack@4.1.0
4.2.0

Open the chart page →

3,564
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
hpack@4.1.0
4.2.0

Open the chart page →

11,462
home-assistantsmall-hack2.1.01 of 1See more

home-assistant small-hack 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-59980.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
hpack@4.1.0
4.2.0

Open the chart page →

4,329

Container images carrying it

52 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
hpack@4.1.0
4.2.0
1
ghcr.io/radiorabe/catpage:2.2.17a37fc471447
hpack@4.1.0
4.2.0
1

syft 1.42.1 · advisories as of 28 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.