StackRadar

CVE-2026-63374

Critical

Advisory

Published 18 Sept 2026In the index since 19 Sept 2026
Severity
Critical
worst across findings
CVSS
9.3
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
247
of 17,805 indexed, latest versions
Container images
260
deployed by those charts
Fix available
1 of 1
affected package

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

Carried by container images the latest versions of 247 of 17,805 indexed charts deploy, on 260 images.

Affected packageAffected versionsFixed inImages
anyiopypi3.3.0, 3.3.4, 3.5.0, 3.6.1+22 more4.14.2260
OSV records
GHSA-82r6-8w77-94w6

Charts affected

247 by stars
ChartLatestAffected imagesRadar Score
authentikgoauthentikOfficialVerified publisher2026.8.31 of 1See more

authentik goauthentik 2026.8.3

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.8.3ab9b4e8cc4ab
anyio@4.14.1
4.14.2

Open the chart page →

988
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
anyio@4.3.0
4.14.2

Open the chart page →

11,463
home-assistanthelm-hassVerified publisher0.3.821 of 1See more

home-assistant helm-hass 0.3.82

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.3d89226851697
anyio@4.13.0
4.14.2

Open the chart page →

2,161
difydoubanVerified publisher0.10.02 of 6See more

dify douban 0.10.0

2 of the 6 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
anyio@4.12.0
4.14.2
langgenius/dify-sandbox:0.2.124e65e8a351a2
anyio@4.9.0
4.14.2

Open the chart page →

74,641
difydify-helmVerified publisher0.38.04 of 11See more

dify dify-helm 0.38.0

4 of the 11 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
langgenius/dify-agent-backend:1.16.1097d3fd27a7b
anyio@4.13.0
4.14.2
langgenius/dify-api:1.16.1dcefa5f7c47c
anyio@4.14.1
4.14.2
langgenius/dify-plugin-daemon:0.6.3-local3c694329357b
anyio@4.14.1
4.14.2
langgenius/dify-sandbox:0.2.15750e1111426e
anyio@4.13.0
4.14.2

Open the chart page →

64,455
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.14.3f09282d281f6
anyio@4.1.0
4.14.2

Open the chart page →

11,570
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
anyio@3.5.0
4.14.2

Open the chart page →

7,785
redashredash4.2.01 of 3See more

redash redash 4.2.0

1 of the 3 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
redash/redash:25.8.000d813437db5
anyio@4.5.2
4.14.2

Open the chart page →

6,139
daskdask2024.1.11 of 2See more

dask dask 2024.1.1

1 of the 2 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
anyio@4.2.0
4.14.2

Open the chart page →

12,946
litellm-helmlitellm1.101.01 of 2See more

litellm-helm litellm 1.101.0

1 of the 2 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm:1.101.0d295634e09c6
anyio@4.13.0
4.14.2

Open the chart page →

5,094
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
anyio@4.0.0
4.14.2

Open the chart page →

6,110
ilumilumOfficialVerified publisher6.7.31 of 19See more

ilum ilum 6.7.3

1 of the 19 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ilum/api:6.7.3624fd09528c8
anyio@4.14.1
4.14.2

Open the chart page →

23,639
syftopenmined0.9.52 of 6See more

syft openmined 0.9.5

2 of the 6 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
anyio@4.8.0
4.14.2
openmined/syft-seaweedfs:0.9.53a4144c0bb82
anyio@4.4.0
4.14.2

Open the chart page →

17,506
paperless-ngxpaperless-ngxVerified publisher0.3.221 of 3See more

paperless-ngx paperless-ngx 0.3.22

1 of the 3 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
anyio@4.12.1
4.14.2

Open the chart page →

8,729
home-assistantalekcVerified publisher2.11.31 of 1See more

home-assistant alekc 2.11.3

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.3d89226851697
anyio@4.13.0
4.14.2

Open the chart page →

2,161
home-assistantandrenarchyVerified publisher14.104.01 of 1See more

home-assistant andrenarchy 14.104.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
anyio@4.13.0
4.14.2

Open the chart page →

2,161
py-kube-downscalerpy-kube-downscalerVerified publisher0.3.121 of 1See more

py-kube-downscaler py-kube-downscaler 0.3.12

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/caas-team/py-kube-downscaler:26.4.0af05a098b0d2
anyio@4.13.0
4.14.2

Open the chart page →

749
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.11.11da5c38c6a78
anyio@4.1.0
4.14.2

Open the chart page →

6,264
openvpn-asas-helm-chartOfficialVerified publisher0.2.11 of 1See more

openvpn-as as-helm-chart 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
openvpn/openvpn-as:latest2253c10ec652
anyio@4.4.0
4.14.2

Open the chart page →

2,801
baserowbaserow-chartVerified publisher1.0.561 of 6See more

baserow baserow-chart 1.0.56

1 of the 6 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
baserow/backend:2.3.37c00549b3a6f
anyio@4.12.1
4.14.2

Open the chart page →

17,758
daskhubdask2024.1.11 of 9See more

daskhub dask 2024.1.1

1 of the 9 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
anyio@4.2.0
4.14.2

Open the chart page →

14,289
dns-exporterchristianhuthVerified publisher2.6.11 of 1See more

dns-exporter christianhuth 2.6.1

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
tykling/dns_exporter:1.2.3cd6d650c01c1
anyio@4.13.0
4.14.2

Open the chart page →

476
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
anyio@4.4.0
4.14.2

Open the chart page →

17,755
dask-kubernetes-operatordask2026.3.01 of 1See more

dask-kubernetes-operator dask 2026.3.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
anyio@4.12.1
4.14.2

Open the chart page →

9,594
flyte-binaryflyte2.0.491 of 4See more

flyte-binary flyte 2.0.49

1 of the 4 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
anyio@4.13.0
4.14.2

Open the chart page →

4,004
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
hkotel/mealie:api-v1.0.0beta-2a7e6b6abe087
anyio@3.6.1
4.14.2

Open the chart page →

7,636
home-assistanthome-assistantVerified publisher0.5.101 of 3See more

home-assistant home-assistant 0.5.10

1 of the 3 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.0372d991e5888
anyio@4.13.0
4.14.2

Open the chart page →

2,360
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
anyio@4.10.0
4.14.2

Open the chart page →

4,694
klancesklances0.1.41 of 1See more

klances klances 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/nicolargo/klances:0.1.374d6d33376eb
anyio@4.12.1
4.14.2

Open the chart page →

1,761
observalobservalVerified publisher1.13.11 of 8See more

observal observal 1.13.1

1 of the 8 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/observal/observal-api:1.13.1153b8b893232
anyio@4.13.0
4.14.2

Open the chart page →

6,202
mealieth-chartsVerified publisher0.5.11 of 1See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
anyio@4.11.0
4.14.2

Open the chart page →

3,890
paperlesszekker6Verified publisher11.8.01 of 1See more

paperless zekker6 11.8.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
anyio@4.12.1
4.14.2

Open the chart page →

4,757
paperless-ngxadnoctemVerified publisher0.4.21 of 5See more

paperless-ngx adnoctem 0.4.2

1 of the 5 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
anyio@4.12.1
4.14.2

Open the chart page →

20,562
agentareaagentareaVerified publisher0.0.182 of 16See more

agentarea agentarea 0.0.18

2 of the 16 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
agentarea/agentarea-api:latest9e15e16fa758
anyio@4.12.1
4.14.2
agentarea/agentarea-worker:latest1e5cb68ee77a
anyio@4.12.1
4.14.2

Open the chart page →

15,343
paperless-ngxalexmorbo-paperless-ngxVerified publisher0.2.01 of 2See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
anyio@4.11.0
4.14.2

Open the chart page →

12,251
clearml-servingallegroaiVerified publisher1.6.21 of 9See more

clearml-serving allegroai 1.6.2

1 of the 9 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
allegroai/clearml-serving-inference:1.3.0fca885e8cfc6
anyio@3.6.2
4.14.2

Open the chart page →

17,941
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
anyio@4.12.1
4.14.2

Open the chart page →

6,035
anteonanteonVerified publisher2.6.41 of 13See more

anteon anteon 2.6.4

1 of the 13 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ddosify/selfhosted_backend:3.2.93c11e3182652
anyio@4.4.0
4.14.2

Open the chart page →

22,630
brightdata-exporterbrightdata-chartsVerified publisher0.2.171 of 1See more

brightdata-exporter brightdata-charts 0.2.17

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/danielgines/brightdata-exporter:0.2.176920d17cf6ff
anyio@4.13.0
4.14.2

Open the chart page →

1,352
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
anyio@4.3.0
4.14.2

Open the chart page →

11,521
paperless-ngxcrystalnetVerified publisher0.2.221 of 3See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
anyio@4.6.0
4.14.2

Open the chart page →

13,928
rommcrystalnetVerified publisher0.2.201 of 3See more

romm crystalnet 0.2.20

1 of the 3 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
zurdi15/romm:2.3.12db88fe44c89
anyio@3.7.1
4.14.2

Open the chart page →

1,962
aibrixdanchevVerified publisher0.7.01 of 5See more

aibrix danchev 0.7.0

1 of the 5 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
aibrix/metadata-service:v0.7.063fb81a64377
anyio@4.14.0
4.14.2

Open the chart page →

5,470
dominodominoVerified publisher0.1.111 of 3See more

domino domino 0.1.11

1 of the 3 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
anyio@3.7.1
4.14.2

Open the chart page →

8,952
craftycontrollerdrewburr-labs-helm-chartsVerified publisher0.3.01 of 1See more

craftycontroller drewburr-labs-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
anyio@4.9.0
4.14.2

Open the chart page →

43,336
fastapi-microservice-appfast-api-microservice-app1.3.03 of 4See more

fastapi-microservice-app fast-api-microservice-app 1.3.0

3 of the 4 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
omkara25/simple-microservice-app-order-service:v2.18327546c7aac
anyio@4.9.0
4.14.2
omkara25/simple-microservice-app-payment-service:v2afff40172b6b
anyio@4.9.0
4.14.2
omkara25/simple-microservice-app-user-service:v2d62cba548580
anyio@4.9.0
4.14.2

Open the chart page →

9,813
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latest612d76760b54
anyio@4.13.0
4.14.2

Open the chart page →

2,161
paperlessgeek-cookbookVerified publisher9.2.01 of 1See more

paperless geek-cookbook 9.2.0

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:1.8.09bbc9a90641e
anyio@3.6.1
4.14.2

Open the chart page →

3,942
harp-proxyharp0.8.11 of 1See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
makersquad/harp-proxy:0.8.1a40dd258c527
anyio@4.9.0
4.14.2

Open the chart page →

6,485
helmuphelmupVerified publisher0.1.02 of 3See more

helmup helmup 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-63374.

Container imageDigestPackageFixed in
sirrend/helmup-engine:0.1.13699e79e3d4e2
anyio@4.4.0
4.14.2
sirrend/helmup-github-scraper:0.1.47ca688c7abf5
anyio@4.4.0
4.14.2

Open the chart page →

16,765

Container images carrying it

260 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
anyio@4.14.0
4.14.2
1
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
anyio@4.12.0
4.14.2
1
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
anyio@4.12.0
4.14.2
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
anyio@4.12.0
4.14.2
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
anyio@4.12.0
4.14.2
1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
anyio@4.12.0
4.14.2
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
anyio@4.12.0
4.14.2
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
anyio@4.12.0
4.14.2
1
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
anyio@4.4.0
4.14.2
1
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
anyio@4.9.0
4.14.2
1

syft 1.42.1 · advisories as of 19 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.