StackRadar

CVE-2026-64847

Medium

Advisory

Published 18 Sept 2026In the index since 19 Sept 2026
Severity
Medium
worst across findings
CVSS
6.8
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
247
of 17,805 indexed, latest versions
Container images
260
deployed by those charts
Fix available
1 of 1
affected package

AnyIO process-pool workers can block indefinitely on undrained stderr

Carried by container images the latest versions of 247 of 17,805 indexed charts deploy, on 260 images.

Affected packageAffected versionsFixed inImages
anyiopypi3.3.0, 3.3.4, 3.5.0, 3.6.1+22 more4.14.2260
OSV records
GHSA-5p39-cfhj-2xmp

Charts affected

247 by stars
ChartLatestAffected imagesRadar Score
rhbk-neurofacerhbk-neurofaceVerified publisher1.0.01 of 4See more

rhbk-neuroface rhbk-neuroface 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
anyio@4.14.0
4.14.2

Open the chart page →

4,022
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
anyio@4.6.2.post1
4.14.2

Open the chart page →

9,771
rommromm-helm-chartVerified publisher1.5.51 of 3See more

romm romm-helm-chart 1.5.5

1 of the 3 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
rommapp/romm:5.2.03512f2ca4557
anyio@4.9.0
4.14.2

Open the chart page →

3,468
imgtagrotationalVerified publisher0.2.01 of 1See more

imgtag rotational 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
anyio@4.8.0
4.14.2

Open the chart page →

3,374
agentdatarss30.1.01 of 1See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
anyio@4.8.0
4.14.2

Open the chart page →

3,592
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
anyio@4.8.0
4.14.2

Open the chart page →

4,798
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
anyio@4.13.0
4.14.2

Open the chart page →

7,818
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
anyio@4.11.0
4.14.2

Open the chart page →

10,767
tandoorrtomik-helm-chartsVerified publisher0.0.11 of 1See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
vabene1111/recipes:2.3.50f8d061895e9
anyio@4.11.0
4.14.2

Open the chart page →

4,598
runwhen-localrunwhen-contribVerified publisher0.6.171 of 3See more

runwhen-local runwhen-contrib 0.6.17

1 of the 3 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
anyio@4.13.0
4.14.2

Open the chart page →

3,837
test-helm-app1saam-helm-test0.1.01 of 1See more

test-helm-app1 saam-helm-test 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
hamidyousefi93/saam-test:latestc34f071f6ed0
anyio@3.7.1
4.14.2

Open the chart page →

3,952
airflowsb-helm-charts0.3.01 of 1See more

airflow sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
apache/airflow:2.8.1e5560ad0b86e
anyio@4.2.0
4.14.2

Open the chart page →

10,296
search-proxysearch-proxy2026.38.01 of 1See more

search-proxy search-proxy 2026.38.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/unique-ag/ai/search-proxy:2026.38.0aa6699b027bb
anyio@4.13.0
4.14.2

Open the chart page →

1,348
first-chartshashkist-test0.1.01 of 3See more

first-chart shashkist-test 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
shashkist/flask-contacts-app:latest581de1fd6084
anyio@4.6.0
4.14.2

Open the chart page →

3,108
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
anyio@4.8.0
4.14.2

Open the chart page →

5,318
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
anyio@3.7.1
4.14.2

Open the chart page →

5,648
cost-analyzersoftonic2.5.51 of 6See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
gcr.io/kubecost1/kubecost-modeling:v0.1.24a2259b098b13
anyio@4.9.0
4.14.2

Open the chart page →

8,185
spoolmanspoolmanVerified publisher0.2.61 of 1See more

spoolman spoolman 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/donkie/spoolman:0.26.1cf9b41e17b93
anyio@4.14.1
4.14.2

Open the chart page →

1,848
srebotsrebot0.14.01 of 2See more

srebot srebot 0.14.0

1 of the 2 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
anyio@4.12.1
4.14.2

Open the chart page →

1,616
servicexssl-hep1.8.52 of 16See more

servicex ssl-hep 1.8.5

2 of the 16 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
sslhep/servicex-did-finder:v1.8.5ab0090083567
anyio@4.14.1
4.14.2
sslhep/x509-secrets:v1.8.5d9e9ecb12d59
anyio@4.14.1
4.14.2

Open the chart page →

69,027
verbasubstratusVerified publisher0.4.01 of 1See more

verba substratus 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
substratusai/verba:v0.4.0-baseURL261695be635eb
anyio@4.3.0
4.14.2

Open the chart page →

13,546
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
anyio@4.13.0
4.14.2

Open the chart page →

3,516
svc-lb-muxsvc-lb-mux0.1.31 of 1See more

svc-lb-mux svc-lb-mux 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/nowakeai/svc-lb-mux:0.1.37d8fb8e996b6
anyio@4.13.0
4.14.2

Open the chart page →

1,475
take-the-helmtake-the-helm0.1.01 of 1See more

take-the-helm take-the-helm 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
cadmusthefounder/lnd:take-the-helm-0.1.0e596c5fbf80f
anyio@3.6.1
4.14.2

Open the chart page →

821
tarkatarkaOfficialVerified publisher0.4.11 of 4See more

tarka tarka 0.4.1

1 of the 4 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/tarkyaio/tarka:0.4.1e8d3f1512f06
anyio@4.12.1
4.14.2

Open the chart page →

1,584
flask-contactstest-configmap1.0.11 of 3See more

flask-contacts test-configmap 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
shashkist/flask-contacts-app:latest581de1fd6084
anyio@4.6.0
4.14.2

Open the chart page →

5,884
asrtest-opea1.0.01 of 1See more

asr test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
opea/asr:1.025dd26d9cd09
anyio@4.5.0
4.14.2

Open the chart page →

4,460
chatqnatest-opea1.0.05 of 11See more

chatqna test-opea 1.0.0

5 of the 11 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
opea/chatqna:1.038c51b791efa
anyio@4.5.0
4.14.2
opea/embedding-tei:1.05c9639de61c1
anyio@4.5.0
4.14.2
opea/llm-tgi:1.00c25aab3f106
anyio@4.5.0
4.14.2
opea/reranking-tei:1.0e48613afb191
anyio@4.5.0
4.14.2
opea/retriever-redis:1.0eb746b263705
anyio@4.5.0
4.14.2

Open the chart page →

39,639
codegentest-opea1.0.02 of 5See more

codegen test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
opea/codegen:1.058f91683892d
anyio@4.5.0
4.14.2
opea/llm-tgi:1.00c25aab3f106
anyio@4.5.0
4.14.2

Open the chart page →

29,111
codetranstest-opea1.0.02 of 5See more

codetrans test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
opea/codetrans:1.0e2436483b73d
anyio@4.5.0
4.14.2
opea/llm-tgi:1.00c25aab3f106
anyio@4.5.0
4.14.2

Open the chart page →

28,683
docsumtest-opea1.0.02 of 5See more

docsum test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
opea/docsum:1.03eaa91849512
anyio@4.5.0
4.14.2
opea/llm-docsum-tgi:1.002f9e8fa5d71
anyio@4.5.0
4.14.2

Open the chart page →

29,157
embedding-usvctest-opea1.0.01 of 1See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
opea/embedding-tei:1.05c9639de61c1
anyio@4.5.0
4.14.2

Open the chart page →

5,263
guardrails-usvctest-opea1.0.01 of 1See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
opea/guardrails-tgi:1.0262c6048aab8
anyio@4.5.0
4.14.2

Open the chart page →

5,299
llm-uservicetest-opea1.0.01 of 1See more

llm-uservice test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
opea/llm-tgi:1.00c25aab3f106
anyio@4.5.0
4.14.2

Open the chart page →

4,797
reranking-usvctest-opea1.0.01 of 1See more

reranking-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
opea/reranking-tei:1.0e48613afb191
anyio@4.5.0
4.14.2

Open the chart page →

5,063
retriever-usvctest-opea1.0.01 of 1See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
opea/retriever-redis:1.0eb746b263705
anyio@4.5.0
4.14.2

Open the chart page →

5,276
speecht5test-opea1.0.01 of 1See more

speecht5 test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
opea/speecht5:1.0249afad3d268
anyio@4.5.0
4.14.2

Open the chart page →

9,713
ttstest-opea1.0.01 of 1See more

tts test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
opea/tts:1.0257ae94709e9
anyio@4.5.0
4.14.2

Open the chart page →

4,443
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
anyio@4.5.0
4.14.2

Open the chart page →

5,445
kasa-exporterth-chartsVerified publisher0.1.01 of 1See more

kasa-exporter th-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
thelande/kasa_exporter:v0.2.3a1fdb8baa152
anyio@4.4.0
4.14.2

Open the chart page →

1,531
tfy-grafanatruefoundryVerified publisher0.1.211 of 3See more

tfy-grafana truefoundry 0.1.21

1 of the 3 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.1.2716b0b33ff2d
anyio@4.11.0
4.14.2

Open the chart page →

1,082
truefoundry-monitoringtruefoundryVerified publisher0.1.61 of 8See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.1.2716b0b33ff2d
anyio@4.11.0
4.14.2

Open the chart page →

4,598
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
anyio@4.10.0
4.14.2

Open the chart page →

7,779
waldur-site-agentwaldur-site-agentVerified publisher1.0.71 of 1See more

waldur-site-agent waldur-site-agent 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
opennode/waldur-site-agent:1.0.76d2e3b97c8d2
anyio@4.12.1
4.14.2

Open the chart page →

551
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.14.45a065930682d
anyio@4.1.0
4.14.2

Open the chart page →

5,616
dingtalk-botxxl-job-adminVerified publisher0.1.21 of 2See more

dingtalk-bot xxl-job-admin 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
dellnoantechnp/dingtalk-bot:v1.0.1034000bbcad5
anyio@4.12.0
4.14.2

Open the chart page →

3,180
kadalu-operatorxxl-job-adminVerified publisher1.2.42 of 4See more

kadalu-operator xxl-job-admin 1.2.4

2 of the 4 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
kadalu/kadalu-csi:1.2.0af8d470b0ef3
anyio@3.7.1
4.14.2
kadalu/kadalu-operator:1.2.03726d7a805f2
anyio@3.7.1
4.14.2

Open the chart page →

4,926

Container images carrying it

260 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
anyio@4.13.0
4.14.2
1
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
anyio@3.5.0
4.14.2
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
anyio@4.0.0
4.14.2
1
ghcr.io/home-operations/beets:2.3.1cc4975f1a0be
anyio@4.9.0
4.14.2
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
anyio@4.10.0
4.14.2
1
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
anyio@4.12.1
4.14.2
1
ghcr.io/iisas/domino-rest:latest3009350bfc11
anyio@4.12.1
4.14.2
1
ghcr.io/immich-app/immich-machine-learning:v2.3.1379e31b8c751
anyio@4.2.0
4.14.2
1
ghcr.io/immich-app/immich-machine-learning:v3.1.05a0839dc5303
anyio@4.2.0
4.14.2
1
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
anyio@4.13.0
4.14.2
1
ghcr.io/jaydee94/kubeseal-webgui/api:4.5.33cceb9462ae1
anyio@4.9.0
4.14.2
1
ghcr.io/kubiyabot/sdk-py:v1.20.0f108f49570cc
anyio@4.6.2.post1
4.14.2
1
ghcr.io/libretime/libretime-api:latesteae026cc8909
anyio@4.9.0
4.14.2
1
ghcr.io/m0nsterrr/hyperglass:v2.0.4f7b5d20c5e42
anyio@4.4.0
4.14.2
1
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
anyio@3.7.1
4.14.2
1
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
anyio@3.7.1
4.14.2
1
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
anyio@4.11.0
4.14.2
1
ghcr.io/microboxlabs/miot-harness:0.1.0d548e9ae4b84
anyio@4.13.0
4.14.2
1
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
anyio@4.12.1
4.14.2
1
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
anyio@4.13.0
4.14.2
1
ghcr.io/nicolargo/klances:0.1.374d6d33376eb
anyio@4.12.1
4.14.2
1
ghcr.io/nowakeai/svc-lb-mux:0.1.37d8fb8e996b6
anyio@4.13.0
4.14.2
1
ghcr.io/observal/observal-api:1.13.1153b8b893232
anyio@4.13.0
4.14.2
1
ghcr.io/openrelik/openrelik-metrics:latest3d0f1ddeebf5
anyio@4.12.1
4.14.2
1
ghcr.io/open-telemetry/demo:3.1.0-chatbot604b1f493c92
anyio@4.13.0
4.14.2
1
ghcr.io/open-telemetry/demo:3.1.0-mcp81db69cdd0b6
anyio@4.14.1
4.14.2
1
ghcr.io/open-telemetry/demo:3.1.0-agentd0f4ae0b32a8
anyio@4.14.1
4.14.2
1
ghcr.io/open-webui/mcpo:git-39b4867f06525afac6b
anyio@4.9.0
4.14.2
1
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
anyio@4.6.0
4.14.2
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
anyio@4.11.0
4.14.2
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
anyio@4.11.0
4.14.2
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
anyio@4.11.0
4.14.2
1
ghcr.io/paperless-ngx/paperless-ngx:1.8.09bbc9a90641e
anyio@3.6.1
4.14.2
1
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
anyio@4.0.0
4.14.2
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
anyio@4.11.0
4.14.2
1
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
anyio@4.4.0
4.14.2
1
ghcr.io/rodg/rtmp-controller:latest67f99a5beab7
anyio@3.7.0
4.14.2
1
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
anyio@4.13.0
4.14.2
1
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
anyio@4.12.1
4.14.2
1
ghcr.io/sooperset/mcp-atlassian:0.11.927c8e5b890e1
anyio@4.9.0
4.14.2
1
ghcr.io/tarkyaio/tarka:0.4.1e8d3f1512f06
anyio@4.12.1
4.14.2
1
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
anyio@3.7.1
4.14.2
1
ghcr.io/unique-ag/ai/search-proxy:2026.38.0aa6699b027bb
anyio@4.13.0
4.14.2
1
ghcr.io/vinny1892/octantis:latest45459c0910fc
anyio@4.12.1
4.14.2
1
ghcr.io/wgbh-mla/pbcore-util:pr-66e04659a3baa
anyio@4.11.0
4.14.2
1
ghcr.io/zoriya/kyoo_scanner:4.7.17dc0ee57b628
anyio@4.8.0
4.14.2
1
public.ecr.aws/k6v9y5g3/cluster-agent:cost_k8s_process.5769e14a72b066d
anyio@4.8.0
4.14.2
1
quay.io/ai-lab/llamacpp_python:latest70d138997acd
anyio@4.9.0
4.14.2
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
anyio@4.13.0
4.14.2
1
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
anyio@4.14.0
4.14.2
1

syft 1.42.1 · advisories as of 19 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.