StackRadar

CVE-2026-64847

Medium

Advisory

Published 18 Sept 2026In the index since 19 Sept 2026
Severity
Medium
worst across findings
CVSS
6.8
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
247
of 17,805 indexed, latest versions
Container images
260
deployed by those charts
Fix available
1 of 1
affected package

AnyIO process-pool workers can block indefinitely on undrained stderr

Carried by container images the latest versions of 247 of 17,805 indexed charts deploy, on 260 images.

Affected packageAffected versionsFixed inImages
anyiopypi3.3.0, 3.3.4, 3.5.0, 3.6.1+22 more4.14.2260
OSV records
GHSA-5p39-cfhj-2xmp

Charts affected

247 by stars
ChartLatestAffected imagesRadar Score
csgshipcsghubVerified publisher0.4.62 of 10See more

csgship csghub 0.4.6

2 of the 10 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
opencsghq/csgship-agentic:v0.4.02cd29671a03e
anyio@4.10.0
4.14.2
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
anyio@4.10.0
4.14.2

Open the chart page →

12,026
dataflowcsghubVerified publisher2.5.01 of 7See more

dataflow csghub 2.5.0

1 of the 7 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
opencsghq/label-studio:v2.5.047e22aa71870
anyio@4.2.0
4.14.2

Open the chart page →

6,987
jupyterhubd4nVerified publisher3.3.71 of 7See more

jupyterhub d4n 3.3.7

1 of the 7 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
aristidetm/basic-notebook:3.6.5469dbc951224
anyio@4.4.0
4.14.2

Open the chart page →

16,844
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
anyio@4.0.0
4.14.2

Open the chart page →

6,248
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
anyio@4.12.1
4.14.2

Open the chart page →

5,214
decisionrules-ocpdecisionrules-ocpVerified publisher0.1.01 of 4See more

decisionrules-ocp decisionrules-ocp 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
decisionrules/ai-engine:latest38c377e7c01e
anyio@4.13.0
4.14.2

Open the chart page →

2,757
deployhubdeployhubVerified publisher10.0.4157 of 11See more

deployhub deployhub 10.0.415

7 of the 11 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
anyio@4.12.0
4.14.2
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
anyio@4.12.0
4.14.2
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
anyio@4.12.0
4.14.2
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
anyio@4.12.0
4.14.2
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
anyio@4.12.0
4.14.2
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
anyio@4.12.0
4.14.2
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
anyio@4.12.0
4.14.2

Open the chart page →

11,342
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
anyio@4.6.2.post1
4.14.2

Open the chart page →

9,771
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
anyio@4.6.2.post1
4.14.2

Open the chart page →

9,771
difydify1.0.02 of 4See more

dify dify 1.0.0

2 of the 4 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
anyio@4.8.0
4.14.2
langgenius/dify-sandbox:0.2.009b7e8705673
anyio@4.3.0
4.14.2

Open the chart page →

51,682
spoolmandjjudas21Verified publisher0.1.81 of 1See more

spoolman djjudas21 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/donkie/spoolman:0.24.042135965c42d
anyio@4.14.1
4.14.2

Open the chart page →

1,902
dominodomino-iisasVerified publisher0.3.11 of 3See more

domino domino-iisas 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/iisas/domino-rest:latest3009350bfc11
anyio@4.12.1
4.14.2

Open the chart page →

10,419
codecovdoubanVerified publisher0.2.42 of 8See more

codecov douban 0.2.4

2 of the 8 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
codecov/self-hosted-api:24.4.10475cb1c3136
anyio@3.6.1
4.14.2
codecov/self-hosted-worker:24.4.1837f546b479b
anyio@3.6.1
4.14.2

Open the chart page →

25,050
helpdeskdoubanVerified publisher0.3.31 of 2See more

helpdesk douban 0.3.3

1 of the 2 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
douz/helpdesk:latest4384103d0219
anyio@3.6.1
4.14.2

Open the chart page →

4,572
aerios-k8s-shimeclipse-aeriosVerified publisher1.0.01 of 1See more

aerios-k8s-shim eclipse-aerios 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
eclipseaerios/aerios-k8s-shim:v1.0.0d4ed3d8e5db4
anyio@4.4.0
4.14.2

Open the chart page →

1,501
hlo-data-aggregatoreclipse-aeriosVerified publisher3.0.01 of 1See more

hlo-data-aggregator eclipse-aerios 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
eclipseaerios/hlo-data-aggregator:v3.0.0b433c2b9f5dc
anyio@4.3.0
4.14.2

Open the chart page →

1,711
hlo-deployment-engineeclipse-aeriosVerified publisher3.0.01 of 1See more

hlo-deployment-engine eclipse-aerios 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
eclipseaerios/hlo-deployment-engine:v3.0.0d582d39208c7
anyio@4.2.0
4.14.2

Open the chart page →

1,722
hlo-fe-engineeclipse-aeriosVerified publisher3.0.01 of 1See more

hlo-fe-engine eclipse-aerios 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
eclipseaerios/hlo-fe-engine:v3.0.08ed2df4ca692
anyio@4.2.0
4.14.2

Open the chart page →

1,711
trustmanagereclipse-aeriosVerified publisher1.0.01 of 1See more

trustmanager eclipse-aerios 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
eclipseaerios/trust-manager:1.0.0f55442e2c0ed
anyio@4.12.1
4.14.2

Open the chart page →

1,964
home-assistantegebackVerified publisher2.0.351 of 1See more

home-assistant egeback 2.0.35

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
anyio@4.13.0
4.14.2

Open the chart page →

2,201
rommernail-romm1.0.11 of 1See more

romm ernail-romm 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
rommapp/romm:4.4.1b909e95d1aab
anyio@4.9.0
4.14.2

Open the chart page →

2,918
huntingfactlyVerified publisher0.4.141 of 1See more

hunting factly 0.4.14

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
anyio@3.6.2
4.14.2

Open the chart page →

4,117
kodiakfikaworks1.1.41 of 2See more

kodiak fikaworks 1.1.4

1 of the 2 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
cdignam/kodiak:v0.54.05a6a55b39cee
anyio@3.6.1
4.14.2

Open the chart page →

3,909
flask-contactsfirst-idror-chart1.0.11 of 3See more

flask-contacts first-idror-chart 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
shashkist/flask-contacts-app:latest581de1fd6084
anyio@4.6.0
4.14.2

Open the chart page →

5,884
flask-contactsflask-contacts-generic1.0.11 of 3See more

flask-contacts flask-contacts-generic 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
shashkist/flask-contacts-app:latest581de1fd6084
anyio@4.6.0
4.14.2

Open the chart page →

5,884
flyteconnectorflyte2.0.01 of 1See more

flyteconnector flyte 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
anyio@4.13.0
4.14.2

Open the chart page →

3,588
searxgeek-cookbookVerified publisher5.6.21 of 4See more

searx geek-cookbook 5.6.2

1 of the 4 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
searx/searx:1.0.0-211-968b28993dbb3a6d9419
anyio@3.3.0
4.14.2

Open the chart page →

7,505
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
anyio@4.11.0
4.14.2

Open the chart page →

9,089
gwangju_2-3gwangju2-30.1.03 of 5See more

gwangju_2-3 gwangju2-3 0.1.0

3 of the 5 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
clsen2024/gwangju_2-3:service-b-10ba9eff852c5
anyio@4.4.0
4.14.2
clsen2024/gwangju_2-3:service-a-151b1d45961cd
anyio@4.4.0
4.14.2
clsen2024/gwangju_2-3:service-c-1efb1586c8299
anyio@4.4.0
4.14.2

Open the chart page →

6,563
esphomehelm-chart-roeiVerified publisher2025.3.01 of 1See more

esphome helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
esphome/esphome:2025.3.0def8b6e4f517
anyio@4.9.0
4.14.2

Open the chart page →

6,061
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
anyio@4.8.0
4.14.2

Open the chart page →

4,859
fastmcp-serverhelmforgeVerified publisher1.7.41 of 1See more

fastmcp-server helmforge 1.7.4

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.11.2fcb7017327d6
anyio@4.13.0
4.14.2

Open the chart page →

3,379
immichhelmforgeVerified publisher1.2.81 of 5See more

immich helmforge 1.2.8

1 of the 5 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-machine-learning:v3.1.05a0839dc5303
anyio@4.2.0
4.14.2

Open the chart page →

11,296
mcp-serverhelmforgeVerified publisher1.0.01 of 1See more

mcp-server helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.2.061f759a1421f
anyio@4.13.0
4.14.2

Open the chart page →

3,528
notediscoveryhelmforgeVerified publisher2.0.11 of 1See more

notediscovery helmforge 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/gamosoft/notediscovery:0.31.5c06aa0fa9a85
anyio@3.7.1
4.14.2

Open the chart page →

1,308
paperlesshomelabcihelmchartstestVerified publisher9.1.91 of 1See more

paperless homelabcihelmchartstest 9.1.9

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
anyio@4.0.0
4.14.2

Open the chart page →

16,556
paperlesshpVerified publisher0.1.21 of 5See more

paperless hp 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
anyio@4.12.1
4.14.2

Open the chart page →

27,499
ilum-apiilumVerified publisher6.7.31 of 1See more

ilum-api ilum 6.7.3

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ilum/api:6.7.3624fd09528c8
anyio@4.14.1
4.14.2

Open the chart page →

2,247
ilum-streamlitilumVerified publisher0.1.01 of 1See more

ilum-streamlit ilum 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ilum/streamlit-example:1.0.0ce5dcdeb22ba
anyio@4.11.0
4.14.2

Open the chart page →

2,845
guardrails-usvcinfracloud-chartsVerified publisher1.0.11 of 1See more

guardrails-usvc infracloud-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
opea/guardrails-tgi:latestf68bec6a1271
anyio@4.8.0
4.14.2

Open the chart page →

5,140
label-studioinseefrlab2.3.11 of 3See more

label-studio inseefrlab 2.3.1

1 of the 3 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
heartexlabs/label-studio:latestaa461572e8f9
anyio@4.2.0
4.14.2

Open the chart page →

3,170
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
anyio@4.13.0
4.14.2

Open the chart page →

18,124
kweather-chartjamoos0.1.01 of 1See more

kweather-chart jamoos 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
jamoos/kweather:history163e2e8a6e87
anyio@4.4.0
4.14.2

Open the chart page →

624
esphomejeffrescVerified publisher0.2.21 of 1See more

esphome jeffresc 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.4.078a82d810709
anyio@4.13.0
4.14.2

Open the chart page →

5,172
beetsk8s-home-lab-repo3.1.11 of 1See more

beets k8s-home-lab-repo 3.1.1

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/home-operations/beets:2.3.1cc4975f1a0be
anyio@4.9.0
4.14.2

Open the chart page →

2,776
paperlessk8s-home-lab-repo11.0.11 of 1See more

paperless k8s-home-lab-repo 11.0.1

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
anyio@4.11.0
4.14.2

Open the chart page →

9,263
authentikkagiso-me0.1.11 of 1See more

authentik kagiso-me 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
anyio@4.12.1
4.14.2

Open the chart page →

4,642
music-assistantkarljorgensen0.1.31 of 1See more

music-assistant karljorgensen 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
anyio@4.13.0
4.14.2

Open the chart page →

7,197
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
anyio@3.7.1
4.14.2

Open the chart page →

6,516
graphiti-mcpkiberonlabs0.1.21 of 1See more

graphiti-mcp kiberonlabs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-64847.

Container imageDigestPackageFixed in
zepai/knowledge-graph-mcp:v0.2.16ab0ee79926b
anyio@4.9.0
4.14.2

Open the chart page →

3,453

Container images carrying it

260 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
anyio@4.14.0
4.14.2
1
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
anyio@4.12.0
4.14.2
1
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
anyio@4.12.0
4.14.2
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
anyio@4.12.0
4.14.2
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
anyio@4.12.0
4.14.2
1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
anyio@4.12.0
4.14.2
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
anyio@4.12.0
4.14.2
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
anyio@4.12.0
4.14.2
1
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
anyio@4.4.0
4.14.2
1
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
anyio@4.9.0
4.14.2
1

syft 1.42.1 · advisories as of 19 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.