StackRadar

CVE-2026-69244

High

Advisory

Published 3 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.1
base score, highest
EPSS
0.003
22nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
176
of 17,781 indexed, latest versions
Container images
178
deployed by those charts
Fix available
1 of 2
affected packages

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

Carried by container images the latest versions of 176 of 17,781 indexed charts deploy, on 178 images.

Affected packageAffected versionsFixed inImages
aiohttppypi3.4.4, 3.5.4, 3.6.2, 3.7.1+35 more3.14.3178
python-aiohttpdeb3.8.4-1, 3.11.16-1+deb13u1no fix listed2
OSV records
DEBIAN-CVE-2026-69244GHSA-cq5v-8q36-5273
Also known as
PYSEC-2026-3545

Charts affected

176 by stars
ChartLatestAffected imagesRadar Score
srebotsrebot0.14.01 of 2See more

srebot srebot 0.14.0

1 of the 2 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
aiohttp@3.13.5
3.14.3

Open the chart page →

1,542
verostakewise0.8.31 of 2See more

vero stakewise 0.8.3

1 of the 2 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ghcr.io/serenita-org/vero:v0.8.3e5a7ec714acc
aiohttp@3.10.10
3.14.3

Open the chart page →

3,458
verbasubstratusVerified publisher0.4.01 of 1See more

verba substratus 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
substratusai/verba:v0.4.0-baseURL261695be635eb
aiohttp@3.9.5
3.14.3

Open the chart page →

13,390
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
aiohttp@3.13.5
3.14.3

Open the chart page →

3,460
svc-lb-muxsvc-lb-mux0.1.31 of 1See more

svc-lb-mux svc-lb-mux 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ghcr.io/nowakeai/svc-lb-mux:0.1.37d8fb8e996b6
aiohttp@3.13.5
3.14.3

Open the chart page →

1,419
asrtest-opea1.0.01 of 1See more

asr test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
opea/asr:1.025dd26d9cd09
aiohttp@3.10.5
3.14.3

Open the chart page →

4,393
chatqnatest-opea1.0.05 of 11See more

chatqna test-opea 1.0.0

5 of the 11 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
opea/chatqna:1.038c51b791efa
aiohttp@3.10.5
3.14.3
opea/embedding-tei:1.05c9639de61c1
aiohttp@3.10.5
3.14.3
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.3
opea/reranking-tei:1.0e48613afb191
aiohttp@3.10.5
3.14.3
opea/retriever-redis:1.0eb746b263705
aiohttp@3.10.5
3.14.3

Open the chart page →

39,090
codegentest-opea1.0.02 of 5See more

codegen test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
opea/codegen:1.058f91683892d
aiohttp@3.10.5
3.14.3
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.3

Open the chart page →

28,814
codetranstest-opea1.0.02 of 5See more

codetrans test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
opea/codetrans:1.0e2436483b73d
aiohttp@3.10.5
3.14.3
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.3

Open the chart page →

28,385
docsumtest-opea1.0.02 of 5See more

docsum test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
opea/docsum:1.03eaa91849512
aiohttp@3.10.5
3.14.3
opea/llm-docsum-tgi:1.002f9e8fa5d71
aiohttp@3.10.5
3.14.3

Open the chart page →

28,858
embedding-usvctest-opea1.0.01 of 1See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
opea/embedding-tei:1.05c9639de61c1
aiohttp@3.10.5
3.14.3

Open the chart page →

5,185
guardrails-usvctest-opea1.0.01 of 1See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
opea/guardrails-tgi:1.0262c6048aab8
aiohttp@3.10.5
3.14.3

Open the chart page →

5,221
llm-uservicetest-opea1.0.01 of 1See more

llm-uservice test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
opea/llm-tgi:1.00c25aab3f106
aiohttp@3.10.5
3.14.3

Open the chart page →

4,720
reranking-usvctest-opea1.0.01 of 1See more

reranking-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
opea/reranking-tei:1.0e48613afb191
aiohttp@3.10.5
3.14.3

Open the chart page →

4,985
retriever-usvctest-opea1.0.01 of 1See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
opea/retriever-redis:1.0eb746b263705
aiohttp@3.10.5
3.14.3

Open the chart page →

5,198
speecht5test-opea1.0.01 of 1See more

speecht5 test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
opea/speecht5:1.0249afad3d268
aiohttp@3.10.5
3.14.3

Open the chart page →

9,616
ttstest-opea1.0.01 of 1See more

tts test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
opea/tts:1.0257ae94709e9
aiohttp@3.10.5
3.14.3

Open the chart page →

4,377
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
aiohttp@3.10.5
3.14.3

Open the chart page →

5,350
kasa-exporterth-chartsVerified publisher0.1.01 of 1See more

kasa-exporter th-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
thelande/kasa_exporter:v0.2.3a1fdb8baa152
aiohttp@3.9.5
3.14.3

Open the chart page →

1,515
traefik-external-dns-operatortraefik-external-dns-operator1.0.11 of 1See more

traefik-external-dns-operator traefik-external-dns-operator 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ybucci/traefik-external-dns-operator:1.0.0f1fcc7c8d9fd
aiohttp@3.11.14
3.14.3

Open the chart page →

1,083
orchestratremolo3.1.551 of 5See more

orchestra tremolo 3.1.55

1 of the 5 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ghcr.io/tremolosecurity/python-slim-nonroot/python3:1.0.079bb14620fe9
aiohttp@3.14.0
3.14.3

Open the chart page →

7,637
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
aiohttp@3.8.1
3.14.3

Open the chart page →

8,607
wasabi-s3-operatorwasabi-s3-operatorVerified publisher0.2.71 of 1See more

wasabi-s3-operator wasabi-s3-operator 0.2.7

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
kenchrcum/wasabi-s3-operator:0.2.7ce657c622ce5
aiohttp@3.13.5
3.14.3

Open the chart page →

628
wazuh-manager-filebeatwazuh-manager-filebeat0.1.0-gamma1 of 1See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
iosifache/wazuh-manager-filebeat:latest85df3f04b5da
aiohttp@3.7.4
3.14.3

Open the chart page →

11,119
alertmanager-matrix-forwarderzloi-space1.0.11 of 2See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
aiohttp@3.8.1
3.14.3

Open the chart page →

3,118
grafana-matrix-forwarderzloi-space1.0.01 of 2See more

grafana-matrix-forwarder zloi-space 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
aiohttp@3.8.1
3.14.3

Open the chart page →

1,636

Container images carrying it

178 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
hayk96/alerta-web:9.0.486377705e9e3
aiohttp@3.10.5
3.14.3
1
hhyo/archery:v1.9.11aa41843419e
aiohttp@3.8.3
3.14.3
1
hjacobs/kube-web-view:23.8.0431f1bf013d0
aiohttp@3.8.4
3.14.3
1
hjacobs/kube-web-view:20.10.0b44a9cf81a2f
aiohttp@3.6.2
3.14.3
1
homeassistant/home-assistant:2023.10.3021e2afc6e57
aiohttp@3.8.5
3.14.3
1
homeassistant/home-assistant:2023.12.48d000332b09b
aiohttp@3.9.1
3.14.3
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
aiohttp@3.13.5
3.14.3
1
iosifache/wazuh-manager-filebeat:latest85df3f04b5da
aiohttp@3.7.4
3.14.3
1
jertel/elastalert2:2.31.03cbf63f9b7dc
aiohttp@3.14.2
3.14.3
1
jupyterhub/k8s-hub:3.0.1-0.dev.git.6287.hbfb05cd65a0ceed1300a
aiohttp@3.8.5
3.14.3
1
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
aiohttp@3.13.5
3.14.3
1
kenchrcum/ansible-playbook-operator:0.1.712fb213debf1
aiohttp@3.13.5
3.14.3
1
kenchrcum/hetzner-s3-operator:0.1.384dae7aeea5b
aiohttp@3.13.5
3.14.3
1
kenchrcum/wasabi-s3-operator:0.2.7ce657c622ce5
aiohttp@3.13.5
3.14.3
1
knspar/phronetis-operator:0.1.60c4f0543ee58
aiohttp@3.12.13
3.14.3
1
langgenius/dify-api:1.0.0066035f93856
aiohttp@3.11.12
3.14.3
1
langgenius/dify-api:1.16.1dcefa5f7c47c
aiohttp@3.14.1
3.14.3
1
langgenius/dify-api:0.6.11fca918260dd6
aiohttp@3.9.5
3.14.3
1
litellm/litellm-non_root:v1.82.3-stable09b217802ded
aiohttp@3.13.3
3.14.3
1
lsstsqre/kafkaaggregator:masterbe1b21060854
aiohttp@3.7.4
3.14.3
1
lsstsqre/nublado2:2.0.1b75bf8aaafa4
aiohttp@3.8.1
3.14.3
1
makersquad/harp-proxy:0.8.1a40dd258c527
aiohttp@3.11.18
3.14.3
1
mathesar/mathesar:0.12.0091757cb01fe
aiohttp@3.14.1
3.14.3
1
milesmcc/shynet:v0.13.1ba54f7797a6b
aiohttp@3.8.1
3.14.3
1
milesmcc/shynet:v0.12.0e821e31140f7
aiohttp@3.8.1
3.14.3
1
mindsdb/mindsdb:latest163011c09299
aiohttp@3.13.5
3.14.3
1
opea/asr:1.025dd26d9cd09
aiohttp@3.10.5
3.14.3
1
opea/chatqna:1.038c51b791efa
aiohttp@3.10.5
3.14.3
1
opea/codegen:1.058f91683892d
aiohttp@3.10.5
3.14.3
1
opea/codetrans:1.0e2436483b73d
aiohttp@3.10.5
3.14.3
1
opea/docsum:1.03eaa91849512
aiohttp@3.10.5
3.14.3
1
opea/guardrails-tgi:1.0262c6048aab8
aiohttp@3.10.5
3.14.3
1
opea/guardrails-tgi:latestf68bec6a1271
aiohttp@3.11.11
3.14.3
1
opea/llm-docsum-tgi:1.002f9e8fa5d71
aiohttp@3.10.5
3.14.3
1
opea/speecht5:1.0249afad3d268
aiohttp@3.10.5
3.14.3
1
opea/tts:1.0257ae94709e9
aiohttp@3.10.5
3.14.3
1
opea/web-retriever-chroma:1.0fe08165d7770
aiohttp@3.10.5
3.14.3
1
openbas/caldera-server:5.1.0a277796d9724
aiohttp@3.10.8
3.14.3
1
opencsghq/agenticflow:ee-v0.6-52f03fead54db
aiohttp@3.12.13
3.14.3
1
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
aiohttp@3.10.11
3.14.3
1
opencsghq/csgship-agentic:v0.4.02cd29671a03e
aiohttp@3.12.15
3.14.3
1
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
aiohttp@3.12.15
3.14.3
1
opendatacube/restcube:latest91870111837c
aiohttp@3.6.2
3.14.3
1
opendatacube/wms:latest1b90cdf68831
aiohttp@3.6.2
3.14.3
1
openmined/syft-backend:0.9.5b72f74a68b32
aiohttp@3.11.12
3.14.3
1
pangeo/base-notebook:2024.01.155fbe688a4f80
aiohttp@3.9.1
3.14.3
1
phntom/email-manager:0.1.22d8e2a9f2f085
aiohttp@3.8.4
3.14.3
1
prowlercloud/prowler-api:5.31.14f252d579be2
aiohttp@3.14.0
3.14.3
1
rhasspy/wyoming-speech-to-phrase:1.4.3e532f0dbc6b2
aiohttp@3.13.5
3.14.3
1
rommapp/romm:4.4.1b909e95d1aab
aiohttp@3.12.14
3.14.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.