StackRadar

CVE-2026-69244

High

Advisory

Published 3 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.1
base score, highest
EPSS
0.003
22nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
176
of 17,781 indexed, latest versions
Container images
178
deployed by those charts
Fix available
1 of 2
affected packages

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

Carried by container images the latest versions of 176 of 17,781 indexed charts deploy, on 178 images.

Affected packageAffected versionsFixed inImages
aiohttppypi3.4.4, 3.5.4, 3.6.2, 3.7.1+35 more3.14.3178
python-aiohttpdeb3.8.4-1, 3.11.16-1+deb13u1no fix listed2
OSV records
DEBIAN-CVE-2026-69244GHSA-cq5v-8q36-5273
Also known as
PYSEC-2026-3545

Charts affected

176 by stars
ChartLatestAffected imagesRadar Score
music-assistant-serverandibraeuVerified publisher2.1.21 of 1See more

music-assistant-server andibraeu 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.9.950666a6f8d7f
aiohttp@3.14.1
3.14.3

Open the chart page →

5,817
mathesarandrenarchyVerified publisher1.8.01 of 1See more

mathesar andrenarchy 1.8.0

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
mathesar/mathesar:0.12.0091757cb01fe
aiohttp@3.14.1
3.14.3

Open the chart page →

7,239
speech-to-phraseandrenarchyVerified publisher1.3.01 of 1See more

speech-to-phrase andrenarchy 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
rhasspy/wyoming-speech-to-phrase:1.4.3e532f0dbc6b2
aiohttp@3.13.5
3.14.3

Open the chart page →

3,991
ansible-playbook-operatoransible-playbook-operatorVerified publisher0.1.71 of 1See more

ansible-playbook-operator ansible-playbook-operator 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
kenchrcum/ansible-playbook-operator:0.1.712fb213debf1
aiohttp@3.13.5
3.14.3

Open the chart page →

1,339
argonix-apiargonix0.2.01 of 4See more

argonix-api argonix 0.2.0

1 of the 4 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ghcr.io/argonix-io/argonix-api:1.0.068e17a8aaa40
aiohttp@3.14.1
3.14.3

Open the chart page →

4,923
smartorchestratorassist-iot-smart-orchestrator4.0.01 of 14See more

smartorchestrator assist-iot-smart-orchestrator 4.0.0

1 of the 14 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
assistiot/smart-orchestrator_mcs:latest7d6a0d534c7f
aiohttp@3.9.3
3.14.3

Open the chart page →

45,363
shynetatrox0.1.11 of 1See more

shynet atrox 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
milesmcc/shynet:v0.12.0e821e31140f7
aiohttp@3.8.1
3.14.3

Open the chart page →

5,507
azure-app-exporterazure-app-exporterVerified publisher0.4.21 of 2See more

azure-app-exporter azure-app-exporter 0.4.2

1 of the 2 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter:0.1.38b472877847f5
aiohttp@3.9.5
3.14.3

Open the chart page →

1,790
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
aiohttp@3.9.5
3.14.3

Open the chart page →

10,145
opencvecfi20170.1.21 of 7See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
aiohttp@3.10.11
3.14.3

Open the chart page →

15,371
suggestarrcharliecharts0.4.41 of 1See more

suggestarr charliecharts 0.4.4

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ciuse99/suggestarr:v1.0.20d72768245ef5
aiohttp@3.11.12
3.14.3

Open the chart page →

1,126
kitchenowlchart-kitchenowl0.1.121 of 2See more

kitchenowl chart-kitchenowl 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
tombursch/kitchenowl-backend:v0.7.8b48e4ab727cd
aiohttp@3.13.4
3.14.3

Open the chart page →

4,803
chat-searchchat-searchVerified publisher0.1.71 of 1See more

chat-search chat-search 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ghcr.io/hemslo/chat-search:latest39d48995a5bd
aiohttp@3.9.5
3.14.3

Open the chart page →

4,042
kube-acp-stackcloudentity2.28.01 of 7See more

kube-acp-stack cloudentity 2.28.0

1 of the 7 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
aiohttp@3.11.13
3.14.3

Open the chart page →

20,900
galaxycloudve6.8.61 of 3See more

galaxy cloudve 6.8.6

1 of the 3 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
aiohttp@3.13.5
3.14.3

Open the chart page →

4,601
galaxykubemancloudve2.10.11 of 7See more

galaxykubeman cloudve 2.10.1

1 of the 7 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
galaxy/cloudman-server:lateste5c265fe9fcd
aiohttp@3.8.1
3.14.3

Open the chart page →

16,069
pulsarcloudve0.2.01 of 2See more

pulsar cloudve 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
galaxy/pulsar-kubernetes:0.15.7e50a890e24c9
aiohttp@3.11.18
3.14.3

Open the chart page →

6,162
authentikcluster-deploy0.2.01 of 1See more

authentik cluster-deploy 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
aiohttp@3.13.5
3.14.3

Open the chart page →

2,481
metaflowcluster-deploy0.2.21 of 1See more

metaflow cluster-deploy 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
aiohttp@3.10.10
3.14.3

Open the chart page →

8,009
web3-prometheus-exportercoinpri-helm-chartsVerified publisher0.1.31 of 1See more

web3-prometheus-exporter coinpri-helm-charts 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
guillh/web3-prometheus-exporter:0.3.04fb99dbc32b2
aiohttp@3.10.3
3.14.3

Open the chart page →

3,378
csghubcsghubVerified publisher2.4.32 of 34See more

csghub csghub 2.4.3

2 of the 34 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
aiohttp@3.12.13
3.14.3
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
aiohttp@3.10.11
3.14.3

Open the chart page →

58,897
csgshipcsghubVerified publisher0.4.62 of 10See more

csgship csghub 0.4.6

2 of the 10 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
opencsghq/csgship-agentic:v0.4.02cd29671a03e
aiohttp@3.12.15
3.14.3
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
aiohttp@3.12.15
3.14.3

Open the chart page →

11,335
wazuhcsic-charts0.1.01 of 4See more

wazuh csic-charts 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.4.121994f40e0da
aiohttp@3.8.1
3.14.3

Open the chart page →

13,852
jupyterhubd4nVerified publisher3.3.72 of 7See more

jupyterhub d4n 3.3.7

2 of the 7 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
aristidetm/basic-notebook:3.6.5469dbc951224
aiohttp@3.9.5
3.14.3
aristidetm/k8s-hub:3.3.7ccb516cb8474
aiohttp@3.9.3
3.14.3

Open the chart page →

16,604
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
aiohttp@3.8.5
3.14.3

Open the chart page →

6,179
dask-gatewaydask2026.3.01 of 2See more

dask-gateway dask 2026.3.0

1 of the 2 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-gateway-server:2026.3.0afa5a729114e
aiohttp@3.13.4
3.14.3

Open the chart page →

1,994
datacubedatacube-charts0.18.21 of 1See more

datacube datacube-charts 0.18.2

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
opendatacube/wms:latest1b90cdf68831
aiohttp@3.6.2
3.14.3

Open the chart page →

27,728
restcubedatacube-charts0.2.91 of 1See more

restcube datacube-charts 0.2.9

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
opendatacube/restcube:latest91870111837c
aiohttp@3.6.2
3.14.3

Open the chart page →

24,335
kube-web-viewdecayofmind0.0.41 of 1See more

kube-web-view decayofmind 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
hjacobs/kube-web-view:20.10.0b44a9cf81a2f
aiohttp@3.6.2
3.14.3

Open the chart page →

2,264
isponsorblocktvdefault-ghVerified publisher1.0.51 of 1See more

isponsorblocktv default-gh 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ghcr.io/dmunozv04/isponsorblocktv:v2.9.05b8cfa805cb6
aiohttp@3.13.5
3.14.3

Open the chart page →

546
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
aiohttp@3.10.10
3.14.3

Open the chart page →

9,607
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
aiohttp@3.10.10
3.14.3

Open the chart page →

9,607
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
aiohttp@3.11.12
3.14.3

Open the chart page →

19,224
dominodomino-iisasVerified publisher0.3.11 of 3See more

domino domino-iisas 0.3.1

1 of the 3 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ghcr.io/iisas/domino-rest:latest3009350bfc11
aiohttp@3.12.15
3.14.3

Open the chart page →

10,270
rommernail-romm1.0.11 of 1See more

romm ernail-romm 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
rommapp/romm:4.4.1b909e95d1aab
aiohttp@3.12.14
3.14.3

Open the chart page →

2,896
argocd-version-exporterevilmartians0.0.11 of 1See more

argocd-version-exporter evilmartians 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
quay.io/evl.ms/argocd-exporter:0.0.136ea8f34aa6b
aiohttp@3.7.4.post0
3.14.3

Open the chart page →

2,401
huntingfactlyVerified publisher0.4.141 of 1See more

hunting factly 0.4.14

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
aiohttp@3.8.3
3.14.3

Open the chart page →

4,085
activityrelayfedihost0.1.41 of 2See more

activityrelay fedihost 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
stratospire/activityrelay:0.2.3a4c34cb01117
aiohttp@3.8.3
3.14.3

Open the chart page →

13,450
flyteconnectorflyte2.0.01 of 1See more

flyteconnector flyte 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
aiohttp@3.13.5
3.14.3

Open the chart page →

3,463
tandoorgabe565Verified publisher0.9.91 of 2See more

tandoor gabe565 0.9.9

1 of the 2 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
aiohttp@3.10.11
3.14.3

Open the chart page →

2,183
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
aiohttp@3.13.2
3.14.3

Open the chart page →

8,923
glassflow-etlglassflowVerified publisher0.5.211 of 16See more

glassflow-etl glassflow 0.5.21

1 of the 16 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ghcr.io/glassflow/glassflow-notifier:v1.0.3d1b0ce10b513
aiohttp@3.13.5
3.14.3

Open the chart page →

12,056
glpiglpi-chart0.1.11 of 3See more

glpi glpi-chart 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
vdiogov/glpi-conteiner:latest6945f84f0058
aiohttp@3.8.4
python-aiohttp@3.8.4-1
3.14.3
no fix listed

Open the chart page →

12,170
resurrectbothalkeye0.1.51 of 1See more

resurrectbot halkeye 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
halkeye/slack-resurrect:v0.1.477b05e95fdb5
aiohttp@3.5.4
3.14.3

Open the chart page →

3,809
helixhelix1.4.31 of 2See more

helix helix 1.4.3

1 of the 2 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
aiohttp@3.13.5
3.14.3

Open the chart page →

5,568
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
aiohttp@3.11.13
3.14.3

Open the chart page →

4,647
chiefonboardinghelmforgeVerified publisher1.1.141 of 3See more

chiefonboarding helmforge 1.1.14

1 of the 3 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
chiefonboarding/chiefonboarding:v2.4.159bc7aa60fe7
aiohttp@3.13.3
3.14.3

Open the chart page →

10,849
jupyterhubhelmforgeVerified publisher1.0.61 of 3See more

jupyterhub helmforge 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
aiohttp@3.13.5
3.14.3

Open the chart page →

5,341
medikeephelmforgeVerified publisher2.0.01 of 3See more

medikeep helmforge 2.0.0

1 of the 3 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
ghcr.io/afairgiant/medikeep:v0.69.0766699daa9ac
aiohttp@3.14.1
3.14.3

Open the chart page →

6,022
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-69244.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
aiohttp@3.10.8
3.14.3

Open the chart page →

25,017

Container images carrying it

178 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/music-assistant/server:2.9.950666a6f8d7f
aiohttp@3.14.1
3.14.3
1
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
aiohttp@3.13.5
3.14.3
1
ghcr.io/nowakeai/svc-lb-mux:0.1.37d8fb8e996b6
aiohttp@3.13.5
3.14.3
1
ghcr.io/open-telemetry/demo:3.0.0-mcp654f860148ba
aiohttp@3.14.1
3.14.3
1
ghcr.io/open-telemetry/demo:3.0.0-agentdf5ee05e23e3
aiohttp@3.14.2
3.14.3
1
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
aiohttp@3.12.13
3.14.3
1
ghcr.io/serenita-org/vero:v0.8.3e5a7ec714acc
aiohttp@3.10.10
3.14.3
1
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
aiohttp@3.13.5
3.14.3
1
ghcr.io/smarter-project/audio-client:v3.1.23c8375dc5487
aiohttp@3.8.3
3.14.3
1
ghcr.io/smarter-project/image-detector:v2.5.31dcca70c6446
aiohttp@3.8.3
3.14.3
1
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
aiohttp@3.10.11
3.14.3
1
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
aiohttp@3.8.3
3.14.3
1
ghcr.io/tremolosecurity/python-slim-nonroot/python3:1.0.079bb14620fe9
aiohttp@3.14.0
3.14.3
1
ghcr.io/unique-ag/ai/search-proxy:2026.38.0aa6699b027bb
aiohttp@3.14.1
3.14.3
1
ghcr.io/vinny1892/octantis:latest45459c0910fc
aiohttp@3.13.3
3.14.3
1
ghcr.io/zoriya/kyoo_scanner:4.7.17dc0ee57b628
aiohttp@3.11.11
3.14.3
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
aiohttp@3.10.10
3.14.3
1
quay.io/clustersecret/clustersecret:0.0.14a9f835d1b241
aiohttp@3.11.11
3.14.3
1
quay.io/evl.ms/argocd-exporter:0.0.136ea8f34aa6b
aiohttp@3.7.4.post0
3.14.3
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
aiohttp@3.13.5
3.14.3
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
aiohttp@3.13.5
3.14.3
1
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
aiohttp@3.9.1
3.14.3
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
aiohttp@3.13.5
3.14.3
1
quay.io/maxiv/pieeat:0.9.3099715479210
aiohttp@3.13.5
3.14.3
1
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
aiohttp@3.8.1
3.14.3
1
quay.io/ocellusai/operator:v0.10.59ff01f642e2b
aiohttp@3.14.1
3.14.3
1
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
aiohttp@3.9.5
3.14.3
1
quay.io/stackgres/operator:1.19.1f241b0b20326
aiohttp@3.14.1
3.14.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.