StackRadar

CVE-2026-71554

Medium

Advisory

Published 6 Aug 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.004
37th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
62
of 17,781 indexed, latest versions
Container images
59
deployed by those charts
Fix available
1 of 2
affected packages

h2: Duplicate Host header could facilitate request smuggling

Carried by container images the latest versions of 62 of 17,781 indexed charts deploy, on 59 images.

Affected packageAffected versionsFixed inImages
h2pypi2.6.2, 3.1.1, 4.0.0, 4.1.0+3 more4.4.159
python-h2deb4.1.0-4no fix listed1
OSV records
GHSA-6hr6-w5qg-qmwgUBUNTU-CVE-2026-71554
Also known as
PYSEC-2026-3628

Charts affected

62 by stars
ChartLatestAffected imagesRadar Score
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
langgenius/dify-api:1.16.1dcefa5f7c47c
h2@4.3.0
4.4.1

Open the chart page →

22,002
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
h2@4.1.0
4.4.1

Open the chart page →

6,041
home-assistantalekcVerified publisher2.11.21 of 1See more

home-assistant alekc 2.11.2

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
h2@4.3.0
4.4.1

Open the chart page →

2,133
home-assistantandrenarchyVerified publisher14.103.01 of 1See more

home-assistant andrenarchy 14.103.0

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.1612d76760b54
h2@4.3.0
4.4.1

Open the chart page →

2,133
openvpn-asas-helm-chartOfficialVerified publisher0.2.11 of 1See more

openvpn-as as-helm-chart 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
openvpn/openvpn-as:latest2253c10ec652
h2@4.1.0
python-h2@4.1.0-4
4.4.1
no fix listed

Open the chart page →

2,668
dns-exporterchristianhuthVerified publisher2.6.11 of 1See more

dns-exporter christianhuth 2.6.1

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
tykling/dns_exporter:1.2.3cd6d650c01c1
h2@4.3.0
4.4.1

Open the chart page →

458
home-assistanthome-assistantVerified publisher0.5.101 of 3See more

home-assistant home-assistant 0.5.10

1 of the 3 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.0372d991e5888
h2@4.3.0
4.4.1

Open the chart page →

2,331
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
h2@4.3.0
4.4.1

Open the chart page →

4,634
skypilotskypilotOfficialVerified publisher0.13.01 of 3See more

skypilot skypilot 0.13.0

1 of the 3 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot:0.13.03bc8bf8f4d83
h2@4.3.0
4.4.1

Open the chart page →

5,852
paperless-ngxalexmorbo-paperless-ngxVerified publisher0.2.01 of 2See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
h2@4.3.0
4.4.1

Open the chart page →

12,037
paperless-ngxcrystalnetVerified publisher0.2.221 of 3See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
h2@4.1.0
4.4.1

Open the chart page →

13,761
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latest612d76760b54
h2@4.3.0
4.4.1

Open the chart page →

2,133
obicogabe565Verified publisher0.6.01 of 3See more

obico gabe565 0.6.0

1 of the 3 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/gabe565/obico/web:latesta5c1daef46c0
h2@4.1.0
4.4.1

Open the chart page →

1,965
harp-proxyharp0.8.11 of 1See more

harp-proxy harp 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
makersquad/harp-proxy:0.8.1a40dd258c527
h2@4.2.0
4.4.1

Open the chart page →

6,374
huehue1.0.31 of 3See more

hue hue 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
gethue/hue:latest7d5c1b9f8a79
h2@2.6.2
4.4.1

Open the chart page →

12,397
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
h2@4.1.0
4.4.1

Open the chart page →

20,403
music-assistant-serverlmatfyVerified publisher0.1.91 of 1See more

music-assistant-server lmatfy 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
h2@4.3.0
4.4.1

Open the chart page →

7,201
palworldpalworld-server-chartVerified publisher2.7.11 of 1See more

palworld palworld-server-chart 2.7.1

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
thijsvanloef/palworld-server-docker:v2.7.1401d3eb5c053
h2@4.3.0
4.4.1

Open the chart page →

3,681
home-assistantpree-helm-chartsVerified publisher1.80.01 of 1See more

home-assistant pree-helm-charts 1.80.0

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
h2@4.3.0
4.4.1

Open the chart page →

2,133
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
h2@4.3.0
4.4.1

Open the chart page →

8,158
sentry-k8ssentry-k8sVerified publisher1.4.11 of 11See more

sentry-k8s sentry-k8s 1.4.1

1 of the 11 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
h2@4.3.0
4.4.1

Open the chart page →

16,449
akto-mini-testingakto1.45.71 of 5See more

akto-mini-testing akto 1.45.7

1 of the 5 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-ai-automated-testing:latest5a5d32281374
h2@4.4.0
4.4.1

Open the chart page →

6,486
music-assistant-serverandibraeuVerified publisher2.1.21 of 1See more

music-assistant-server andibraeu 2.1.2

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.9.950666a6f8d7f
h2@4.3.0
4.4.1

Open the chart page →

5,817
asya-playgroundasya1.1.31 of 1See more

asya-playground asya 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
localstack/localstack:3.19d278167f2b7
h2@4.1.0
4.4.1

Open the chart page →

9,412
azure-app-exporterazure-app-exporterVerified publisher0.4.21 of 2See more

azure-app-exporter azure-app-exporter 0.4.2

1 of the 2 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter:0.1.38b472877847f5
h2@4.1.0
4.4.1

Open the chart page →

1,790
huebigdata-chartsVerified publisher1.0.41 of 2See more

hue bigdata-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
gethue/hue:4.10.05702b2c37ff9
h2@2.6.2
4.4.1

Open the chart page →

22,891
catpagecatpage2.2.11 of 1See more

catpage catpage 2.2.1

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/radiorabe/catpage:2.2.17a37fc471447
h2@4.3.0
4.4.1

Open the chart page →

105
authentikcluster-deploy0.2.01 of 1See more

authentik cluster-deploy 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
h2@4.3.0
4.4.1

Open the chart page →

2,481
csghubcsghubVerified publisher2.4.32 of 34See more

csghub csghub 2.4.3

2 of the 34 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
h2@4.2.0
4.4.1
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
h2@4.1.0
4.4.1

Open the chart page →

58,897
csgshipcsghubVerified publisher0.4.61 of 10See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
opencsghq/csgship-agentic:v0.4.02cd29671a03e
h2@4.1.0
4.4.1

Open the chart page →

11,335
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
h2@4.1.0
4.4.1

Open the chart page →

6,179
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
h2@4.1.0
4.4.1

Open the chart page →

9,607
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
h2@4.1.0
4.4.1

Open the chart page →

9,607
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
h2@4.2.0
4.4.1

Open the chart page →

19,224
self-awarenesseclipse-aeriosVerified publisher1.4.42 of 2See more

self-awareness eclipse-aerios 1.4.4

2 of the 2 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
eclipseaerios/self-awareness-hardware-info:1.4.434b72f45b46a
h2@4.3.0
4.4.1
eclipseaerios/self-awareness-power-consumption:1.3.3c8af377c709f
h2@4.3.0
4.4.1

Open the chart page →

2,219
home-assistantegebackVerified publisher2.0.351 of 1See more

home-assistant egeback 2.0.35

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
h2@4.3.0
4.4.1

Open the chart page →

2,158
searxgeek-cookbookVerified publisher5.6.21 of 4See more

searx geek-cookbook 5.6.2

1 of the 4 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
searx/searx:1.0.0-211-968b28993dbb3a6d9419
h2@4.0.0
4.4.1

Open the chart page →

7,470
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
h2@4.3.0
4.4.1

Open the chart page →

8,923
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
h2@4.1.0
4.4.1

Open the chart page →

4,647
paperlesshomelabcihelmchartstestVerified publisher9.1.91 of 1See more

paperless homelabcihelmchartstest 9.1.9

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
h2@4.1.0
4.4.1

Open the chart page →

16,384
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
h2@4.3.0
4.4.1

Open the chart page →

17,852
palworld-serverk8s-chartsVerified publisher1.2.11 of 1See more

palworld-server k8s-charts 1.2.1

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
thijsvanloef/palworld-server-docker:v2.5.0b4ac9ee22483
h2@4.3.0
4.4.1

Open the chart page →

3,460
paperlessk8s-home-lab-repo11.0.11 of 1See more

paperless k8s-home-lab-repo 11.0.1

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
h2@4.3.0
4.4.1

Open the chart page →

9,103
authentikkagiso-me0.1.11 of 1See more

authentik kagiso-me 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
h2@4.3.0
4.4.1

Open the chart page →

4,568
music-assistantkarljorgensen0.1.31 of 1See more

music-assistant karljorgensen 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
h2@4.3.0
4.4.1

Open the chart page →

7,081
huekatool1.0.81 of 1See more

hue katool 1.0.8

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
gethue/hue:4.11.011b649636e68
h2@2.6.2
4.4.1

Open the chart page →

16,417
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
h2@4.1.0
4.4.1

Open the chart page →

6,447
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
h2@4.2.0
4.4.1

Open the chart page →

8,405
searxngkubeblocksVerified publisher0.1.01 of 1See more

searxng kubeblocks 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
searxng/searxng:2026.7.2-67973783d33aa33278be6
h2@4.3.0
4.4.1

Open the chart page →

9
searxnglbenicio-communityVerified publisher0.1.11 of 1See more

searxng lbenicio-community 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
searxng/searxng:2026.6.22-952896d293f52dca114d9
h2@4.3.0
4.4.1

Open the chart page →

9

Container images carrying it

59 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/devtron/ai-agent:0.0.16545dac92173
h2@4.1.0
4.4.1
3
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
h2@4.1.0
4.4.1
2
ghcr.io/home-assistant/home-assistant:2026.9.1:latest612d76760b54
h2@4.3.0
4.4.1
2
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
h2@4.3.0
4.4.1
2
apache/airflow:2.10.2-python3.9ce90bdc3d2af
h2@4.1.0
4.4.1
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
h2@4.2.0
4.4.1
1
berkeleyskypilot/skypilot:0.13.03bc8bf8f4d83
h2@4.3.0
4.4.1
1
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
h2@4.3.0
4.4.1
1
eclipseaerios/self-awareness-hardware-info:1.4.434b72f45b46a
h2@4.3.0
4.4.1
1
eclipseaerios/self-awareness-power-consumption:1.3.3c8af377c709f
h2@4.3.0
4.4.1
1
gethue/hue:4.11.011b649636e68
h2@2.6.2
4.4.1
1
gethue/hue:4.10.05702b2c37ff9
h2@2.6.2
4.4.1
1
gethue/hue:latest7d5c1b9f8a79
h2@2.6.2
4.4.1
1
homeassistant/home-assistant:2023.10.3021e2afc6e57
h2@4.1.0
4.4.1
1
homeassistant/home-assistant:2026.75a531753cea9
h2@4.3.0
4.4.1
1
homeassistant/home-assistant:2023.12.48d000332b09b
h2@4.1.0
4.4.1
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
h2@4.3.0
4.4.1
1
langgenius/dify-api:1.0.0066035f93856
h2@4.2.0
4.4.1
1
langgenius/dify-api:1.16.1dcefa5f7c47c
h2@4.3.0
4.4.1
1
langgenius/dify-api:0.6.11fca918260dd6
h2@4.1.0
4.4.1
1
localstack/localstack:3.19d278167f2b7
h2@4.1.0
4.4.1
1
makersquad/harp-proxy:0.8.1a40dd258c527
h2@4.2.0
4.4.1
1
opencsghq/agenticflow:ee-v0.6-52f03fead54db
h2@4.2.0
4.4.1
1
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
h2@4.1.0
4.4.1
1
opencsghq/csgship-agentic:v0.4.02cd29671a03e
h2@4.1.0
4.4.1
1
openvpn/openvpn-as:latest2253c10ec652
h2@4.1.0
python-h2@4.1.0-4
4.4.1
no fix listed
1
prefecthq/prefect:2.20.4-python3.101df4b5b6238a
h2@4.1.0
4.4.1
1
prowlercloud/prowler-api:5.31.14f252d579be2
h2@4.3.0
4.4.1
1
scrapinghub/splash:3.4.1a5f89bc84606
h2@3.1.1
4.4.1
1
searxng/searxng:2026.7.2-67973783d33aa33278be6
h2@4.3.0
4.4.1
1
searxng/searxng:2026.6.22-952896d293f52dca114d9
h2@4.3.0
4.4.1
1
searxng/searxng:2026.7.28-c01178d035d6d903ab82a
h2@4.4.0
4.4.1
1
searx/searx:1.0.0-211-968b28993dbb3a6d9419
h2@4.0.0
4.4.1
1
thijsvanloef/palworld-server-docker:v2.7.1401d3eb5c053
h2@4.3.0
4.4.1
1
thijsvanloef/palworld-server-docker:v2.5.0b4ac9ee22483
h2@4.3.0
4.4.1
1
tykling/dns_exporter:1.2.3cd6d650c01c1
h2@4.3.0
4.4.1
1
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
h2@4.2.0
4.4.1
1
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter:0.1.38b472877847f5
h2@4.1.0
4.4.1
1
ghcr.io/gabe565/obico/web:latesta5c1daef46c0
h2@4.1.0
4.4.1
1
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
h2@4.3.0
4.4.1
1
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
h2@4.3.0
4.4.1
1
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
h2@4.3.0
4.4.1
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
h2@4.1.0
4.4.1
1
ghcr.io/home-assistant/home-assistant:2026.9.0372d991e5888
h2@4.3.0
4.4.1
1
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
h2@4.3.0
4.4.1
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
h2@4.3.0
4.4.1
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
h2@4.1.0
4.4.1
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
h2@4.3.0
4.4.1
1
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
h2@4.3.0
4.4.1
1
ghcr.io/music-assistant/server:2.9.950666a6f8d7f
h2@4.3.0
4.4.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.