StackRadar

CVE-2026-71554

Medium

Advisory

Published 6 Aug 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.004
37th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
62
of 17,781 indexed, latest versions
Container images
59
deployed by those charts
Fix available
1 of 2
affected packages

h2: Duplicate Host header could facilitate request smuggling

Carried by container images the latest versions of 62 of 17,781 indexed charts deploy, on 59 images.

Affected packageAffected versionsFixed inImages
h2pypi2.6.2, 3.1.1, 4.0.0, 4.1.0+3 more4.4.159
python-h2deb4.1.0-4no fix listed1
OSV records
GHSA-6hr6-w5qg-qmwgUBUNTU-CVE-2026-71554
Also known as
PYSEC-2026-3628

Charts affected

62 by stars
ChartLatestAffected imagesRadar Score
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
h2@4.3.0
4.4.1

Open the chart page →

2,444
paperless-ngxmt1905027.6.141 of 4See more

paperless-ngx mt190502 7.6.14

1 of the 4 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
h2@4.3.0
4.4.1

Open the chart page →

11,950
splashntppoolVerified publisher1.0.41 of 1See more

splash ntppool 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
scrapinghub/splash:3.4.1a5f89bc84606
h2@3.1.1
4.4.1

Open the chart page →

27,633
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
h2@4.3.0
4.4.1

Open the chart page →

4,749
prefect-agentprefectVerified publisher2024.8.301638221 of 1See more

prefect-agent prefect 2024.8.30163822

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
prefecthq/prefect:2.20.4-python3.101df4b5b6238a
h2@4.1.0
4.4.1

Open the chart page →

5,451
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
h2@4.1.0
4.4.1

Open the chart page →

21,211
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
h2@4.1.0
4.4.1

Open the chart page →

9,607
imgtagrotationalVerified publisher0.2.01 of 1See more

imgtag rotational 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
h2@4.2.0
4.4.1

Open the chart page →

3,312
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
h2@4.3.0
4.4.1

Open the chart page →

10,605
searxngrubxkubeVerified publisher0.1.01 of 2See more

searxng rubxkube 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
searxng/searxng:2026.7.28-c01178d035d6d903ab82a
h2@4.4.0
4.4.1

Open the chart page →

9
alertmanager-matrix-forwarderzloi-space1.0.11 of 2See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
h2@4.1.0
4.4.1

Open the chart page →

3,118
grafana-matrix-forwarderzloi-space1.0.01 of 2See more

grafana-matrix-forwarder zloi-space 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-71554.

Container imageDigestPackageFixed in
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
h2@4.1.0
4.4.1

Open the chart page →

1,636

Container images carrying it

59 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/devtron/ai-agent:0.0.16545dac92173
h2@4.1.0
4.4.1
3
matrixdotorg/pantalaimon:v0.10.4ba6a587fa508
h2@4.1.0
4.4.1
2
ghcr.io/home-assistant/home-assistant:2026.9.1:latest612d76760b54
h2@4.3.0
4.4.1
2
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
h2@4.3.0
4.4.1
2
apache/airflow:2.10.2-python3.9ce90bdc3d2af
h2@4.1.0
4.4.1
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
h2@4.2.0
4.4.1
1
berkeleyskypilot/skypilot:0.13.03bc8bf8f4d83
h2@4.3.0
4.4.1
1
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
h2@4.3.0
4.4.1
1
eclipseaerios/self-awareness-hardware-info:1.4.434b72f45b46a
h2@4.3.0
4.4.1
1
eclipseaerios/self-awareness-power-consumption:1.3.3c8af377c709f
h2@4.3.0
4.4.1
1
gethue/hue:4.11.011b649636e68
h2@2.6.2
4.4.1
1
gethue/hue:4.10.05702b2c37ff9
h2@2.6.2
4.4.1
1
gethue/hue:latest7d5c1b9f8a79
h2@2.6.2
4.4.1
1
homeassistant/home-assistant:2023.10.3021e2afc6e57
h2@4.1.0
4.4.1
1
homeassistant/home-assistant:2026.75a531753cea9
h2@4.3.0
4.4.1
1
homeassistant/home-assistant:2023.12.48d000332b09b
h2@4.1.0
4.4.1
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
h2@4.3.0
4.4.1
1
langgenius/dify-api:1.0.0066035f93856
h2@4.2.0
4.4.1
1
langgenius/dify-api:1.16.1dcefa5f7c47c
h2@4.3.0
4.4.1
1
langgenius/dify-api:0.6.11fca918260dd6
h2@4.1.0
4.4.1
1
localstack/localstack:3.19d278167f2b7
h2@4.1.0
4.4.1
1
makersquad/harp-proxy:0.8.1a40dd258c527
h2@4.2.0
4.4.1
1
opencsghq/agenticflow:ee-v0.6-52f03fead54db
h2@4.2.0
4.4.1
1
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
h2@4.1.0
4.4.1
1
opencsghq/csgship-agentic:v0.4.02cd29671a03e
h2@4.1.0
4.4.1
1
openvpn/openvpn-as:latest2253c10ec652
h2@4.1.0
python-h2@4.1.0-4
4.4.1
no fix listed
1
prefecthq/prefect:2.20.4-python3.101df4b5b6238a
h2@4.1.0
4.4.1
1
prowlercloud/prowler-api:5.31.14f252d579be2
h2@4.3.0
4.4.1
1
scrapinghub/splash:3.4.1a5f89bc84606
h2@3.1.1
4.4.1
1
searxng/searxng:2026.7.2-67973783d33aa33278be6
h2@4.3.0
4.4.1
1
searxng/searxng:2026.6.22-952896d293f52dca114d9
h2@4.3.0
4.4.1
1
searxng/searxng:2026.7.28-c01178d035d6d903ab82a
h2@4.4.0
4.4.1
1
searx/searx:1.0.0-211-968b28993dbb3a6d9419
h2@4.0.0
4.4.1
1
thijsvanloef/palworld-server-docker:v2.7.1401d3eb5c053
h2@4.3.0
4.4.1
1
thijsvanloef/palworld-server-docker:v2.5.0b4ac9ee22483
h2@4.3.0
4.4.1
1
tykling/dns_exporter:1.2.3cd6d650c01c1
h2@4.3.0
4.4.1
1
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
h2@4.2.0
4.4.1
1
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter:0.1.38b472877847f5
h2@4.1.0
4.4.1
1
ghcr.io/gabe565/obico/web:latesta5c1daef46c0
h2@4.1.0
4.4.1
1
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
h2@4.3.0
4.4.1
1
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
h2@4.3.0
4.4.1
1
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
h2@4.3.0
4.4.1
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
h2@4.1.0
4.4.1
1
ghcr.io/home-assistant/home-assistant:2026.9.0372d991e5888
h2@4.3.0
4.4.1
1
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
h2@4.3.0
4.4.1
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
h2@4.3.0
4.4.1
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
h2@4.1.0
4.4.1
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
h2@4.3.0
4.4.1
1
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
h2@4.3.0
4.4.1
1
ghcr.io/music-assistant/server:2.9.950666a6f8d7f
h2@4.3.0
4.4.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.