StackRadar

CVE-2026-82397

High

Advisory

Published 31 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
28th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
116
of 17,781 indexed, latest versions
Container images
120
deployed by those charts
Fix available
1 of 2
affected packages

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Carried by container images the latest versions of 116 of 17,781 indexed charts deploy, on 120 images.

Affected packageAffected versionsFixed inImages
tornadopypi2.4.1, 4.5.3, 5.1.1, 6.0.2+14 more6.5.8120
python-tornadodeb6.2.0-3+deb12u1no fix listed1
OSV records
DEBIAN-CVE-2026-82397GHSA-mpf4-983q-p7j4
Also known as
PYSEC-2026-3928

Charts affected

116 by stars
ChartLatestAffected imagesRadar Score
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
tornado@6.4
6.5.8

Open the chart page →

11,367
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
grafana/oncall:v1.16.5499851658393
tornado@6.5.1
6.5.8

Open the chart page →

16,251
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
tornado@6.1
6.5.8

Open the chart page →

7,705
synapsehalkeye0.40.01 of 2See more

synapse halkeye 0.40.0

1 of the 2 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
tornado@6.4.1
6.5.8

Open the chart page →

6,543
daskdask2024.1.12 of 2See more

dask dask 2024.1.1

2 of the 2 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
ghcr.io/dask/dask:2024.1.0080150de7d86
tornado@6.3.3
6.5.8
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
tornado@6.3.3
6.5.8

Open the chart page →

12,746
litellm-helmlitellm1.100.11 of 2See more

litellm-helm litellm 1.100.1

1 of the 2 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm:1.100.1a3715fa7ad83
tornado@6.5.7
6.5.8

Open the chart page →

5,003
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
tornado@6.4
6.5.8

Open the chart page →

6,041
baserowbaserow-chartVerified publisher1.0.561 of 6See more

baserow baserow-chart 1.0.56

1 of the 6 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
baserow/backend:2.3.37c00549b3a6f
tornado@6.5.7
6.5.8

Open the chart page →

17,263
fadicetic0.3.12 of 25See more

fadi cetic 0.3.1

2 of the 25 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
jupyterhub/k8s-hub:0.11.1b6b4a1a34bf0
tornado@6.1
6.5.8
jupyterhub/k8s-singleuser-sample:0.11.1e3e6f3051df8
tornado@6.0.4
6.5.8

Open the chart page →

52,919
daskhubdask2024.1.12 of 9See more

daskhub dask 2024.1.1

2 of the 9 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
tornado@6.3.3
6.5.8
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
tornado@6.3.3
6.5.8

Open the chart page →

14,094
matrixzekker6Verified publisher3.30.01 of 4See more

matrix zekker6 3.30.0

1 of the 4 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.160.078de1d10bef0
tornado@6.5.7
6.5.8

Open the chart page →

5,557
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
tornado@6.4.1
6.5.8

Open the chart page →

17,404
dask-kubernetes-operatordask2026.3.01 of 1See more

dask-kubernetes-operator dask 2026.3.0

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
tornado@6.5.4
6.5.8

Open the chart page →

9,316
esphomegeek-cookbookVerified publisher8.4.21 of 1See more

esphome geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
esphome/esphome:1.18.03f51ec10e823
tornado@6.1
6.5.8

Open the chart page →

3,717
calibre-webk8s-home-lab-repo9.1.11 of 1See more

calibre-web k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
tornado@6.5.7
6.5.8

Open the chart page →

4,477
wgerwgerOfficialVerified publisher1.0.01 of 8See more

wger wger 1.0.0

1 of the 8 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
wger/server:2.6997ead43aabd
tornado@6.5.7
6.5.8

Open the chart page →

8,491
paperless-ngxalexmorbo-paperless-ngxVerified publisher0.2.01 of 2See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
tornado@6.5.2
6.5.8

Open the chart page →

12,037
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
tornado@6.5.7
6.5.8

Open the chart page →

5,880
anteonanteonVerified publisher2.6.41 of 13See more

anteon anteon 2.6.4

1 of the 13 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
ddosify/selfhosted_alaz_backend:2.3.11e5be48b37348
tornado@6.4.1
6.5.8

Open the chart page →

22,202
tensorflow-notebookcloudnativeapp0.1.21 of 1See more

tensorflow-notebook cloudnativeapp 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
tensorflow/tensorflow:1.6.0-devel1e3172090703
tornado@4.5.3
6.5.8

Open the chart page →

36,094
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
tornado@6.4
6.5.8

Open the chart page →

11,205
paperless-ngxcrystalnetVerified publisher0.2.221 of 3See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
tornado@6.4.1
6.5.8

Open the chart page →

13,761
data-fairdata354-helmVerified publisher1.1.21 of 12See more

data-fair data354-helm 1.1.2

1 of the 12 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
apsl/thumbor:6.7.051e2de5c2c70
tornado@5.1.1
6.5.8

Open the chart page →

38,346
datacube-explorerdatacube-charts0.5.321 of 1See more

datacube-explorer datacube-charts 0.5.32

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
opendatacube/explorer:latest120457ffcd69
tornado@6.5.2
6.5.8

Open the chart page →

4,854
craftycontrollerdrewburr-labs-helm-chartsVerified publisher0.3.01 of 1See more

craftycontroller drewburr-labs-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
registry.gitlab.com/crafty-controller/crafty-4:latest166a06f73d8c
tornado@6.5.4
6.5.8

Open the chart page →

3,671
copypartyernail-copyparty2.0.01 of 1See more

copyparty ernail-copyparty 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
copyparty/ac:1.19.200a0a8605062c
tornado@6.5.1
6.5.8

Open the chart page →

1,685
deepstackgeek-cookbookVerified publisher1.5.21 of 2See more

deepstack geek-cookbook 1.5.2

1 of the 2 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
robmarkcole/deepstack-ui:latest410275726459
tornado@6.1
6.5.8

Open the chart page →

5,305
octoprintgeek-cookbookVerified publisher6.4.21 of 1See more

octoprint geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
octoprint/octoprint:1.6.1ea3bffae2470
tornado@5.1.1
6.5.8

Open the chart page →

3,153
octoprinthalkeye0.1.11 of 1See more

octoprint halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
octoprint/octoprint:1.4.0106c26efcd8a
tornado@4.5.3
6.5.8

Open the chart page →

3,608
huehue1.0.31 of 3See more

hue hue 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
gethue/hue:latest7d5c1b9f8a79
tornado@6.5.4
6.5.8

Open the chart page →

12,397
jupyterhub-outpostjupyter-jscVerified publisher2.4.11 of 1See more

jupyterhub-outpost jupyter-jsc 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
tornado@6.5.5
6.5.8

Open the chart page →

1,678
medusamedusaVerified publisher1.3.81 of 1See more

medusa medusa 1.3.8

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
linuxserver/medusa:v1.0.26-ls2884477fb1ce3ca
tornado@6.5.2
6.5.8

Open the chart page →

977
open-notificatiesopen-zaak0.7.01 of 4See more

open-notificaties open-zaak 0.7.0

1 of the 4 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
openzaak/open-notificaties:1.3.02e65313b9b10
tornado@6.1
6.5.8

Open the chart page →

2,850
palworldpalworld-server-chartVerified publisher2.7.11 of 1See more

palworld palworld-server-chart 2.7.1

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
thijsvanloef/palworld-server-docker:v2.7.1401d3eb5c053
tornado@6.5.5
6.5.8

Open the chart page →

3,681
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
treskon/portrait-web-setup:DEV-latesta475d80e4ecf
tornado@6.4.2
6.5.8

Open the chart page →

31,844
streamlit-appstreamlit-appVerified publisher0.2.01 of 1See more

streamlit-app streamlit-app 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
sruthitanneru/pi-sample:ui-lateste565ea454ffd
tornado@6.4.2
6.5.8

Open the chart page →

1,696
synapsesudermanjr1.1.51 of 1See more

synapse sudermanjr 1.1.5

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.53.0cb89c0f17ba1
tornado@6.1
6.5.8

Open the chart page →

3,332
litellmalareira0.3.01 of 1See more

litellm alareira 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm:main-stablec8756e7b9a61
tornado@6.5.7
6.5.8

Open the chart page →

83
esphomealexmorbo-esphomeVerified publisher1.0.01 of 1See more

esphome alexmorbo-esphome 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
esphome/esphome:2024.12.2b2c6322700ac
tornado@6.4
6.5.8

Open the chart page →

6,324
ansible-inspecansible-inspec0.2.171 of 2See more

ansible-inspec ansible-inspec 0.2.17

1 of the 2 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
tornado@6.5.4
6.5.8

Open the chart page →

5,558
ddosifyanteonVerified publisher1.7.51 of 13See more

ddosify anteon 1.7.5

1 of the 13 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
tornado@6.4
6.5.8

Open the chart page →

25,669
bookinfobasictechno0.1.01 of 6See more

bookinfo basictechno 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
istio/examples-bookinfo-productpage-v1:1.17.06668bcf42ef0
tornado@4.5.3
6.5.8

Open the chart page →

20,671
huebigdata-chartsVerified publisher1.0.41 of 2See more

hue bigdata-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
gethue/hue:4.10.05702b2c37ff9
tornado@6.1
6.5.8

Open the chart page →

22,891
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
tornado@6.4.1
6.5.8

Open the chart page →

10,145
istio-bookinfobookinfo1.2.21 of 6See more

istio-bookinfo bookinfo 1.2.2

1 of the 6 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
istio/examples-bookinfo-productpage-v1:1.15.00a5eb4795952
tornado@4.5.3
6.5.8

Open the chart page →

18,980
sickchillbryanalves0.3.01 of 1See more

sickchill bryanalves 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
tornado@5.1.1
6.5.8

Open the chart page →

2,504
daskcloudnativeapp2.2.12 of 2See more

dask cloudnativeapp 2.2.1

2 of the 2 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
daskdev/dask:1.1.04ecd7bc35500
tornado@5.1.1
6.5.8
daskdev/dask-notebook:1.1.0052630f5ca04
tornado@5.1.1
6.5.8

Open the chart page →

29,901
distributed-tensorflowcloudnativeapp0.1.11 of 1See more

distributed-tensorflow cloudnativeapp 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
cheyang/distributed-tf:1.6.046cc34755493
tornado@4.5.3
6.5.8

Open the chart page →

36,094
supersetcloudnativeapp1.1.61 of 1See more

superset cloudnativeapp 1.1.6

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
amancevice/superset:0.28.1c8c04bfe3d66
tornado@5.1.1
6.5.8

Open the chart page →

5,060
webpagetest-agentcloudnativeapp0.2.01 of 1See more

webpagetest-agent cloudnativeapp 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
tornado@4.5.3
6.5.8

Open the chart page →

77,758

Container images carrying it

120 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
istio/examples-bookinfo-productpage-v1:1.15.00a5eb4795952
tornado@4.5.3
6.5.8
2
istio/examples-bookinfo-productpage-v1:1.14.022a0410f35a8
tornado@4.5.3
6.5.8
2
opendatacube/ows:latest668cbb41473c
tornado@6.4.2
6.5.8
2
safeglobal/safe-transaction-service:latest80db836cc5d5
tornado@6.5.7
6.5.8
2
alaaamin/reload-count-tornado-py-app:v1.0.1alpine46da5844794e
tornado@5.1.1
6.5.8
1
amagdi888/my-repo:hello-appd8a10fc8faf6
tornado@5.1.1
6.5.8
1
amancevice/superset:0.28.1c8c04bfe3d66
tornado@5.1.1
6.5.8
1
amundsendev/amundsen-metadata:2.5.44d98eb21f5f9
tornado@4.5.3
6.5.8
1
apache/airflow:2.8.4-python3.964e58748b6b9
tornado@6.4
6.5.8
1
apache/airflow:2.10.2-python3.9ce90bdc3d2af
tornado@6.4.1
6.5.8
1
apache/airflow:2.8.1e5560ad0b86e
tornado@6.4
6.5.8
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
tornado@6.4.2
6.5.8
1
apsl/thumbor:6.7.051e2de5c2c70
tornado@5.1.1
6.5.8
1
aristidetm/basic-notebook:3.6.5469dbc951224
tornado@6.4.1
6.5.8
1
aristidetm/k8s-hub:3.3.7ccb516cb8474
tornado@6.4
6.5.8
1
baserow/backend:2.3.37c00549b3a6f
tornado@6.5.7
6.5.8
1
baserow/backend:1.31.1e0b3c8130b91
tornado@6.4.1
6.5.8
1
baserow/baserow:1.30.1df0c42eb67e8
tornado@6.4.1
6.5.8
1
bmeares/meerschaum:2.8.48e9c5bacaa82
tornado@6.4.2
6.5.8
1
cheyang/distributed-tf:1.6.046cc34755493
tornado@4.5.3
6.5.8
1
copyparty/ac:1.19.200a0a8605062c
tornado@6.5.1
6.5.8
1
daskdev/dask:1.1.04ecd7bc35500
tornado@5.1.1
6.5.8
1
daskdev/dask-notebook:1.1.0052630f5ca04
tornado@5.1.1
6.5.8
1
datagrok/grok_spawner:latest8c2d48c1545c
tornado@6.5.7
6.5.8
1
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
tornado@6.4
6.5.8
1
ddosify/selfhosted_alaz_backend:2.3.11e5be48b37348
tornado@6.4.1
6.5.8
1
errbotio/errbot:6.1.900ee4e0953ab
tornado@6.1
6.5.8
1
esphome/esphome:1.18.03f51ec10e823
tornado@6.1
6.5.8
1
esphome/esphome:2024.3.09ab8cc88b28c
tornado@6.4
6.5.8
1
esphome/esphome:2024.12.2b2c6322700ac
tornado@6.4
6.5.8
1
esphome/esphome:2025.3.0def8b6e4f517
tornado@6.4.2
6.5.8
1
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
tornado@6.2
6.5.8
1
geoscienceaustralia/dea-k8s-data:latestf4039b45572a
tornado@6.0.4
6.5.8
1
gethue/hue:4.11.011b649636e68
tornado@6.2
6.5.8
1
gethue/hue:4.10.05702b2c37ff9
tornado@6.1
6.5.8
1
gethue/hue:latest7d5c1b9f8a79
tornado@6.5.4
6.5.8
1
gmaas2/github-api:latest148fc2d9afe9
tornado@6.2
6.5.8
1
grafana/oncall:v1.16.5499851658393
tornado@6.5.1
6.5.8
1
homeassistant/home-assistant:2023.10.3021e2afc6e57
tornado@6.3.3
6.5.8
1
homeassistant/home-assistant:2023.12.48d000332b09b
tornado@6.4
6.5.8
1
ilum/streamlit-example:1.0.0ce5dcdeb22ba
tornado@6.5.2
6.5.8
1
intel/dlstreamer-pipeline-server:2022.1.1-ubuntu20aa8f5483a2ef
tornado@6.1
6.5.8
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
tornado@6.5.5
6.5.8
1
istio/examples-bookinfo-productpage-v1:1.17.06668bcf42ef0
tornado@4.5.3
6.5.8
1
jaedb/iris:latest048cfbf58d57
python-tornado@6.2.0-3+deb12u1
tornado@6.2
no fix listed
6.5.8
1
josh5/unmanic:0.2.64d49c4816260
tornado@6.0.2
6.5.8
1
jupyterhub/jupyterhub:5.4.63974ba945e65
tornado@6.5.6
6.5.8
1
jupyterhub/k8s-hub:3.0.1-0.dev.git.6287.hbfb05cd65a0ceed1300a
tornado@6.3.2
6.5.8
1
jupyterhub/k8s-hub:0.11.1b6b4a1a34bf0
tornado@6.1
6.5.8
1
jupyterhub/k8s-hub:1.2.0e4770285aaf7
tornado@6.1
6.5.8
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.