StackRadar

CVE-2026-82397

High

Advisory

Published 31 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
28th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
116
of 17,781 indexed, latest versions
Container images
120
deployed by those charts
Fix available
1 of 2
affected packages

Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Carried by container images the latest versions of 116 of 17,781 indexed charts deploy, on 120 images.

Affected packageAffected versionsFixed inImages
tornadopypi2.4.1, 4.5.3, 5.1.1, 6.0.2+14 more6.5.8120
python-tornadodeb6.2.0-3+deb12u1no fix listed1
OSV records
DEBIAN-CVE-2026-82397GHSA-mpf4-983q-p7j4
Also known as
PYSEC-2026-3928

Charts affected

116 by stars
ChartLatestAffected imagesRadar Score
safe-stacksafe-global0.1.01 of 9See more

safe-stack safe-global 0.1.0

1 of the 9 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
safeglobal/safe-transaction-service:latest80db836cc5d5
tornado@6.5.7
6.5.8

Open the chart page →

19,560
safe-transaction-servicesafe-global0.1.01 of 6See more

safe-transaction-service safe-global 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
safeglobal/safe-transaction-service:latest80db836cc5d5
tornado@6.5.7
6.5.8

Open the chart page →

16,620
airflowsb-helm-charts0.3.01 of 1See more

airflow sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
apache/airflow:2.8.1e5560ad0b86e
tornado@6.4
6.5.8

Open the chart page →

10,209
seldon-deployseldon1.4.01 of 2See more

seldon-deploy seldon 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
seldonio/seldon-request-logger:1.11.24e985d2006a8
tornado@6.1
6.5.8

Open the chart page →

21,997
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
tornado@6.5.5
6.5.8

Open the chart page →

5,201
backendsignalen4.24.01 of 4See more

backend signalen 4.24.0

1 of the 4 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
signalen/backend:2.50.14760256000738
tornado@6.5.7
6.5.8

Open the chart page →

11,636
srebotsrebot0.14.01 of 2See more

srebot srebot 0.14.0

1 of the 2 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
tornado@6.5.4
6.5.8

Open the chart page →

1,542
restful-distributed-lock-managerstakaterVerified publisher1.0.41 of 1See more

restful-distributed-lock-manager stakater 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
stakater/restful-distributed-lock-manager:0.5.34f8e409f30c2
tornado@2.4.1
6.5.8

Open the chart page →

3,116
netforge-besvtechVerified publisher0.0.21 of 3See more

netforge-be svtech 0.0.2

1 of the 3 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
mher/flower:2.051c3c3db5be3
tornado@6.3.3
6.5.8

Open the chart page →

4,674
icinga2-reportsvtech-public-helm-charts1.0.01 of 1See more

icinga2-report svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
trungkien210493/icinga2-report:v1.7.12cc8c3763c4c
tornado@5.1.1
6.5.8

Open the chart page →

1,779
tezos-nodetezos-nodeVerified publisher1.0.01 of 4See more

tezos-node tezos-node 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
oxheadalpha/tezos-k8s-utils:5.3.4d9faed45bf1c
tornado@6.1
6.5.8

Open the chart page →

5,321
synapsetranhailongVerified publisher0.1.01 of 2See more

synapse tranhailong 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.78.0def97fd537d8
tornado@6.1
6.5.8

Open the chart page →

3,164
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
tornado@6.2
6.5.8

Open the chart page →

8,607
unmanicvhdirkVerified publisher0.1.41 of 1See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
josh5/unmanic:0.2.64d49c4816260
tornado@6.0.2
6.5.8

Open the chart page →

9,347
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
tornado@6.4.2
6.5.8

Open the chart page →

7,628
webapp-chartwebappchart1.0.01 of 1See more

webapp-chart webappchart 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-82397.

Container imageDigestPackageFixed in
amagdi888/my-repo:hello-appd8a10fc8faf6
tornado@5.1.1
6.5.8

Open the chart page →

1,201

Container images carrying it

120 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
tornado@6.3.2
6.5.8
1
jupyterhub/k8s-singleuser-sample:0.11.1e3e6f3051df8
tornado@6.0.4
6.5.8
1
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
tornado@6.5.5
6.5.8
1
kubesphere/examples-bookinfo-productpage-v1:1.13.0378f49ec9c44
tornado@4.5.3
6.5.8
1
kyso/kyso-nbdime:latest4aa9d38ee81d
tornado@6.2
6.5.8
1
linuxserver/calibre-web:0.6.24241009026e6f
tornado@6.4.2
6.5.8
1
linuxserver/calibre-web:version-0.6.12938810eca3d3
tornado@6.1
6.5.8
1
linuxserver/medusa:v1.0.26-ls2884477fb1ce3ca
tornado@6.5.2
6.5.8
1
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
tornado@5.1.1
6.5.8
1
litellm/litellm-non_root:v1.82.3-stable09b217802ded
tornado@6.5.5
6.5.8
1
lsstsqre/nublado2:2.0.1b75bf8aaafa4
tornado@6.1
6.5.8
1
lsstsqre/prepuller:latest19c2dfc4e4ff
tornado@6.1
6.5.8
1
lsstsqre/sciplat-hub:latest5e0ade6bed1c
tornado@6.1
6.5.8
1
lsstsqre/wfdispatcher:lateste9feb99f524d
tornado@6.1
6.5.8
1
matrixdotorg/synapse:v1.160.078de1d10bef0
tornado@6.5.7
6.5.8
1
matrixdotorg/synapse:v1.127.1c3c4a9de2a0b
tornado@6.4.2
6.5.8
1
matrixdotorg/synapse:v1.53.0cb89c0f17ba1
tornado@6.1
6.5.8
1
matrixdotorg/synapse:v1.78.0def97fd537d8
tornado@6.1
6.5.8
1
mher/flower:2.051c3c3db5be3
tornado@6.3.3
6.5.8
1
mnaggar3396/python-app:latest371d8ed84b15
tornado@6.2
6.5.8
1
mohameddev006/web-app:v50fbc7360ecf4
tornado@5.1.1
6.5.8
1
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
tornado@6.5.7
6.5.8
1
octoprint/octoprint:1.4.0106c26efcd8a
tornado@4.5.3
6.5.8
1
octoprint/octoprint:1.6.1ea3bffae2470
tornado@5.1.1
6.5.8
1
onyxdotapp/onyx-backend:latest473fdffe4e67
tornado@6.5.7
6.5.8
1
opencsghq/agenticflow:ee-v0.6-52f03fead54db
tornado@6.5.1
6.5.8
1
opendatacube/explorer:latest120457ffcd69
tornado@6.5.2
6.5.8
1
opendatacube/wps:latest80df355a660b
tornado@6.4.2
6.5.8
1
openzaak/open-notificaties:1.3.02e65313b9b10
tornado@6.1
6.5.8
1
oxheadalpha/tezos-k8s-utils:5.3.4d9faed45bf1c
tornado@6.1
6.5.8
1
pangeo/base-notebook:2024.01.155fbe688a4f80
tornado@6.3.3
6.5.8
1
roadiehq/community-backstage-image:latestef355bf5b639
tornado@5.1.1
6.5.8
1
robmarkcole/deepstack-ui:latest410275726459
tornado@6.1
6.5.8
1
seldonio/seldon-request-logger:1.11.24e985d2006a8
tornado@6.1
6.5.8
1
signalen/backend:2.50.14760256000738
tornado@6.5.7
6.5.8
1
sruthitanneru/pi-sample:ui-lateste565ea454ffd
tornado@6.4.2
6.5.8
1
stakater/restful-distributed-lock-manager:0.5.34f8e409f30c2
tornado@2.4.1
6.5.8
1
tensorflow/tensorflow:1.6.0-devel1e3172090703
tornado@4.5.3
6.5.8
1
thijsvanloef/palworld-server-docker:v2.7.1401d3eb5c053
tornado@6.5.5
6.5.8
1
thijsvanloef/palworld-server-docker:v2.5.0b4ac9ee22483
tornado@6.5.5
6.5.8
1
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
tornado@4.5.3
6.5.8
1
treskon/portrait-web-setup:DEV-latesta475d80e4ecf
tornado@6.4.2
6.5.8
1
trungkien210493/icinga2-report:v1.7.12cc8c3763c4c
tornado@5.1.1
6.5.8
1
wger/server:2.6997ead43aabd
tornado@6.5.7
6.5.8
1
ghcr.io/berriai/litellm:1.100.1a3715fa7ad83
tornado@6.5.7
6.5.8
1
ghcr.io/berriai/litellm:main-stablec8756e7b9a61
tornado@6.5.7
6.5.8
1
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
tornado@6.4
6.5.8
1
ghcr.io/dask/dask:2024.1.0080150de7d86
tornado@6.3.3
6.5.8
1
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
tornado@6.5.4
6.5.8
1
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
tornado@6.3.3
6.5.8
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.