StackRadarChart IndexLive demo

CVE-2026-84311

Medium

Advisory

Published 1 Sept 2026In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 4.8; base score, highest
EPSS: 0.001; 4th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 21; of 17,781 indexed, latest versions
Container images: 20; deployed by those charts
Fix available: 1 of 1; affected package

pypdf: Possible long runtimes/large memory usage when extracting XForm objects

Carried by container images the latest versions of 21 of 17,781 indexed charts deploy, on 20 images.

Affected package	Affected versions	Fixed in	Images
pypdfpypi	5.0.1, 5.1.0, 5.3.0, 5.4.0+6 more	6.16.1	20

OSV records: GHSA-763m-79hh-57f2
Also known as: PYSEC-2026-3911

Charts affected

21 by stars

Chart

Latest

Affected images

Radar Score

difydify-helm

2 of 11 See more

dify dify-helm 0.38.0

2 of the 11 container images this version deploys carry CVE-2026-84311.

Container image	Digest	Package	Fixed in
langgenius/dify-agent-backend :1.16.1	097d3fd27a7b	pypdf@6.14.2	6.16.1
langgenius/dify-api :1.16.1	dcefa5f7c47c	pypdf@6.14.2	6.16.1

Open the chart page →

22,002

litellm-helmlitellm

1 of 2 See more

litellm-helm litellm 1.100.1

1 of the 2 container images this version deploys carry CVE-2026-84311.

Container image	Digest	Package	Fixed in
ghcr.io/berriai/litellm :1.100.1	a3715fa7ad83	pypdf@6.15.0	6.16.1

Open the chart page →

5,003

calibre-webk8s-home-lab-repo

1 of 1 See more

calibre-web k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-84311.

Container image	Digest	Package	Fixed in
ghcr.io/linuxserver/calibre-web :0.6.26	7c0464228f2f	pypdf@6.4.2	6.16.1

Open the chart page →

4,477

pretixtechwolf12

1 of 3 See more

pretix techwolf12 2026.7.0

1 of the 3 container images this version deploys carry CVE-2026-84311.

Container image	Digest	Package	Fixed in
pretix/standalone :2026.7.0	5df3b7aa852e	pypdf@6.5.0	6.16.1

Open the chart page →

9,770

agentareaagentarea

1 of 16 See more

agentarea agentarea 0.0.18

1 of the 16 container images this version deploys carry CVE-2026-84311.

Container image	Digest	Package	Fixed in
agentarea/agentarea-mcp-runner :latest	d3c209a5d531	pypdf@6.14.2	6.16.1

Open the chart page →

14,914

langflow-idelangflow

1 of 2 See more

langflow-ide langflow 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-84311.

Container image	Digest	Package	Fixed in
langflowai/langflow :latest	65796601f3fc	pypdf@6.15.0	6.16.1

Open the chart page →

3,980

langflow-runtimelangflow

1 of 1 See more

langflow-runtime langflow 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-84311.

Container image	Digest	Package	Fixed in
langflowai/langflow :latest	65796601f3fc	pypdf@6.15.0	6.16.1

Open the chart page →

144

litellmalareira

1 of 1 See more

litellm alareira 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-84311.

Container image	Digest	Package	Fixed in
ghcr.io/berriai/litellm :main-stable	c8756e7b9a61	pypdf@6.15.0	6.16.1

Open the chart page →

83

argonix-apiargonix

1 of 4 See more

argonix-api argonix 0.2.0

1 of the 4 container images this version deploys carry CVE-2026-84311.

Container image	Digest	Package	Fixed in
ghcr.io/argonix-io/argonix-api :1.0.0	68e17a8aaa40	pypdf@6.14.2	6.16.1

Open the chart page →

4,923

calibre-webcharts-derwitt-dev

1 of 1 See more

calibre-web charts-derwitt-dev 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-84311.

Container image	Digest	Package	Fixed in
ghcr.io/wittdennis/calibre-web :1.1.1	aa7d5d5dd6be	pypdf@6.10.2	6.16.1

Open the chart page →

4,911

csghubcsghub

1 of 34 See more

csghub csghub 2.4.3

1 of the 34 container images this version deploys carry CVE-2026-84311.

Container image	Digest	Package	Fixed in
opencsghq/agenticflow :ee-v0.6-5	2f03fead54db	pypdf@5.1.0	6.16.1

Open the chart page →

58,897

difydify

1 of 4 See more

19,224

rag-apihajowieland

1 of 1 See more

rag-api hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84311.

Container image	Digest	Package	Fixed in
ghcr.io/danny-avila/librechat-rag-api-dev-lite :latest	f9f34c8ed688	pypdf@6.14.2	6.16.1

Open the chart page →

1,683

langflowhelmforge

1 of 1 See more

langflow helmforge 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-84311.

Container image	Digest	Package	Fixed in
langflowai/langflow :1.12.0	65796601f3fc	pypdf@6.15.0	6.16.1

Open the chart page →

144

inventreeinventree

1 of 2 See more

inventree inventree 0.4.28

1 of the 2 container images this version deploys carry CVE-2026-84311.

Container image	Digest	Package	Fixed in
inventree/inventree :1.5.4	a946ec09da3e	pypdf@6.15.0	6.16.1

Open the chart page →

5,788

aperagkubeblocks

1 of 3 See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-84311.

Container image	Digest	Package	Fixed in
apecloud/aperag :v0.0.0-nightly	8ac9947a2c84	pypdf@5.4.0	6.16.1

Open the chart page →

8,405

1 of 12 See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-84311.

Container image	Digest	Package	Fixed in
onyxdotapp/onyx-backend :latest	473fdffe4e67	pypdf@6.15.0	6.16.1

Open the chart page →

6,338

checkmkrtomik-helm-charts

1 of 1 See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-84311.

Container image	Digest	Package	Fixed in
checkmk/check-mk-community :2.5.0p6	c11b422210c4	pypdf@6.10.2	6.16.1

Open the chart page →

7,436

showroom-docs-mcpshowroom-docs-mcp

1 of 4 See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-84311.

Container image	Digest	Package	Fixed in
litellm/litellm-non_root :v1.82.3-stable	09b217802ded	pypdf@6.9.0	6.16.1

Open the chart page →

5,201

backendsignalen

1 of 4 See more

backend signalen 4.24.0

1 of the 4 container images this version deploys carry CVE-2026-84311.

Container image	Digest	Package	Fixed in
signalen/backend :2.50.14	760256000738	pypdf@6.14.2	6.16.1

Open the chart page →

11,636

calibre-webvista

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-84311.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	pypdf@5.0.1	6.16.1

Open the chart page →

7,628

Container images carrying it

20 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
langflowai/langflow :1.12.0 :latest	65796601f3fc	pypdf@6.15.0	6.16.1	3
agentarea/agentarea-mcp-runner :latest	d3c209a5d531	pypdf@6.14.2	6.16.1	1
apecloud/aperag :v0.0.0-nightly	8ac9947a2c84	pypdf@5.4.0	6.16.1	1
checkmk/check-mk-community :2.5.0p6	c11b422210c4	pypdf@6.10.2	6.16.1	1
inventree/inventree :1.5.4	a946ec09da3e	pypdf@6.15.0	6.16.1	1
langgenius/dify-agent-backend :1.16.1	097d3fd27a7b	pypdf@6.14.2	6.16.1	1
langgenius/dify-api :1.0.0	066035f93856	pypdf@5.3.0	6.16.1	1
langgenius/dify-api :1.16.1	dcefa5f7c47c	pypdf@6.14.2	6.16.1	1
linuxserver/calibre-web :0.6.24	241009026e6f	pypdf@5.0.1	6.16.1	1
litellm/litellm-non_root :v1.82.3-stable	09b217802ded	pypdf@6.9.0	6.16.1	1
onyxdotapp/onyx-backend :latest	473fdffe4e67	pypdf@6.15.0	6.16.1	1
opencsghq/agenticflow :ee-v0.6-5	2f03fead54db	pypdf@5.1.0	6.16.1	1
pretix/standalone :2026.7.0	5df3b7aa852e	pypdf@6.5.0	6.16.1	1
signalen/backend :2.50.14	760256000738	pypdf@6.14.2	6.16.1	1
ghcr.io/argonix-io/argonix-api :1.0.0	68e17a8aaa40	pypdf@6.14.2	6.16.1	1
ghcr.io/berriai/litellm :1.100.1	a3715fa7ad83	pypdf@6.15.0	6.16.1	1
ghcr.io/berriai/litellm :main-stable	c8756e7b9a61	pypdf@6.15.0	6.16.1	1
ghcr.io/danny-avila/librechat-rag-api-dev-lite :latest	f9f34c8ed688	pypdf@6.14.2	6.16.1	1
ghcr.io/linuxserver/calibre-web :0.6.26	7c0464228f2f	pypdf@6.4.2	6.16.1	1
ghcr.io/wittdennis/calibre-web :1.1.1	aa7d5d5dd6be	pypdf@6.10.2	6.16.1	1