StackRadar

CVE-2026-96640

High

Advisory

Published 21 Oct 2026In the index since 23 Oct 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
0.004
35th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
290
of 18,232 indexed, latest versions
Container images
274
deployed by those charts
Fix available
1 of 2
affected packages

Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

Carried by container images the latest versions of 290 of 18,232 indexed charts deploy, on 274 images.

Affected packageAffected versionsFixed inImages
pillowpypi5.1.0, 5.2.0, 5.3.0, 5.4.1+32 more13.0.0274
pillowdeb5.1.0-1, 5.1.0-1ubuntu0.6, 5.1.0-1ubuntu0.7, 7.0.0-4ubuntu0.5+7 moreno fix listed15
OSV records
DEBIAN-CVE-2026-96640GHSA-mrfp-p49p-3hf2UBUNTU-CVE-2026-96640
Trending
Rank 8 in indexed charts, since 24 Oct 2026. See the ranking →

Charts affected

290 by stars
ChartLatestAffected imagesRadar Score
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
pillow@11.3.0
13.0.0

Open the chart page →

13,887
tandoorrtomik-helm-chartsVerified publisher0.0.11 of 1See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
vabene1111/recipes:2.3.50f8d061895e9
pillow@11.3.0
13.0.0

Open the chart page →

5,776
safe-config-servicesafe-global0.1.01 of 3See more

safe-config-service safe-global 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
safeglobal/safe-config-service:latest09a5e495c219
pillow@12.2.0
13.0.0

Open the chart page →

2,701
safe-stacksafe-global0.1.02 of 9See more

safe-stack safe-global 0.1.0

2 of the 9 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
safeglobal/safe-config-service:latest09a5e495c219
pillow@12.2.0
13.0.0
safeglobal/safe-transaction-service:latest7b576c73f865
pillow@12.3.0
13.0.0

Open the chart page →

106,910
safe-transaction-servicesafe-global0.1.01 of 6See more

safe-transaction-service safe-global 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
safeglobal/safe-transaction-service:latest7b576c73f865
pillow@12.3.0
13.0.0

Open the chart page →

102,808
pgadminsb-helm-charts0.3.01 of 1See more

pgadmin sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
dpage/pgadmin4:8.13561c1f8f99f2
pillow@11.0.0
13.0.0

Open the chart page →

2,367
scapyscapy-containerised0.3.41 of 2See more

scapy scapy-containerised 0.3.4

1 of the 2 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
saidsef/scapy-containerised:v2025.02f17f7c435891
pillow@11.1.0
13.0.0

Open the chart page →

4,055
otterwikischmitzis0.1.01 of 1See more

otterwiki schmitzis 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
redimp/otterwiki:2b7ece5b8d7cc
pillow@12.3.0
13.0.0

Open the chart page →

3,410
seafileschmitzis13.0.131 of 4See more

seafile schmitzis 13.0.13

1 of the 4 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
schmitzis/monorepo:seafile-13.0-latestc583f1be2af2
pillow@11.3.0
13.0.0

Open the chart page →

45,498
seafileseafileVerified publisher0.12.11 of 1See more

seafile seafile 0.12.1

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:11.0.12d0c66e4621bd
pillow@10.2.0
13.0.0

Open the chart page →

76,611
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
pillow@12.1.1
13.0.0

Open the chart page →

6,719
backendsignalen4.25.01 of 4See more

backend signalen 4.25.0

1 of the 4 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
signalen/backend:2.50.1826bb090bc4e4
pillow@12.3.0
13.0.0

Open the chart page →

38,204
pgadminsikalabs0.1.01 of 2See more

pgadmin sikalabs 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
dpage/pgadmin4:latestc332c5f6dfba
pillow@12.3.0
13.0.0

Open the chart page →

644
weblateslamdev0.0.111 of 2See more

weblate slamdev 0.0.11

1 of the 2 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
weblate/weblate:3.11.3-182848df56ecd
pillow@5.4.1
13.0.0

Open the chart page →

12,283
deconzsmall-hack0.1.01 of 1See more

deconz small-hack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
deconzcommunity/deconz:2.26.123c86008d73f
pillow@9.4.0-1.1+b1
pillow@9.4.0
no fix listed
13.0.0

Open the chart page →

14,935
home-assistantsmall-hack2.1.01 of 1See more

home-assistant small-hack 2.1.0

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
pillow@12.1.1
13.0.0

Open the chart page →

6,160
frigatesmarthallVerified publisher1.0.61 of 1See more

frigate smarthall 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
ghcr.io/blakeblackshear/frigate:0.12.0c862771e38e8
pillow@8.1.2
13.0.0

Open the chart page →

2,914
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
pillow@10.3.0
13.0.0

Open the chart page →

7,281
srsran-5gsrsran-5gVerified publisher1.0.01 of 1See more

srsran-5g srsran-5g 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
gradiant/srsran-5g:23_10_19061b1bf0f36
pillow@7.0.0
pillow@7.0.0-4ubuntu0.9
13.0.0
no fix listed

Open the chart page →

68,303
srsran-5g-zmqsrsran-5g-zmqVerified publisher1.0.11 of 2See more

srsran-5g-zmq srsran-5g-zmq 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
gradiant/srsran-5g:23_10_19061b1bf0f36
pillow@7.0.0
pillow@7.0.0-4ubuntu0.9
13.0.0
no fix listed

Open the chart page →

74,187
krokiteochenglim1.0.11 of 5See more

kroki teochenglim 1.0.1

1 of the 5 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
yuzutech/kroki-blockdiag:0.16.07c1917c66d96
pillow@8.4.0
13.0.0

Open the chart page →

9,367
asrtest-opea1.0.01 of 1See more

asr test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
opea/asr:1.025dd26d9cd09
pillow@10.2.0
13.0.0

Open the chart page →

5,365
chatqnatest-opea1.0.05 of 11See more

chatqna test-opea 1.0.0

5 of the 11 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
opea/chatqna:1.038c51b791efa
pillow@10.4.0
13.0.0
opea/embedding-tei:1.05c9639de61c1
pillow@10.4.0
13.0.0
opea/llm-tgi:1.00c25aab3f106
pillow@10.4.0
13.0.0
opea/reranking-tei:1.0e48613afb191
pillow@10.4.0
13.0.0
opea/retriever-redis:1.0eb746b263705
pillow@10.2.0
13.0.0

Open the chart page →

45,913
codegentest-opea1.0.02 of 5See more

codegen test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
opea/codegen:1.058f91683892d
pillow@10.4.0
13.0.0
opea/llm-tgi:1.00c25aab3f106
pillow@10.4.0
13.0.0

Open the chart page →

108,485
codetranstest-opea1.0.02 of 5See more

codetrans test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
opea/codetrans:1.0e2436483b73d
pillow@10.4.0
13.0.0
opea/llm-tgi:1.00c25aab3f106
pillow@10.4.0
13.0.0

Open the chart page →

108,010
docsumtest-opea1.0.02 of 5See more

docsum test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
opea/docsum:1.03eaa91849512
pillow@10.4.0
13.0.0
opea/llm-docsum-tgi:1.002f9e8fa5d71
pillow@10.2.0
13.0.0

Open the chart page →

108,512
embedding-usvctest-opea1.0.01 of 1See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
opea/embedding-tei:1.05c9639de61c1
pillow@10.4.0
13.0.0

Open the chart page →

6,228
guardrails-usvctest-opea1.0.01 of 1See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
opea/guardrails-tgi:1.0262c6048aab8
pillow@10.4.0
13.0.0

Open the chart page →

6,262
llm-uservicetest-opea1.0.01 of 1See more

llm-uservice test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
opea/llm-tgi:1.00c25aab3f106
pillow@10.4.0
13.0.0

Open the chart page →

5,730
reranking-usvctest-opea1.0.01 of 1See more

reranking-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
opea/reranking-tei:1.0e48613afb191
pillow@10.4.0
13.0.0

Open the chart page →

6,020
retriever-usvctest-opea1.0.01 of 1See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
opea/retriever-redis:1.0eb746b263705
pillow@10.2.0
13.0.0

Open the chart page →

6,236
speecht5test-opea1.0.01 of 1See more

speecht5 test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
opea/speecht5:1.0249afad3d268
pillow@10.2.0
13.0.0

Open the chart page →

11,193
ttstest-opea1.0.01 of 1See more

tts test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
opea/tts:1.0257ae94709e9
pillow@10.2.0
13.0.0

Open the chart page →

5,348
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
pillow@10.4.0
13.0.0

Open the chart page →

6,450
synapsetranhailongVerified publisher0.1.01 of 2See more

synapse tranhailong 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.78.0def97fd537d8
pillow@9.4.0
13.0.0

Open the chart page →

4,044
nemo-guardrailsupstreamyardVerified publisher0.1.11 of 1See more

nemo-guardrails upstreamyard 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
upstreamyard/nemo-guardrails:0.24.19f673183cfc0
pillow@12.3.0
13.0.0

Open the chart page →

1,987
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
dpage/pgadmin4:9.252cb72a9e3da
pillow@11.1.0
13.0.0

Open the chart page →

6,943
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
pillow@11.3.0
13.0.0

Open the chart page →

10,663
supersetwbstack0.1.01 of 1See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
apache/superset:4.0.1ab9467fd712c
pillow@10.2.0
13.0.0

Open the chart page →

79,276
changedetection-iozekker6Verified publisher1.104.01 of 1See more

changedetection-io zekker6 1.104.0

1 of the 1 container images this version deploys carry CVE-2026-96640.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.904eaae7915ba
pillow@12.3.0
13.0.0

Open the chart page →

3,129

Container images carrying it

274 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
opencsghq/csgbot:v0.6.9-ee7d0271e26521
pillow@12.1.0
13.0.0
1
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
pillow@11.3.0
13.0.0
1
opendatacube/ows:latest668cbb41473c
pillow@10.2.0
pillow@10.2.0-1ubuntu1
13.0.0
no fix listed
1
opendatacube/wms:latest1b90cdf68831
pillow@5.1.0
pillow@5.1.0-1
13.0.0
no fix listed
1
opendatacube/wps:latest80df355a660b
pillow@9.0.1
pillow@9.0.1-1ubuntu0.3
13.0.0
no fix listed
1
opendronemap/nodeodm:3.6.2fcd99eb23d8d
pillow@11.3.0
13.0.0
1
openmined/syft-backend:0.9.5b72f74a68b32
pillow@11.1.0
13.0.0
1
opennode/waldur-mastermind:8.1.382e8f276c5ed
pillow@12.3.0
13.0.0
1
pangeo/base-notebook:2024.01.155fbe688a4f80
pillow@10.2.0
13.0.0
1
pretix/standalone:2026.8.0ec17c2f761f7
pillow@12.3.0
13.0.0
1
prowlercloud/prowler-api:5.31.14f252d579be2
pillow@12.2.0
13.0.0
1
pschiffe/pdns-admin:0.4.137ebba8c2b8f
pillow@11.3.0
13.0.0
1
psono/psono-server:5.0.03b974b43ea03
pillow@10.3.0
13.0.0
1
rdavidoff/twitch-channel-points-miner-v2:1.8.67ae4c5135771
pillow@10.0.0
13.0.0
1
reallibrephotos/librephotos:1.4.011418bf5d617
pillow@12.3.0
13.0.0
1
redimp/otterwiki:2b7ece5b8d7cc
pillow@12.3.0
13.0.0
1
robmarkcole/deepstack-ui:latest410275726459
pillow@8.3.2
13.0.0
1
robustadev/krr:v1.30.0b8d782e568c7
pillow@12.3.0
13.0.0
1
rommapp/romm:5.2.03512f2ca4557
pillow@12.3.0
13.0.0
1
rommapp/romm:4.4.1b909e95d1aab
pillow@10.4.0
13.0.0
1
saidsef/scapy-containerised:v2025.02f17f7c435891
pillow@11.1.0
13.0.0
1
schmitzis/monorepo:seafile-13.0-latestc583f1be2af2
pillow@11.3.0
13.0.0
1
scrapinghub/splash:3.4.1a5f89bc84606
pillow@5.4.1
13.0.0
1
seafileltd/seafile-mc:9.0.106693911bcc40
pillow@9.3.0
13.0.0
1
seafileltd/seafile-mc:10.0.170628f29c663
pillow@9.3.0
13.0.0
1
seafileltd/seafile-mc:9.0.97ac833196f60
pillow@9.2.0
13.0.0
1
seafileltd/seafile-mc:8.0.7ed0fcda5e6a9
pillow@8.3.1
13.0.0
1
signalen/backend:2.50.1826bb090bc4e4
pillow@12.3.0
13.0.0
1
sirrend/helmup-engine:0.1.13699e79e3d4e2
pillow@10.4.0
13.0.0
1
sirrend/helmup-github-scraper:0.1.47ca688c7abf5
pillow@10.3.0
13.0.0
1
sruthitanneru/pi-sample:ui-lateste565ea454ffd
pillow@11.0.0
13.0.0
1
szurubooru/server:2.5accf2ad9fbc3
pillow@11.2.1
13.0.0
1
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
pillow@9.4.0
13.0.0
1
taigaio/taiga-back:latest4beed8f62c9f
pillow@12.0.0
13.0.0
1
taigaio/taiga-back:6.4.29f97323cc150
pillow@8.2.0
13.0.0
1
timescale/timescaledb-ha:pg17.2-ts2.18.2e8d0a9cc3db5
pillow@11.1.0
13.0.0
1
tombursch/kitchenowl-backend:v0.7.104a7ed693531b
pillow@12.3.0
13.0.0
1
upstreamyard/nemo-guardrails:0.24.19f673183cfc0
pillow@12.3.0
13.0.0
1
vabene1111/recipes:2.3.50f8d061895e9
pillow@11.3.0
13.0.0
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
pillow@9.0.0
13.0.0
1
weblate/weblate:2026.10.1.26663a7c8b444
pillow@12.3.0
13.0.0
1
weblate/weblate:3.11.3-182848df56ecd
pillow@5.4.1
13.0.0
1
wger/server:2.71c5789b93bfe
pillow@12.3.0
13.0.0
1
yuzutech/kroki-blockdiag:0.16.07c1917c66d96
pillow@8.4.0
13.0.0
1
zurdi15/romm:2.3.12db88fe44c89
pillow@10.1.0
13.0.0
1
gcr.io/getindata-images-public/mlflow:latest25d6975951f1
pillow@10.3.0
13.0.0
1
ghcr.io/afairgiant/medikeep:v0.72.09285e26f6d0d
pillow@12.3.0
13.0.0
1
ghcr.io/argonix-io/argonix-api:0.6.5431abcce7c1e
pillow@12.3.0
13.0.0
1
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
pillow@11.0.0
13.0.0
1
ghcr.io/blakeblackshear/frigate:0.14.122e3d0b486df
pillow@10.4.0
13.0.0
1

syft 1.42.1 · advisories as of 24 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.