CVE-2026-96641
MediumAdvisory
Published 21 Oct 2026In the index since 23 Oct 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.5
- base score, highest
- EPSS
- 0.003
- 19th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 295
- of 18,232 indexed, latest versions
- Container images
- 279
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise
Carried by container images the latest versions of 295 of 18,232 indexed charts deploy, on 279 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| pillowpypi | 2.6.1, 4.0.0, 4.3.0, 5.0.0+36 more | 13.0.0 | 279 |
| pillowdeb | 5.1.0-1, 5.1.0-1ubuntu0.6, 5.1.0-1ubuntu0.7, 7.0.0-4ubuntu0.5+7 more | no fix listed | 15 |
- OSV records
- DEBIAN-CVE-2026-96641GHSA-4rm8-3hmm-39fgUBUNTU-CVE-2026-96641
- Trending
- Rank 15 in indexed charts, since 24 Oct 2026. See the ranking →
Charts affected
295 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| pgadmin4runixVerified publisher | 1.70.4 | 1 of 1See more | 644 |
| home-assistanthelm-hassVerified publisher | 0.3.88 | 1 of 1See more | 1,797 |
| mlflowcommunity-chartsVerified publisher | 1.11.7 | 1 of 1See more | 1,639 |
| netboxnetboxOfficialVerified publisher | 8.3.94 | 1 of 5See more | 2,046 |
| netboxbootcVerified publisher | 4.1.1 | 1 of 4See more | 10,425 |
| clearmlallegroaiOfficialVerified publisher | 7.15.0 | 1 of 4See more | 73,887 |
| weblateweblateOfficialVerified publisher | 0.5.44 | 1 of 3See more | 8,034 |
| difydify-helmVerified publisher | 0.39.0 | 2 of 11See more | 64,891 |
| home-assistantgeek-cookbookVerified publisher | 13.5.0 | 1 of 1See more | 9,736 |
| synapsehalkeye | 0.40.0 | 1 of 2See more | 8,198 |
| daskdask | 2024.1.1 | 2 of 2See more | 15,679 |
| homeassistantvolker-raschekVerified publisher | 0.2.3 | 1 of 1See more | 8,090 |
| frigateblakeblackshear | 7.8.0 | 1 of 1See more | 4,778 |
| paperless-ngxfmjstudios | 0.2.8 | 1 of 5See more | 37,307 |
| nautobotnautobotOfficialVerified publisher | 3.2.0 | 1 of 1See more | 6,065 |
| syftopenmined | 0.9.5 | 1 of 6See more | 22,327 |
| paperless-ngxpaperless-ngxVerified publisher | 0.3.25 | 1 of 3See more | 10,438 |
| home-assistantalekcVerified publisher | 2.12.3 | 1 of 1See more | 1,797 |
| home-assistantandrenarchyVerified publisher | 14.104.0 | 1 of 1See more | 4,398 |
| minecraft-overvieweralphani-helm-chartsVerified publisher | 0.1.0 | 1 of 3See more | 4,202 |
| baserowbaserow-chartVerified publisher | 1.1.1 | 1 of 6See more | 20,099 |
| pgadmincetic | 0.1.12 | 1 of 1See more | 644 |
| daskhubdask | 2024.1.1 | 1 of 9See more | 18,630 |
| seafiledatamateVerified publisher | 0.6.0 | 1 of 6See more | 85,274 |
| taigarc-helm-charts | 0.1.0 | 1 of 7See more | 8,774 |
| netboxstartechnicaVerified publisher | 5.1.0 | 1 of 4See more | 2,402 |
| grafana-pdf-exporterwiremindVerified publisher | 2.1.1 | 1 of 1See more | 11,450 |
| matrixzekker6Verified publisher | 3.34.0 | 1 of 4See more | 6,555 |
| changedetectionalekcVerified publisher | 0.14.7 | 1 of 1See more | 3,129 |
| convertigoconvertigoOfficialVerified publisher | 8.4.6 | 1 of 5See more | 79,283 |
| openshift-secured-pgadmineximiaitVerified publisher | 0.2.0 | 1 of 2See more | 16,105 |
| deconzgeek-cookbookVerified publisher | 6.5.2 | 1 of 1See more | 4,589 |
| frigategeek-cookbookVerified publisher | 8.2.2 | 1 of 1See more | 11,896 |
| mealiegeek-cookbookVerified publisher | 5.1.2 | 1 of 2See more | 9,923 |
| mlflowgetindataVerified publisher | 0.1.2 | 1 of 1See more | 3,123 |
| simple-krr-dashboardhelm-simple-krr-dashboardVerified publisher | 1.6.2 | 1 of 3See more | 3,659 |
| home-assistanthome-assistantVerified publisher | 0.5.14 | 1 of 3See more | 4,129 |
| calibre-webk8s-home-lab-repo | 9.1.1 | 1 of 1See more | 7,392 |
| home-assistantk8s-home-lab-repo | 16.3.1 | 1 of 1See more | 6,889 |
| mlflow-tracking-servermlflow-tracking-serverVerified publisher | 4.1.0 | 1 of 1See more | 1,230 |
| kobotoolboxone-acre-fundVerified publisher | 0.7.4 | 2 of 9See more | 24,982 |
| oesopsmxVerified publisher | 4.0.32 | 1 of 25See more | 114,036 |
| skypilotskypilotOfficialVerified publisher | 0.14.1 | 1 of 3See more | 7,122 |
| pretixtechwolf12Verified publisher | 2026.8.0 | 1 of 3See more | 11,400 |
| mealieth-chartsVerified publisher | 0.5.1 | 1 of 1See more | 5,414 |
| wgerwgerOfficialVerified publisher | 2.0.0 | 1 of 7See more | 9,774 |
| paperless-ngxadnoctemVerified publisher | 0.5.1 | 1 of 5See more | 33,726 |
| agentareaagentareaVerified publisher | 0.0.29 | 1 of 17See more | 13,394 |
| paperless-ngxalexmorbo-paperless-ngxVerified publisher | 0.2.0 | 1 of 2See more | 15,607 |
| clearml-servingallegroaiVerified publisher | 1.6.2 | 2 of 9See more | 26,898 |
Container images carrying it
279 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| opea/ | 257ae94709e9 | pillow | 13.0.0 | 1 |
| opea/ | fe08165d7770 | pillow | 13.0.0 | 1 |
| opencsghq/ | 41cba9c366f1 | pillow | 13.0.0 | 1 |
| opencsghq/ | 7d0271e26521 | pillow | 13.0.0 | 1 |
| opencsghq/ | c36a5bac3cf0 | pillow | 13.0.0 | 1 |
| opendatacube/ | 668cbb41473c | pillow pillow | 13.0.0 no fix listed | 1 |
| opendatacube/ | 1b90cdf68831 | pillow pillow | 13.0.0 no fix listed | 1 |
| opendatacube/ | 80df355a660b | pillow pillow | 13.0.0 no fix listed | 1 |
| opendronemap/ | fcd99eb23d8d | pillow | 13.0.0 | 1 |
| openmined/ | b72f74a68b32 | pillow | 13.0.0 | 1 |
| opennode/ | 82e8f276c5ed | pillow | 13.0.0 | 1 |
| pangeo/ | 5fbe688a4f80 | pillow | 13.0.0 | 1 |
| pretix/ | ec17c2f761f7 | pillow | 13.0.0 | 1 |
| prowlercloud/ | 4f252d579be2 | pillow | 13.0.0 | 1 |
| pschiffe/ | 37ebba8c2b8f | pillow | 13.0.0 | 1 |
| psono/ | 3b974b43ea03 | pillow | 13.0.0 | 1 |
| rdavidoff/ | 7ae4c5135771 | pillow | 13.0.0 | 1 |
| reallibrephotos/ | 11418bf5d617 | pillow | 13.0.0 | 1 |
| redimp/ | b7ece5b8d7cc | pillow | 13.0.0 | 1 |
| robmarkcole/ | 410275726459 | pillow | 13.0.0 | 1 |
| robustadev/ | b8d782e568c7 | pillow | 13.0.0 | 1 |
| rommapp/ | 3512f2ca4557 | pillow | 13.0.0 | 1 |
| rommapp/ | b909e95d1aab | pillow | 13.0.0 | 1 |
| saidsef/ | f17f7c435891 | pillow | 13.0.0 | 1 |
| schmitzis/ | c583f1be2af2 | pillow | 13.0.0 | 1 |
| scrapinghub/ | a5f89bc84606 | pillow | 13.0.0 | 1 |
| seafileltd/ | 6693911bcc40 | pillow | 13.0.0 | 1 |
| seafileltd/ | 70628f29c663 | pillow | 13.0.0 | 1 |
| seafileltd/ | 7ac833196f60 | pillow | 13.0.0 | 1 |
| seafileltd/ | ed0fcda5e6a9 | pillow | 13.0.0 | 1 |
| signalen/ | 26bb090bc4e4 | pillow | 13.0.0 | 1 |
| sirrend/ | 699e79e3d4e2 | pillow | 13.0.0 | 1 |
| sirrend/ | 7ca688c7abf5 | pillow | 13.0.0 | 1 |
| sruthitanneru/ | e565ea454ffd | pillow | 13.0.0 | 1 |
| szurubooru/ | accf2ad9fbc3 | pillow | 13.0.0 | 1 |
| tachyongroup/ | f4f7fabe1037 | pillow | 13.0.0 | 1 |
| taigaio/ | 4beed8f62c9f | pillow | 13.0.0 | 1 |
| taigaio/ | 9f97323cc150 | pillow | 13.0.0 | 1 |
| timescale/ | e8d0a9cc3db5 | pillow | 13.0.0 | 1 |
| timothyclarke/ | 22c41e5ca7e2 | pillow | 13.0.0 | 1 |
| timothyclarke/ | 40a80ced8031 | pillow | 13.0.0 | 1 |
| tombursch/ | 4a7ed693531b | pillow | 13.0.0 | 1 |
| upstreamyard/ | 9f673183cfc0 | pillow | 13.0.0 | 1 |
| vabene1111/ | 0f8d061895e9 | pillow | 13.0.0 | 1 |
| vabene1111/ | ec4e9e2905b0 | pillow | 13.0.0 | 1 |
| weblate/ | 6663a7c8b444 | pillow | 13.0.0 | 1 |
| weblate/ | 82848df56ecd | pillow | 13.0.0 | 1 |
| wger/ | 1c5789b93bfe | pillow | 13.0.0 | 1 |
| yuzutech/ | 7c1917c66d96 | pillow | 13.0.0 | 1 |
| zurdi15/ | 2db88fe44c89 | pillow | 13.0.0 | 1 |