StackRadar

CVE-2026-97688

Medium

Advisory

Published 29 Sept 2026In the index since 1 Oct 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.003
20th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
577
of 17,966 indexed, latest versions
Container images
435
deployed by those charts
Fix available
1 of 3
affected packages

urllib3: Chunked Deflate streaming can enter an infinite loop

Carried by container images the latest versions of 577 of 17,966 indexed charts deploy, on 435 images.

Affected packageAffected versionsFixed inImages
urllib3pypi2.6.2, 2.6.3, 2.7.02.8.0298
python-pipdeb1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+23 moreno fix listed114
python-urllib3deb1.7.1-1build1, 1.7.1-1ubuntu4, 1.13.1-2ubuntu0.16.04.1, 1.13.1-2ubuntu0.16.04.2+12 moreno fix listed62
OSV records
GHSA-gh4c-6fx4-qh6gUBUNTU-CVE-2026-97688

Charts affected

577 by stars
ChartLatestAffected imagesRadar Score
pagespages-mihai1.0.01 of 3See more

pages pages-mihai 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagespages-nivesh1.0.01 of 3See more

pages pages-nivesh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagespagessandeepgudu1.0.01 of 3See more

pages pagessandeepgudu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagespages-shubhanker1.0.01 of 3See more

pages pages-shubhanker 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagespages-ssharma09091.0.01 of 3See more

pages pages-ssharma0909 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagespages-sucharitha1.0.01 of 3See more

pages pages-sucharitha 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagespages-sudhir1.0.01 of 3See more

pages pages-sudhir 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagespages-sushi1.0.01 of 3See more

pages pages-sushi 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagespages-vasanth58141.0.01 of 3See more

pages pages-vasanth5814 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagespages-vjp1.0.01 of 3See more

pages pages-vjp 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
urllib3@2.6.2
2.8.0

Open the chart page →

5,410
linkdingpascaliskeVerified publisher3.0.01 of 1See more

linkding pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/sissbruecker/linkding:1.45.061b2eb9eed8e
urllib3@2.6.2
2.8.0

Open the chart page →

4,305
pagespawan-pages1.0.01 of 3See more

pages pawan-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pax-prometheuspaxtecnologia0.7.31 of 8See more

pax-prometheus paxtecnologia 0.7.3

1 of the 8 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.11.22912be006f62
urllib3@2.7.0
2.8.0

Open the chart page →

1,903
stk-fluent-bit-loki-s3paxtecnologia0.2.11 of 6See more

stk-fluent-bit-loki-s3 paxtecnologia 0.2.1

1 of the 6 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
urllib3@2.6.3
2.8.0

Open the chart page →

3,950
pcppcp-helm-chartsVerified publisher1.0.11 of 1See more

pcp pcp-helm-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/performancecopilot/pcp:latest70dde5f13f08
urllib3@2.7.0
2.8.0

Open the chart page →

33
phronetisphronetis0.1.271 of 2See more

phronetis phronetis 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
knspar/phronetis:0.1.4609499d2dc91a
python-pip@24.0+dfsg-1ubuntu1.1
no fix listed

Open the chart page →

17,572
seafilephybros-helm-charts4.0.11 of 1See more

seafile phybros-helm-charts 4.0.1

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:9.0.97ac833196f60
python-pip@20.0.2-5ubuntu1.6
python-urllib3@1.25.8-2ubuntu0.1
no fix listed
no fix listed

Open the chart page →

94,375
pieeatpieeatOfficialVerified publisher0.9.31 of 1See more

pieeat pieeat 0.9.3

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/maxiv/pieeat:0.9.3099715479210
urllib3@2.6.3
2.8.0

Open the chart page →

1,734
pagespighosh-pages1.0.01 of 3See more

pages pighosh-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
playlist-mirrorplaylist-mirrorVerified publisher1.0.31 of 1See more

playlist-mirror playlist-mirror 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/itobey/playlist-mirror:1.0.0601082677a46
urllib3@2.7.0
2.8.0

Open the chart page →

1,339
pagesprasanthi1.0.01 of 3See more

pages prasanthi 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
prismeai-appsprismeai0.7.11 of 4See more

prismeai-apps prismeai 0.7.1

1 of the 4 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
urllib3@2.6.3
2.8.0

Open the chart page →

2,909
prismeai-coreprismeai1.12.31 of 7See more

prismeai-core prismeai 1.12.3

1 of the 7 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
urllib3@2.6.3
2.8.0

Open the chart page →

4,859
prowlerprowler0.1.11 of 1See more

prowler prowler 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
toniblyx/prowler:stablecf1ee9fc5b67
urllib3@2.7.0
2.8.0

Open the chart page →

1,598
flaskDiaryptj-miniproject2.1.21 of 2See more

flaskDiary ptj-miniproject 2.1.2

1 of the 2 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

3,360
qubivaqubiva0.3.21 of 3See more

qubiva qubiva 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
urllib3@2.7.0
2.8.0

Open the chart page →

7,198
airflowquench-airflowVerified publisher0.1.221 of 2See more

airflow quench-airflow 0.1.22

1 of the 2 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/airflowdigest-pinned09760517014a
urllib3@2.7.0
2.8.0

Open the chart page →

257
pgadminquench-pgadminVerified publisher0.0.21 of 1See more

pgadmin quench-pgadmin 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/pgadmindigest-pinneda989540d10b6
urllib3@2.7.0
2.8.0

Open the chart page →

128
pagesranjinigogga1.0.01 of 3See more

pages ranjinigogga 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
rawfile-localpvrawfile0.15.31 of 6See more

rawfile-localpv rawfile 0.15.3

1 of the 6 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
openebs/rawfile-localpv:v0.15.396fd7987ea79
urllib3@2.7.0
2.8.0

Open the chart page →

3,167
pagesrebecca-pages1.0.01 of 3See more

pages rebecca-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
httpbinrgnu1.0.01 of 1See more

httpbin rgnu 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
citizenstig/httpbin:latestb81c818ccb86
python-pip@8.1.1-2ubuntu0.4
no fix listed

Open the chart page →

11,758
rhbk-neurofacerhbk-neurofaceVerified publisher1.0.01 of 4See more

rhbk-neuroface rhbk-neuroface 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
urllib3@2.7.0
2.8.0

Open the chart page →

4,324
pagesroccohiggins-pages1.0.01 of 3See more

pages roccohiggins-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
reviewboardrock8sVerified publisher0.0.11 of 3See more

reviewboard rock8s 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
beanbag/reviewboard:latest6b840f546e1c
urllib3@2.7.0
2.8.0

Open the chart page →

6,389
rommromm-helm-chartVerified publisher1.5.51 of 3See more

romm romm-helm-chart 1.5.5

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
rommapp/romm:5.2.03512f2ca4557
urllib3@2.7.0
2.8.0

Open the chart page →

3,407
pagesronan-pages1.0.01 of 3See more

pages ronan-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
urllib3@2.7.0
2.8.0

Open the chart page →

8,658
flaresolverrrubxkubeVerified publisher0.1.11 of 1See more

flaresolverr rubxkube 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
flaresolverr/flaresolverr:v3.5.0139dfee1c6f8
urllib3@2.7.0
2.8.0

Open the chart page →

30,002
linkdingrubxkubeVerified publisher1.2.41 of 1See more

linkding rubxkube 1.2.4

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
sissbruecker/linkding:1.47.0e35cb50e0581
urllib3@2.7.0
2.8.0

Open the chart page →

2,460
rybbitrybbit-helm1.3.21 of 7See more

rybbit rybbit-helm 1.3.2

1 of the 7 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
alpine/k8s:1.32.12048f8d9c8cc7
urllib3@2.6.3
2.8.0

Open the chart page →

6,932
housekeepersaashousekeeper1.0.01 of 14See more

housekeeper saashousekeeper 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

4,470
safe-config-servicesafe-global0.1.01 of 3See more

safe-config-service safe-global 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
safeglobal/safe-config-service:latest09a5e495c219
urllib3@2.7.0
2.8.0

Open the chart page →

1,926
safe-stacksafe-global0.1.02 of 9See more

safe-stack safe-global 0.1.0

2 of the 9 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
safeglobal/safe-config-service:latest09a5e495c219
urllib3@2.7.0
2.8.0
safeglobal/safe-transaction-service:latest7b576c73f865
urllib3@2.7.0
2.8.0

Open the chart page →

20,611
safe-transaction-servicesafe-global0.1.01 of 6See more

safe-transaction-service safe-global 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
safeglobal/safe-transaction-service:latest7b576c73f865
urllib3@2.7.0
2.8.0

Open the chart page →

17,188
pagessamanvithkaranth1.0.01 of 3See more

pages samanvithkaranth 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagessarubits-pages1.0.01 of 3See more

pages sarubits-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
photonschichtelVerified publisher0.2.01 of 1See more

photon schichtel 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
rtuszik/photon-docker:2.4.021549c60f9e6
urllib3@2.7.0
2.8.0

Open the chart page →

3,265
seafileschmitzis13.0.131 of 4See more

seafile schmitzis 13.0.13

1 of the 4 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
schmitzis/monorepo:seafile-13.0-latestf7e51ba2fb07
python-pip@24.0+dfsg-1ubuntu1.3
urllib3@2.6.3
no fix listed
2.8.0

Open the chart page →

43,152

Container images carrying it

435 by charts deploying them

A fixed version is listed for 1 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
urllib3@2.6.3
2.8.0
1
kenchrcum/ansible-playbook-operator:0.1.712fb213debf1
urllib3@2.6.3
2.8.0
1
kenchrcum/fluxcd-helm-upgrader:0.7.7c326e28a8f5f
urllib3@2.6.3
2.8.0
1
kenchrcum/grafana-dashboard-converter:0.3.105310497aea3f
urllib3@2.6.3
2.8.0
1
kenchrcum/hetzner-s3-operator:0.1.384dae7aeea5b
urllib3@2.6.3
2.8.0
1
kenchrcum/wasabi-s3-operator:0.2.7ce657c622ce5
urllib3@2.6.3
2.8.0
1
kennethreitz/httpbin:latest599fe5e50731
python-pip@9.0.1-2.3~ubuntu1
no fix listed
1
kiwigrid/k8s-sidecar:2.10.17eac5c4fed71
urllib3@2.7.0
2.8.0
1
knspar/phronetis:0.1.4609499d2dc91a
python-pip@24.0+dfsg-1ubuntu1.1
no fix listed
1
kong/httpbin:latesta6ac46531193
python-pip@22.0.2+dfsg-1ubuntu0.5
no fix listed
1
kusionstack/kusion:v0.14.0126c8f0b0976
python-pip@22.0.2+dfsg-1ubuntu0.5
no fix listed
1
labs64/traefik-authproxy:0.0.3dfc6086dfbce
urllib3@2.7.0
2.8.0
1
langflowai/langflow:1.12.334055a07d446
urllib3@2.7.0
2.8.0
1
langgenius/dify-agent-backend:1.16.1097d3fd27a7b
urllib3@2.7.0
2.8.0
1
langgenius/dify-api:1.16.1dcefa5f7c47c
urllib3@2.7.0
2.8.0
1
langgenius/dify-plugin-daemon:0.6.3-local3c694329357b
python-pip@24.0+dfsg-1ubuntu1.3
urllib3@2.7.0
no fix listed
2.8.0
1
langgenius/dify-plugin-daemon:main-local7d2fb04baf44
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed
1
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed
1
langgenius/dify-sandbox:0.2.15750e1111426e
urllib3@2.6.3
2.8.0
1
library/mysql:8.4.108dbcf531a03a
urllib3@2.6.3
2.8.0
1
libretranslate/libretranslate:v1.9.61de2d7056bb8
urllib3@2.7.0
2.8.0
1
linuxserver/bazarr:latestd24bd0048c75
urllib3@2.7.0
2.8.0
1
linuxserver/calibre-web:0.6.24241009026e6f
python-pip@24.0+dfsg-1ubuntu1.2
no fix listed
1
linuxserver/deluge:18.04.10ac871624394
python-urllib3@1.22-1ubuntu0.18.04.2
no fix listed
1
linuxserver/deluge:version-2.0.3-2201906121747ubuntu18.04.12ce561a95e7b
python-urllib3@1.22-1ubuntu0.18.04.2
no fix listed
1
linuxserver/nzbget:26.3.2026091124951ff9689d
urllib3@2.7.0
2.8.0
1
litellm/litellm-non_root:v1.82.3-stable09b217802ded
urllib3@2.6.3
2.8.0
1
loeken/home-assistant:2026.5.14ce6abc553b3
urllib3@2.7.0
2.8.0
1
loeken/jellyfin:10.11.87efbc24e47b0
urllib3@2.6.3
2.8.0
1
lsstsqre/nublado2:2.0.1b75bf8aaafa4
python-pip@20.0.2-5ubuntu1.6
no fix listed
1
lumutools/kubernetes-feeder:lateste35ffa90b129
urllib3@2.7.0
2.8.0
1
makeplane/plane-mcp-server:v0.3.071b7252adef0
urllib3@2.7.0
2.8.0
1
maponyacharles/sceptreai:mlflow-0.1.1242d418654ebd
urllib3@2.7.0
2.8.0
1
maponyacharles/sceptreai:api-0.1.127b37b092130a
urllib3@2.7.0
2.8.0
1
marcoimme/oidcmock:latestb6035c0721a8
urllib3@2.6.3
2.8.0
1
mathesar/mathesar:0.12.0091757cb01fe
urllib3@2.7.0
2.8.0
1
matrixdotorg/synapse:v1.162.06b84a7bbac36
urllib3@2.7.0
2.8.0
1
mawad98/backstage-pyactions:demo99422c56a274
urllib3@2.6.3
2.8.0
1
mediagis/nominatim:5.3.27923a8e67197
python-pip@24.0+dfsg-1ubuntu1.3
python-urllib3@2.0.7-1ubuntu0.7
no fix listed
no fix listed
1
mediagis/nominatim:3.7c15e941485ef
python-pip@20.0.2-5ubuntu1.6
no fix listed
1
mediagis/nominatim:4.2d0eae7b51374
python-pip@22.0.2+dfsg-1ubuntu0.4
no fix listed
1
mindsdb/mindsdb:latest163011c09299
urllib3@2.6.3
2.8.0
1
mohankrishna999/k8s-ai-agent:3.1.27f980f8c650c
urllib3@2.7.0
2.8.0
1
mshanley80/httpbin2022:latest5b189a70c0fb
python-pip@20.0.2-5ubuntu1.6
no fix listed
1
muluder/prograncontrollermcord:0.1.843b597a93da7
python-urllib3@1.13.1-2ubuntu0.16.04.1
no fix listed
1
n8nio/runners:2.41.31522f8179b76
urllib3@2.7.0
2.8.0
1
netboxcommunity/netbox:v4.6.10-5.0.291b823a05cb5
urllib3@2.7.0
2.8.0
1
networktocode/nautobot:3.0-py3.13ed484336b1ad
urllib3@2.6.3
2.8.0
1
neuvector/manager:5.6.2380fcd70f3e0
urllib3@2.7.0
2.8.0
1
neuvector/prometheus-exporter:1.0.19ab4e4332053a
urllib3@2.7.0
2.8.0
1

syft 1.42.1 · advisories as of 1 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.