StackRadar

CVE-2026-97688

Medium

Advisory

Published 29 Sept 2026In the index since 1 Oct 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.003
20th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
577
of 17,966 indexed, latest versions
Container images
435
deployed by those charts
Fix available
1 of 3
affected packages

urllib3: Chunked Deflate streaming can enter an infinite loop

Carried by container images the latest versions of 577 of 17,966 indexed charts deploy, on 435 images.

Affected packageAffected versionsFixed inImages
urllib3pypi2.6.2, 2.6.3, 2.7.02.8.0298
python-pipdeb1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+23 moreno fix listed114
python-urllib3deb1.7.1-1build1, 1.7.1-1ubuntu4, 1.13.1-2ubuntu0.16.04.1, 1.13.1-2ubuntu0.16.04.2+12 moreno fix listed62
OSV records
GHSA-gh4c-6fx4-qh6gUBUNTU-CVE-2026-97688

Charts affected

577 by stars
ChartLatestAffected imagesRadar Score
pagespages-mihai1.0.01 of 3See more

pages pages-mihai 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagespages-nivesh1.0.01 of 3See more

pages pages-nivesh 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagespagessandeepgudu1.0.01 of 3See more

pages pagessandeepgudu 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagespages-shubhanker1.0.01 of 3See more

pages pages-shubhanker 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagespages-ssharma09091.0.01 of 3See more

pages pages-ssharma0909 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagespages-sucharitha1.0.01 of 3See more

pages pages-sucharitha 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagespages-sudhir1.0.01 of 3See more

pages pages-sudhir 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagespages-sushi1.0.01 of 3See more

pages pages-sushi 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagespages-vasanth58141.0.01 of 3See more

pages pages-vasanth5814 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagespages-vjp1.0.01 of 3See more

pages pages-vjp 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
urllib3@2.6.2
2.8.0

Open the chart page →

5,410
linkdingpascaliskeVerified publisher3.0.01 of 1See more

linkding pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/sissbruecker/linkding:1.45.061b2eb9eed8e
urllib3@2.6.2
2.8.0

Open the chart page →

4,305
pagespawan-pages1.0.01 of 3See more

pages pawan-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pax-prometheuspaxtecnologia0.7.31 of 8See more

pax-prometheus paxtecnologia 0.7.3

1 of the 8 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.11.22912be006f62
urllib3@2.7.0
2.8.0

Open the chart page →

1,903
stk-fluent-bit-loki-s3paxtecnologia0.2.11 of 6See more

stk-fluent-bit-loki-s3 paxtecnologia 0.2.1

1 of the 6 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
urllib3@2.6.3
2.8.0

Open the chart page →

3,950
pcppcp-helm-chartsVerified publisher1.0.11 of 1See more

pcp pcp-helm-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/performancecopilot/pcp:latest70dde5f13f08
urllib3@2.7.0
2.8.0

Open the chart page →

33
phronetisphronetis0.1.271 of 2See more

phronetis phronetis 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
knspar/phronetis:0.1.4609499d2dc91a
python-pip@24.0+dfsg-1ubuntu1.1
no fix listed

Open the chart page →

17,572
seafilephybros-helm-charts4.0.11 of 1See more

seafile phybros-helm-charts 4.0.1

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:9.0.97ac833196f60
python-pip@20.0.2-5ubuntu1.6
python-urllib3@1.25.8-2ubuntu0.1
no fix listed
no fix listed

Open the chart page →

94,375
pieeatpieeatOfficialVerified publisher0.9.31 of 1See more

pieeat pieeat 0.9.3

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/maxiv/pieeat:0.9.3099715479210
urllib3@2.6.3
2.8.0

Open the chart page →

1,734
pagespighosh-pages1.0.01 of 3See more

pages pighosh-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
playlist-mirrorplaylist-mirrorVerified publisher1.0.31 of 1See more

playlist-mirror playlist-mirror 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/itobey/playlist-mirror:1.0.0601082677a46
urllib3@2.7.0
2.8.0

Open the chart page →

1,339
pagesprasanthi1.0.01 of 3See more

pages prasanthi 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
prismeai-appsprismeai0.7.11 of 4See more

prismeai-apps prismeai 0.7.1

1 of the 4 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
urllib3@2.6.3
2.8.0

Open the chart page →

2,909
prismeai-coreprismeai1.12.31 of 7See more

prismeai-core prismeai 1.12.3

1 of the 7 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-infra:latestb1198ea741d1
urllib3@2.6.3
2.8.0

Open the chart page →

4,859
prowlerprowler0.1.11 of 1See more

prowler prowler 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
toniblyx/prowler:stablecf1ee9fc5b67
urllib3@2.7.0
2.8.0

Open the chart page →

1,598
flaskDiaryptj-miniproject2.1.21 of 2See more

flaskDiary ptj-miniproject 2.1.2

1 of the 2 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

3,360
qubivaqubiva0.3.21 of 3See more

qubiva qubiva 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
urllib3@2.7.0
2.8.0

Open the chart page →

7,198
airflowquench-airflowVerified publisher0.1.221 of 2See more

airflow quench-airflow 0.1.22

1 of the 2 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/airflowdigest-pinned09760517014a
urllib3@2.7.0
2.8.0

Open the chart page →

257
pgadminquench-pgadminVerified publisher0.0.21 of 1See more

pgadmin quench-pgadmin 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/pgadmindigest-pinneda989540d10b6
urllib3@2.7.0
2.8.0

Open the chart page →

128
pagesranjinigogga1.0.01 of 3See more

pages ranjinigogga 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
rawfile-localpvrawfile0.15.31 of 6See more

rawfile-localpv rawfile 0.15.3

1 of the 6 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
openebs/rawfile-localpv:v0.15.396fd7987ea79
urllib3@2.7.0
2.8.0

Open the chart page →

3,167
pagesrebecca-pages1.0.01 of 3See more

pages rebecca-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
httpbinrgnu1.0.01 of 1See more

httpbin rgnu 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
citizenstig/httpbin:latestb81c818ccb86
python-pip@8.1.1-2ubuntu0.4
no fix listed

Open the chart page →

11,758
rhbk-neurofacerhbk-neurofaceVerified publisher1.0.01 of 4See more

rhbk-neuroface rhbk-neuroface 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
urllib3@2.7.0
2.8.0

Open the chart page →

4,324
pagesroccohiggins-pages1.0.01 of 3See more

pages roccohiggins-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
reviewboardrock8sVerified publisher0.0.11 of 3See more

reviewboard rock8s 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
beanbag/reviewboard:latest6b840f546e1c
urllib3@2.7.0
2.8.0

Open the chart page →

6,389
rommromm-helm-chartVerified publisher1.5.51 of 3See more

romm romm-helm-chart 1.5.5

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
rommapp/romm:5.2.03512f2ca4557
urllib3@2.7.0
2.8.0

Open the chart page →

3,407
pagesronan-pages1.0.01 of 3See more

pages ronan-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
urllib3@2.7.0
2.8.0

Open the chart page →

8,658
flaresolverrrubxkubeVerified publisher0.1.11 of 1See more

flaresolverr rubxkube 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
flaresolverr/flaresolverr:v3.5.0139dfee1c6f8
urllib3@2.7.0
2.8.0

Open the chart page →

30,002
linkdingrubxkubeVerified publisher1.2.41 of 1See more

linkding rubxkube 1.2.4

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
sissbruecker/linkding:1.47.0e35cb50e0581
urllib3@2.7.0
2.8.0

Open the chart page →

2,460
rybbitrybbit-helm1.3.21 of 7See more

rybbit rybbit-helm 1.3.2

1 of the 7 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
alpine/k8s:1.32.12048f8d9c8cc7
urllib3@2.6.3
2.8.0

Open the chart page →

6,932
housekeepersaashousekeeper1.0.01 of 14See more

housekeeper saashousekeeper 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

4,470
safe-config-servicesafe-global0.1.01 of 3See more

safe-config-service safe-global 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
safeglobal/safe-config-service:latest09a5e495c219
urllib3@2.7.0
2.8.0

Open the chart page →

1,926
safe-stacksafe-global0.1.02 of 9See more

safe-stack safe-global 0.1.0

2 of the 9 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
safeglobal/safe-config-service:latest09a5e495c219
urllib3@2.7.0
2.8.0
safeglobal/safe-transaction-service:latest7b576c73f865
urllib3@2.7.0
2.8.0

Open the chart page →

20,611
safe-transaction-servicesafe-global0.1.01 of 6See more

safe-transaction-service safe-global 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
safeglobal/safe-transaction-service:latest7b576c73f865
urllib3@2.7.0
2.8.0

Open the chart page →

17,188
pagessamanvithkaranth1.0.01 of 3See more

pages samanvithkaranth 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
pagessarubits-pages1.0.01 of 3See more

pages sarubits-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
photonschichtelVerified publisher0.2.01 of 1See more

photon schichtel 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
rtuszik/photon-docker:2.4.021549c60f9e6
urllib3@2.7.0
2.8.0

Open the chart page →

3,265
seafileschmitzis13.0.131 of 4See more

seafile schmitzis 13.0.13

1 of the 4 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
schmitzis/monorepo:seafile-13.0-latestf7e51ba2fb07
python-pip@24.0+dfsg-1ubuntu1.3
urllib3@2.6.3
no fix listed
2.8.0

Open the chart page →

43,152

Container images carrying it

435 by charts deploying them

A fixed version is listed for 1 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/vinny1892/octantis:latest45459c0910fc
urllib3@2.6.3
2.8.0
1
ghcr.io/zazukoians/qlever-server:v0.10.11de7869ab46e
python-pip@24.0+dfsg-1ubuntu1.3
urllib3@2.7.0
no fix listed
2.8.0
1
ghcr.io/zazukoians/qlever-ui:v0.10.151a7ec1c2de4
urllib3@2.6.3
2.8.0
1
public.ecr.aws/aktosecurity/akto-ai-automated-testing:latest573542399fe4
urllib3@2.7.0
2.8.0
1
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
python-urllib3@1.25.8-2ubuntu0.1
no fix listed
1
quay.io/argoprojlabs/argocd-image-updater:v1.2.13c56f354fac5
urllib3@2.6.3
2.8.0
1
quay.io/datamattsson/truenas-csp:v3.2.09e58f2127d85
urllib3@2.7.0
2.8.0
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
urllib3@2.7.0
2.8.0
1
quay.io/jupyterhub/k8s-hub:4.4.2108fbb01c3fe
urllib3@2.7.0
2.8.0
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
urllib3@2.6.3
2.8.0
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
urllib3@2.6.3
2.8.0
1
quay.io/jupyterhub/k8s-singleuser-sample:4.4.265e1b09fc8c9
urllib3@2.7.0
2.8.0
1
quay.io/kiwigrid/k8s-sidecar:2.10.021b9fe7bb29d
urllib3@2.7.0
2.8.0
1
quay.io/kiwigrid/k8s-sidecar:2.7.15bc0c5634d4a
urllib3@2.7.0
2.8.0
1
quay.io/kiwigrid/k8s-sidecar:2.7.3694950d736c8
urllib3@2.7.0
2.8.0
1
quay.io/kiwigrid/k8s-sidecar:2.6.0a6c101156d42
urllib3@2.6.3
2.8.0
1
quay.io/kubev2v/forklift-operator:release-2.1200312252b07e
urllib3@2.7.0
2.8.0
1
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
urllib3@2.7.0
2.8.0
1
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
urllib3@2.7.0
2.8.0
1
quay.io/maxiv/pieeat:0.9.3099715479210
urllib3@2.6.3
2.8.0
1
quay.io/opstree/k8s-sidecar:2.7.126aa9bb3386b
urllib3@2.6.3
2.8.0
1
quay.io/opstree/k8s-sidecar:2.7.37075d455b219
urllib3@2.7.0
2.8.0
1
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
urllib3@2.6.2
2.8.0
1
quay.io/stackgres/operator:1.19.282f33ab3fb1e
urllib3@2.7.0
2.8.0
1
registry.gitlab.com/crafty-controller/crafty-4:latest7b6e87514259
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed
1
registry.gitlab.com/dyff/dyff-orchestrator:0.22.199bd5d93aaff7
urllib3@2.7.0
2.8.0
1
registry.gitlab.com/dyff/workflows-sink:0.16.4001e589acf2e
urllib3@2.6.3
2.8.0
1
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
python-pip@20.0.2-5ubuntu1.1
no fix listed
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
urllib3@2.6.2
2.8.0
1

syft 1.42.1 · advisories as of 1 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.