StackRadar

CVE-2026-97688

Medium

Advisory

Published 29 Sept 2026In the index since 1 Oct 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.003
20th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
577
of 17,966 indexed, latest versions
Container images
435
deployed by those charts
Fix available
1 of 3
affected packages

urllib3: Chunked Deflate streaming can enter an infinite loop

Carried by container images the latest versions of 577 of 17,966 indexed charts deploy, on 435 images.

Affected packageAffected versionsFixed inImages
urllib3pypi2.6.2, 2.6.3, 2.7.02.8.0298
python-pipdeb1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+23 moreno fix listed114
python-urllib3deb1.7.1-1build1, 1.7.1-1ubuntu4, 1.13.1-2ubuntu0.16.04.1, 1.13.1-2ubuntu0.16.04.2+12 moreno fix listed62
OSV records
GHSA-gh4c-6fx4-qh6gUBUNTU-CVE-2026-97688

Charts affected

577 by stars
ChartLatestAffected imagesRadar Score
devnopesdevnopes0.1.81 of 1See more

devnopes devnopes 0.1.8

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
sokushinbutsu/devnopes:latest0bbd90448671
urllib3@2.7.0
2.8.0

Open the chart page →

537
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
langgenius/dify-plugin-daemon:main-local7d2fb04baf44
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed

Open the chart page →

55,753
pagesdipak1.0.01 of 3See more

pages dipak 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
adventurelogdjjudas21Verified publisher0.1.11 of 3See more

adventurelog djjudas21 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/seanmorley15/adventurelog-backend:v0.13.00250d9cb0d74
urllib3@2.7.0
2.8.0

Open the chart page →

8,224
netbirddmdhrumilmistryVerified publisher0.1.01 of 6See more

netbird dmdhrumilmistry 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
netbirdio/dashboard:latestfa2d8b02a817
urllib3@2.7.0
2.8.0

Open the chart page →

3,920
dnation-kubernetes-monitoring-stackdnationcloud5.0.01 of 18See more

dnation-kubernetes-monitoring-stack dnationcloud 5.0.0

1 of the 18 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.8.1abb55b2165c6
urllib3@2.7.0
2.8.0

Open the chart page →

24,155
codecovdoubanVerified publisher0.2.41 of 8See more

codecov douban 0.2.4

1 of the 8 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg14.6-ts2.9.1-p1cdb9ae118899
python-urllib3@1.26.5-1~exp1
no fix listed

Open the chart page →

26,156
healthchecksdoubanVerified publisher1.0.101 of 2See more

healthchecks douban 1.0.10

1 of the 2 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
healthchecks/healthchecks:latestaa08a61b0dcf
urllib3@2.7.0
2.8.0

Open the chart page →

2,116
drogue-cloud-examplesdrogue-iotVerified publisher0.7.111 of 6See more

drogue-cloud-examples drogue-iot 0.7.11

1 of the 6 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg14-ts2.6-latested719c0cd19d
python-urllib3@1.26.5-1~exp1
no fix listed

Open the chart page →

31,755
trustmanagereclipse-aeriosVerified publisher1.0.01 of 1See more

trustmanager eclipse-aerios 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
eclipseaerios/trust-manager:1.0.0f55442e2c0ed
urllib3@2.6.3
2.8.0

Open the chart page →

2,243
pagesedgwarepages1.0.01 of 3See more

pages edgwarepages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
esphomeegebackVerified publisher2.0.251 of 1See more

esphome egeback 2.0.25

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
esphome/esphome:2026.7.44866347cb5b4
urllib3@2.7.0
2.8.0

Open the chart page →

3,579
home-assistantegebackVerified publisher2.0.351 of 1See more

home-assistant egeback 2.0.35

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
urllib3@2.7.0
2.8.0

Open the chart page →

2,617
pgadmin4eks-storageclass0.1.01 of 2See more

pgadmin4 eks-storageclass 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
dpage/pgadmin4:latestc332c5f6dfba
urllib3@2.7.0
2.8.0

Open the chart page →

57
seafileeleksbai0.1.11 of 3See more

seafile eleksbai 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:9.0.106693911bcc40
python-pip@20.0.2-5ubuntu1.6
python-urllib3@1.25.8-2ubuntu0.1
no fix listed
no fix listed

Open the chart page →

94,115
emissary-ingressemissary-ingress4.1.01 of 1See more

emissary-ingress emissary-ingress 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/emissary-ingress/emissary:4.1.04a981156abee
urllib3@2.7.0
2.8.0

Open the chart page →

1,103
eoloPlanteolo-plannerVerified publisher0.1.01 of 7See more

eoloPlant eolo-planner 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:885b9bf2e29cf
urllib3@2.6.3
2.8.0

Open the chart page →

29,261
eoloPlannerCommunicationsKubernetes3eoloplannercommunicationskuberneteshelmVerified publisher0.1.01 of 7See more

eoloPlannerCommunicationsKubernetes3 eoloplannercommunicationskuberneteshelm 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:885b9bf2e29cf
urllib3@2.6.3
2.8.0

Open the chart page →

29,261
eoloplanteoloplant1.0.01 of 7See more

eoloplant eoloplant 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:80744ee5ef89c
urllib3@2.6.3
2.8.0

Open the chart page →

29,261
flywayeosc-lot-1Verified publisher0.7.01 of 3See more

flyway eosc-lot-1 0.7.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
flyway/flyway:9.1545b5d7cdc75a
python-pip@20.0.2-5ubuntu1.8
no fix listed

Open the chart page →

74,473
supportpalevilgn0me0.1.61 of 1See more

supportpal evilgn0me 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
python-urllib3@1.25.8-2ubuntu0.1
no fix listed

Open the chart page →

21,697
farm-observabilityfarm-observabilityOfficialVerified publisher0.27.22 of 18See more

farm-observability farm-observability 0.27.2

2 of the 18 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.7.3694950d736c8
urllib3@2.7.0
2.8.0
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
urllib3@2.6.3
2.8.0

Open the chart page →

14,268
flask-contactsfirst-idror-chart1.0.11 of 3See more

flask-contacts first-idror-chart 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

5,894
business-api-ecosystemfiware1.1.01 of 4See more

business-api-ecosystem fiware 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
python-pip@20.0.2-5ubuntu1.11
python-urllib3@1.25.8-2ubuntu0.4
no fix listed
no fix listed

Open the chart page →

117,372
flask-contactsflask-contacts-generic1.0.11 of 3See more

flask-contacts flask-contacts-generic 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

5,894
fluxcd-helm-upgraderfluxcd-helm-upgraderVerified publisher0.7.71 of 1See more

fluxcd-helm-upgrader fluxcd-helm-upgrader 0.7.7

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
kenchrcum/fluxcd-helm-upgrader:0.7.7c326e28a8f5f
urllib3@2.6.3
2.8.0

Open the chart page →

2,627
flyteconnectorflyte2.0.01 of 1See more

flyteconnector flyte 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
urllib3@2.7.0
2.8.0

Open the chart page →

4,105
flyte-devboxflyte0.1.01 of 14See more

flyte-devbox flyte 0.1.0

1 of the 14 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
urllib3@2.7.0
2.8.0

Open the chart page →

8,866
forgejoforgejo-captnbp-helm1.2.61 of 2See more

forgejo forgejo-captnbp-helm 1.2.6

1 of the 2 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/cloudnative-pg/postgresql:18.4-system-trixie42708a75345b
urllib3@2.7.0
2.8.0

Open the chart page →

2,175
pagesgary-pages1.0.01 of 3See more

pages gary-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
airsonicgeek-cookbookVerified publisher6.4.21 of 1See more

airsonic geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
airsonicadvanced/airsonic-advanced:latestf7cbafac2806
python-urllib3@1.25.8-2ubuntu0.1
no fix listed

Open the chart page →

18,795
delugegeek-cookbookVerified publisher5.4.21 of 1See more

deluge geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
linuxserver/deluge:version-2.0.3-2201906121747ubuntu18.04.12ce561a95e7b
python-urllib3@1.22-1ubuntu0.18.04.2
no fix listed

Open the chart page →

14,003
seafilegeek-cookbookVerified publisher3.2.01 of 1See more

seafile geek-cookbook 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:8.0.7ed0fcda5e6a9
python-pip@20.0.2-5ubuntu1.6
python-urllib3@1.25.8-2ubuntu0.1
no fix listed
no fix listed

Open the chart page →

102,703
mysqlgengxiankun-charts0.2.01 of 1See more

mysql gengxiankun-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

511
geomapfishgeomapfish0.8.01 of 3See more

geomapfish geomapfish 0.8.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
camptocamp/geomapfishapp-geoportal:latestae874f70cc16
python-pip@24.0+dfsg-1ubuntu1.3
urllib3@2.7.0
no fix listed
2.8.0

Open the chart page →

7,146
kube-prometheus-stackgpg-dev84.0.01 of 6See more

kube-prometheus-stack gpg-dev 84.0.0

1 of the 6 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.6.0a6c101156d42
urllib3@2.6.3
2.8.0

Open the chart page →

4,470
grafana-dashboard-convertergrafana-dashboard-converterVerified publisher0.3.101 of 1See more

grafana-dashboard-converter grafana-dashboard-converter 0.3.10

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
kenchrcum/grafana-dashboard-converter:0.3.105310497aea3f
urllib3@2.6.3
2.8.0

Open the chart page →

1,015
grapple-installergrapple-installer0.3.221 of 1See more

grapple-installer grapple-installer 0.3.22

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
grpl/grapple-cli:0.2.127c00aafee6629
python-pip@24.0+dfsg-1ubuntu1
no fix listed

Open the chart page →

88,899
mysqlgroundhog2k3.1.41 of 1See more

mysql groundhog2k 3.1.4

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:9.7.230a0abfa7b50
urllib3@2.6.3
2.8.0

Open the chart page →

511
hawk-envoy-pluginhawk0.1.01 of 4See more

hawk-envoy-plugin hawk 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
kong/httpbin:latesta6ac46531193
python-pip@22.0.2+dfsg-1ubuntu0.5
no fix listed

Open the chart page →

69,666
heliconehelicone0.1.421 of 14See more

helicone helicone 0.1.42

1 of the 14 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
helicone/clickhouse-migration-runner:v2025.03.05-14c69b971a7e4
python-pip@20.0.2-5ubuntu1.11
no fix listed

Open the chart page →

79,355
helixhelix1.4.31 of 2See more

helix helix 1.4.3

1 of the 2 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
urllib3@2.6.3
2.8.0

Open the chart page →

6,241
pageshelm-chart-repos-camden1.0.01 of 3See more

pages helm-chart-repos-camden 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
supersethelm-charts-nr1.1.31 of 1See more

superset helm-charts-nr 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
apache/superset:latest16b50bbef664
urllib3@2.6.3
2.8.0

Open the chart page →

2,635
appwritehelmforgeVerified publisher2.0.21 of 5See more

appwrite helmforge 2.0.2

1 of the 5 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
appwrite/appwrite:2.3.034ef77fb6e87
urllib3@2.7.0
2.8.0

Open the chart page →

4,745
chiefonboardinghelmforgeVerified publisher1.1.151 of 3See more

chiefonboarding helmforge 1.1.15

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
chiefonboarding/chiefonboarding:v2.5.0d0964135ea82
urllib3@2.7.0
2.8.0

Open the chart page →

7,786
ckanhelmforgeVerified publisher1.3.91 of 6See more

ckan helmforge 1.3.9

1 of the 6 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ckan/ckan-base:2.12.087ecf3f27ad6
urllib3@2.7.0
2.8.0

Open the chart page →

10,326
countlyhelmforgeVerified publisher1.2.81 of 3See more

countly helmforge 1.2.8

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
countly/countly-server:25.05.4e3c238248f99
python-urllib3@1.25.8-2ubuntu0.1
no fix listed

Open the chart page →

75,569
discount-bandithelmforgeVerified publisher2.0.91 of 3See more

discount-bandit helmforge 2.0.9

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:26.7.0ade067ae2fb1
urllib3@2.7.0
2.8.0

Open the chart page →

32,722
drupalhelmforgeVerified publisher1.2.151 of 2See more

drupal helmforge 1.2.15

1 of the 2 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:26.7.0ade067ae2fb1
urllib3@2.7.0
2.8.0

Open the chart page →

3,795

Container images carrying it

435 by charts deploying them

A fixed version is listed for 1 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/vinny1892/octantis:latest45459c0910fc
urllib3@2.6.3
2.8.0
1
ghcr.io/zazukoians/qlever-server:v0.10.11de7869ab46e
python-pip@24.0+dfsg-1ubuntu1.3
urllib3@2.7.0
no fix listed
2.8.0
1
ghcr.io/zazukoians/qlever-ui:v0.10.151a7ec1c2de4
urllib3@2.6.3
2.8.0
1
public.ecr.aws/aktosecurity/akto-ai-automated-testing:latest573542399fe4
urllib3@2.7.0
2.8.0
1
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
python-urllib3@1.25.8-2ubuntu0.1
no fix listed
1
quay.io/argoprojlabs/argocd-image-updater:v1.2.13c56f354fac5
urllib3@2.6.3
2.8.0
1
quay.io/datamattsson/truenas-csp:v3.2.09e58f2127d85
urllib3@2.7.0
2.8.0
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
urllib3@2.7.0
2.8.0
1
quay.io/jupyterhub/k8s-hub:4.4.2108fbb01c3fe
urllib3@2.7.0
2.8.0
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
urllib3@2.6.3
2.8.0
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
urllib3@2.6.3
2.8.0
1
quay.io/jupyterhub/k8s-singleuser-sample:4.4.265e1b09fc8c9
urllib3@2.7.0
2.8.0
1
quay.io/kiwigrid/k8s-sidecar:2.10.021b9fe7bb29d
urllib3@2.7.0
2.8.0
1
quay.io/kiwigrid/k8s-sidecar:2.7.15bc0c5634d4a
urllib3@2.7.0
2.8.0
1
quay.io/kiwigrid/k8s-sidecar:2.7.3694950d736c8
urllib3@2.7.0
2.8.0
1
quay.io/kiwigrid/k8s-sidecar:2.6.0a6c101156d42
urllib3@2.6.3
2.8.0
1
quay.io/kubev2v/forklift-operator:release-2.1200312252b07e
urllib3@2.7.0
2.8.0
1
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
urllib3@2.7.0
2.8.0
1
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
urllib3@2.7.0
2.8.0
1
quay.io/maxiv/pieeat:0.9.3099715479210
urllib3@2.6.3
2.8.0
1
quay.io/opstree/k8s-sidecar:2.7.126aa9bb3386b
urllib3@2.6.3
2.8.0
1
quay.io/opstree/k8s-sidecar:2.7.37075d455b219
urllib3@2.7.0
2.8.0
1
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
urllib3@2.6.2
2.8.0
1
quay.io/stackgres/operator:1.19.282f33ab3fb1e
urllib3@2.7.0
2.8.0
1
registry.gitlab.com/crafty-controller/crafty-4:latest7b6e87514259
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed
1
registry.gitlab.com/dyff/dyff-orchestrator:0.22.199bd5d93aaff7
urllib3@2.7.0
2.8.0
1
registry.gitlab.com/dyff/workflows-sink:0.16.4001e589acf2e
urllib3@2.6.3
2.8.0
1
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
python-pip@20.0.2-5ubuntu1.1
no fix listed
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
urllib3@2.6.2
2.8.0
1

syft 1.42.1 · advisories as of 1 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.