StackRadar

CVE-2026-97688

Medium

Advisory

Published 29 Sept 2026In the index since 1 Oct 2026
Severity
Medium
worst across findings
CVSS
6.9
base score, highest
EPSS
0.003
20th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
577
of 17,966 indexed, latest versions
Container images
435
deployed by those charts
Fix available
1 of 3
affected packages

urllib3: Chunked Deflate streaming can enter an infinite loop

Carried by container images the latest versions of 577 of 17,966 indexed charts deploy, on 435 images.

Affected packageAffected versionsFixed inImages
urllib3pypi2.6.2, 2.6.3, 2.7.02.8.0298
python-pipdeb1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+23 moreno fix listed114
python-urllib3deb1.7.1-1build1, 1.7.1-1ubuntu4, 1.13.1-2ubuntu0.16.04.1, 1.13.1-2ubuntu0.16.04.2+12 moreno fix listed62
OSV records
GHSA-gh4c-6fx4-qh6gUBUNTU-CVE-2026-97688

Charts affected

577 by stars
ChartLatestAffected imagesRadar Score
fastmcp-serverhelmforgeVerified publisher1.7.41 of 1See more

fastmcp-server helmforge 1.7.4

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.11.2fcb7017327d6
urllib3@2.6.3
2.8.0

Open the chart page →

3,772
ghosthelmforgeVerified publisher1.2.101 of 3See more

ghost helmforge 1.2.10

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.4.110744ee5ef89c
urllib3@2.6.3
2.8.0

Open the chart page →

2,978
hermes-agenthelmforgeVerified publisher1.0.11 of 1See more

hermes-agent helmforge 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.9.24fca358f12efd
urllib3@2.7.0
2.8.0

Open the chart page →

6,235
immichhelmforgeVerified publisher1.2.91 of 5See more

immich helmforge 1.2.9

1 of the 5 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-machine-learning:v3.1.05a0839dc5303
urllib3@2.6.2
2.8.0

Open the chart page →

12,121
jupyterhubhelmforgeVerified publisher1.0.61 of 3See more

jupyterhub helmforge 1.0.6

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
urllib3@2.6.3
2.8.0

Open the chart page →

6,013
langflowhelmforgeVerified publisher2.0.21 of 1See more

langflow helmforge 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
langflowai/langflow:1.12.334055a07d446
urllib3@2.7.0
2.8.0

Open the chart page →

318
mcp-serverhelmforgeVerified publisher1.0.01 of 1See more

mcp-server helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.2.061f759a1421f
urllib3@2.6.3
2.8.0

Open the chart page →

3,940
mysqlhelmforgeVerified publisher2.0.41 of 1See more

mysql helmforge 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:26.7.0ade067ae2fb1
urllib3@2.7.0
2.8.0

Open the chart page →

428
netboxhelmforgeVerified publisher2.0.21 of 4See more

netbox helmforge 2.0.2

1 of the 4 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
netboxcommunity/netbox:v4.6.10-5.0.291b823a05cb5
urllib3@2.7.0
2.8.0

Open the chart page →

4,349
olivetinhelmforgeVerified publisher1.2.21 of 2See more

olivetin helmforge 1.2.2

1 of the 2 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
jamesread/olivetin:3000.20.0f3066e207efd
urllib3@2.7.0
2.8.0

Open the chart page →

331
supersethelmforgeVerified publisher1.3.71 of 5See more

superset helmforge 1.3.7

1 of the 5 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
apache/superset:6.1.016b50bbef664
urllib3@2.6.3
2.8.0

Open the chart page →

5,693
pageshelm-repo1.0.01 of 3See more

pages helm-repo 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
urllib3@2.6.3
2.8.0

Open the chart page →

20,785
hetzner-s3-operatorhetzner-s3-operatorVerified publisher0.1.31 of 1See more

hetzner-s3-operator hetzner-s3-operator 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
kenchrcum/hetzner-s3-operator:0.1.384dae7aeea5b
urllib3@2.6.3
2.8.0

Open the chart page →

731
nominatimheywood8-helm-chartsVerified publisher3.10.81 of 3See more

nominatim heywood8-helm-charts 3.10.8

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
mediagis/nominatim:4.2d0eae7b51374
python-pip@22.0.2+dfsg-1ubuntu0.4
no fix listed

Open the chart page →

15,149
huginnhomeenterpriseinc0.2.01 of 1See more

huginn homeenterpriseinc 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
huginn/huginn:4df1217d3055db980a04f293e28016b77826e3caeab0db98264e
python-pip@9.0.1-2.3~ubuntu1.18.04.5
no fix listed

Open the chart page →

78,058
paperlesshpVerified publisher0.1.21 of 5See more

paperless hp 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
urllib3@2.7.0
2.8.0

Open the chart page →

30,498
httpbin2022httpbin2022Verified publisher0.1.11 of 1See more

httpbin2022 httpbin2022 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
mshanley80/httpbin2022:latest5b189a70c0fb
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

77,682
browserlessicoretechVerified publisher0.16.61 of 1See more

browserless icoretech 0.16.6

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.56.7b1ba7b054af2
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed

Open the chart page →

2,584
monitoring-stackict-platformVerified publisher0.4.01 of 13See more

monitoring-stack ict-platform 0.4.0

1 of the 13 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.5.0a6b3f707f883
urllib3@2.6.3
2.8.0

Open the chart page →

9,985
bluesky-pdsijmacd1.0.01 of 2See more

bluesky-pds ijmacd 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
arunvelsriram/utils:latest655ad18fd8d6
python-pip@24.0+dfsg-1ubuntu1.2
python-urllib3@2.0.7-1ubuntu0.2
no fix listed
no fix listed

Open the chart page →

9,614
ikigaiikigai-chartVerified publisher0.0.91 of 58See more

ikigai ikigai-chart 0.0.9

1 of the 58 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
jupyterhub/k8s-hub:1.2.0e4770285aaf7
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

115,998
ilum-apiilumVerified publisher6.7.31 of 1See more

ilum-api ilum 6.7.3

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ilum/api:6.7.3624fd09528c8
urllib3@2.7.0
2.8.0

Open the chart page →

2,612
impulseimpulse1.0.171 of 1See more

impulse impulse 1.0.17

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/eslupmi/impulse:v3.7.1186a24030e82
urllib3@2.6.3
2.8.0

Open the chart page →

1,273
label-studioinseefrlab2.3.11 of 3See more

label-studio inseefrlab 2.3.1

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
heartexlabs/label-studio:latestaa461572e8f9
urllib3@2.6.3
2.8.0

Open the chart page →

3,141
pgadmininseefrlab3.2.01 of 1See more

pgadmin inseefrlab 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
dpage/pgadmin4:latestc332c5f6dfba
urllib3@2.7.0
2.8.0

Open the chart page →

57
gmaintelVerified publisher0.1.01 of 1See more

gma intel 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
smartedge/generic-multi-access-network-virtualization:1.04cd63c22ce36
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

77,740
itm-servicesintelVerified publisher2.0.01 of 8See more

itm-services intel 2.0.0

1 of the 8 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
intel/dlstreamer-pipeline-server:2022.1.1-ubuntu20aa8f5483a2ef
python-pip@20.0.2-5ubuntu1.6
python-urllib3@1.25.8-2ubuntu0.1
no fix listed
no fix listed

Open the chart page →

91,138
map5gintelVerified publisher1.0.01 of 1See more

map5g intel 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
smartedge/generic-multi-access-network-virtualization:1.04cd63c22ce36
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

77,740
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
urllib3@2.6.3
2.8.0

Open the chart page →

19,848
inventreeinventreeOfficialVerified publisher0.4.301 of 2See more

inventree inventree 0.4.30

1 of the 2 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
inventree/inventree:1.5.6b61e6a7534bf
urllib3@2.7.0
2.8.0

Open the chart page →

5,820
janus-shieldjanus-shield1.0.01 of 2See more

janus-shield janus-shield 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
seoulorigin/janus-ml-sidecar:v3.192cbaad0c540
urllib3@2.7.0
2.8.0

Open the chart page →

2,694
esphomejeffrescVerified publisher0.2.21 of 1See more

esphome jeffresc 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.4.078a82d810709
urllib3@2.6.3
2.8.0

Open the chart page →

5,546
homebridgejespernohrVerified publisher0.2.01 of 1See more

homebridge jespernohr 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
homebridge/homebridge:latest77c685a40911
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed

Open the chart page →

39,069
proxmox-exporterjhofer-cloud1.4.01 of 1See more

proxmox-exporter jhofer-cloud 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
prompve/prometheus-pve-exporter:3.10.04867684c0a93
urllib3@2.7.0
2.8.0

Open the chart page →

424
k8s-ai-srek8s-ai-sreVerified publisher3.1.21 of 1See more

k8s-ai-sre k8s-ai-sre 3.1.2

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
mohankrishna999/k8s-ai-agent:3.1.27f980f8c650c
urllib3@2.7.0
2.8.0

Open the chart page →

588
flaresolverrk8s-home-lab-repo6.2.01 of 1See more

flaresolverr k8s-home-lab-repo 6.2.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
flaresolverr/flaresolverr:v3.5.0139dfee1c6f8
urllib3@2.7.0
2.8.0

Open the chart page →

30,002
youtubedl-materialk8s-home-lab-repo5.1.11 of 1See more

youtubedl-material k8s-home-lab-repo 5.1.1

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
tzahi12345/youtubedl-material:4.3.22f943d584711
python-pip@22.0.2+dfsg-1ubuntu0.2
no fix listed

Open the chart page →

10,435
jupyterhub-chartk8s-jupyterhub0.1.01 of 1See more

jupyterhub-chart k8s-jupyterhub 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
truebyteinnovationllp/jupyterhub-k8s:5.5.06bf978b96279
urllib3@2.7.0
2.8.0

Open the chart page →

1,803
authentikkagiso-me0.1.11 of 1See more

authentik kagiso-me 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
urllib3@2.6.3
2.8.0

Open the chart page →

5,138
karbkarbVerified publisher1.0.31 of 1See more

karb karb 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/xeor/karb:main647a3c938d31
urllib3@2.6.3
2.8.0

Open the chart page →

733
karb-chartkarbVerified publisher1.0.61 of 1See more

karb-chart karb 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/xeor/karb:1.0.6647a3c938d31
urllib3@2.6.3
2.8.0

Open the chart page →

733
music-assistantkarljorgensen0.1.31 of 1See more

music-assistant karljorgensen 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
urllib3@2.7.0
2.8.0

Open the chart page →

7,907
huekatool1.0.81 of 1See more

hue katool 1.0.8

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
gethue/hue:4.11.011b649636e68
python-pip@20.0.2-5ubuntu1.6
no fix listed

Open the chart page →

85,445
kc-chartkc-chart1.0.01 of 3See more

kc-chart kc-chart 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
library/mysql:latestade067ae2fb1
urllib3@2.7.0
2.8.0

Open the chart page →

9,497
allurekfirfer0.1.81 of 2See more

allure kfirfer 0.1.8

1 of the 2 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
frankescobar/allure-docker-service:2.21.08a4d7e9308de
python-pip@9.0.1-2.3~ubuntu1.18.04.6
no fix listed

Open the chart page →

69,676
kitarukitaru0.27.11 of 1See more

kitaru kitaru 0.27.1

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
zenmldocker/kitaru-server:0.27.1f1c4675a188b
urllib3@2.7.0
2.8.0

Open the chart page →

1,306
csa-exporterklicktippVerified publisher0.1.41 of 1See more

csa-exporter klicktipp 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/klicktipp/csa-exporter:0.3.12c69513f9d85
urllib3@2.7.0
2.8.0

Open the chart page →

1,288
snds-exporterklicktippVerified publisher0.2.51 of 1See more

snds-exporter klicktipp 0.2.5

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
ghcr.io/klicktipp/snds-exporter:v0.2.4a23b389cb3c5
urllib3@2.7.0
2.8.0

Open the chart page →

1,297
kovi-appkovi-charts0.9.01 of 1See more

kovi-app kovi-charts 0.9.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
kennethreitz/httpbin:latest599fe5e50731
python-pip@9.0.1-2.3~ubuntu1
no fix listed

Open the chart page →

86,689
mindsdbkronkltdVerified publisher0.1.01 of 1See more

mindsdb kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-97688.

Container imageDigestPackageFixed in
mindsdb/mindsdb:latest163011c09299
urllib3@2.6.3
2.8.0

Open the chart page →

10,835

Container images carrying it

435 by charts deploying them

A fixed version is listed for 1 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/vinny1892/octantis:latest45459c0910fc
urllib3@2.6.3
2.8.0
1
ghcr.io/zazukoians/qlever-server:v0.10.11de7869ab46e
python-pip@24.0+dfsg-1ubuntu1.3
urllib3@2.7.0
no fix listed
2.8.0
1
ghcr.io/zazukoians/qlever-ui:v0.10.151a7ec1c2de4
urllib3@2.6.3
2.8.0
1
public.ecr.aws/aktosecurity/akto-ai-automated-testing:latest573542399fe4
urllib3@2.7.0
2.8.0
1
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
python-urllib3@1.25.8-2ubuntu0.1
no fix listed
1
quay.io/argoprojlabs/argocd-image-updater:v1.2.13c56f354fac5
urllib3@2.6.3
2.8.0
1
quay.io/datamattsson/truenas-csp:v3.2.09e58f2127d85
urllib3@2.7.0
2.8.0
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
urllib3@2.7.0
2.8.0
1
quay.io/jupyterhub/k8s-hub:4.4.2108fbb01c3fe
urllib3@2.7.0
2.8.0
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
urllib3@2.6.3
2.8.0
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
urllib3@2.6.3
2.8.0
1
quay.io/jupyterhub/k8s-singleuser-sample:4.4.265e1b09fc8c9
urllib3@2.7.0
2.8.0
1
quay.io/kiwigrid/k8s-sidecar:2.10.021b9fe7bb29d
urllib3@2.7.0
2.8.0
1
quay.io/kiwigrid/k8s-sidecar:2.7.15bc0c5634d4a
urllib3@2.7.0
2.8.0
1
quay.io/kiwigrid/k8s-sidecar:2.7.3694950d736c8
urllib3@2.7.0
2.8.0
1
quay.io/kiwigrid/k8s-sidecar:2.6.0a6c101156d42
urllib3@2.6.3
2.8.0
1
quay.io/kubev2v/forklift-operator:release-2.1200312252b07e
urllib3@2.7.0
2.8.0
1
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
urllib3@2.7.0
2.8.0
1
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
urllib3@2.7.0
2.8.0
1
quay.io/maxiv/pieeat:0.9.3099715479210
urllib3@2.6.3
2.8.0
1
quay.io/opstree/k8s-sidecar:2.7.126aa9bb3386b
urllib3@2.6.3
2.8.0
1
quay.io/opstree/k8s-sidecar:2.7.37075d455b219
urllib3@2.7.0
2.8.0
1
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
urllib3@2.6.2
2.8.0
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
urllib3@2.6.2
2.8.0
1
quay.io/stackgres/operator:1.19.282f33ab3fb1e
urllib3@2.7.0
2.8.0
1
registry.gitlab.com/crafty-controller/crafty-4:latest7b6e87514259
python-pip@24.0+dfsg-1ubuntu1.3
no fix listed
1
registry.gitlab.com/dyff/dyff-orchestrator:0.22.199bd5d93aaff7
urllib3@2.7.0
2.8.0
1
registry.gitlab.com/dyff/workflows-sink:0.16.4001e589acf2e
urllib3@2.6.3
2.8.0
1
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
python-pip@20.0.2-5ubuntu1.1
no fix listed
1
registry.gitlab.com/xrow-public/helm-smtp/postfix:1.3.37eea4f0883dd
urllib3@2.6.2
2.8.0
1

syft 1.42.1 · advisories as of 1 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.