StackRadar

GHSA-3hv7-mjh2-fv65

Medium

Advisory

Published 30 Sept 2026In the index since 1 Oct 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
138
of 17,966 indexed, latest versions
Container images
137
deployed by those charts
Fix available
1 of 1
affected package

Tornado: Unbounded query-string argument count allows event-loop-stalling DoS

Carried by container images the latest versions of 138 of 17,966 indexed charts deploy, on 137 images.

Affected packageAffected versionsFixed inImages
tornadopypi2.4.1, 4.4.3, 4.5.3, 5.0.2+17 more6.5.9137
OSV records
GHSA-3hv7-mjh2-fv65

Charts affected

138 by stars
ChartLatestAffected imagesRadar Score
jupyterhubkubeblocksVerified publisher0.1.02 of 7See more

jupyterhub kubeblocks 0.1.0

2 of the 7 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
jupyterhub/k8s-hub:3.0.1-0.dev.git.6287.hbfb05cd65a0ceed1300a
tornado@6.3.2
6.5.9
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
tornado@6.3.2
6.5.9

Open the chart page →

7,742
sample-bookinfokubesphere-carryon-test1.0.01 of 4See more

sample-bookinfo kubesphere-carryon-test 1.0.0

1 of the 4 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
kubesphere/examples-bookinfo-productpage-v1:1.13.0378f49ec9c44
tornado@4.5.3
6.5.9

Open the chart page →

10,012
sample-bookinfokubesphere-testVerified publisher1.0.01 of 4See more

sample-bookinfo kubesphere-test 1.0.0

1 of the 4 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
kubesphere/examples-bookinfo-productpage-v1:1.13.0378f49ec9c44
tornado@4.5.3
6.5.9

Open the chart page →

10,012
kyso-nbdimekyso1.0.01 of 1See more

kyso-nbdime kyso 1.0.0

1 of the 1 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
kyso/kyso-nbdime:latest4aa9d38ee81d
tornado@6.2
6.5.9

Open the chart page →

2,970
oncall-hobbylovemew67Verified publisher0.0.51 of 2See more

oncall-hobby lovemew67 0.0.5

1 of the 2 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
grafana/oncall:v1.13.11159b6b836fed
tornado@6.4.2
6.5.9

Open the chart page →

6,320
nubladolsst-sqre0.9.233 of 5See more

nublado lsst-sqre 0.9.23

3 of the 5 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
lsstsqre/prepuller:latest19c2dfc4e4ff
tornado@6.1
6.5.9
lsstsqre/sciplat-hub:latest5e0ade6bed1c
tornado@6.1
6.5.9
lsstsqre/wfdispatcher:lateste9feb99f524d
tornado@6.1
6.5.9

Open the chart page →

6,309
nublado2lsst-sqre0.8.51 of 2See more

nublado2 lsst-sqre 0.8.5

1 of the 2 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
lsstsqre/nublado2:2.0.1b75bf8aaafa4
tornado@6.1
6.5.9

Open the chart page →

93,398
meerschaummeerschaumVerified publisher0.2.01 of 1See more

meerschaum meerschaum 0.2.0

1 of the 1 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
bmeares/meerschaum:2.8.48e9c5bacaa82
tornado@6.4.2
6.5.9

Open the chart page →

6,396
errbotmidokura-communityVerified publisher0.0.51 of 1See more

errbot midokura-community 0.0.5

1 of the 1 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
errbotio/errbot:6.1.900ee4e0953ab
tornado@6.1
6.5.9

Open the chart page →

2,338
paperless-ngxmt1905027.6.141 of 4See more

paperless-ngx mt190502 7.6.14

1 of the 4 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
tornado@6.5.2
6.5.9

Open the chart page →

12,979
sickchillnicholaswildeVerified publisher0.1.01 of 1See more

sickchill nicholaswilde 0.1.0

1 of the 1 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/sickchill:2021.5.10-1-ls63a607452a692a
tornado@6.1
6.5.9

Open the chart page →

1,199
paperless-ngxoli-the-devVerified publisher1.1.11 of 1See more

paperless-ngx oli-the-dev 1.1.1

1 of the 1 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
tornado@6.5.8
6.5.9

Open the chart page →

5,464
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
onyxdotapp/onyx-backend:latest60e83a098ae4
tornado@6.5.7
6.5.9

Open the chart page →

7,423
opds-shelfopds-shelfVerified publisher0.4.01 of 3See more

opds-shelf opds-shelf 0.4.0

1 of the 3 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/calibre-web:latest0767226fcf20
tornado@6.5.8
6.5.9

Open the chart page →

5,076
chatbot-ai-sampleopenshift0.1.61 of 4See more

chatbot-ai-sample openshift 0.1.6

1 of the 4 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
tornado@6.4
6.5.9

Open the chart page →

20,376
python-apppython-app-chart0.1.01 of 2See more

python-app python-app-chart 0.1.0

1 of the 2 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
mnaggar3396/python-app:latest371d8ed84b15
tornado@6.2
6.5.9

Open the chart page →

3,926
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
tornado@6.4.1
6.5.9

Open the chart page →

22,494
reload-counterreload-counter0.1.01 of 1See more

reload-counter reload-counter 0.1.0

1 of the 1 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
alaaamin/reload-count-tornado-py-app:v1.0.1alpine46da5844794e
tornado@5.1.1
6.5.9

Open the chart page →

1,052
esphomeretsamedocVerified publisher2026.2.51 of 1See more

esphome retsamedoc 2026.2.5

1 of the 1 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
esphome/esphome:2024.3.09ab8cc88b28c
tornado@6.4
6.5.9

Open the chart page →

7,882
bookinforgnu1.0.01 of 7See more

bookinfo rgnu 1.0.0

1 of the 7 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
istio/examples-bookinfo-productpage-v1:1.14.022a0410f35a8
tornado@4.5.3
6.5.9

Open the chart page →

21,507
istio-bookinforgnu1.0.21 of 7See more

istio-bookinfo rgnu 1.0.2

1 of the 7 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
istio/examples-bookinfo-productpage-v1:1.14.022a0410f35a8
tornado@4.5.3
6.5.9

Open the chart page →

21,507
matrix-stackrock8sVerified publisher0.8.11 of 7See more

matrix-stack rock8s 0.8.1

1 of the 7 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.127.1c3c4a9de2a0b
tornado@6.4.2
6.5.9

Open the chart page →

9,872
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
tornado@6.5.2
6.5.9

Open the chart page →

11,750
safe-stacksafe-global0.1.01 of 9See more

safe-stack safe-global 0.1.0

1 of the 9 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
safeglobal/safe-transaction-service:latest7b576c73f865
tornado@6.5.8
6.5.9

Open the chart page →

20,611
safe-transaction-servicesafe-global0.1.01 of 6See more

safe-transaction-service safe-global 0.1.0

1 of the 6 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
safeglobal/safe-transaction-service:latest7b576c73f865
tornado@6.5.8
6.5.9

Open the chart page →

17,188
airflowsb-helm-charts0.3.01 of 1See more

airflow sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
apache/airflow:2.8.1e5560ad0b86e
tornado@6.4
6.5.9

Open the chart page →

10,912
seldon-deployseldon1.4.01 of 2See more

seldon-deploy seldon 1.4.0

1 of the 2 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
seldonio/seldon-request-logger:1.11.24e985d2006a8
tornado@6.1
6.5.9

Open the chart page →

22,877
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
tornado@6.5.5
6.5.9

Open the chart page →

5,789
backendsignalen4.25.01 of 4See more

backend signalen 4.25.0

1 of the 4 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
signalen/backend:2.50.1826bb090bc4e4
tornado@6.5.8
6.5.9

Open the chart page →

11,735
srebotsrebot0.14.01 of 2See more

srebot srebot 0.14.0

1 of the 2 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
tornado@6.5.4
6.5.9

Open the chart page →

1,779
restful-distributed-lock-managerstakaterVerified publisher1.0.41 of 1See more

restful-distributed-lock-manager stakater 1.0.4

1 of the 1 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
stakater/restful-distributed-lock-manager:0.5.34f8e409f30c2
tornado@2.4.1
6.5.9

Open the chart page →

3,565
icinga2-reportsvtech-public-helm-charts1.0.01 of 1See more

icinga2-report svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
trungkien210493/icinga2-report:v1.7.12cc8c3763c4c
tornado@5.1.1
6.5.9

Open the chart page →

1,835
tezos-nodetezos-nodeVerified publisher1.0.01 of 4See more

tezos-node tezos-node 1.0.0

1 of the 4 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
oxheadalpha/tezos-k8s-utils:5.3.4d9faed45bf1c
tornado@6.1
6.5.9

Open the chart page →

5,400
synapsetranhailongVerified publisher0.1.01 of 2See more

synapse tranhailong 0.1.0

1 of the 2 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.78.0def97fd537d8
tornado@6.1
6.5.9

Open the chart page →

3,282
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
tornado@6.2
6.5.9

Open the chart page →

9,112
unmanicvhdirkVerified publisher0.1.41 of 1See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
josh5/unmanic:0.2.64d49c4816260
tornado@6.0.2
6.5.9

Open the chart page →

80,662
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
tornado@6.4.2
6.5.9

Open the chart page →

8,510
webapp-chartwebappchart1.0.01 of 1See more

webapp-chart webappchart 1.0.0

1 of the 1 container images this version deploys carry GHSA-3hv7-mjh2-fv65.

Container imageDigestPackageFixed in
amagdi888/my-repo:hello-appd8a10fc8faf6
tornado@5.1.1
6.5.9

Open the chart page →

1,246

Container images carrying it

137 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
truebyteinnovationllp/jupyterhub-k8s:5.5.06bf978b96279
tornado@6.5.7
6.5.9
1
trungkien210493/icinga2-report:v1.7.12cc8c3763c4c
tornado@5.1.1
6.5.9
1
wger/server:2.71c5789b93bfe
tornado@6.5.8
6.5.9
1
ghcr.io/berriai/litellm:1.102.0:main-stable32cfd7a427f6
tornado@6.5.8
6.5.9
1
ghcr.io/berriai/litellm:1.103.1df15400b5b80
tornado@6.5.8
6.5.9
1
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
tornado@6.5.8
6.5.9
1
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
tornado@6.4
6.5.9
1
ghcr.io/dask/dask:2024.1.0080150de7d86
tornado@6.3.3
6.5.9
1
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
tornado@6.5.4
6.5.9
1
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
tornado@6.3.3
6.5.9
1
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
tornado@6.4.1
6.5.9
1
ghcr.io/esphome/esphome:2026.4.078a82d810709
tornado@6.5.5
6.5.9
1
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
tornado@6.1
6.5.9
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
tornado@6.3.3
6.5.9
1
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
tornado@6.5.4
6.5.9
1
ghcr.io/linuxserver/calibre-web:latest0767226fcf20
tornado@6.5.8
6.5.9
1
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
tornado@6.5.7
6.5.9
1
ghcr.io/linuxserver/sickchill:2021.5.10-1-ls63a607452a692a
tornado@6.1
6.5.9
1
ghcr.io/opendatacube/explorer:latest7c25578068cd
tornado@6.5.8
6.5.9
1
ghcr.io/opendatacube/ows:latestf591c9d96c0f
tornado@6.5.7
6.5.9
1
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
tornado@6.4.1
6.5.9
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
tornado@6.5.2
6.5.9
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
tornado@6.5.2
6.5.9
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
tornado@6.5.2
6.5.9
1
ghcr.io/paperless-ngx/paperless-ngx:2.10.1a132c2ac7c57
tornado@6.4.1
6.5.9
1
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
tornado@6.3.3
6.5.9
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
tornado@6.5.2
6.5.9
1
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
tornado@6.5.4
6.5.9
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
tornado@6.5.5
6.5.9
1
quay.io/jupyterhub/k8s-hub:4.4.2108fbb01c3fe
tornado@6.5.8
6.5.9
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
tornado@6.5.5
6.5.9
1
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
tornado@6.3.3
6.5.9
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
tornado@6.5.5
6.5.9
1
quay.io/jupyterhub/k8s-singleuser-sample:4.4.265e1b09fc8c9
tornado@6.5.8
6.5.9
1
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
tornado@6.2
6.5.9
1
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
tornado@6.4
6.5.9
1
registry.gitlab.com/crafty-controller/crafty-4:latest7b6e87514259
tornado@6.5.4
6.5.9
1

syft 1.42.1 · advisories as of 1 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.