GHSA-8423-8fgw-73vq
MediumAdvisory
Published 1 Sept 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.9
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 116
- of 17,781 indexed, latest versions
- Container images
- 120
- deployed by those charts
- Fix available
- 1 of 1
- affected package
tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)
Carried by container images the latest versions of 116 of 17,781 indexed charts deploy, on 120 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| tornadopypi | 2.4.1, 4.5.3, 5.1.1, 6.0.2+14 more | 6.5.8 | 120 |
- OSV records
- GHSA-8423-8fgw-73vq
Charts affected
116 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| safe-stacksafe-global | 0.1.0 | 1 of 9See more | 19,560 |
| safe-transaction-servicesafe-global | 0.1.0 | 1 of 6See more | 16,620 |
| airflowsb-helm-charts | 0.3.0 | 1 of 1See more | 10,209 |
| seldon-deployseldon | 1.4.0 | 1 of 2See more | 21,997 |
| showroom-docs-mcpshowroom-docs-mcpVerified publisher | 2.1.0 | 1 of 4See more | 5,201 |
| backendsignalen | 4.24.0 | 1 of 4See more | 11,636 |
| srebotsrebot | 0.14.0 | 1 of 2See more | 1,542 |
| restful-distributed-lock-managerstakaterVerified publisher | 1.0.4 | 1 of 1See more | 3,116 |
| netforge-besvtechVerified publisher | 0.0.2 | 1 of 3See more | 4,674 |
| icinga2-reportsvtech-public-helm-charts | 1.0.0 | 1 of 1See more | 1,779 |
| tezos-nodetezos-nodeVerified publisher | 1.0.0 | 1 of 4See more | 5,321 |
| synapsetranhailongVerified publisher | 0.1.0 | 1 of 2See more | 3,164 |
| jupyterhubuninettsigma2 | 1.6.0 | 1 of 5See more | 8,607 |
| unmanicvhdirkVerified publisher | 0.1.4 | 1 of 1See more | 9,347 |
| calibre-webvista | 0.1.3 | 1 of 1See more | 7,628 |
| webapp-chartwebappchart | 1.0.0 | 1 of 1See more | 1,201 |
Container images carrying it
120 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| istio/ | 0a5eb4795952 | tornado | 6.5.8 | 2 |
| istio/ | 22a0410f35a8 | tornado | 6.5.8 | 2 |
| opendatacube/ | 668cbb41473c | tornado | 6.5.8 | 2 |
| safeglobal/ | 80db836cc5d5 | tornado | 6.5.8 | 2 |
| alaaamin/ | 46da5844794e | tornado | 6.5.8 | 1 |
| amagdi888/ | d8a10fc8faf6 | tornado | 6.5.8 | 1 |
| amancevice/ | c8c04bfe3d66 | tornado | 6.5.8 | 1 |
| amundsendev/ | 4d98eb21f5f9 | tornado | 6.5.8 | 1 |
| apache/ | 64e58748b6b9 | tornado | 6.5.8 | 1 |
| apache/ | ce90bdc3d2af | tornado | 6.5.8 | 1 |
| apache/ | e5560ad0b86e | tornado | 6.5.8 | 1 |
| apecloud/ | 8ac9947a2c84 | tornado | 6.5.8 | 1 |
| apsl/ | 51e2de5c2c70 | tornado | 6.5.8 | 1 |
| aristidetm/ | 469dbc951224 | tornado | 6.5.8 | 1 |
| aristidetm/ | ccb516cb8474 | tornado | 6.5.8 | 1 |
| baserow/ | 7c00549b3a6f | tornado | 6.5.8 | 1 |
| baserow/ | e0b3c8130b91 | tornado | 6.5.8 | 1 |
| baserow/ | df0c42eb67e8 | tornado | 6.5.8 | 1 |
| bmeares/ | 8e9c5bacaa82 | tornado | 6.5.8 | 1 |
| cheyang/ | 46cc34755493 | tornado | 6.5.8 | 1 |
| copyparty/ | 0a0a8605062c | tornado | 6.5.8 | 1 |
| daskdev/ | 4ecd7bc35500 | tornado | 6.5.8 | 1 |
| daskdev/ | 052630f5ca04 | tornado | 6.5.8 | 1 |
| datagrok/ | 8c2d48c1545c | tornado | 6.5.8 | 1 |
| ddosify/ | a43c5155fa1c | tornado | 6.5.8 | 1 |
| ddosify/ | e5be48b37348 | tornado | 6.5.8 | 1 |
| errbotio/ | 00ee4e0953ab | tornado | 6.5.8 | 1 |
| esphome/ | 3f51ec10e823 | tornado | 6.5.8 | 1 |
| esphome/ | 9ab8cc88b28c | tornado | 6.5.8 | 1 |
| esphome/ | b2c6322700ac | tornado | 6.5.8 | 1 |
| esphome/ | def8b6e4f517 | tornado | 6.5.8 | 1 |
| factly/ | ca5bc71d1d5c | tornado | 6.5.8 | 1 |
| geoscienceaustralia/ | f4039b45572a | tornado | 6.5.8 | 1 |
| gethue/ | 11b649636e68 | tornado | 6.5.8 | 1 |
| gethue/ | 5702b2c37ff9 | tornado | 6.5.8 | 1 |
| gethue/ | 7d5c1b9f8a79 | tornado | 6.5.8 | 1 |
| gmaas2/ | 148fc2d9afe9 | tornado | 6.5.8 | 1 |
| grafana/ | 499851658393 | tornado | 6.5.8 | 1 |
| homeassistant/ | 021e2afc6e57 | tornado | 6.5.8 | 1 |
| homeassistant/ | 8d000332b09b | tornado | 6.5.8 | 1 |
| ilum/ | ce5dcdeb22ba | tornado | 6.5.8 | 1 |
| intel/ | aa8f5483a2ef | tornado | 6.5.8 | 1 |
| intelowlproject/ | 0b22e547ea6b | tornado | 6.5.8 | 1 |
| istio/ | 6668bcf42ef0 | tornado | 6.5.8 | 1 |
| jaedb/ | 048cfbf58d57 | tornado | 6.5.8 | 1 |
| josh5/ | 4d49c4816260 | tornado | 6.5.8 | 1 |
| jupyterhub/ | 3974ba945e65 | tornado | 6.5.8 | 1 |
| jupyterhub/ | 5a0ceed1300a | tornado | 6.5.8 | 1 |
| jupyterhub/ | b6b4a1a34bf0 | tornado | 6.5.8 | 1 |
| jupyterhub/ | e4770285aaf7 | tornado | 6.5.8 | 1 |