StackRadar

GHSA-9v8h-qqgm-4m35

Critical

Advisory

Published 22 Oct 2026In the index since 24 Oct 2026
Severity
Critical
worst across findings
CVSS
9.2
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
127
of 18,232 indexed, latest versions
Container images
110
deployed by those charts
Fix available
2 of 2
affected packages

Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

Carried by container images the latest versions of 127 of 18,232 indexed charts deploy, on 110 images.

Affected packageAffected versionsFixed inImages
brotlipypi1.0.9, 1.1.0, 1.2.01.2.1107
brotlicffipypi1.2.0.1, 1.2.0.21.2.1.03
OSV records
GHSA-9v8h-qqgm-4m35

Charts affected

127 by stars
ChartLatestAffected imagesRadar Score
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
brotli@1.1.0
1.2.1

Open the chart page →

10,309
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
brotli@1.2.0
1.2.1

Open the chart page →

4,718
locust-pluginslocust-pluginsVerified publisher0.0.41 of 3See more

locust-plugins locust-plugins 0.0.4

1 of the 3 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
locustio/locust:2.24.151d866285170
brotli@1.1.0
1.2.1

Open the chart page →

9,522
hyperglassm0nsterrr-hyperglassVerified publisher4.2.11 of 2See more

hyperglass m0nsterrr-hyperglass 4.2.1

1 of the 2 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/m0nsterrr/hyperglass:v2.0.4f7b5d20c5e42
brotli@1.1.0
1.2.1

Open the chart page →

5,551
meerschaummeerschaumVerified publisher0.2.01 of 1See more

meerschaum meerschaum 0.2.0

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
bmeares/meerschaum:2.8.48e9c5bacaa82
brotli@1.1.0
1.2.1

Open the chart page →

65,632
paperless-ngxmt1905027.6.141 of 4See more

paperless-ngx mt190502 7.6.14

1 of the 4 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
brotli@1.1.0
1.2.1

Open the chart page →

15,245
mlflowncsaVerified publisher1.2.11 of 4See more

mlflow ncsa 1.2.1

1 of the 4 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
evk02/mlflow:2.2.1ef6ff257ef35
brotli@1.0.9
1.2.1

Open the chart page →

7,031
esphome-device-buildernewbenji-chartsVerified publisher0.1.11 of 1See more

esphome-device-builder newbenji-charts 0.1.1

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.7.4e636269c6390
brotli@1.2.0
1.2.1

Open the chart page →

4,491
home-assistantnewbenji-chartsVerified publisher0.7.21 of 1See more

home-assistant newbenji-charts 0.7.2

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.8.0a21689ef0510
brotli@1.2.0
1.2.1

Open the chart page →

4,468
music-assistantnewbenji-chartsVerified publisher0.1.01 of 1See more

music-assistant newbenji-charts 0.1.0

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.645fdb050e069
brotli@1.2.0
1.2.1

Open the chart page →

5,747
paperless-ngxoli-the-devVerified publisher1.3.21 of 1See more

paperless-ngx oli-the-dev 1.3.2

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
brotli@1.2.0
1.2.1

Open the chart page →

6,319
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
onyxdotapp/onyx-backend:latestf76bfd1f3c18
brotli@1.2.0
1.2.1

Open the chart page →

9,294
opds-shelfopds-shelfVerified publisher0.4.01 of 3See more

opds-shelf opds-shelf 0.4.0

1 of the 3 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/calibre-web:latestb206b791d77b
brotli@1.2.0
1.2.1

Open the chart page →

6,399
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
brotli@1.2.0
1.2.1

Open the chart page →

7,266
pgadminquench-pgadminVerified publisher0.0.81 of 1See more

pgadmin quench-pgadmin 0.0.8

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/pgadmindigest-pinnedc35f42c8210f
brotli@1.2.0
1.2.1

Open the chart page →

73
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
brotli@1.1.0
1.2.1

Open the chart page →

6,583
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
brotli@1.1.0
1.2.1

Open the chart page →

13,887
pgadminsb-helm-charts0.3.01 of 1See more

pgadmin sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
dpage/pgadmin4:8.13561c1f8f99f2
brotli@1.1.0
1.2.1

Open the chart page →

2,367
ansible-semaphoresergiotocaliniVerified publisher1.2.01 of 1See more

ansible-semaphore sergiotocalini 1.2.0

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
semaphoreui/semaphore:v2.9.645b50bc11833f
brotli@1.0.9
1.2.1

Open the chart page →

4,153
backendsignalen4.25.01 of 4See more

backend signalen 4.25.0

1 of the 4 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
signalen/backend:2.50.1826bb090bc4e4
brotli@1.2.0
1.2.1

Open the chart page →

38,204
pgadminsikalabs0.1.01 of 2See more

pgadmin sikalabs 0.1.0

1 of the 2 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
dpage/pgadmin4:latestc332c5f6dfba
brotli@1.2.0
1.2.1

Open the chart page →

644
home-assistantsmall-hack2.1.01 of 1See more

home-assistant small-hack 2.1.0

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
brotli@1.2.0
1.2.1

Open the chart page →

6,160
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
dpage/pgadmin4:9.252cb72a9e3da
brotli@1.1.0
1.2.1

Open the chart page →

6,943
bugsinkvictorlane0.3.71 of 2See more

bugsink victorlane 0.3.7

1 of the 2 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
bugsink/bugsink:2ae7633acd52b
brotli@1.2.0
1.2.1

Open the chart page →

4,905
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
brotli@1.1.0
1.2.1

Open the chart page →

10,663
supersetwbstack0.1.01 of 1See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
apache/superset:4.0.1ab9467fd712c
brotli@1.0.9
1.2.1

Open the chart page →

79,276
changedetection-iozekker6Verified publisher1.104.01 of 1See more

changedetection-io zekker6 1.104.0

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.904eaae7915ba
brotli@1.2.0
1.2.1

Open the chart page →

3,129

Container images carrying it

110 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
linuxserver/calibre-web:0.6.24241009026e6f
brotli@1.1.0
1.2.1
1
locustio/locust:2.24.151d866285170
brotli@1.1.0
1.2.1
1
loeken/home-assistant:2026.9.2b1dff5b4c593
brotli@1.2.0
1.2.1
1
mindsdb/mindsdb:latest163011c09299
brotli@1.2.0
1.2.1
1
nousresearch/hermes-agent:v0.22.59c5561579f3f
brotlicffi@1.2.0.2
1.2.1.0
1
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
brotlicffi@1.2.0.1
1.2.1.0
1
nousresearch/hermes-agent:v2026.9.24fca358f12efd
brotlicffi@1.2.0.2
1.2.1.0
1
onyxdotapp/onyx-backend:latestf76bfd1f3c18
brotli@1.2.0
1.2.1
1
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
brotli@1.1.0
1.2.1
1
pangeo/base-notebook:2024.01.155fbe688a4f80
brotli@1.1.0
1.2.1
1
searx/searx:1.0.0-211-968b28993dbb3a6d9419
brotli@1.0.9
1.2.1
1
semaphoreui/semaphore:v2.9.645b50bc11833f
brotli@1.0.9
1.2.1
1
signalen/backend:2.50.1826bb090bc4e4
brotli@1.2.0
1.2.1
1
thijsvanloef/palworld-server-docker:v2.7.1401d3eb5c053
brotli@1.2.0
1.2.1
1
thijsvanloef/palworld-server-docker:v2.5.0b4ac9ee22483
brotli@1.2.0
1.2.1
1
weblate/weblate:2026.10.1.26663a7c8b444
brotli@1.2.0
1.2.1
1
ghcr.io/dask/dask:2024.1.0080150de7d86
brotli@1.1.0
1.2.1
1
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
brotli@1.1.0
1.2.1
1
ghcr.io/dgtlmoon/changedetection.io:0.44534b9bc5c46e
brotli@1.0.9
1.2.1
1
ghcr.io/esphome/esphome:latest776a845d5089
brotli@1.2.0
1.2.1
1
ghcr.io/esphome/esphome:2026.7.4e636269c6390
brotli@1.2.0
1.2.1
1
ghcr.io/gabe565/obico/web:latest6acb4a5903eb
brotli@1.1.0
1.2.1
1
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
brotli@1.2.0
1.2.1
1
ghcr.io/getsentry/snuba:26.7.210f8d164109b
brotli@1.2.0
1.2.1
1
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
brotli@1.2.0
1.2.1
1
ghcr.io/home-assistant/home-assistant:2026.10.1130241f28d01
brotli@1.2.0
1.2.1
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
brotli@1.1.0
1.2.1
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
brotli@1.2.0
1.2.1
1
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
brotli@1.2.0
1.2.1
1
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
brotli@1.0.9
1.2.1
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
brotli@1.1.0
1.2.1
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
brotli@1.2.0
1.2.1
1
ghcr.io/juniorjpdj/mumbledj:latest4229c7f97bc7
brotli@1.2.0
1.2.1
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
brotli@1.1.0
1.2.1
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
brotli@1.1.0
1.2.1
1
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
brotli@1.2.0
1.2.1
1
ghcr.io/linuxserver/calibre-web:latestb206b791d77b
brotli@1.2.0
1.2.1
1
ghcr.io/m0nsterrr/hyperglass:v2.0.4f7b5d20c5e42
brotli@1.1.0
1.2.1
1
ghcr.io/mirio/verbacap:v1.5.084928e2fc4f2
brotli@1.1.0
1.2.1
1
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
brotli@1.2.0
1.2.1
1
ghcr.io/music-assistant/server:2.10.645fdb050e069
brotli@1.2.0
1.2.1
1
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
brotli@1.2.0
1.2.1
1
ghcr.io/open-telemetry/demo:3.1.0-chatbot604b1f493c92
brotli@1.2.0
1.2.1
1
ghcr.io/open-telemetry/demo:1.12.0-loadgenerator85c9935ff31b
brotli@1.1.0
1.2.1
1
ghcr.io/open-telemetry/demo:3.1.0-load-generatorb130d6cee6cb
brotli@1.2.0
1.2.1
1
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
brotli@1.1.0
1.2.1
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
brotli@1.1.0
1.2.1
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
brotli@1.1.0
1.2.1
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
brotli@1.1.0
1.2.1
1
ghcr.io/paperless-ngx/paperless-ngx:2.10.1a132c2ac7c57
brotli@1.1.0
1.2.1
1

syft 1.42.1 · advisories as of 24 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.