StackRadar

GHSA-9v8h-qqgm-4m35

Critical

Advisory

Published 22 Oct 2026In the index since 24 Oct 2026
Severity
Critical
worst across findings
CVSS
9.2
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
127
of 18,232 indexed, latest versions
Container images
110
deployed by those charts
Fix available
2 of 2
affected packages

Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

Carried by container images the latest versions of 127 of 18,232 indexed charts deploy, on 110 images.

Affected packageAffected versionsFixed inImages
brotlipypi1.0.9, 1.1.0, 1.2.01.2.1107
brotlicffipypi1.2.0.1, 1.2.0.21.2.1.03
OSV records
GHSA-9v8h-qqgm-4m35

Charts affected

127 by stars
ChartLatestAffected imagesRadar Score
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
brotli@1.1.0
1.2.1

Open the chart page →

10,309
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
brotli@1.2.0
1.2.1

Open the chart page →

4,718
locust-pluginslocust-pluginsVerified publisher0.0.41 of 3See more

locust-plugins locust-plugins 0.0.4

1 of the 3 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
locustio/locust:2.24.151d866285170
brotli@1.1.0
1.2.1

Open the chart page →

9,522
hyperglassm0nsterrr-hyperglassVerified publisher4.2.11 of 2See more

hyperglass m0nsterrr-hyperglass 4.2.1

1 of the 2 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/m0nsterrr/hyperglass:v2.0.4f7b5d20c5e42
brotli@1.1.0
1.2.1

Open the chart page →

5,551
meerschaummeerschaumVerified publisher0.2.01 of 1See more

meerschaum meerschaum 0.2.0

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
bmeares/meerschaum:2.8.48e9c5bacaa82
brotli@1.1.0
1.2.1

Open the chart page →

65,632
paperless-ngxmt1905027.6.141 of 4See more

paperless-ngx mt190502 7.6.14

1 of the 4 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
brotli@1.1.0
1.2.1

Open the chart page →

15,245
mlflowncsaVerified publisher1.2.11 of 4See more

mlflow ncsa 1.2.1

1 of the 4 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
evk02/mlflow:2.2.1ef6ff257ef35
brotli@1.0.9
1.2.1

Open the chart page →

7,031
esphome-device-buildernewbenji-chartsVerified publisher0.1.11 of 1See more

esphome-device-builder newbenji-charts 0.1.1

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.7.4e636269c6390
brotli@1.2.0
1.2.1

Open the chart page →

4,491
home-assistantnewbenji-chartsVerified publisher0.7.21 of 1See more

home-assistant newbenji-charts 0.7.2

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.8.0a21689ef0510
brotli@1.2.0
1.2.1

Open the chart page →

4,468
music-assistantnewbenji-chartsVerified publisher0.1.01 of 1See more

music-assistant newbenji-charts 0.1.0

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.10.645fdb050e069
brotli@1.2.0
1.2.1

Open the chart page →

5,747
paperless-ngxoli-the-devVerified publisher1.3.21 of 1See more

paperless-ngx oli-the-dev 1.3.2

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
brotli@1.2.0
1.2.1

Open the chart page →

6,319
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
onyxdotapp/onyx-backend:latestf76bfd1f3c18
brotli@1.2.0
1.2.1

Open the chart page →

9,294
opds-shelfopds-shelfVerified publisher0.4.01 of 3See more

opds-shelf opds-shelf 0.4.0

1 of the 3 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/calibre-web:latestb206b791d77b
brotli@1.2.0
1.2.1

Open the chart page →

6,399
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
brotli@1.2.0
1.2.1

Open the chart page →

7,266
pgadminquench-pgadminVerified publisher0.0.81 of 1See more

pgadmin quench-pgadmin 0.0.8

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/pgadmindigest-pinnedc35f42c8210f
brotli@1.2.0
1.2.1

Open the chart page →

73
karakeeprtomik-helm-chartsVerified publisher0.0.11 of 3See more

karakeep rtomik-helm-charts 0.0.1

1 of the 3 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
brotli@1.1.0
1.2.1

Open the chart page →

6,583
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
brotli@1.1.0
1.2.1

Open the chart page →

13,887
pgadminsb-helm-charts0.3.01 of 1See more

pgadmin sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
dpage/pgadmin4:8.13561c1f8f99f2
brotli@1.1.0
1.2.1

Open the chart page →

2,367
ansible-semaphoresergiotocaliniVerified publisher1.2.01 of 1See more

ansible-semaphore sergiotocalini 1.2.0

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
semaphoreui/semaphore:v2.9.645b50bc11833f
brotli@1.0.9
1.2.1

Open the chart page →

4,153
backendsignalen4.25.01 of 4See more

backend signalen 4.25.0

1 of the 4 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
signalen/backend:2.50.1826bb090bc4e4
brotli@1.2.0
1.2.1

Open the chart page →

38,204
pgadminsikalabs0.1.01 of 2See more

pgadmin sikalabs 0.1.0

1 of the 2 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
dpage/pgadmin4:latestc332c5f6dfba
brotli@1.2.0
1.2.1

Open the chart page →

644
home-assistantsmall-hack2.1.01 of 1See more

home-assistant small-hack 2.1.0

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.3.10e091dfce306
brotli@1.2.0
1.2.1

Open the chart page →

6,160
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
dpage/pgadmin4:9.252cb72a9e3da
brotli@1.1.0
1.2.1

Open the chart page →

6,943
bugsinkvictorlane0.3.71 of 2See more

bugsink victorlane 0.3.7

1 of the 2 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
bugsink/bugsink:2ae7633acd52b
brotli@1.2.0
1.2.1

Open the chart page →

4,905
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
brotli@1.1.0
1.2.1

Open the chart page →

10,663
supersetwbstack0.1.01 of 1See more

superset wbstack 0.1.0

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
apache/superset:4.0.1ab9467fd712c
brotli@1.0.9
1.2.1

Open the chart page →

79,276
changedetection-iozekker6Verified publisher1.104.01 of 1See more

changedetection-io zekker6 1.104.0

1 of the 1 container images this version deploys carry GHSA-9v8h-qqgm-4m35.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.904eaae7915ba
brotli@1.2.0
1.2.1

Open the chart page →

3,129

Container images carrying it

110 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
dpage/pgadmin4:9.17:9.18:latestc332c5f6dfba
brotli@1.2.0
1.2.1
5
ghcr.io/dgtlmoon/changedetection.io:0.60.9:latest04eaae7915ba
brotli@1.2.0
1.2.1
4
apache/superset:6.1.0:latest16b50bbef664
brotli@1.2.0
1.2.1
3
cloudve/cloudlaunch-server:latest4a3d7fae90bb
brotli@1.0.9
1.2.1
3
dpage/pgadmin4:6.12781369df9994
brotli@1.0.9
1.2.1
3
ghcr.io/paperless-ngx/paperless-ngx:3.3.49bc6e8248891
brotli@1.2.0
1.2.1
3
ghcr.io/paperless-ngx/paperless-ngx:3.3.2d232cba37cc0
brotli@1.2.0
1.2.1
3
locustio/locust:2.32.2a0d4b88e42c1
brotli@1.1.0
1.2.1
2
ghcr.io/home-assistant/home-assistant:2026.10.2:latest33afb0659d78
brotli@1.2.0
1.2.1
2
ghcr.io/music-assistant/server:2.10.7dce482dc3bf4
brotli@1.2.0
1.2.1
2
ghcr.io/paperless-ngx/paperless-ngx:3.3.3dba0242c1df1
brotli@1.2.0
1.2.1
2
alerta/alerta-web:8.5.04786b9eaa606
brotli@1.0.9
1.2.1
1
allegroai/clearml:2.0.0-613713ae38f7daf
brotli@1.1.0
1.2.1
1
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
brotli@1.0.9
1.2.1
1
apache/superset:4.0.1ab9467fd712c
brotli@1.0.9
1.2.1
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
brotli@1.1.0
1.2.1
1
archivebox/archivebox:0.9.73d4720d86c0e9
brotli@1.2.0
1.2.1
1
baserow/backend:2.4.1497347d0ba74
brotli@1.2.0
1.2.1
1
baserow/backend:1.31.1e0b3c8130b91
brotli@1.1.0
1.2.1
1
baserow/baserow:1.30.1df0c42eb67e8
brotli@1.1.0
1.2.1
1
bbilly1/tubearchivist:v0.5.9b827a713f55b
brotli@1.2.0
1.2.1
1
berkeleyskypilot/skypilot:0.14.125577df35586
brotli@1.2.0
1.2.1
1
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
brotli@1.2.0
1.2.1
1
blackducksoftware/bdba-frontend:2026.9.29d7730e506c0
brotli@1.2.0
1.2.1
1
bmeares/meerschaum:2.8.48e9c5bacaa82
brotli@1.1.0
1.2.1
1
bugsink/bugsink:2ae7633acd52b
brotli@1.2.0
1.2.1
1
crocodilestick/calibre-web-automated:v4.0.6c31a738b6d5e
brotli@1.2.0
1.2.1
1
datagrok/grok_spawner:latestd8b14c641dfb
brotli@1.2.0
1.2.1
1
defectdojo/defectdojo-django:3.4.202b1c3fc5c295f
brotli@1.2.0
1.2.1
1
dpage/pgadmin4:8.418cd5711fc9a
brotli@1.1.0
1.2.1
1
dpage/pgadmin4:7.537946e4f3e7b
brotli@1.0.9
1.2.1
1
dpage/pgadmin4:9.11.050700ac17936
brotli@1.2.0
1.2.1
1
dpage/pgadmin4:9.252cb72a9e3da
brotli@1.1.0
1.2.1
1
dpage/pgadmin4:8.13561c1f8f99f2
brotli@1.1.0
1.2.1
1
esphome/esphome:2026.10.03a32372dfbd6
brotli@1.2.0
1.2.1
1
esphome/esphome:2026.9.14ad55931c018
brotli@1.2.0
1.2.1
1
evk02/mlflow:2.2.1ef6ff257ef35
brotli@1.0.9
1.2.1
1
galaxy/cloudman-server:lateste5c265fe9fcd
brotli@1.0.9
1.2.1
1
hansehe/locust:1.1.0bc8e45262bc4
brotli@1.1.0
1.2.1
1
hayk96/alerta-web:9.0.486377705e9e3
brotli@1.1.0
1.2.1
1
homeassistant/home-assistant:2023.10.3021e2afc6e57
brotli@1.1.0
1.2.1
1
homeassistant/home-assistant:2022.3.5565751f33794
brotli@1.0.9
1.2.1
1
homeassistant/home-assistant:2026.75a531753cea9
brotli@1.2.0
1.2.1
1
homeassistant/home-assistant:2023.12.48d000332b09b
brotli@1.1.0
1.2.1
1
homeassistant/home-assistant:2026.8.0a21689ef0510
brotli@1.2.0
1.2.1
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
brotli@1.2.0
1.2.1
1
inventree/inventree:1.6.17c1e251a6c52
brotli@1.1.0
1.2.1
1
langgenius/dify-api:1.0.0066035f93856
brotli@1.1.0
1.2.1
1
langgenius/dify-api:1.17.052be6088dd84
brotli@1.2.0
1.2.1
1
langgenius/dify-api:0.6.11fca918260dd6
brotli@1.1.0
1.2.1
1

syft 1.42.1 · advisories as of 24 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.