StackRadar

GHSA-chx6-46f5-w4vp

High

Advisory

Published 30 Sept 2026In the index since 1 Oct 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
138
of 17,966 indexed, latest versions
Container images
137
deployed by those charts
Fix available
1 of 1
affected package

tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM

Carried by container images the latest versions of 138 of 17,966 indexed charts deploy, on 137 images.

Affected packageAffected versionsFixed inImages
tornadopypi2.4.1, 4.4.3, 4.5.3, 5.0.2+17 more6.5.9137
OSV records
GHSA-chx6-46f5-w4vp

Charts affected

138 by stars
ChartLatestAffected imagesRadar Score
jupyterhubkubeblocksVerified publisher0.1.02 of 7See more

jupyterhub kubeblocks 0.1.0

2 of the 7 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
jupyterhub/k8s-hub:3.0.1-0.dev.git.6287.hbfb05cd65a0ceed1300a
tornado@6.3.2
6.5.9
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
tornado@6.3.2
6.5.9

Open the chart page →

7,742
sample-bookinfokubesphere-carryon-test1.0.01 of 4See more

sample-bookinfo kubesphere-carryon-test 1.0.0

1 of the 4 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
kubesphere/examples-bookinfo-productpage-v1:1.13.0378f49ec9c44
tornado@4.5.3
6.5.9

Open the chart page →

10,012
sample-bookinfokubesphere-testVerified publisher1.0.01 of 4See more

sample-bookinfo kubesphere-test 1.0.0

1 of the 4 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
kubesphere/examples-bookinfo-productpage-v1:1.13.0378f49ec9c44
tornado@4.5.3
6.5.9

Open the chart page →

10,012
kyso-nbdimekyso1.0.01 of 1See more

kyso-nbdime kyso 1.0.0

1 of the 1 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
kyso/kyso-nbdime:latest4aa9d38ee81d
tornado@6.2
6.5.9

Open the chart page →

2,970
oncall-hobbylovemew67Verified publisher0.0.51 of 2See more

oncall-hobby lovemew67 0.0.5

1 of the 2 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
grafana/oncall:v1.13.11159b6b836fed
tornado@6.4.2
6.5.9

Open the chart page →

6,320
nubladolsst-sqre0.9.233 of 5See more

nublado lsst-sqre 0.9.23

3 of the 5 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
lsstsqre/prepuller:latest19c2dfc4e4ff
tornado@6.1
6.5.9
lsstsqre/sciplat-hub:latest5e0ade6bed1c
tornado@6.1
6.5.9
lsstsqre/wfdispatcher:lateste9feb99f524d
tornado@6.1
6.5.9

Open the chart page →

6,309
nublado2lsst-sqre0.8.51 of 2See more

nublado2 lsst-sqre 0.8.5

1 of the 2 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
lsstsqre/nublado2:2.0.1b75bf8aaafa4
tornado@6.1
6.5.9

Open the chart page →

93,398
meerschaummeerschaumVerified publisher0.2.01 of 1See more

meerschaum meerschaum 0.2.0

1 of the 1 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
bmeares/meerschaum:2.8.48e9c5bacaa82
tornado@6.4.2
6.5.9

Open the chart page →

6,396
errbotmidokura-communityVerified publisher0.0.51 of 1See more

errbot midokura-community 0.0.5

1 of the 1 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
errbotio/errbot:6.1.900ee4e0953ab
tornado@6.1
6.5.9

Open the chart page →

2,338
paperless-ngxmt1905027.6.141 of 4See more

paperless-ngx mt190502 7.6.14

1 of the 4 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
tornado@6.5.2
6.5.9

Open the chart page →

12,979
sickchillnicholaswildeVerified publisher0.1.01 of 1See more

sickchill nicholaswilde 0.1.0

1 of the 1 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/sickchill:2021.5.10-1-ls63a607452a692a
tornado@6.1
6.5.9

Open the chart page →

1,199
paperless-ngxoli-the-devVerified publisher1.1.11 of 1See more

paperless-ngx oli-the-dev 1.1.1

1 of the 1 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
tornado@6.5.8
6.5.9

Open the chart page →

5,464
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
onyxdotapp/onyx-backend:latest60e83a098ae4
tornado@6.5.7
6.5.9

Open the chart page →

7,423
opds-shelfopds-shelfVerified publisher0.4.01 of 3See more

opds-shelf opds-shelf 0.4.0

1 of the 3 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/calibre-web:latest0767226fcf20
tornado@6.5.8
6.5.9

Open the chart page →

5,076
chatbot-ai-sampleopenshift0.1.61 of 4See more

chatbot-ai-sample openshift 0.1.6

1 of the 4 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
tornado@6.4
6.5.9

Open the chart page →

20,376
python-apppython-app-chart0.1.01 of 2See more

python-app python-app-chart 0.1.0

1 of the 2 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
mnaggar3396/python-app:latest371d8ed84b15
tornado@6.2
6.5.9

Open the chart page →

3,926
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
tornado@6.4.1
6.5.9

Open the chart page →

22,494
reload-counterreload-counter0.1.01 of 1See more

reload-counter reload-counter 0.1.0

1 of the 1 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
alaaamin/reload-count-tornado-py-app:v1.0.1alpine46da5844794e
tornado@5.1.1
6.5.9

Open the chart page →

1,052
esphomeretsamedocVerified publisher2026.2.51 of 1See more

esphome retsamedoc 2026.2.5

1 of the 1 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
esphome/esphome:2024.3.09ab8cc88b28c
tornado@6.4
6.5.9

Open the chart page →

7,882
bookinforgnu1.0.01 of 7See more

bookinfo rgnu 1.0.0

1 of the 7 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
istio/examples-bookinfo-productpage-v1:1.14.022a0410f35a8
tornado@4.5.3
6.5.9

Open the chart page →

21,507
istio-bookinforgnu1.0.21 of 7See more

istio-bookinfo rgnu 1.0.2

1 of the 7 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
istio/examples-bookinfo-productpage-v1:1.14.022a0410f35a8
tornado@4.5.3
6.5.9

Open the chart page →

21,507
matrix-stackrock8sVerified publisher0.8.11 of 7See more

matrix-stack rock8s 0.8.1

1 of the 7 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.127.1c3c4a9de2a0b
tornado@6.4.2
6.5.9

Open the chart page →

9,872
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
tornado@6.5.2
6.5.9

Open the chart page →

11,750
safe-stacksafe-global0.1.01 of 9See more

safe-stack safe-global 0.1.0

1 of the 9 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
safeglobal/safe-transaction-service:latest7b576c73f865
tornado@6.5.8
6.5.9

Open the chart page →

20,611
safe-transaction-servicesafe-global0.1.01 of 6See more

safe-transaction-service safe-global 0.1.0

1 of the 6 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
safeglobal/safe-transaction-service:latest7b576c73f865
tornado@6.5.8
6.5.9

Open the chart page →

17,188
airflowsb-helm-charts0.3.01 of 1See more

airflow sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
apache/airflow:2.8.1e5560ad0b86e
tornado@6.4
6.5.9

Open the chart page →

10,912
seldon-deployseldon1.4.01 of 2See more

seldon-deploy seldon 1.4.0

1 of the 2 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
seldonio/seldon-request-logger:1.11.24e985d2006a8
tornado@6.1
6.5.9

Open the chart page →

22,877
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
tornado@6.5.5
6.5.9

Open the chart page →

5,789
backendsignalen4.25.01 of 4See more

backend signalen 4.25.0

1 of the 4 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
signalen/backend:2.50.1826bb090bc4e4
tornado@6.5.8
6.5.9

Open the chart page →

11,735
srebotsrebot0.14.01 of 2See more

srebot srebot 0.14.0

1 of the 2 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
tornado@6.5.4
6.5.9

Open the chart page →

1,779
restful-distributed-lock-managerstakaterVerified publisher1.0.41 of 1See more

restful-distributed-lock-manager stakater 1.0.4

1 of the 1 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
stakater/restful-distributed-lock-manager:0.5.34f8e409f30c2
tornado@2.4.1
6.5.9

Open the chart page →

3,565
icinga2-reportsvtech-public-helm-charts1.0.01 of 1See more

icinga2-report svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
trungkien210493/icinga2-report:v1.7.12cc8c3763c4c
tornado@5.1.1
6.5.9

Open the chart page →

1,835
tezos-nodetezos-nodeVerified publisher1.0.01 of 4See more

tezos-node tezos-node 1.0.0

1 of the 4 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
oxheadalpha/tezos-k8s-utils:5.3.4d9faed45bf1c
tornado@6.1
6.5.9

Open the chart page →

5,400
synapsetranhailongVerified publisher0.1.01 of 2See more

synapse tranhailong 0.1.0

1 of the 2 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.78.0def97fd537d8
tornado@6.1
6.5.9

Open the chart page →

3,282
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
tornado@6.2
6.5.9

Open the chart page →

9,112
unmanicvhdirkVerified publisher0.1.41 of 1See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
josh5/unmanic:0.2.64d49c4816260
tornado@6.0.2
6.5.9

Open the chart page →

80,662
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
tornado@6.4.2
6.5.9

Open the chart page →

8,510
webapp-chartwebappchart1.0.01 of 1See more

webapp-chart webappchart 1.0.0

1 of the 1 container images this version deploys carry GHSA-chx6-46f5-w4vp.

Container imageDigestPackageFixed in
amagdi888/my-repo:hello-appd8a10fc8faf6
tornado@5.1.1
6.5.9

Open the chart page →

1,246

Container images carrying it

137 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
truebyteinnovationllp/jupyterhub-k8s:5.5.06bf978b96279
tornado@6.5.7
6.5.9
1
trungkien210493/icinga2-report:v1.7.12cc8c3763c4c
tornado@5.1.1
6.5.9
1
wger/server:2.71c5789b93bfe
tornado@6.5.8
6.5.9
1
ghcr.io/berriai/litellm:1.102.0:main-stable32cfd7a427f6
tornado@6.5.8
6.5.9
1
ghcr.io/berriai/litellm:1.103.1df15400b5b80
tornado@6.5.8
6.5.9
1
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
tornado@6.5.8
6.5.9
1
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
tornado@6.4
6.5.9
1
ghcr.io/dask/dask:2024.1.0080150de7d86
tornado@6.3.3
6.5.9
1
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
tornado@6.5.4
6.5.9
1
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
tornado@6.3.3
6.5.9
1
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
tornado@6.4.1
6.5.9
1
ghcr.io/esphome/esphome:2026.4.078a82d810709
tornado@6.5.5
6.5.9
1
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
tornado@6.1
6.5.9
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
tornado@6.3.3
6.5.9
1
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
tornado@6.5.4
6.5.9
1
ghcr.io/linuxserver/calibre-web:latest0767226fcf20
tornado@6.5.8
6.5.9
1
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
tornado@6.5.7
6.5.9
1
ghcr.io/linuxserver/sickchill:2021.5.10-1-ls63a607452a692a
tornado@6.1
6.5.9
1
ghcr.io/opendatacube/explorer:latest7c25578068cd
tornado@6.5.8
6.5.9
1
ghcr.io/opendatacube/ows:latestf591c9d96c0f
tornado@6.5.7
6.5.9
1
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
tornado@6.4.1
6.5.9
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
tornado@6.5.2
6.5.9
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
tornado@6.5.2
6.5.9
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
tornado@6.5.2
6.5.9
1
ghcr.io/paperless-ngx/paperless-ngx:2.10.1a132c2ac7c57
tornado@6.4.1
6.5.9
1
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
tornado@6.3.3
6.5.9
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
tornado@6.5.2
6.5.9
1
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
tornado@6.5.4
6.5.9
1
quay.io/galaxyproject/galaxy-min:26.1.12c324c9789f5
tornado@6.5.5
6.5.9
1
quay.io/jupyterhub/k8s-hub:4.4.2108fbb01c3fe
tornado@6.5.8
6.5.9
1
quay.io/jupyterhub/k8s-hub:4.3.5113e372cf71b
tornado@6.5.5
6.5.9
1
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
tornado@6.3.3
6.5.9
1
quay.io/jupyterhub/k8s-hub:4.3.492f883d09270
tornado@6.5.5
6.5.9
1
quay.io/jupyterhub/k8s-singleuser-sample:4.4.265e1b09fc8c9
tornado@6.5.8
6.5.9
1
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
tornado@6.2
6.5.9
1
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
tornado@6.4
6.5.9
1
registry.gitlab.com/crafty-controller/crafty-4:latest7b6e87514259
tornado@6.5.4
6.5.9
1

syft 1.42.1 · advisories as of 1 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.