StackRadar

GHSA-pw6j-qg29-8w7f

Medium

Advisory

Published 15 Jun 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
104
of 17,781 indexed, latest versions
Container images
109
deployed by those charts
Fix available
1 of 1
affected package

Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse

Carried by container images the latest versions of 104 of 17,781 indexed charts deploy, on 109 images.

Affected packageAffected versionsFixed inImages
tornadopypi2.4.1, 4.5.3, 5.1.1, 6.0.2+13 more6.5.7109
OSV records
GHSA-pw6j-qg29-8w7f

Charts affected

104 by stars
ChartLatestAffected imagesRadar Score
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry GHSA-pw6j-qg29-8w7f.

Container imageDigestPackageFixed in
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
tornado@6.2
6.5.7

Open the chart page →

8,607
unmanicvhdirkVerified publisher0.1.41 of 1See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry GHSA-pw6j-qg29-8w7f.

Container imageDigestPackageFixed in
josh5/unmanic:0.2.64d49c4816260
tornado@6.0.2
6.5.7

Open the chart page →

9,347
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry GHSA-pw6j-qg29-8w7f.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
tornado@6.4.2
6.5.7

Open the chart page →

7,628
webapp-chartwebappchart1.0.01 of 1See more

webapp-chart webappchart 1.0.0

1 of the 1 container images this version deploys carry GHSA-pw6j-qg29-8w7f.

Container imageDigestPackageFixed in
amagdi888/my-repo:hello-appd8a10fc8faf6
tornado@5.1.1
6.5.7

Open the chart page →

1,201

Container images carrying it

109 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
kubesphere/examples-bookinfo-productpage-v1:1.13.0378f49ec9c44
tornado@4.5.3
6.5.7
1
kyso/kyso-nbdime:latest4aa9d38ee81d
tornado@6.2
6.5.7
1
linuxserver/calibre-web:0.6.24241009026e6f
tornado@6.4.2
6.5.7
1
linuxserver/calibre-web:version-0.6.12938810eca3d3
tornado@6.1
6.5.7
1
linuxserver/medusa:v1.0.26-ls2884477fb1ce3ca
tornado@6.5.2
6.5.7
1
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
tornado@5.1.1
6.5.7
1
litellm/litellm-non_root:v1.82.3-stable09b217802ded
tornado@6.5.5
6.5.7
1
lsstsqre/nublado2:2.0.1b75bf8aaafa4
tornado@6.1
6.5.7
1
lsstsqre/prepuller:latest19c2dfc4e4ff
tornado@6.1
6.5.7
1
lsstsqre/sciplat-hub:latest5e0ade6bed1c
tornado@6.1
6.5.7
1
lsstsqre/wfdispatcher:lateste9feb99f524d
tornado@6.1
6.5.7
1
matrixdotorg/synapse:v1.127.1c3c4a9de2a0b
tornado@6.4.2
6.5.7
1
matrixdotorg/synapse:v1.53.0cb89c0f17ba1
tornado@6.1
6.5.7
1
matrixdotorg/synapse:v1.78.0def97fd537d8
tornado@6.1
6.5.7
1
mher/flower:2.051c3c3db5be3
tornado@6.3.3
6.5.7
1
mnaggar3396/python-app:latest371d8ed84b15
tornado@6.2
6.5.7
1
mohameddev006/web-app:v50fbc7360ecf4
tornado@5.1.1
6.5.7
1
octoprint/octoprint:1.4.0106c26efcd8a
tornado@4.5.3
6.5.7
1
octoprint/octoprint:1.6.1ea3bffae2470
tornado@5.1.1
6.5.7
1
opencsghq/agenticflow:ee-v0.6-52f03fead54db
tornado@6.5.1
6.5.7
1
opendatacube/explorer:latest120457ffcd69
tornado@6.5.2
6.5.7
1
opendatacube/wps:latest80df355a660b
tornado@6.4.2
6.5.7
1
openzaak/open-notificaties:1.3.02e65313b9b10
tornado@6.1
6.5.7
1
oxheadalpha/tezos-k8s-utils:5.3.4d9faed45bf1c
tornado@6.1
6.5.7
1
pangeo/base-notebook:2024.01.155fbe688a4f80
tornado@6.3.3
6.5.7
1
roadiehq/community-backstage-image:latestef355bf5b639
tornado@5.1.1
6.5.7
1
robmarkcole/deepstack-ui:latest410275726459
tornado@6.1
6.5.7
1
seldonio/seldon-request-logger:1.11.24e985d2006a8
tornado@6.1
6.5.7
1
sruthitanneru/pi-sample:ui-lateste565ea454ffd
tornado@6.4.2
6.5.7
1
stakater/restful-distributed-lock-manager:0.5.34f8e409f30c2
tornado@2.4.1
6.5.7
1
tensorflow/tensorflow:1.6.0-devel1e3172090703
tornado@4.5.3
6.5.7
1
thijsvanloef/palworld-server-docker:v2.7.1401d3eb5c053
tornado@6.5.5
6.5.7
1
thijsvanloef/palworld-server-docker:v2.5.0b4ac9ee22483
tornado@6.5.5
6.5.7
1
timothyclarke/wptagent:2018-01-2322c41e5ca7e2
tornado@4.5.3
6.5.7
1
treskon/portrait-web-setup:DEV-latesta475d80e4ecf
tornado@6.4.2
6.5.7
1
trungkien210493/icinga2-report:v1.7.12cc8c3763c4c
tornado@5.1.1
6.5.7
1
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
tornado@6.4
6.5.7
1
ghcr.io/dask/dask:2024.1.0080150de7d86
tornado@6.3.3
6.5.7
1
ghcr.io/dask/dask-kubernetes-operator:2026.3.03225d2bc6b3c
tornado@6.5.4
6.5.7
1
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
tornado@6.3.3
6.5.7
1
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
tornado@6.4.1
6.5.7
1
ghcr.io/esphome/esphome:2026.4.078a82d810709
tornado@6.5.5
6.5.7
1
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
tornado@6.1
6.5.7
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
tornado@6.3.3
6.5.7
1
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
tornado@6.5.4
6.5.7
1
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
tornado@6.4.1
6.5.7
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
tornado@6.5.2
6.5.7
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
tornado@6.5.2
6.5.7
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
tornado@6.5.2
6.5.7
1
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
tornado@6.3.3
6.5.7
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.