StackRadar

GHSA-pw6j-qg29-8w7f

Medium

Advisory

Published 15 Jun 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
104
of 17,781 indexed, latest versions
Container images
109
deployed by those charts
Fix available
1 of 1
affected package

Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse

Carried by container images the latest versions of 104 of 17,781 indexed charts deploy, on 109 images.

Affected packageAffected versionsFixed inImages
tornadopypi2.4.1, 4.5.3, 5.1.1, 6.0.2+13 more6.5.7109
OSV records
GHSA-pw6j-qg29-8w7f

Charts affected

104 by stars
ChartLatestAffected imagesRadar Score
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry GHSA-pw6j-qg29-8w7f.

Container imageDigestPackageFixed in
quay.io/nird-toolkit/jupyterhub-server:20221215-e6aa80ecae8c0622533
tornado@6.2
6.5.7

Open the chart page →

8,607
unmanicvhdirkVerified publisher0.1.41 of 1See more

unmanic vhdirk 0.1.4

1 of the 1 container images this version deploys carry GHSA-pw6j-qg29-8w7f.

Container imageDigestPackageFixed in
josh5/unmanic:0.2.64d49c4816260
tornado@6.0.2
6.5.7

Open the chart page →

9,347
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry GHSA-pw6j-qg29-8w7f.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
tornado@6.4.2
6.5.7

Open the chart page →

7,628
webapp-chartwebappchart1.0.01 of 1See more

webapp-chart webappchart 1.0.0

1 of the 1 container images this version deploys carry GHSA-pw6j-qg29-8w7f.

Container imageDigestPackageFixed in
amagdi888/my-repo:hello-appd8a10fc8faf6
tornado@5.1.1
6.5.7

Open the chart page →

1,201

Container images carrying it

109 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
istio/examples-bookinfo-productpage-v1:1.15.00a5eb4795952
tornado@4.5.3
6.5.7
2
istio/examples-bookinfo-productpage-v1:1.14.022a0410f35a8
tornado@4.5.3
6.5.7
2
opendatacube/ows:latest668cbb41473c
tornado@6.4.2
6.5.7
2
alaaamin/reload-count-tornado-py-app:v1.0.1alpine46da5844794e
tornado@5.1.1
6.5.7
1
amagdi888/my-repo:hello-appd8a10fc8faf6
tornado@5.1.1
6.5.7
1
amancevice/superset:0.28.1c8c04bfe3d66
tornado@5.1.1
6.5.7
1
amundsendev/amundsen-metadata:2.5.44d98eb21f5f9
tornado@4.5.3
6.5.7
1
apache/airflow:2.8.4-python3.964e58748b6b9
tornado@6.4
6.5.7
1
apache/airflow:2.10.2-python3.9ce90bdc3d2af
tornado@6.4.1
6.5.7
1
apache/airflow:2.8.1e5560ad0b86e
tornado@6.4
6.5.7
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
tornado@6.4.2
6.5.7
1
apsl/thumbor:6.7.051e2de5c2c70
tornado@5.1.1
6.5.7
1
aristidetm/basic-notebook:3.6.5469dbc951224
tornado@6.4.1
6.5.7
1
aristidetm/k8s-hub:3.3.7ccb516cb8474
tornado@6.4
6.5.7
1
baserow/backend:1.31.1e0b3c8130b91
tornado@6.4.1
6.5.7
1
baserow/baserow:1.30.1df0c42eb67e8
tornado@6.4.1
6.5.7
1
bmeares/meerschaum:2.8.48e9c5bacaa82
tornado@6.4.2
6.5.7
1
cheyang/distributed-tf:1.6.046cc34755493
tornado@4.5.3
6.5.7
1
copyparty/ac:1.19.200a0a8605062c
tornado@6.5.1
6.5.7
1
daskdev/dask:1.1.04ecd7bc35500
tornado@5.1.1
6.5.7
1
daskdev/dask-notebook:1.1.0052630f5ca04
tornado@5.1.1
6.5.7
1
ddosify/selfhosted_alaz_backend:1.0.6a43c5155fa1c
tornado@6.4
6.5.7
1
ddosify/selfhosted_alaz_backend:2.3.11e5be48b37348
tornado@6.4.1
6.5.7
1
errbotio/errbot:6.1.900ee4e0953ab
tornado@6.1
6.5.7
1
esphome/esphome:1.18.03f51ec10e823
tornado@6.1
6.5.7
1
esphome/esphome:2024.3.09ab8cc88b28c
tornado@6.4
6.5.7
1
esphome/esphome:2024.12.2b2c6322700ac
tornado@6.4
6.5.7
1
esphome/esphome:2025.3.0def8b6e4f517
tornado@6.4.2
6.5.7
1
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
tornado@6.2
6.5.7
1
geoscienceaustralia/dea-k8s-data:latestf4039b45572a
tornado@6.0.4
6.5.7
1
gethue/hue:4.11.011b649636e68
tornado@6.2
6.5.7
1
gethue/hue:4.10.05702b2c37ff9
tornado@6.1
6.5.7
1
gethue/hue:latest7d5c1b9f8a79
tornado@6.5.4
6.5.7
1
gmaas2/github-api:latest148fc2d9afe9
tornado@6.2
6.5.7
1
grafana/oncall:v1.16.5499851658393
tornado@6.5.1
6.5.7
1
homeassistant/home-assistant:2023.10.3021e2afc6e57
tornado@6.3.3
6.5.7
1
homeassistant/home-assistant:2023.12.48d000332b09b
tornado@6.4
6.5.7
1
ilum/streamlit-example:1.0.0ce5dcdeb22ba
tornado@6.5.2
6.5.7
1
intel/dlstreamer-pipeline-server:2022.1.1-ubuntu20aa8f5483a2ef
tornado@6.1
6.5.7
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
tornado@6.5.5
6.5.7
1
istio/examples-bookinfo-productpage-v1:1.17.06668bcf42ef0
tornado@4.5.3
6.5.7
1
jaedb/iris:latest048cfbf58d57
tornado@6.2
6.5.7
1
josh5/unmanic:0.2.64d49c4816260
tornado@6.0.2
6.5.7
1
jupyterhub/jupyterhub:5.4.63974ba945e65
tornado@6.5.6
6.5.7
1
jupyterhub/k8s-hub:3.0.1-0.dev.git.6287.hbfb05cd65a0ceed1300a
tornado@6.3.2
6.5.7
1
jupyterhub/k8s-hub:0.11.1b6b4a1a34bf0
tornado@6.1
6.5.7
1
jupyterhub/k8s-hub:1.2.0e4770285aaf7
tornado@6.1
6.5.7
1
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
tornado@6.3.2
6.5.7
1
jupyterhub/k8s-singleuser-sample:0.11.1e3e6f3051df8
tornado@6.0.4
6.5.7
1
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
tornado@6.5.5
6.5.7
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.