StackRadar

CVE-2026-14164

High

Advisory

Published 30 Jun 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
41st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
166
of 17,781 indexed, latest versions
Container images
195
deployed by those charts
Fix available
2 of 2
affected packages

Red Hat Security Advisory: libarchive security update

Carried by container images the latest versions of 166 of 17,781 indexed charts deploy, on 195 images.

Affected packageAffected versionsFixed inImages
libarchiverpm3.5.3-3.el9, 3.5.3-4.el9, 3.5.3-4.el9.0.1, 3.5.3-5.el9_6+4 more0:3.5.3-11.el9_8, 0:3.7.7-10.el10_2148
libarchivedeb3.4.0-2ubuntu1, 3.4.0-2ubuntu1.2, 3.4.0-2ubuntu1.5, 3.6.0-1ubuntu1+16 more3.4.0-2ubuntu1.5+esm3, 3.6.0-1ubuntu1.8, 3.6.2-1+deb12u5, 3.7.2-2ubuntu0.8+1 more47
OSV records
DEBIAN-CVE-2026-14164RHSA-2026:52674RHSA-2026:52675RLSA-2026:52674RLSA-2026:52675UBUNTU-CVE-2026-14164
Also known as
RHSA-2026:58558, RHSA-2026:58573, RHSA-2026:58574, USN-8581-1

Charts affected

166 by stars
ChartLatestAffected imagesRadar Score
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-14164.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
libarchive@3.7.4-4
no fix listed

Open the chart page →

10,605
stirling-pdfrubxkubeVerified publisher0.1.21 of 1See more

stirling-pdf rubxkube 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-14164.

Container imageDigestPackageFixed in
ghcr.io/stirling-tools/stirling-pdf:2.14.33b3670fce70b
libarchive@3.7.2-2ubuntu0.6
3.7.2-2ubuntu0.8

Open the chart page →

6,207
photoprismschoolguys-helmcharts0.3.81 of 1See more

photoprism schoolguys-helmcharts 0.3.8

1 of the 1 container images this version deploys carry CVE-2026-14164.

Container imageDigestPackageFixed in
photoprism/photoprism:260601650c6ad5a651
libarchive@3.8.5-1ubuntu2.1
3.8.5-1ubuntu2.2

Open the chart page →

10,348
shopwareshopware-storeVerified publisher2.1.11 of 5See more

shopware shopware-store 2.1.1

1 of the 5 container images this version deploys carry CVE-2026-14164.

Container imageDigestPackageFixed in
percona/percona-xtradb-cluster-operator:1.14.03232ae01d0ff
libarchive@3.5.3-4.el9
0:3.5.3-11.el9_8

Open the chart page →

4,876
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-14164.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/showroom-docs-mcp:latest1a6eff92827a
libarchive@3.5.3-4.el9
0:3.5.3-11.el9_8

Open the chart page →

5,201
infisicalsinextraVerified publisher0.6.01 of 1See more

infisical sinextra 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-14164.

Container imageDigestPackageFixed in
infisical/infisical:v0.165.602082bf13163
libarchive@3.7.4-4+deb13u1
no fix listed

Open the chart page →

3,014
cost-analyzersoftonic2.5.52 of 6See more

cost-analyzer softonic 2.5.5

2 of the 6 container images this version deploys carry CVE-2026-14164.

Container imageDigestPackageFixed in
gcr.io/kubecost1/cost-model:prod-2.5.502b90651367f
libarchive@3.5.3-4.el9
0:3.5.3-11.el9_8
gcr.io/kubecost1/kubecost-modeling:v0.1.24a2259b098b13
libarchive@3.5.3-4.el9
0:3.5.3-11.el9_8

Open the chart page →

7,901
strimzi-user-operatorspartan0.4.01 of 1See more

strimzi-user-operator spartan 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-14164.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.45.158c727cd2e68
libarchive@3.5.3-6.el9_6
0:3.5.3-11.el9_8

Open the chart page →

1,836
servicexssl-hep1.8.51 of 16See more

servicex ssl-hep 1.8.5

1 of the 16 container images this version deploys carry CVE-2026-14164.

Container imageDigestPackageFixed in
sslhep/servicex-did-finder-xrootd:v1.8.5c284442b44e3
libarchive@3.7.4-4+deb13u1
no fix listed

Open the chart page →

66,266
stash-boxswuuper-githubVerified publisher0.1.11 of 2See more

stash-box swuuper-github 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-14164.

Container imageDigestPackageFixed in
stashapp/stash-box:latesta534c8afdf39
libarchive@3.7.2-2ubuntu0.4
3.7.2-2ubuntu0.8

Open the chart page →

8,193
owncloudth-chartsVerified publisher0.2.11 of 1See more

owncloud th-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-14164.

Container imageDigestPackageFixed in
owncloud/server:10.15.051d9b74fc2a8
libarchive@3.4.0-2ubuntu1.2
3.4.0-2ubuntu1.5+esm3

Open the chart page →

10,006
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-14164.

Container imageDigestPackageFixed in
apache/tika:2.9.2.1-fullae0b86d3c4d0
libarchive@3.7.2-2
3.7.2-2ubuntu0.8

Open the chart page →

45,239
devportalveecode-platform-nextVerified publisher0.1.211 of 1See more

devportal veecode-platform-next 0.1.21

1 of the 1 container images this version deploys carry CVE-2026-14164.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinnedc443520aebf7
libarchive@3.5.3-9.el9_7
0:3.5.3-11.el9_8

Open the chart page →

1,787
velero-clientvelero-clientVerified publisher1.4.21 of 1See more

velero-client velero-client 1.4.2

1 of the 1 container images this version deploys carry CVE-2026-14164.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/velero-client/velero-client:1.4.203015f863a3e
libarchive@3.7.7-8.el10_1
0:3.7.7-10.el10_2

Open the chart page →

513
myweatherhelmwebapp11.3.501 of 8See more

myweatherhelm webapp1 1.3.50

1 of the 8 container images this version deploys carry CVE-2026-14164.

Container imageDigestPackageFixed in
mcr.microsoft.com/azure-sql-edge:latest902628a8be89
libarchive@3.4.0-2ubuntu1.2
3.4.0-2ubuntu1.5+esm3

Open the chart page →

9,130
myweatherhelm-schedulingwebapp11.3.921 of 9See more

myweatherhelm-scheduling webapp1 1.3.92

1 of the 9 container images this version deploys carry CVE-2026-14164.

Container imageDigestPackageFixed in
mcr.microsoft.com/azure-sql-edge:latest902628a8be89
libarchive@3.4.0-2ubuntu1.2
3.4.0-2ubuntu1.5+esm3

Open the chart page →

9,130

Container images carrying it

195 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/drogue-iot/outbox-controller:0.11.01a958edafdb1
libarchive@3.5.3-3.el9
0:3.5.3-11.el9_8
1
ghcr.io/drogue-iot/topic-strimzi-operator:0.11.05253fbf8d04c
libarchive@3.5.3-3.el9
0:3.5.3-11.el9_8
1
ghcr.io/drogue-iot/ttn-operator:0.11.07dd5ac80c8f1
libarchive@3.5.3-3.el9
0:3.5.3-11.el9_8
1
ghcr.io/drogue-iot/user-auth-service:0.11.0adebc40ddf98
libarchive@3.5.3-3.el9
0:3.5.3-11.el9_8
1
ghcr.io/drogue-iot/websocket-integration:0.11.0372dcd370945
libarchive@3.5.3-3.el9
0:3.5.3-11.el9_8
1
ghcr.io/grafana/alloy-operator:1.3.02088dcb22aaa
libarchive@3.5.3-5.el9_6
0:3.5.3-11.el9_8
1
ghcr.io/grafana/alloy-operator:1.7.02ce23f948e02
libarchive@3.5.3-6.el9_6
0:3.5.3-11.el9_8
1
ghcr.io/grafana/alloy-operator:1.12.14ee4b71cf16a
libarchive@3.5.3-9.el9_7
0:3.5.3-11.el9_8
1
ghcr.io/grafana/alloy-operator:1.8.1ae85d68749c7
libarchive@3.5.3-6.el9_6
0:3.5.3-11.el9_8
1
ghcr.io/haveagitgat/tdarr:2.00.18.23fbe4c29d14c
libarchive@3.4.0-2ubuntu1.2
3.4.0-2ubuntu1.5+esm3
1
ghcr.io/it-at-m/dave-admin-portal/dave-adminportal:10.0.0cbff8141302f
libarchive@3.5.3-9.el9_7
0:3.5.3-11.el9_8
1
ghcr.io/it-at-m/dave-backend/dave-backend:10.0.0f66413e62afc
libarchive@3.5.3-9.el9_7
0:3.5.3-11.el9_8
1
ghcr.io/it-at-m/dave-document-storage/dave-document-storage:10.0.09c7fc07330c9
libarchive@3.5.3-6.el9_6
0:3.5.3-11.el9_8
1
ghcr.io/it-at-m/dave-eai/dave-eai:10.0.0fd93e0d125b3
libarchive@3.5.3-9.el9_7
0:3.5.3-11.el9_8
1
ghcr.io/it-at-m/dave-frontend/dave-frontend:10.0.0a49fdb8d6f1b
libarchive@3.5.3-9.el9_7
0:3.5.3-11.el9_8
1
ghcr.io/it-at-m/dave-geodata-eai/dave-geodata-eai:10.0.06a3fe3136856
libarchive@3.5.3-9.el9_7
0:3.5.3-11.el9_8
1
ghcr.io/it-at-m/dave-selfservice-portal/dave-selfserviceportal:10.0.0d352df1b94b6
libarchive@3.5.3-9.el9_7
0:3.5.3-11.el9_8
1
ghcr.io/it-at-m/kf-app-eai:1.0.65de339b3d537
libarchive@3.5.3-6.el9_6
0:3.5.3-11.el9_8
1
ghcr.io/it-at-m/wjh-rechner:1.0.0bc70cdb5a01a
libarchive@3.5.3-4.el9
0:3.5.3-11.el9_8
1
ghcr.io/it-at-m/zammad-ldap-sync:dev10de22c8cbce
libarchive@3.5.3-9.el9_7
0:3.5.3-11.el9_8
1
ghcr.io/k8s-at-home/apache-musicindex:v1.4.1-2c9bd82dc5fda
libarchive@3.4.0-2ubuntu1.2
3.4.0-2ubuntu1.5+esm3
1
ghcr.io/k8s-at-home/xteve:v2.2.0.200292b3614670f
libarchive@3.4.0-2ubuntu1.2
3.4.0-2ubuntu1.5+esm3
1
ghcr.io/kanisterio/controller:0.118.0d22616a5998b
libarchive@3.5.3-6.el9_6
0:3.5.3-11.el9_8
1
ghcr.io/kluster-manager/cluster-gateway:v1.12.158bed8d1e7fc
libarchive@3.5.3-9.el9_7
0:3.5.3-11.el9_8
1
ghcr.io/kluster-manager/cluster-gateway-manager:v1.12.1f22cae0e6cf3
libarchive@3.5.3-9.el9_7
0:3.5.3-11.el9_8
1
ghcr.io/kluster-manager/managed-serviceaccount:v0.10.0fc256885915b
libarchive@3.5.3-6.el9_6
0:3.5.3-11.el9_8
1
ghcr.io/kluster-manager/registration-operator:v1.2.00cbced8e6240
libarchive@3.5.3-6.el9_6
0:3.5.3-11.el9_8
1
ghcr.io/llm-d/llm-d-model-service:v0.0.158b99a8104a2f
libarchive@3.5.3-4.el9
0:3.5.3-11.el9_8
1
ghcr.io/microboxlabs/miot-calendar:latest-jvm7157cdc0bf5b
libarchive@3.5.3-6.el9_6
0:3.5.3-11.el9_8
1
ghcr.io/microboxlabs/miot-srv:latest4ec11d229028
libarchive@3.5.3-6.el9_6
0:3.5.3-11.el9_8
1
ghcr.io/microboxlabs/miot-srv:latest5796553b41ae
libarchive@3.5.3-6.el9_6
0:3.5.3-11.el9_8
1
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
libarchive@3.6.2-1+deb12u1
3.6.2-1+deb12u5
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
libarchive@3.7.4-4
no fix listed
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
libarchive@3.7.4-4
no fix listed
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
libarchive@3.7.4-4
no fix listed
1
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
libarchive@3.6.2-1
3.6.2-1+deb12u5
1
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
libarchive@3.7.4-4
no fix listed
1
ghcr.io/projectnessie/nessie:0.92.19efe3c74d55f
libarchive@3.5.3-4.el9
0:3.5.3-11.el9_8
1
ghcr.io/projectnessie/nessie:0.108.4c0f42874c810
libarchive@3.5.3-9.el9_7
0:3.5.3-11.el9_8
1
ghcr.io/stirling-tools/stirling-pdf:2.14.33b3670fce70b
libarchive@3.7.2-2ubuntu0.6
3.7.2-2ubuntu0.8
1
mcr.microsoft.com/mssql/server:2019-CU16-ubuntu-20.0449a57dc220b1
libarchive@3.4.0-2ubuntu1.2
3.4.0-2ubuntu1.5+esm3
1
mcr.microsoft.com/mssql/server:2022-latestba4c8329f48f
libarchive@3.6.0-1ubuntu1.7
3.6.0-1ubuntu1.8
1
mcr.microsoft.com/mssql/server:2025-CU5-ubuntu-24.04cee0f4db03b5
libarchive@3.7.2-2ubuntu0.6
3.7.2-2ubuntu0.8
1
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.0-1-ubi99026dbbf280d
libarchive@3.5.3-6.el9_6
0:3.5.3-11.el9_8
1
public.ecr.aws/perfectscale-io/psc-exporter:v1.0.45-redhat9083e60c38bc
libarchive@3.5.3-4.el9
0:3.5.3-11.el9_8
1
public.ecr.aws/perfectscale-io/ubi9/ubi:9.5d7c3def9252b
libarchive@3.5.3-4.el9
0:3.5.3-11.el9_8
1
public.ecr.aws/v0r6c2e2/hive-metastore:latest794b3bff9510
libarchive@3.5.3-4.el9
0:3.5.3-11.el9_8
1
public.ecr.aws/v0r6c2e2/trino:latestc265156b00d1
libarchive@3.5.3-4.el9
0:3.5.3-11.el9_8
1
quay.io/ai-lab/llamacpp_python:latest70d138997acd
libarchive@3.5.3-4.el9
0:3.5.3-11.el9_8
1
quay.io/backube/volsync:0.16.00d03a6aad575
libarchive@3.5.3-9.el9_7
0:3.5.3-11.el9_8
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.