StackRadar

CVE-2026-16517

Low

Advisory

Published 21 Jul 2026In the index since 6 Sept 2026
Severity
Low
worst across findings
CVSS
2.9
base score, highest
EPSS
0.001
0th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
63
of 17,787 indexed, latest versions
Container images
54
deployed by those charts
Fix available
1 of 1
affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 63 of 17,787 indexed charts deploy, on 54 images.

Affected packageAffected versionsFixed inImages
libarchivedeb3.1.2-11ubuntu0.16.04.3, 3.4.0-2ubuntu1, 3.4.0-2ubuntu1.2, 3.4.0-2ubuntu1.5+19 more3.6.2-1+deb12u554
OSV records
DEBIAN-CVE-2026-16517UBUNTU-CVE-2026-16517

Charts affected

63 by stars
ChartLatestAffected imagesRadar Score
difydoubanVerified publisher0.10.01 of 6See more

dify douban 0.10.0

1 of the 6 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
libarchive@3.7.2-2ubuntu0.5
no fix listed

Open the chart page →

19,497
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
langgenius/dify-plugin-daemon:0.6.3-local3c694329357b
libarchive@3.7.2-2ubuntu0.7
no fix listed

Open the chart page →

22,115
openprojectopenproject-helm-chartsOfficialVerified publisher13.11.01 of 5See more

openproject openproject-helm-charts 13.11.0

1 of the 5 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
openproject/openproject:17.8.0-slim48952034215d
libarchive@3.7.4-4+deb13u1
no fix listed

Open the chart page →

19,998
paperless-ngxpaperless-ngxVerified publisher0.3.221 of 3See more

paperless-ngx paperless-ngx 0.3.22

1 of the 3 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
libarchive@3.7.4-4+deb13u1
no fix listed

Open the chart page →

8,510
mssqlserver-2022simcube1.2.31 of 1See more

mssqlserver-2022 simcube 1.2.3

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
mcr.microsoft.com/mssql/server:2022-latestba4c8329f48f
libarchive@3.6.0-1ubuntu1.7
no fix listed

Open the chart page →

2,927
photoprismandrenarchyVerified publisher8.15.01 of 1See more

photoprism andrenarchy 8.15.0

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
photoprism/photoprism:260728958642220223
libarchive@3.8.5-1ubuntu2.2
no fix listed

Open the chart page →

8,907
kubeservice-lxcfs-webhookkubservice-chartsVerified publisher1.6.01 of 6See more

kubeservice-lxcfs-webhook kubservice-charts 1.6.0

1 of the 6 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
dongjiang1989/lxcfs:v6.0.34bf9ae391948
libarchive@3.4.0-2ubuntu1.5
no fix listed

Open the chart page →

11,630
paperlesszekker6Verified publisher11.8.01 of 1See more

paperless zekker6 11.8.0

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
libarchive@3.7.4-4+deb13u1
no fix listed

Open the chart page →

4,644
paperless-ngxadnoctemVerified publisher0.4.21 of 5See more

paperless-ngx adnoctem 0.4.2

1 of the 5 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
libarchive@3.7.4-4+deb13u1
no fix listed

Open the chart page →

19,769
paperless-ngxalexmorbo-paperless-ngxVerified publisher0.2.01 of 2See more

paperless-ngx alexmorbo-paperless-ngx 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.5665f2f5cc548
libarchive@3.7.4-4
no fix listed

Open the chart page →

11,936
hermes-agentankra-chartsVerified publisher0.3.11 of 1See more

hermes-agent ankra-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
nousresearch/hermes-agent:v2026.8.27e0df6adebddf
libarchive@3.7.4-4+deb13u1
no fix listed

Open the chart page →

5,918
self-hostbitwarden2.4.01 of 11See more

self-host bitwarden 2.4.0

1 of the 11 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
mcr.microsoft.com/mssql/server:2025-CU5-ubuntu-24.04cee0f4db03b5
libarchive@3.7.2-2ubuntu0.6
no fix listed

Open the chart page →

5,238
dawarichcogitriVerified publisher2.8.41 of 3See more

dawarich cogitri 2.8.4

1 of the 3 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
freikin/dawarich:1.14.511826c67e4b1
libarchive@3.7.4-4+deb13u1
no fix listed

Open the chart page →

5,650
paperless-ngxcrystalnetVerified publisher0.2.221 of 3See more

paperless-ngx crystalnet 0.2.22

1 of the 3 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.13.10642357c5dbd
libarchive@3.6.2-1+deb12u1
3.6.2-1+deb12u5

Open the chart page →

12,924
iobrokereugen0.2.61 of 1See more

iobroker eugen 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
libarchive@3.6.2-1+deb12u1
3.6.2-1+deb12u5

Open the chart page →

11,483
games-on-whalesgeek-cookbookVerified publisher1.8.21 of 7See more

games-on-whales geek-cookbook 1.8.2

1 of the 7 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
ghcr.io/games-on-whales/retroarch:1.0.0103fbcec2314
libarchive@3.4.0-2ubuntu1
no fix listed

Open the chart page →

35,464
tdarrgeek-cookbookVerified publisher4.6.22 of 2See more

tdarr geek-cookbook 4.6.2

2 of the 2 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
haveagitgat/tdarr:2.00.181256348872ce
libarchive@3.4.0-2ubuntu1.2
no fix listed
haveagitgat/tdarr_node:2.00.101e3f9328327d
libarchive@3.4.0-2ubuntu1
no fix listed

Open the chart page →

31,178
paperless-ngxpaperlessVerified publisher0.4.01 of 3See more

paperless-ngx paperless 0.4.0

1 of the 3 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngxdigest-pinnedaa810a36942c
libarchive@3.7.4-4+deb13u1
no fix listed

Open the chart page →

8,510
fluent-bitromanow-helm-chartsVerified publisher1.7.31 of 1See more

fluent-bit romanow-helm-charts 1.7.3

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
fluent/fluent-bit:4.0-debuge76397ef3983
libarchive@3.6.2-1+deb12u3
3.6.2-1+deb12u5

Open the chart page →

7,767
mssqlserver-2019simcube1.2.31 of 1See more

mssqlserver-2019 simcube 1.2.3

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
mcr.microsoft.com/mssql/server:2019-CU16-ubuntu-20.0449a57dc220b1
libarchive@3.4.0-2ubuntu1.2
no fix listed

Open the chart page →

6,864
tdarrvhdirkVerified publisher5.0.52 of 2See more

tdarr vhdirk 5.0.5

2 of the 2 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
haveagitgat/tdarr_node:2.17.013ff0913202dd
libarchive@3.4.0-2ubuntu1.2
no fix listed
ghcr.io/haveagitgat/tdarr:2.00.18.23fbe4c29d14c
libarchive@3.4.0-2ubuntu1.2
no fix listed

Open the chart page →

26,843
open5gsadaptivenetlabVerified publisher1.0.31 of 3See more

open5gs adaptivenetlab 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
libarchive@3.4.0-2ubuntu1
no fix listed

Open the chart page →

25,507
games-on-whalesangelnu2.0.01 of 7See more

games-on-whales angelnu 2.0.0

1 of the 7 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
ghcr.io/games-on-whales/retroarch:1.0.0103fbcec2314
libarchive@3.4.0-2ubuntu1
no fix listed

Open the chart page →

42,345
asya-playgroundasya1.1.31 of 1See more

asya-playground asya 1.1.3

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
localstack/localstack:3.19d278167f2b7
libarchive@3.6.2-1
3.6.2-1+deb12u5

Open the chart page →

8,555
paperless-ngxcharts-derwitt-devVerified publisher2.1.41 of 1See more

paperless-ngx charts-derwitt-dev 2.1.4

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
libarchive@3.7.4-4+deb13u1
no fix listed

Open the chart page →

4,644
hlf-couchdbcloudnativeapp1.0.61 of 1See more

hlf-couchdb cloudnativeapp 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
hyperledger/fabric-couchdb:0.4.10c65891b6c237
libarchive@3.1.2-11ubuntu0.16.04.3
no fix listed

Open the chart page →

34,014
opencloudcommunity-opencloud3.0.01 of 11See more

opencloud community-opencloud 3.0.0

1 of the 11 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
apache/tika:latest-full80072bb73dd3
libarchive@3.8.5-1ubuntu2.2
no fix listed

Open the chart page →

3,850
logstream-leadercriblio4.19.21 of 1See more

logstream-leader criblio 4.19.2

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
cribl/cribl:4.19.2044f9a5fac9a
libarchive@3.7.2-2ubuntu0.8
no fix listed

Open the chart page →

1,269
logstream-workergroupcriblio4.19.21 of 1See more

logstream-workergroup criblio 4.19.2

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
cribl/cribl:4.19.2044f9a5fac9a
libarchive@3.7.2-2ubuntu0.8
no fix listed

Open the chart page →

1,269
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
langgenius/dify-plugin-daemon:main-localda995c129e2f
libarchive@3.7.2-2ubuntu0.8
no fix listed

Open the chart page →

19,063
photoprismdjjudas21Verified publisher99.99.991 of 1See more

photoprism djjudas21 99.99.99

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
photoprism/photoprism:240711-cefc6fd632ca74
libarchive@3.7.2-2ubuntu0.1
no fix listed

Open the chart page →

17,053
faasnetfaasnet0.0.41 of 5See more

faasnet faasnet 0.0.4

1 of the 5 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
mcr.microsoft.com/mssql/server:latest4bab24f36c1e
libarchive@3.7.2-2ubuntu0.8
no fix listed

Open the chart page →

7,665
business-api-ecosystemfiware1.1.01 of 4See more

business-api-ecosystem fiware 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
libarchive@3.4.0-2ubuntu1.5
no fix listed

Open the chart page →

64,192
scanservjsgabe565Verified publisher0.9.21 of 1See more

scanservjs gabe565 0.9.2

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
sbs20/scanservjs:release-v3.0.3dad1fd6e9a98
libarchive@3.6.2-1
3.6.2-1+deb12u5

Open the chart page →

13,247
apache-musicindexgeek-cookbookVerified publisher2.4.21 of 1See more

apache-musicindex geek-cookbook 2.4.2

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/apache-musicindex:v1.4.1-2c9bd82dc5fda
libarchive@3.4.0-2ubuntu1.2
no fix listed

Open the chart page →

14,698
icinga2geek-cookbookVerified publisher4.2.01 of 1See more

icinga2 geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
jordan/icinga2:latestf75025fe8ea8
libarchive@3.6.2-1+deb12u4
3.6.2-1+deb12u5

Open the chart page →

9,103
openkmgeek-cookbookVerified publisher4.2.01 of 1See more

openkm geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
openkm/openkm-ce:6.3.113bc465a7461b
libarchive@3.4.0-2ubuntu1.2
no fix listed

Open the chart page →

28,039
xtevegeek-cookbookVerified publisher8.4.21 of 1See more

xteve geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/xteve:v2.2.0.200292b3614670f
libarchive@3.4.0-2ubuntu1.2
no fix listed

Open the chart page →

17,996
medikeephelmforgeVerified publisher2.0.01 of 3See more

medikeep helmforge 2.0.0

1 of the 3 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
ghcr.io/afairgiant/medikeep:v0.69.0766699daa9ac
libarchive@3.6.2-1+deb12u4
3.6.2-1+deb12u5

Open the chart page →

6,041
nominatimheywood8-helm-chartsVerified publisher3.10.81 of 3See more

nominatim heywood8-helm-charts 3.10.8

1 of the 3 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
mediagis/nominatim:4.2d0eae7b51374
libarchive@3.6.0-1ubuntu1
no fix listed

Open the chart page →

14,350
paperlesshomelabcihelmchartstestVerified publisher9.1.91 of 1See more

paperless homelabcihelmchartstest 9.1.9

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
libarchive@3.6.2-1
3.6.2-1+deb12u5

Open the chart page →

14,629
paperlesshpVerified publisher0.1.11 of 5See more

paperless hp 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:3.1.3aa810a36942c
libarchive@3.7.4-4+deb13u1
no fix listed

Open the chart page →

26,579
infisicalinfisical-charts0.4.21 of 3See more

infisical infisical-charts 0.4.2

1 of the 3 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
infisical/infisical:latest02082bf13163
libarchive@3.7.4-4+deb13u1
no fix listed

Open the chart page →

2,954
opencloudjacobcolvinVerified publisher0.2.31 of 13See more

opencloud jacobcolvin 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
apache/tika:2.9.2.1-fullae0b86d3c4d0
libarchive@3.7.2-2
no fix listed

Open the chart page →

45,392
deltabadgerk8s-chartsVerified publisher2.0.01 of 1See more

deltabadger k8s-charts 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
ghcr.io/deltabadger/deltabadger:2.23.3bffe3c22fabc
libarchive@3.7.4-4+deb13u1
no fix listed

Open the chart page →

5,681
paperlessk8s-home-lab-repo11.0.11 of 1See more

paperless k8s-home-lab-repo 11.0.1

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.14b89f83345532
libarchive@3.7.4-4
no fix listed

Open the chart page →

8,990
rspamdklicktippVerified publisher1.6.01 of 1See more

rspamd klicktipp 1.6.0

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
rspamd/rspamd:4.1.4e870599c970d
libarchive@3.7.4-4+deb13u1
no fix listed

Open the chart page →

1,788
adventureworkskronkltdVerified publisher0.1.01 of 1See more

adventureworks kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
chriseaton/adventureworks:latest54c3384ce701
libarchive@3.6.0-1ubuntu1.4
no fix listed

Open the chart page →

4,462
paperless-ngxmt1905027.6.141 of 4See more

paperless-ngx mt190502 7.6.14

1 of the 4 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.134b05bcd28e69
libarchive@3.7.4-4
no fix listed

Open the chart page →

11,860
nominatimnominatim-chart1.3.01 of 3See more

nominatim nominatim-chart 1.3.0

1 of the 3 container images this version deploys carry CVE-2026-16517.

Container imageDigestPackageFixed in
mediagis/nominatim:3.7c15e941485ef
libarchive@3.4.0-2ubuntu1.2
no fix listed

Open the chart page →

22,713

Container images carrying it

54 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
mcr.microsoft.com/mssql/server:latest4bab24f36c1e
libarchive@3.7.2-2ubuntu0.8
no fix listed
1
mcr.microsoft.com/mssql/server:2022-latestba4c8329f48f
libarchive@3.6.0-1ubuntu1.7
no fix listed
1
mcr.microsoft.com/mssql/server:2025-CU5-ubuntu-24.04cee0f4db03b5
libarchive@3.7.2-2ubuntu0.6
no fix listed
1
registry.gitlab.com/infinitydon/registry/open5gs-aio:v2.2.2f6385712935f
libarchive@3.4.0-2ubuntu1
no fix listed
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.