StackRadar

CVE-2026-27820

Critical

Advisory

Published 16 Apr 2026In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
71
of 17,781 indexed, latest versions
Container images
78
deployed by those charts
Fix available
2 of 6
affected packages

Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption

Carried by container images the latest versions of 71 of 17,781 indexed charts deploy, on 78 images.

Affected packageAffected versionsFixed inImages
zlibgem1.0.0, 1.1.0, 2.0.0, 2.1.1+4 more3.0.1, 3.1.2, 3.2.376
ruby2.7deb2.7.0-5ubuntu1.4, 2.7.0-5ubuntu1.5, 2.7.0-5ubuntu1.8no fix listed6
ruby2.3deb2.3.1-2~16.04.52.3.1-2~ubuntu16.04.16+esm152
ruby3.0deb3.0.2-7ubuntu2.4, 3.0.2-7ubuntu2.8no fix listed2
ruby2.5deb2.5.8-1bbox1~bionic1no fix listed1
ruby3.1deb3.1.2-7+deb12u1no fix listed1
OSV records
DEBIAN-CVE-2026-27820GHSA-g857-hhfv-j68wUBUNTU-CVE-2026-27820
Also known as
USN-8556-1

Charts affected

71 by stars
ChartLatestAffected imagesRadar Score
danbooru-stackmy0nVerified publisher0.0.31 of 4See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
zlib@2.1.1
3.0.1

Open the chart page →

12,791
betydbncsaVerified publisher0.6.11 of 4See more

betydb ncsa 0.6.1

1 of the 4 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
pecan/bety:5.4.1f825d480cd62
zlib@1.0.0
3.0.1

Open the chart page →

9,542
pecanncsaVerified publisher0.6.21 of 15See more

pecan ncsa 0.6.2

1 of the 15 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
pecan/bety:5.4.1f825d480cd62
zlib@1.0.0
3.0.1

Open the chart page →

14,154
comacopencord1.0.01 of 9See more

comac opencord 1.0.0

1 of the 9 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
omecproject/onos-progran:1.0.05715e5648aa0
ruby2.3@2.3.1-2~16.04.5
2.3.1-2~ubuntu16.04.16+esm15

Open the chart page →

88,546
onos-progranopencord1.2.71 of 2See more

onos-progran opencord 1.2.7

1 of the 2 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
muluder/prograncontrollermcord:0.1.843b597a93da7
ruby2.3@2.3.1-2~16.04.5
2.3.1-2~ubuntu16.04.16+esm15

Open the chart page →

38,865
pact-brokerqamatic0.1.01 of 2See more

pact-broker qamatic 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
pactfoundation/pact-broker:2.32.0-2062d6c710099
zlib@1.0.0
3.0.1

Open the chart page →

3,533
cf-operatorquarks2.3.0+0.g27a91cdf2 of 2See more

cf-operator quarks 2.3.0+0.g27a91cdf

2 of the 2 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
cfcontainerization/cf-operator:v2.3.0-0.g27a91cdf82fa261c18a8
zlib@1.0.0
3.0.1
cfcontainerization/quarks-job:v0.0.0-0.g70ae34b58fb1c173a46
zlib@1.0.0
3.0.1

Open the chart page →

11,942
quarksquarks7.0.1+0.g5396b114 of 5See more

quarks quarks 7.0.1+0.g5396b11

4 of the 5 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
ghcr.io/cloudfoundry-incubator/quarks-job:v1.0.213760eee87f839
zlib@1.0.0
3.0.1
ghcr.io/cloudfoundry-incubator/quarks-operator:v7.0.1-0.g5396b116a1432b0d503
zlib@1.0.0
3.0.1
ghcr.io/cloudfoundry-incubator/quarks-secret:v1.0.754f059af4de8ed
zlib@1.0.0
3.0.1
ghcr.io/cloudfoundry-incubator/quarks-statefulset:v0.0.1308-g6a8b2220e24a9e0a21b6
zlib@1.0.0
3.0.1

Open the chart page →

18,197
quarks-jobquarks0.0.124-g03faac81 of 1See more

quarks-job quarks 0.0.124-g03faac8

1 of the 1 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
cfcontainerization/quarks-job:v0.0.124-g03faac87366b11c5fa5
zlib@1.0.0
3.0.1

Open the chart page →

1,804
quarks-secretquarks0.0.677-ga060bb61 of 1See more

quarks-secret quarks 0.0.677-ga060bb6

1 of the 1 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
cfcontainerization/quarks-secret:v0.0.677-ga060bb643131dbc0c8f
zlib@1.0.0
3.0.1

Open the chart page →

1,814
quarks-statefulsetquarks0.0.1304-g4b4f2ac51 of 1See more

quarks-statefulset quarks 0.0.1304-g4b4f2ac5

1 of the 1 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
ghcr.io/cloudfoundry-incubator/quarks-statefulset:v0.0.1304-g4b4f2ac5c7c70b527255
zlib@1.0.0
3.0.1

Open the chart page →

4,010
bookinforgnu1.0.01 of 7See more

bookinfo rgnu 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
istio/examples-bookinfo-details-v1:1.14.04c3379923c8a
zlib@1.0.0
3.0.1

Open the chart page →

20,462
istio-bookinforgnu1.0.21 of 7See more

istio-bookinfo rgnu 1.0.2

1 of the 7 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
istio/examples-bookinfo-details-v1:1.14.04c3379923c8a
zlib@1.0.0
3.0.1

Open the chart page →

20,462
mastodonrivals-spaceVerified publisher3.1.21 of 3See more

mastodon rivals-space 3.1.2

1 of the 3 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
zlib@2.0.0
3.0.1

Open the chart page →

6,026
coralogix-fluentdromholdings1.0.31 of 1See more

coralogix-fluentd romholdings 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
coralogixrepo/fluentd-coralogix-image:1.1.6b976e0412424
zlib@1.0.0
3.0.1

Open the chart page →

750
fluentdslamdev0.0.61 of 1See more

fluentd slamdev 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.11.5-debian-forward-1.00717111a3362
zlib@1.0.0
3.0.1

Open the chart page →

1,384
fluentd-operatorstatcan0.5.11 of 1See more

fluentd-operator statcan 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
vmware/kube-fluentd-operator:latestf028c138a5f4
zlib@2.1.1
3.0.1

Open the chart page →

1,955
velero-notificationsvelero-notifications1.1.01 of 1See more

velero-notifications velero-notifications 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
ghcr.io/simoncaron/velero-notifications:1.0.0d058963d4de7
zlib@1.1.0
3.0.1

Open the chart page →

1,285
maybe-financevicsuferVerified publisher0.2.71 of 3See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
zlib@3.2.1
3.2.3

Open the chart page →

10,795
kongwallarmVerified publisher4.6.32 of 7See more

kong wallarm 4.6.3

2 of the 7 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
wallarm/ingress-ruby:4.6.0-1aecdb35c4def
zlib@1.1.0
3.0.1
wallarm/kong:3.1.0-ubuntu-4.6.0ea9608c82e40
ruby2.7@2.7.0-5ubuntu1.8
zlib@1.1.0
no fix listed
3.0.1

Open the chart page →

11,405
kong-previewwallarmVerified publisher4.2.31 of 5See more

kong-preview wallarm 4.2.3

1 of the 5 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
wallarm/ingress-ruby:4.2.1-195ea2632326c
zlib@1.1.0
3.0.1

Open the chart page →

2,905

Container images carrying it

78 by charts deploying them

A fixed version is listed for 2 of the 6 affected packages.

Container imageDigestPackageFixed inUsed by
wallarm/ingress-ruby:4.6.0-1aecdb35c4def
zlib@1.1.0
3.0.1
1
wallarm/kong:3.1.0-ubuntu-4.6.0ea9608c82e40
ruby2.7@2.7.0-5ubuntu1.8
zlib@1.1.0
no fix listed
3.0.1
1
zammad/zammad-docker-compose:zammad-4.1.0-312808e2dfa810
zlib@1.0.0
3.0.1
1
ghcr.io/caninehq/canine:latesta058034ca006
zlib@3.1.1
3.1.2
1
ghcr.io/cloudfoundry-incubator/quarks-job:v1.0.213760eee87f839
zlib@1.0.0
3.0.1
1
ghcr.io/cloudfoundry-incubator/quarks-operator:v7.0.1-0.g5396b116a1432b0d503
zlib@1.0.0
3.0.1
1
ghcr.io/cloudfoundry-incubator/quarks-secret:v1.0.754f059af4de8ed
zlib@1.0.0
3.0.1
1
ghcr.io/cloudfoundry-incubator/quarks-statefulset:v0.0.1304-g4b4f2ac5c7c70b527255
zlib@1.0.0
3.0.1
1
ghcr.io/cloudfoundry-incubator/quarks-statefulset:v0.0.1308-g6a8b2220e24a9e0a21b6
zlib@1.0.0
3.0.1
1
ghcr.io/deltabadger/deltabadger:2.23.3bffe3c22fabc
zlib@3.2.1
3.2.3
1
ghcr.io/g0dscookie/icinga2:2.13.5da81246ccfc9
zlib@1.1.0
3.0.1
1
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
zlib@2.1.1
3.0.1
1
ghcr.io/kvaps/opennebula:v5.12.0.4-1e28e0e7de11b
ruby2.7@2.7.0-5ubuntu1.5
zlib@1.1.0
no fix listed
3.0.1
1
ghcr.io/kvaps/opennebula-exporter:v5.12.0.401563adc95fd
ruby2.7@2.7.0-5ubuntu1.4
zlib@1.1.0
no fix listed
3.0.1
1
ghcr.io/kvaps/opennebula-exporter:v5.12.0.4-12b92df1143b9
ruby2.7@2.7.0-5ubuntu1.5
zlib@1.1.0
no fix listed
3.0.1
1
ghcr.io/kvaps/opennebula-flow:v5.12.0.4-1600221f0f43f
ruby2.7@2.7.0-5ubuntu1.5
zlib@1.1.0
no fix listed
3.0.1
1
ghcr.io/kvaps/opennebula-gate:v5.12.0.4-1a85e03d8bc1d
ruby2.7@2.7.0-5ubuntu1.5
zlib@1.1.0
no fix listed
3.0.1
1
ghcr.io/manyfold3d/manyfold:0.136.0d14ca4d82475
zlib@3.2.1
3.2.3
1
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
zlib@2.0.0
3.0.1
1
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
zlib@3.2.1
3.2.3
1
ghcr.io/open-telemetry/demo:1.12.0-emailservicea1f5cebb5240
zlib@3.0.0
3.0.1
1
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
zlib@2.0.0
3.0.1
1
ghcr.io/simoncaron/velero-notifications:1.0.0d058963d4de7
zlib@1.1.0
3.0.1
1
ghcr.io/voxpupuli/container-puppetdb:7.18.0-v1.5.0a56dfe91f5b1
zlib@1.1.0
3.0.1
1
ghcr.io/voxpupuli/container-puppetserver:7.17.0-v1.5.0916746209ac5
ruby3.0@3.0.2-7ubuntu2.4
zlib@1.1.0
no fix listed
3.0.1
1
ghcr.io/voxpupuli/puppetserver:8.7.0-main63873f3f698e
ruby3.0@3.0.2-7ubuntu2.8
zlib@1.1.0
no fix listed
3.0.1
1
quay.io/fairwinds/yelb-appserver:v0.6.0fae21f06131f
zlib@1.1.0
3.0.1
1
quay.io/fluentd_elasticsearch/fluentd:v4.2.399079df58561
zlib@2.1.1
3.0.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.