StackRadar

CVE-2026-27820

Critical

Advisory

Published 16 Apr 2026In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
71
of 17,781 indexed, latest versions
Container images
78
deployed by those charts
Fix available
2 of 6
affected packages

Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption

Carried by container images the latest versions of 71 of 17,781 indexed charts deploy, on 78 images.

Affected packageAffected versionsFixed inImages
zlibgem1.0.0, 1.1.0, 2.0.0, 2.1.1+4 more3.0.1, 3.1.2, 3.2.376
ruby2.7deb2.7.0-5ubuntu1.4, 2.7.0-5ubuntu1.5, 2.7.0-5ubuntu1.8no fix listed6
ruby2.3deb2.3.1-2~16.04.52.3.1-2~ubuntu16.04.16+esm152
ruby3.0deb3.0.2-7ubuntu2.4, 3.0.2-7ubuntu2.8no fix listed2
ruby2.5deb2.5.8-1bbox1~bionic1no fix listed1
ruby3.1deb3.1.2-7+deb12u1no fix listed1
OSV records
DEBIAN-CVE-2026-27820GHSA-g857-hhfv-j68wUBUNTU-CVE-2026-27820
Also known as
USN-8556-1

Charts affected

71 by stars
ChartLatestAffected imagesRadar Score
danbooru-stackmy0nVerified publisher0.0.31 of 4See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
zlib@2.1.1
3.0.1

Open the chart page →

12,791
betydbncsaVerified publisher0.6.11 of 4See more

betydb ncsa 0.6.1

1 of the 4 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
pecan/bety:5.4.1f825d480cd62
zlib@1.0.0
3.0.1

Open the chart page →

9,542
pecanncsaVerified publisher0.6.21 of 15See more

pecan ncsa 0.6.2

1 of the 15 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
pecan/bety:5.4.1f825d480cd62
zlib@1.0.0
3.0.1

Open the chart page →

14,154
comacopencord1.0.01 of 9See more

comac opencord 1.0.0

1 of the 9 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
omecproject/onos-progran:1.0.05715e5648aa0
ruby2.3@2.3.1-2~16.04.5
2.3.1-2~ubuntu16.04.16+esm15

Open the chart page →

88,546
onos-progranopencord1.2.71 of 2See more

onos-progran opencord 1.2.7

1 of the 2 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
muluder/prograncontrollermcord:0.1.843b597a93da7
ruby2.3@2.3.1-2~16.04.5
2.3.1-2~ubuntu16.04.16+esm15

Open the chart page →

38,865
pact-brokerqamatic0.1.01 of 2See more

pact-broker qamatic 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
pactfoundation/pact-broker:2.32.0-2062d6c710099
zlib@1.0.0
3.0.1

Open the chart page →

3,533
cf-operatorquarks2.3.0+0.g27a91cdf2 of 2See more

cf-operator quarks 2.3.0+0.g27a91cdf

2 of the 2 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
cfcontainerization/cf-operator:v2.3.0-0.g27a91cdf82fa261c18a8
zlib@1.0.0
3.0.1
cfcontainerization/quarks-job:v0.0.0-0.g70ae34b58fb1c173a46
zlib@1.0.0
3.0.1

Open the chart page →

11,942
quarksquarks7.0.1+0.g5396b114 of 5See more

quarks quarks 7.0.1+0.g5396b11

4 of the 5 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
ghcr.io/cloudfoundry-incubator/quarks-job:v1.0.213760eee87f839
zlib@1.0.0
3.0.1
ghcr.io/cloudfoundry-incubator/quarks-operator:v7.0.1-0.g5396b116a1432b0d503
zlib@1.0.0
3.0.1
ghcr.io/cloudfoundry-incubator/quarks-secret:v1.0.754f059af4de8ed
zlib@1.0.0
3.0.1
ghcr.io/cloudfoundry-incubator/quarks-statefulset:v0.0.1308-g6a8b2220e24a9e0a21b6
zlib@1.0.0
3.0.1

Open the chart page →

18,197
quarks-jobquarks0.0.124-g03faac81 of 1See more

quarks-job quarks 0.0.124-g03faac8

1 of the 1 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
cfcontainerization/quarks-job:v0.0.124-g03faac87366b11c5fa5
zlib@1.0.0
3.0.1

Open the chart page →

1,804
quarks-secretquarks0.0.677-ga060bb61 of 1See more

quarks-secret quarks 0.0.677-ga060bb6

1 of the 1 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
cfcontainerization/quarks-secret:v0.0.677-ga060bb643131dbc0c8f
zlib@1.0.0
3.0.1

Open the chart page →

1,814
quarks-statefulsetquarks0.0.1304-g4b4f2ac51 of 1See more

quarks-statefulset quarks 0.0.1304-g4b4f2ac5

1 of the 1 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
ghcr.io/cloudfoundry-incubator/quarks-statefulset:v0.0.1304-g4b4f2ac5c7c70b527255
zlib@1.0.0
3.0.1

Open the chart page →

4,010
bookinforgnu1.0.01 of 7See more

bookinfo rgnu 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
istio/examples-bookinfo-details-v1:1.14.04c3379923c8a
zlib@1.0.0
3.0.1

Open the chart page →

20,462
istio-bookinforgnu1.0.21 of 7See more

istio-bookinfo rgnu 1.0.2

1 of the 7 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
istio/examples-bookinfo-details-v1:1.14.04c3379923c8a
zlib@1.0.0
3.0.1

Open the chart page →

20,462
mastodonrivals-spaceVerified publisher3.1.21 of 3See more

mastodon rivals-space 3.1.2

1 of the 3 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
ghcr.io/rivals-space/rivals-mastodon:1.6.143b23d55e4be
zlib@2.0.0
3.0.1

Open the chart page →

6,026
coralogix-fluentdromholdings1.0.31 of 1See more

coralogix-fluentd romholdings 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
coralogixrepo/fluentd-coralogix-image:1.1.6b976e0412424
zlib@1.0.0
3.0.1

Open the chart page →

750
fluentdslamdev0.0.61 of 1See more

fluentd slamdev 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
fluent/fluentd-kubernetes-daemonset:v1.11.5-debian-forward-1.00717111a3362
zlib@1.0.0
3.0.1

Open the chart page →

1,384
fluentd-operatorstatcan0.5.11 of 1See more

fluentd-operator statcan 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
vmware/kube-fluentd-operator:latestf028c138a5f4
zlib@2.1.1
3.0.1

Open the chart page →

1,955
velero-notificationsvelero-notifications1.1.01 of 1See more

velero-notifications velero-notifications 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
ghcr.io/simoncaron/velero-notifications:1.0.0d058963d4de7
zlib@1.1.0
3.0.1

Open the chart page →

1,285
maybe-financevicsuferVerified publisher0.2.71 of 3See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
ghcr.io/maybe-finance/maybe:0.5.0c6ab95ca9130
zlib@3.2.1
3.2.3

Open the chart page →

10,795
kongwallarmVerified publisher4.6.32 of 7See more

kong wallarm 4.6.3

2 of the 7 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
wallarm/ingress-ruby:4.6.0-1aecdb35c4def
zlib@1.1.0
3.0.1
wallarm/kong:3.1.0-ubuntu-4.6.0ea9608c82e40
ruby2.7@2.7.0-5ubuntu1.8
zlib@1.1.0
no fix listed
3.0.1

Open the chart page →

11,405
kong-previewwallarmVerified publisher4.2.31 of 5See more

kong-preview wallarm 4.2.3

1 of the 5 container images this version deploys carry CVE-2026-27820.

Container imageDigestPackageFixed in
wallarm/ingress-ruby:4.2.1-195ea2632326c
zlib@1.1.0
3.0.1

Open the chart page →

2,905

Container images carrying it

78 by charts deploying them

A fixed version is listed for 2 of the 6 affected packages.

Container imageDigestPackageFixed inUsed by
coralogixrepo/fluentd-coralogix-image:1.1.6b976e0412424
zlib@1.0.0
3.0.1
4
chatwoot/chatwoot:v3.1.0d530ab8c1753
zlib@3.0.0
3.0.1
2
istio/examples-bookinfo-details-v1:1.14.04c3379923c8a
zlib@1.0.0
3.0.1
2
istio/examples-bookinfo-details-v1:1.15.0fce0bcbff0be
zlib@1.0.0
3.0.1
2
pecan/bety:5.4.1f825d480cd62
zlib@1.0.0
3.0.1
2
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
zlib@2.1.1
3.0.1
2
binford2k/showoff:0.20.2a64937052ce7
zlib@1.0.0
3.0.1
1
bryanalves/fluentd:0.5d3605be4b178
zlib@1.0.0
3.0.1
1
bryanalves/honeywell_exporter:0.0.1195f73dce8b21
zlib@1.0.0
3.0.1
1
bryanalves/smart_exporter:0.2af47dfbb9413
zlib@1.0.0
3.0.1
1
ceticasbl/pg-ldap-sync:latest6c0aa7567145
zlib@1.0.0
3.0.1
1
cfcontainerization/cf-operator:v2.3.0-0.g27a91cdf82fa261c18a8
zlib@1.0.0
3.0.1
1
cfcontainerization/quarks-job:v0.0.0-0.g70ae34b58fb1c173a46
zlib@1.0.0
3.0.1
1
cfcontainerization/quarks-job:v0.0.124-g03faac87366b11c5fa5
zlib@1.0.0
3.0.1
1
cfcontainerization/quarks-secret:v0.0.677-ga060bb643131dbc0c8f
zlib@1.0.0
3.0.1
1
chatwoot/chatwoot:v4.15.167ebc751c171
zlib@3.2.1
3.2.3
1
dannyben/madness:latestebdf50556c02
zlib@3.1.1
3.1.2
1
docuseal/docuseal:2.4.17493fd7f6728
zlib@3.2.2
3.2.3
1
fluent/fluentd-kubernetes-daemonset:v1.11.5-debian-forward-1.00717111a3362
zlib@1.0.0
3.0.1
1
fluent/fluentd-kubernetes-daemonset:v1.10.3-debian-cloudwatch-1.019a8f0662241
zlib@1.0.0
3.0.1
1
fluent/fluentd-kubernetes-daemonset:v1.14.0-debian-elasticsearch7-1.03933cae61054
zlib@1.0.0
3.0.1
1
fluent/fluentd-kubernetes-daemonset:v1.12.4-debian-elasticsearch7-1.0656423b5fabb
zlib@1.0.0
3.0.1
1
fluent/fluentd-kubernetes-daemonset:papertrail9c209835eea1
zlib@1.0.0
3.0.1
1
fluent/fluentd-kubernetes-daemonset:v1.4.2-debian-elasticsearch-1.1ce4885865850
zlib@1.0.0
3.0.1
1
gollumorg/gollum:latest7cd5305a3cf7
zlib@1.1.0
3.0.1
1
grafana/fluent-plugin-loki:latest8a3882e8c28b
zlib@3.2.1
3.2.3
1
huginn/huginn-single-process:4d17829cf6b15b004ad3f4be196303dca4944810c794eddc7b47
ruby2.5@2.5.8-1bbox1~bionic1
zlib@1.0.0
no fix listed
3.0.1
1
istio/examples-bookinfo-details-v1:1.17.02b081e3c86dd
zlib@1.1.0
3.0.1
1
jordan/icinga2:latestf75025fe8ea8
ruby3.1@3.1.2-7+deb12u1
zlib@2.1.1
no fix listed
3.0.1
1
klausmeyer/docker-registry-browser:1.3.5430a440d95af
zlib@1.1.0
3.0.1
1
klausmeyer/docker-registry-browser:1.4.0bdc4c6b8595b
zlib@1.1.0
3.0.1
1
kubesphere/examples-bookinfo-details-v1:1.13.0108d022f64f0
zlib@1.0.0
3.0.1
1
logicmonitor/lm-logs-k8s-fluentd:1.0.55ac21b3f1572
zlib@2.1.1
3.0.1
1
mirrorgitlabcontainers/gitaly:v13.2.283599461ef8b
zlib@1.0.0
3.0.1
1
mirrorgitlabcontainers/gitlab-shell:v13.3.09f3654f1eafc
zlib@1.0.0
3.0.1
1
mirrorgitlabcontainers/gitlab-sidekiq-ce:v13.2.294d1431683fa
zlib@1.0.0
3.0.1
1
mirrorgitlabcontainers/gitlab-task-runner-ce:v13.2.29efd73993c34
zlib@1.0.0
3.0.1
1
mirrorgitlabcontainers/gitlab-webservice-ce:v13.2.230393f990f5c
zlib@1.0.0
3.0.1
1
mirrorgitlabcontainers/gitlab-workhorse-ce:v13.2.2a6d7bf42805a
zlib@1.0.0
3.0.1
1
muluder/prograncontrollermcord:0.1.843b597a93da7
ruby2.3@2.3.1-2~16.04.5
2.3.1-2~ubuntu16.04.16+esm15
1
octoboxio/octobox:latestd909041c46eb
zlib@3.2.1
3.2.3
1
omecproject/onos-progran:1.0.05715e5648aa0
ruby2.3@2.3.1-2~16.04.5
2.3.1-2~ubuntu16.04.16+esm15
1
openproject/community:12.0.2734743d11094
zlib@1.1.0
3.0.1
1
pactfoundation/pact-broker:2.32.0-2062d6c710099
zlib@1.0.0
3.0.1
1
pactfoundation/pact-broker:2.79.1.112861b0bd4d9
zlib@1.0.0
3.0.1
1
pactfoundation/pact-broker:2.101.0.0a3021fc42834
zlib@1.1.0
3.0.1
1
puppet/puppet-agent:7.14.00b6fd9a6b7da
zlib@1.1.0
3.0.1
1
uffizzi/app:latest66e9e3937c60
zlib@1.1.0
3.0.1
1
vmware/kube-fluentd-operator:latestf028c138a5f4
zlib@2.1.1
3.0.1
1
wallarm/ingress-ruby:4.2.1-195ea2632326c
zlib@1.1.0
3.0.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.