StackRadar

CVE-2026-4111

High

Advisory

Published 13 Mar 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.007
51st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
105
of 17,781 indexed, latest versions
Container images
126
deployed by those charts
Fix available
2 of 2
affected packages

Red Hat Security Advisory: libarchive security update

Carried by container images the latest versions of 105 of 17,781 indexed charts deploy, on 126 images.

Affected packageAffected versionsFixed inImages
libarchiverpm3.5.3-3.el9, 3.5.3-4.el9, 3.5.3-4.el9.0.1, 3.5.3-5.el9_6+2 more0:3.5.3-7.el9_7, 0:3.7.7-5.el10_193
libarchivedeb3.1.2-11ubuntu0.16.04.3, 3.4.0-2ubuntu1, 3.4.0-2ubuntu1.2, 3.4.0-2ubuntu1.5+11 more3.1.2-11ubuntu0.16.04.8+esm2, 3.4.0-2ubuntu1.5+esm1, 3.6.0-1ubuntu1.6, 3.6.2-1+deb12u4+3 more33
OSV records
DEBIAN-CVE-2026-4111RHSA-2026:5063RHSA-2026:5080RLSA-2026:5080UBUNTU-CVE-2026-4111
Also known as
RHSA-2026:6647, RHSA-2026:7105, RHSA-2026:7106, USN-8147-1

Charts affected

105 by stars
ChartLatestAffected imagesRadar Score
stash-boxswuuper-githubVerified publisher0.1.11 of 2See more

stash-box swuuper-github 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-4111.

Container imageDigestPackageFixed in
stashapp/stash-box:latesta534c8afdf39
libarchive@3.7.2-2ubuntu0.4
3.7.2-2ubuntu0.6

Open the chart page →

8,193
owncloudth-chartsVerified publisher0.2.11 of 1See more

owncloud th-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-4111.

Container imageDigestPackageFixed in
owncloud/server:10.15.051d9b74fc2a8
libarchive@3.4.0-2ubuntu1.2
3.4.0-2ubuntu1.5+esm1

Open the chart page →

10,006
opencloudunxwaresVerified publisher0.2.31 of 13See more

opencloud unxwares 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-4111.

Container imageDigestPackageFixed in
apache/tika:2.9.2.1-fullae0b86d3c4d0
libarchive@3.7.2-2
3.7.2-2ubuntu0.6

Open the chart page →

45,239
myweatherhelmwebapp11.3.501 of 8See more

myweatherhelm webapp1 1.3.50

1 of the 8 container images this version deploys carry CVE-2026-4111.

Container imageDigestPackageFixed in
mcr.microsoft.com/azure-sql-edge:latest902628a8be89
libarchive@3.4.0-2ubuntu1.2
3.4.0-2ubuntu1.5+esm1

Open the chart page →

9,130
myweatherhelm-schedulingwebapp11.3.921 of 9See more

myweatherhelm-scheduling webapp1 1.3.92

1 of the 9 container images this version deploys carry CVE-2026-4111.

Container imageDigestPackageFixed in
mcr.microsoft.com/azure-sql-edge:latest902628a8be89
libarchive@3.4.0-2ubuntu1.2
3.4.0-2ubuntu1.5+esm1

Open the chart page →

9,130

Container images carrying it

126 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
apacherocketmq/rocketmq-dashboard:2.1.0ce78506bd6fe
libarchive@3.5.3-6.el9_6
0:3.5.3-7.el9_7
2
apache/tika:2.9.2.1-fullae0b86d3c4d0
libarchive@3.7.2-2
3.7.2-2ubuntu0.6
2
ghcr.io/games-on-whales/retroarch:1.0.0103fbcec2314
libarchive@3.4.0-2ubuntu1
3.4.0-2ubuntu1.5+esm1
2
mcr.microsoft.com/azure-sql-edge:latest902628a8be89
libarchive@3.4.0-2ubuntu1.2
3.4.0-2ubuntu1.5+esm1
2
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.1.1-1-ubi9d20bd62f0182
libarchive@3.5.3-6.el9_6
0:3.5.3-7.el9_7
2
quay.io/strimzi/operator:0.46.0ac434a48ac2b
libarchive@3.5.3-4.el9
0:3.5.3-7.el9_7
2
quay.io/zncdatadev/tools:1.0.0-kubedoop0.0.0-dev382fca2054c9
libarchive@3.5.3-6.el9_6
0:3.5.3-7.el9_7
2
adeptiainc/adeptia-automate-observe:1.0.031f295e948e6
libarchive@3.7.7-4.el10_0
0:3.7.7-5.el10_1
1
alquimiaai/studio:certification38a1f0341982
libarchive@3.5.3-6.el9_6
0:3.5.3-7.el9_7
1
andrianrf/backoffice-be:latest6036614803d4
libarchive@3.5.3-4.el9
0:3.5.3-7.el9_7
1
andrianrf/iso-server:latest7da47f525c7d
libarchive@3.5.3-4.el9
0:3.5.3-7.el9_7
1
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
libarchive@3.5.3-6.el9_6
0:3.5.3-7.el9_7
1
chriseaton/adventureworks:latest54c3384ce701
libarchive@3.6.0-1ubuntu1.4
3.6.0-1ubuntu1.6
1
cleveritcz/opencve:1.5.0c75c1636e0b7
libarchive@3.5.3-4.el9
0:3.5.3-7.el9_7
1
cockroachdb/cockroachdb-operator-v2:v1.0.04335d8bcbd3d
libarchive@3.5.3-6.el9_6
0:3.5.3-7.el9_7
1
codetogether/codetogether:latest4348c8a38752
libarchive@3.5.3-4.el9
0:3.5.3-7.el9_7
1
dongjiang1989/lxcfs:v6.0.34bf9ae391948
libarchive@3.4.0-2ubuntu1.5
3.4.0-2ubuntu1.5+esm1
1
fiware/biz-ecosystem-charging-backend:11.7.029456835bb2c
libarchive@3.4.0-2ubuntu1.5
3.4.0-2ubuntu1.5+esm1
1
fluent/fluent-bit:4.0-debuge76397ef3983
libarchive@3.6.2-1+deb12u3
3.6.2-1+deb12u4
1
foundationdb/fdb-kubernetes-operator:v2.3.07d7b6985291e
libarchive@3.5.3-4.el9.0.1
0:3.5.3-7.el9_7
1
hammerspaceinc/csi-plugin:v1.2.8-rc2395bee4504fc
libarchive@3.5.3-5.el9_6
0:3.5.3-7.el9_7
1
haveagitgat/tdarr:2.00.181256348872ce
libarchive@3.4.0-2ubuntu1.2
3.4.0-2ubuntu1.5+esm1
1
haveagitgat/tdarr_node:2.00.101e3f9328327d
libarchive@3.4.0-2ubuntu1
3.4.0-2ubuntu1.5+esm1
1
haveagitgat/tdarr_node:2.17.013ff0913202dd
libarchive@3.4.0-2ubuntu1.2
3.4.0-2ubuntu1.5+esm1
1
hyperledger/fabric-couchdb:0.4.10c65891b6c237
libarchive@3.1.2-11ubuntu0.16.04.3
3.1.2-11ubuntu0.16.04.8+esm2
1
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
libarchive@3.7.2-2ubuntu0.5
3.7.2-2ubuntu0.6
1
library/logstash:9.1.233eae14f0867
libarchive@3.5.3-6.el9_6
0:3.5.3-7.el9_7
1
localstack/localstack:3.19d278167f2b7
libarchive@3.6.2-1
3.6.2-1+deb12u4
1
mediagis/nominatim:3.7c15e941485ef
libarchive@3.4.0-2ubuntu1.2
3.4.0-2ubuntu1.5+esm1
1
mediagis/nominatim:4.2d0eae7b51374
libarchive@3.6.0-1ubuntu1
3.6.0-1ubuntu1.6
1
openkm/openkm-ce:6.3.113bc465a7461b
libarchive@3.4.0-2ubuntu1.2
3.4.0-2ubuntu1.5+esm1
1
owncloud/server:10.15.051d9b74fc2a8
libarchive@3.4.0-2ubuntu1.2
3.4.0-2ubuntu1.5+esm1
1
percona/percona-postgresql-operator:2.8.06cce2698d3f5
libarchive@3.5.3-6.el9_6
0:3.5.3-7.el9_7
1
percona/percona-server-mongodb-operator:1.20.1d09453ce7886
libarchive@3.5.3-4.el9
0:3.5.3-7.el9_7
1
percona/percona-xtradb-cluster-operator:1.14.03232ae01d0ff
libarchive@3.5.3-4.el9
0:3.5.3-7.el9_7
1
photoprism/photoprism:251130db16ee6b1ba3
libarchive@3.7.7-0ubuntu3
3.7.7-0ubuntu3.1
1
photoprism/photoprism:240711-cefc6fd632ca74
libarchive@3.7.2-2ubuntu0.1
3.7.2-2ubuntu0.6
1
razzy10/product-service:latest702e411956db
libarchive@3.5.3-5.el9_6
0:3.5.3-7.el9_7
1
rm3l/dev-feed-api:latest9a7f732245a3
libarchive@3.5.3-4.el9
0:3.5.3-7.el9_7
1
sbs20/scanservjs:release-v3.0.3dad1fd6e9a98
libarchive@3.6.2-1
3.6.2-1+deb12u4
1
seldonio/seldon-core-operator:1.19.0544e3bf71bd1
libarchive@3.5.3-6.el9_6
0:3.5.3-7.el9_7
1
stashapp/stash-box:latesta534c8afdf39
libarchive@3.7.2-2ubuntu0.4
3.7.2-2ubuntu0.6
1
trinodb/trino:45038c6f24ab1a4
libarchive@3.5.3-4.el9
0:3.5.3-7.el9_7
1
gcr.io/kasten-images/restorectl:8.0.145a0884f9a90c
libarchive@3.5.3-6.el9_6
0:3.5.3-7.el9_7
1
gcr.io/kubecost1/cost-model:prod-2.5.502b90651367f
libarchive@3.5.3-4.el9
0:3.5.3-7.el9_7
1
gcr.io/kubecost1/cost-model:prod-2.6.39e507ac0aebb
libarchive@3.5.3-4.el9
0:3.5.3-7.el9_7
1
gcr.io/kubecost1/kubecost-modeling:v0.1.24a2259b098b13
libarchive@3.5.3-4.el9
0:3.5.3-7.el9_7
1
gcr.io/kubecost1/kubecost-modeling:v0.1.22a461dc5cb96a
libarchive@3.5.3-4.el9
0:3.5.3-7.el9_7
1
ghcr.io/adfinis/kubernetes-etcd-backup:v1.4.68ec6c4812a7e
libarchive@3.5.3-4.el9
0:3.5.3-7.el9_7
1
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
libarchive@3.6.2-1+deb12u1
3.6.2-1+deb12u4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.