StackRadar

CVE-2026-42250

Medium

Advisory

Published 28 May 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.8
base score, highest
EPSS
0.001
3rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,361
of 17,813 indexed, latest versions
Container images
2,370
deployed by those charts
Fix available
2 of 2
affected packages

CVE-2026-42250 affecting package bzip2 for versions less than 1.0.8-2

Carried by container images the latest versions of 2,361 of 17,813 indexed charts deploy, on 2,370 images.

Affected packageAffected versionsFixed inImages
bzip2deb1.0.6-5, 1.0.6-8, 1.0.6-8.1, 1.0.6-8.1ubuntu0.2+11 more1.0.6-5ubuntu0.1~esm3, 1.0.6-8.1ubuntu0.2+esm1, 1.0.6-8ubuntu0.2+esm1, 1.0.8-2ubuntu0.1~esm1+4 more2,357
bzip2rpm1.0.8-1.azl3, 1.0.8-150400.1.1221.0.8-2, 1.0.8-150400.3.4.113
OSV records
DEBIAN-CVE-2026-42250UBUNTU-CVE-2026-42250AZL-88809ECHO-dfc7-0c27-52d8SUSE-SU-2026:4055-1
Also known as
USN-8685-1

Charts affected

2,361 by stars
ChartLatestAffected imagesRadar Score

Container images carrying it

2,370 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
gcr.io/ml-pipeline/metadata-envoy:2.3.0e8e263a919ff
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1
1
gcr.io/ml-pipeline/metadata-writer:2.3.09bcfd2abc361
bzip2@1.0.8-5+b1
no fix listed
1
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
bzip2@1.0.8-5+b1
no fix listed
1
gcr.io/tfx-oss-public/ml_metadata_store_server:1.14.051404ef4419c
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1
1
gcr.io/tfx-oss-public/ml_metadata_store_server:1.5.0db8691752b4c
bzip2@1.0.6-8.1ubuntu0.2
1.0.6-8.1ubuntu0.2+esm1
1
ghcr.io/98jan/smalland-server/smalland-server:deveb7be822d5b2
bzip2@1.0.6-8.1ubuntu0.2
1.0.6-8.1ubuntu0.2+esm1
1
ghcr.io/adnoctem/lhci:1.0.119553e4b4033
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/aeharding/voyager:latest779759172676
bzip2@1.0.8-6
no fix listed
1
ghcr.io/aetrius/msockperf-client/msockperf-client:main820af919c5e2
bzip2@1.0.8-5.1
1.0.8-5.1ubuntu0.1
1
ghcr.io/aetrius/msockperf-server/msockperf-server:main46ae4ea003e0
bzip2@1.0.8-5.1
1.0.8-5.1ubuntu0.1
1
ghcr.io/afairgiant/medikeep:v0.70.04c28334f3c79
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/aklivity/zilla:2.4.3e33d59dbb606
bzip2@1.0.8-5build1
1.0.8-5ubuntu0.1
1
ghcr.io/alethic/auth0-operator-image:1.4.122468990a8521
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
1
ghcr.io/alexanderwanyoike/the0/runtime:1.14.7459010a02aff
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
1
ghcr.io/alexmorbo/dell_idrac_fan_controller:v0.1.6-1d110504d551d
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
1
ghcr.io/almarklein/timetagger:v26.1.3-nonroot18a81afcb249
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/alpineworks/katalog-migrations:v1.0.562c44a384e13
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/analogj/scrutiny:master-omnibus18689773150d
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/analogj/scrutiny:v0.9.2-web71be54e99608
bzip2@1.0.8-6
no fix listed
1
ghcr.io/angelscloud/prometheus-optimizer:latest744bc929a579
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets:0.0.0-main13e267ad7d94
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
1
ghcr.io/apache/flink-kubernetes-operator:c703255e9c2ce635b89
bzip2@1.0.8-5build1
1.0.8-5ubuntu0.1
1
ghcr.io/appscode/csi-driver-cacerts:v0.6.0ab213b156017
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/appscode/gotenberg:8.25f9104080d9a7
bzip2@1.0.8-6
no fix listed
1
ghcr.io/appscode/inbox-server:MailetGroup4a2824296412
bzip2@1.0.8-5build1
1.0.8-5ubuntu0.1
1
ghcr.io/appscode/s3proxy:sha-a82ca6820518335f9f9
bzip2@1.0.8-5build1
1.0.8-5ubuntu0.1
1
ghcr.io/argoproj-labs/mcp-for-argocd:v0.9.0dffc6c719d86
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/astradns/astradns-agent:v0.2.9-unbound6ba69487f1b0
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/astriaorg/account-monitor:latest4c8b42890035
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/astriaorg/auctioneer:pr-18391386b7b5e555
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/astriaorg/conductor:1.1.01f97d131b1d1
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/astriaorg/evm-bridge-withdrawer:1.0.29c88e1aff357
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/astriaorg/hermes:0.5.04f33a0a9f75e
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
1
ghcr.io/astriaorg/sequencer:latest44f82ee0b24c
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/astriaorg/sequencer-relayer:latest5f6c74993f08
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/atuinsh/atuin:18.12.0e953fa9e36ef
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/avistotelecom/docker-wazuh-agent:4.12.08766ba08bf1a
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/backstage/backstage:latest792e262ea504
bzip2@1.0.8-6
no fix listed
1
ghcr.io/base/node-reth:v1.1.18eb6e492fe3c
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
1
ghcr.io/base-org/node:v0.11.11aba0ffe55ea
bzip2@1.0.8-5build1
1.0.8-5ubuntu0.1
1
ghcr.io/beluga-cloud/jellyfin/jellyfin:10.8.1368f52b993a7f
bzip2@1.0.8-5build1
1.0.8-5ubuntu0.1
1
ghcr.io/beslovas/duckdb-ui:1.3.272f35584026d
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/blockscout/smart-contract-verifier:main9a43f0cc5797
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
1
ghcr.io/botify-labs/airbyte_exporter:2.3.02105b1f33013
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/brittonhayes/arma-reforger:latest6fde1edc0983
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1
1
ghcr.io/browserless/chromium:v2.55.42ed0183564d7
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
1
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
1
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
bzip2@1.0.8-5+b1
no fix listed
1

syft 1.42.1 · advisories as of 19 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.