StackRadar

CVE-2026-42250

Medium

Advisory

Published 28 May 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.8
base score, highest
EPSS
0.001
3rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,361
of 17,813 indexed, latest versions
Container images
2,370
deployed by those charts
Fix available
2 of 2
affected packages

CVE-2026-42250 affecting package bzip2 for versions less than 1.0.8-2

Carried by container images the latest versions of 2,361 of 17,813 indexed charts deploy, on 2,370 images.

Affected packageAffected versionsFixed inImages
bzip2deb1.0.6-5, 1.0.6-8, 1.0.6-8.1, 1.0.6-8.1ubuntu0.2+11 more1.0.6-5ubuntu0.1~esm3, 1.0.6-8.1ubuntu0.2+esm1, 1.0.6-8ubuntu0.2+esm1, 1.0.8-2ubuntu0.1~esm1+4 more2,357
bzip2rpm1.0.8-1.azl3, 1.0.8-150400.1.1221.0.8-2, 1.0.8-150400.3.4.113
OSV records
DEBIAN-CVE-2026-42250UBUNTU-CVE-2026-42250AZL-88809ECHO-dfc7-0c27-52d8SUSE-SU-2026:4055-1
Also known as
USN-8685-1

Charts affected

2,361 by stars
ChartLatestAffected imagesRadar Score

Container images carrying it

2,370 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/drewburr-labs/evobot:3.0.04ddbb244c82f
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/drewburr-labs/mum-discord-bot:3.1.26e82914e1051
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/dysnix/docker-bitcoind:0.29.0490ca8e3dd21
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
1
ghcr.io/edgelesssys/coordinator:v0.5.0bcd5b8d4c45c
bzip2@1.0.6-8.1ubuntu0.2
1.0.6-8.1ubuntu0.2+esm1
1
ghcr.io/edgelesssys/edgelessdb-sgx-1gb:v0.3.27e1d7a11a11a
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1
1
ghcr.io/edgelesssys/marblerun/coordinator:v1.9.2e589db0d0a2c
bzip2@1.0.8-5build1
1.0.8-5ubuntu0.1
1
ghcr.io/egos-tech/smtp:1.2.2b5451793ad91
bzip2@1.0.8-6
no fix listed
1
ghcr.io/element-hq/synapse:v1.111.022ae556e0de4
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/enderdash-com/enderdash-agent:latest8525a1a67958
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
1
ghcr.io/ente/web:5ab0c5b4c7a89c4e470ef6f793600da33cebf35d3f4864eb7f11
bzip2@1.0.8-6
no fix listed
1
ghcr.io/erlkoenig91/prompt-db-backend:1.0.7ab120359810d
bzip2@1.0.8-6
no fix listed
1
ghcr.io/eslupmi/impulse:v3.7.03ded1b7ebca0
bzip2@1.0.8-6
no fix listed
1
ghcr.io/esphome/esphome:latest000c5ee5ee96
bzip2@1.0.8-6
no fix listed
1
ghcr.io/esphome/esphome:2026.4.078a82d810709
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/ferama/rospo:v0.12.0ab40c1745534
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/ferama/vipien:v0.5.3923a3f704b21
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1
1
ghcr.io/firecrawl/firecrawl:2.11.35987ebe1dc85b0
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/firecrawl/nuq-postgres:latestf9388bd25ae2
bzip2@1.0.8-6
no fix listed
1
ghcr.io/firecrawl/playwright-service:latest1f6eba640320
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/flanksource/facet:0.1.7237237038be15
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/flanksource/mission-control-ai-assistant:1.0.1229a635cbeeb5
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/flanksource/postgres:17.6-497383cebcf66281fc1
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/flaresolverr/flaresolverr:v3.4.0ab535d1fef5d
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/fluent/fluentd-aggregator-docker-image:2.1.0ad25916eebbb
bzip2@1.0.8-6
no fix listed
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/formancehq/ledger:v1.9.203c1ddbda33b
bzip2@1.0.8-5build1
1.0.8-5ubuntu0.1
1
ghcr.io/formancehq/membership:v1.11.024a0113d5fb0
bzip2@1.0.8-5build1
1.0.8-5ubuntu0.1
1
ghcr.io/gamosoft/notediscovery:0.31.5c06aa0fa9a85
bzip2@1.0.8-6
no fix listed
1
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/getsentry/snuba:26.7.210f8d164109b
bzip2@1.0.8-6
no fix listed
1
ghcr.io/getsentry/taskbroker:26.7.264d0da74a578
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/gla-rad/mc-mms-edgerouter:latest3620d5680775
bzip2@1.0.8-6
no fix listed
1
ghcr.io/gla-rad/mc-mms-router:latest032e977d9adf
bzip2@1.0.8-6
no fix listed
1
ghcr.io/glassflow/glassflow-notifier:v1.0.3d1b0ce10b513
bzip2@1.0.8-6
no fix listed
1
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
bzip2@1.0.8-6
no fix listed
1
ghcr.io/goauthentik/server:2026.8.3ab9b4e8cc4ab
bzip2@1.0.8-6
no fix listed
1
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
bzip2@1.0.8-6
no fix listed
1
ghcr.io/graphprotocol/availability-oracle:sha-28312fd472a25038957
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/gregperlinli/certvault:2.12.0a7d0cc9e260a
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
1
ghcr.io/grycap/im:latest06a16d4f279f
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
1
ghcr.io/haveagitgat/tdarr:2.00.18.23fbe4c29d14c
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1
1
ghcr.io/hemslo/chat-search:latest39d48995a5bd
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/home-operations/plex:1.43.1a9c3723cb31c
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
1
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
bzip2@1.0.8-6
no fix listed
1
ghcr.io/huggingface/text-embeddings-inference:cpu-1.666db77d7856c
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/huggingface/text-embeddings-inference:cpu-1.9.3ad950d30878e
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/huscker/townsquare-backend:2.15.2e106681e7673
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/hypolia/kanri:0.1.2-rc4fa7d5cc7fb7d
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/icegatetech/icegate-ingest:0.1.1bae3c441894a
bzip2@1.0.8-5+b1
no fix listed
1
ghcr.io/icegatetech/icegate-maintain:0.1.193e85b2b76ee
bzip2@1.0.8-5+b1
no fix listed
1

syft 1.42.1 · advisories as of 19 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.