StackRadar

CVE-2026-42250

Medium

Advisory

Published 28 May 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.8
base score, highest
EPSS
0.001
3rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,439
of 17,821 indexed, latest versions
Container images
2,454
deployed by those charts
Fix available
2 of 2
affected packages

CVE-2026-42250 affecting package bzip2 for versions less than 1.0.8-2

Carried by container images the latest versions of 2,439 of 17,821 indexed charts deploy, on 2,454 images.

Affected packageAffected versionsFixed inImages
bzip2deb1.0.6-5, 1.0.6-8, 1.0.6-8.1, 1.0.6-8.1ubuntu0.2+11 more1.0.6-5ubuntu0.1~esm3, 1.0.6-8.1ubuntu0.2+esm1, 1.0.6-8ubuntu0.2+esm1, 1.0.8-2ubuntu0.1~esm1+4 more2,441
bzip2rpm1.0.8-1.azl3, 1.0.8-150400.1.1221.0.8-2, 1.0.8-150400.3.4.113
OSV records
DEBIAN-CVE-2026-42250UBUNTU-CVE-2026-42250AZL-88809ECHO-dfc7-0c27-52d8SUSE-SU-2026:4055-1
Also known as
USN-8685-1

Charts affected

2,439 by stars
ChartLatestAffected imagesRadar Score
apache-musicindexgeek-cookbookVerified publisher2.4.21 of 1See more

apache-musicindex geek-cookbook 2.4.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/apache-musicindex:v1.4.1-2c9bd82dc5fda
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1

Open the chart page →

14,890
booksonic-airgeek-cookbookVerified publisher6.4.21 of 1See more

booksonic-air geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/booksonic-air:version-v2009.1.0baa4fa9549dc
bzip2@1.0.6-8.1ubuntu0.2
1.0.6-8.1ubuntu0.2+esm1

Open the chart page →

19,295
calibre-webgeek-cookbookVerified publisher8.4.21 of 1See more

calibre-web geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
linuxserver/calibre-web:version-0.6.12938810eca3d3
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1

Open the chart page →

16,259
delugegeek-cookbookVerified publisher5.4.21 of 1See more

deluge geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
linuxserver/deluge:version-2.0.3-2201906121747ubuntu18.04.12ce561a95e7b
bzip2@1.0.6-8.1ubuntu0.2
1.0.6-8.1ubuntu0.2+esm1

Open the chart page →

13,613
dizquetvgeek-cookbookVerified publisher4.4.21 of 1See more

dizquetv geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
vexorian/dizquetv:1.4.37e2b99844a5c
bzip2@1.0.6-8.1ubuntu0.2
1.0.6-8.1ubuntu0.2+esm1

Open the chart page →

4,910
double-takegeek-cookbookVerified publisher2.3.21 of 1See more

double-take geek-cookbook 2.3.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
jakowenko/double-take:1.6.0b858bac9e32a
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1

Open the chart page →

87,582
embygeek-cookbookVerified publisher3.4.21 of 1See more

emby geek-cookbook 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/emby:v4.6.1.05c6b8f91f1c4
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1

Open the chart page →

8,612
factoriogeek-cookbookVerified publisher1.2.21 of 2See more

factorio geek-cookbook 1.2.2

1 of the 2 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
factoriotools/factorio:stable4ec5fea2e06b
bzip2@1.0.8-6
no fix listed

Open the chart page →

1,406
gapsgeek-cookbookVerified publisher5.4.21 of 1See more

gaps geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
housewrecker/gaps:latestf417dd0a7547
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1

Open the chart page →

8,998
haste-servergeek-cookbookVerified publisher3.4.21 of 1See more

haste-server geek-cookbook 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/haste-server:latest827aa2f2389d
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1

Open the chart page →

11,080
icinga2geek-cookbookVerified publisher4.2.01 of 1See more

icinga2 geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
jordan/icinga2:latestf75025fe8ea8
bzip2@1.0.8-5+b1
no fix listed

Open the chart page →

9,386
jackettgeek-cookbookVerified publisher11.7.21 of 1See more

jackett geek-cookbook 11.7.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/jackett:v0.20.13163a4715b46aa2
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1

Open the chart page →

9,922
komgageek-cookbookVerified publisher2.4.21 of 1See more

komga geek-cookbook 2.4.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
gotson/komga:0.99.49b15ea6bfc30
bzip2@1.0.6-8.1ubuntu0.2
1.0.6-8.1ubuntu0.2+esm1

Open the chart page →

12,602
lidarrgeek-cookbookVerified publisher14.2.21 of 1See more

lidarr geek-cookbook 14.2.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/lidarr:v1.0.0.225554ebc1f90963
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1

Open the chart page →

14,492
mopidygeek-cookbookVerified publisher0.1.21 of 1See more

mopidy geek-cookbook 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
jaedb/iris:latest048cfbf58d57
bzip2@1.0.8-5+b1
no fix listed

Open the chart page →

13,169
nzbgetgeek-cookbookVerified publisher12.4.21 of 1See more

nzbget geek-cookbook 12.4.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/nzbget:v21.1e5571acd10ce
bzip2@1.0.8-5build1
1.0.8-5ubuntu0.1

Open the chart page →

12,330
nzbhydra2geek-cookbookVerified publisher10.4.21 of 1See more

nzbhydra2 geek-cookbook 10.4.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/nzbhydra2:v3.14.2ef3670f7e0a8
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1

Open the chart page →

17,824
openkmgeek-cookbookVerified publisher4.2.01 of 1See more

openkm geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
openkm/openkm-ce:6.3.113bc465a7461b
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1

Open the chart page →

28,115
photoprismgeek-cookbookVerified publisher7.2.01 of 1See more

photoprism geek-cookbook 7.2.0

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
photoprism/photoprism:220629-jammy2954334adbda
bzip2@1.0.8-5build1
1.0.8-5ubuntu0.1

Open the chart page →

19,612
puppeteergeek-cookbookVerified publisher1.2.21 of 1See more

puppeteer geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
ghcr.io/jr0dd/puppeteer:v13.3.26047599cd78e
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1

Open the chart page →

15,832
qbittorrentgeek-cookbookVerified publisher13.5.21 of 1See more

qbittorrent geek-cookbook 13.5.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/qbittorrent:v4.4.261deadd1ec78
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1

Open the chart page →

12,049
radarrgeek-cookbookVerified publisher16.3.21 of 1See more

radarr geek-cookbook 16.3.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/radarr:v4.1.0.61754273dfaf0295
bzip2@1.0.8-5build1
1.0.8-5ubuntu0.1

Open the chart page →

10,608
readarrgeek-cookbookVerified publisher6.4.21 of 1See more

readarr geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/readarr:v0.1.0.715ad943e9309e4
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1

Open the chart page →

7,832
resilio-syncgeek-cookbookVerified publisher5.4.21 of 1See more

resilio-sync geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/resilio-sync:version-2.7.2.1375605b6d544028
bzip2@1.0.6-8.1ubuntu0.2
1.0.6-8.1ubuntu0.2+esm1

Open the chart page →

5,923
satisfactorygeek-cookbookVerified publisher1.2.21 of 1See more

satisfactory geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
wolveix/satisfactory-server:lateste103700ae6ae
bzip2@1.0.8-5build1
1.0.8-5ubuntu0.1

Open the chart page →

3,490
sdtdgeek-cookbookVerified publisher0.3.21 of 1See more

sdtd geek-cookbook 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
ghcr.io/reitermarkus/7d2d:main39953b387b61
bzip2@1.0.8-6
no fix listed

Open the chart page →

2,479
seafilegeek-cookbookVerified publisher3.2.01 of 1See more

seafile geek-cookbook 3.2.0

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:8.0.7ed0fcda5e6a9
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1

Open the chart page →

100,989
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
bzip2@1.0.8-6
no fix listed

Open the chart page →

9,116
teedygeek-cookbookVerified publisher6.2.01 of 1See more

teedy geek-cookbook 6.2.0

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
sismics/docs:v1.10f4b0ef019cf1
bzip2@1.0.6-8.1
1.0.6-8.1ubuntu0.2+esm1

Open the chart page →

27,081
transmissiongeek-cookbookVerified publisher8.4.31 of 1See more

transmission geek-cookbook 8.4.3

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/transmission:v3.006011182e3946
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1

Open the chart page →

12,103
xtevegeek-cookbookVerified publisher8.4.21 of 1See more

xteve geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
ghcr.io/k8s-at-home/xteve:v2.2.0.200292b3614670f
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1

Open the chart page →

18,153
chproxygeneral-helm-chartsVerified publisher0.0.21 of 1See more

chproxy general-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
contentsquareplatform/chproxy:v1.26.524555f22d4be
bzip2@1.0.8-5+b1
no fix listed

Open the chart page →

3,686
mongogengxiankun-charts0.1.01 of 1See more

mongo gengxiankun-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
library/mongo:5.041108d183e97
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1

Open the chart page →

4,030
redisgengxiankun-charts0.2.01 of 1See more

redis gengxiankun-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
library/redis:latest298e5b3bc566
bzip2@1.0.8-6
no fix listed

Open the chart page →

929
rocketmqgengxiankun-charts0.3.01 of 1See more

rocketmq gengxiankun-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
apache/rocketmq:5.3.0434d8398f996
bzip2@1.0.8-5.1
1.0.8-5.1ubuntu0.1

Open the chart page →

4,981
genieacsgenieacsVerified publisher0.5.11 of 2See more

genieacs genieacs 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
drumsergio/genieacs:1.2.16.028244054e1bf
bzip2@1.0.8-5+b1
no fix listed

Open the chart page →

4,209
geonetwork-k8sgeonetwork-k8sVerified publisher4.2.84 of 5See more

geonetwork-k8s geonetwork-k8s 4.2.8

4 of the 5 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
geonetwork/gn-cloud-ogc-api-records-service:4.2.8-020c9bb761f67
bzip2@1.0.6-8.1ubuntu0.2
1.0.6-8.1ubuntu0.2+esm1
jingking/geonetwork-hnap:4.2.843e74ab234e1
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1
library/elasticsearch:7.17.1588c2ec10c7f2
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1
library/kibana:7.17.150172f1c538e7
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1

Open the chart page →

35,014
istiogetindataVerified publisher1.11.12 of 2See more

istio getindata 1.11.1

2 of the 2 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
gcr.io/istio-release/pilot:1.11.1c552478f8f11
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1
gcr.io/istio-release/proxyv2:1.11.19538fabe49fd
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1

Open the chart page →

16,899
ghostghostVerified publisher0.1.01 of 4See more

ghost ghost 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
library/ghost:5.79.083f7bf209844
bzip2@1.0.8-5+b1
no fix listed

Open the chart page →

8,851
qryn-helmgigapipeVerified publisher0.1.91 of 1See more

qryn-helm gigapipe 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
qxip/qryn:3.2.3977acc9c7a9fd
bzip2@1.0.8-5+b1
no fix listed

Open the chart page →

3,033
redis-uigin0.0.11 of 1See more

redis-ui gin 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
patrikx3/p3x-redis-ui:latestf19eb45b0694
bzip2@1.0.8-5+b1
no fix listed

Open the chart page →

1,028
rabbitmqginger-society0.1.01 of 2See more

rabbitmq ginger-society 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
library/rabbitmq:4-managementffd1b50c522a
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1

Open the chart page →

1,537
knativegitlabVerified publisher0.10.03 of 10See more

knative gitlab 0.10.0

3 of the 10 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
istio/node-agent-k8s:1.2.9268ab879ea51
bzip2@1.0.6-8
1.0.6-8ubuntu0.2+esm1
istio/pilot:1.2.9c09319753454
bzip2@1.0.6-8
1.0.6-8ubuntu0.2+esm1
istio/proxyv2:1.2.90c78be035e98
bzip2@1.0.6-8
1.0.6-8ubuntu0.2+esm1

Open the chart page →

206,878
glassflow-etlglassflowVerified publisher0.5.211 of 16See more

glassflow-etl glassflow 0.5.21

1 of the 16 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
ghcr.io/glassflow/glassflow-notifier:v1.0.3d1b0ce10b513
bzip2@1.0.8-6
no fix listed

Open the chart page →

12,028
pgbouncerglassflowVerified publisher0.1.01 of 1See more

pgbouncer glassflow 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
bitnamilegacy/pgbouncer:1.23.192356da09704
bzip2@1.0.8-5+b1
no fix listed

Open the chart page →

3,332
glauthglauthVerified publisher0.3.171 of 2See more

glauth glauth 0.3.17

1 of the 2 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
nouchka/sqlite3:latestce0d90cbe832
bzip2@1.0.8-6
no fix listed

Open the chart page →

2,577
glpiglpi-chart0.1.13 of 3See more

glpi glpi-chart 0.1.1

3 of the 3 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
library/mariadb:latestdd9b303aed4f
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
library/phpmyadmin:latest3a8a8d6b5289
bzip2@1.0.8-6
no fix listed
vdiogov/glpi-conteiner:latest6945f84f0058
bzip2@1.0.8-5+b1
no fix listed

Open the chart page →

12,368
goofy-chartgoofy-chart0.1.01 of 1See more

goofy-chart goofy-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
library/nginx:latest05b8cb60c354
bzip2@1.0.8-6
no fix listed

Open the chart page →

1,887
platformgoofy-chart0.1.01 of 1See more

platform goofy-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
devopsgoofy/k8s-platform:latestad865312099f
bzip2@1.0.8-5+b1
no fix listed

Open the chart page →

2,843
googly-logingoogly-login0.1.01 of 2See more

googly-login googly-login 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-42250.

Container imageDigestPackageFixed in
library/postgres:16f1c3376c26f2
bzip2@1.0.8-6
no fix listed

Open the chart page →

1,618

Container images carrying it

2,454 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/local-volume-provisioner:v2.8.03e2bf2eaef9f
bzip2@1.0.8-5+b1
no fix listed
1
registry.k8s.io/sig-storage/local-volume-provisioner:v2.9.0f9d65db8bda2
bzip2@1.0.8-5+b1
no fix listed
1
registry.k8s.io/sig-storage/nfsplugin:v4.13.41eb5a85180a4
bzip2@1.0.8-5+b1
no fix listed
1
registry.k8s.io/sig-storage/nfsplugin:v4.11.0ce5b5ccd5eb0
bzip2@1.0.8-5+b1
no fix listed
1

syft 1.42.1 · advisories as of 21 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.