StackRadar

CVE-2026-42250

Medium

Advisory

Published 28 May 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
4.8
base score, highest
EPSS
0.001
3rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,373
of 17,792 indexed, latest versions
Container images
2,346
deployed by those charts
Fix available
2 of 2
affected packages

CVE-2026-42250 affecting package bzip2 for versions less than 1.0.8-2

Carried by container images the latest versions of 2,373 of 17,792 indexed charts deploy, on 2,346 images.

Affected packageAffected versionsFixed inImages
bzip2deb1.0.6-5, 1.0.6-8, 1.0.6-8.1, 1.0.6-8.1ubuntu0.2+11 more1.0.6-5ubuntu0.1~esm3, 1.0.6-8.1ubuntu0.2+esm1, 1.0.6-8ubuntu0.2+esm1, 1.0.8-2ubuntu0.1~esm1+4 more2,333
bzip2rpm1.0.8-1.azl3, 1.0.8-150400.1.1221.0.8-2, 1.0.8-150400.3.4.113
OSV records
DEBIAN-CVE-2026-42250UBUNTU-CVE-2026-42250AZL-88809ECHO-dfc7-0c27-52d8SUSE-SU-2026:4055-1
Also known as
USN-8685-1

Charts affected

2,373 by stars
ChartLatestAffected imagesRadar Score

Container images carrying it

2,346 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
2
ghcr.io/chroma-core/chroma:1.5.91e0b73a187a2
bzip2@1.0.8-6
no fix listed
2
ghcr.io/codingducksrl/laravel:8.15be52524664c
bzip2@1.0.8-5build1
1.0.8-5ubuntu0.1
2
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
bzip2@1.0.8-5build1
1.0.8-5ubuntu0.1
2
ghcr.io/flaresolverr/flaresolverr:v3.4.67962759d99d7
bzip2@1.0.8-5+b1
no fix listed
2
ghcr.io/flaresolverr/flaresolverr:v3.5.2c80ae007ce2c
bzip2@1.0.8-5+b1
no fix listed
2
ghcr.io/flyteorg/flyte-connectors:py3.12-v2.3.6896fc7b18b1b
bzip2@1.0.8-5+b1
no fix listed
2
ghcr.io/games-on-whales/pulseaudio:1.0.0f34f98405c10
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1
2
ghcr.io/games-on-whales/retroarch:1.0.0103fbcec2314
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1
2
ghcr.io/games-on-whales/steam:1.0.09b6105be7ad0
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1
2
ghcr.io/google/fleetspeak:v0.1.17cd264d33efd4
bzip2@1.0.8-5+b1
no fix listed
2
ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0bcf63357191b
bzip2@1.0.8-5+b1
no fix listed
2
ghcr.io/linuxserver/openvpn-as:version-2.8.6-916f8e7d-ubuntu184ee0764310e7
bzip2@1.0.6-8.1ubuntu0.2
1.0.6-8.1ubuntu0.2+esm1
2
ghcr.io/lissy93/web-check:latesta4e021c0f6a9
bzip2@1.0.8-5+b1
no fix listed
2
ghcr.io/mumble-voip/mumble-server:v1.6.87002fd613b6a35
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
2
ghcr.io/nginxinc/nginx-s3-gateway/nginx-oss-s3-gateway:unprivileged-oss:unprivileged-oss-202503313db8145349a3
bzip2@1.0.8-5+b1
no fix listed
2
ghcr.io/nucleuscloud/neosync/api:0.5.41e2abb798f29f
bzip2@1.0.8-5+b1
no fix listed
2
ghcr.io/nucleuscloud/neosync/worker:0.5.4196f42450c5b1
bzip2@1.0.8-5+b1
no fix listed
2
ghcr.io/postgresml/pgcat:main245f9d2f5f5b
bzip2@1.0.8-5+b1
no fix listed
2
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
bzip2@1.0.8-5+b1
no fix listed
2
ghcr.io/salaboy/fmtok8s-frontend:v0.1.103fd01b4f56e
bzip2@1.0.8-5build1
1.0.8-5ubuntu0.1
2
ghcr.io/smarter-project/home-ha-mock:main95ee018cf558
bzip2@1.0.8-5+b1
no fix listed
2
ghcr.io/smarter-project/hydra/isolated-vm:main4457b79b24cd
bzip2@1.0.8-5+b1
no fix listed
2
mcr.microsoft.com/azure-sql-edge:latest902628a8be89
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1
2
public.ecr.aws/aktosecurity/akto-api-security-dashboard:1.69.2:latestb53a854bd7c1
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
2
public.ecr.aws/cloudnatix/llmariner/model-manager-loader:1.27.026ac7263a823
bzip2@1.0.8-6
no fix listed
2
quay.io/argoproj/argocd:v2.14.115fc69e31c755
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
2
registry.k8s.io/sig-storage/smbplugin:v1.20.3dc7746bb081e
bzip2@1.0.8-5+b1
no fix listed
2
1dev/server:11.9.0cd5b12fe5471
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
1
48n6e/camellia-redis-proxy:1.4.0-jdk-21-0.0.1a6ed886fddfc
bzip2@1.0.8-5+b1
no fix listed
1
5200710/hadoop:3.2.3-java8092d3088a5fb
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1
1
a10networks/acos-prometheus-exporter:latest8dc58d434d71
bzip2@1.0.6-8.1
1.0.6-8.1ubuntu0.2+esm1
1
aapjeisbaas/wp-frankenphp:v0.2.26b261abc7fb0
bzip2@1.0.8-6
no fix listed
1
aboogie/login_test_backend:new9c41a4483ac8
bzip2@1.0.8-5+b1
no fix listed
1
actualbudget/actual-server:25.3.158fecd9088b7
bzip2@1.0.8-5+b1
no fix listed
1
adamzammit/limesurvey:7.1.1fdb06d62c22e
bzip2@1.0.8-6
no fix listed
1
adorsys/keycloak-config-cli:6.3.0-26.1.085be7a45a94c
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
1
adorsys/keycloak-config-cli:6.1.6-25.0.1eb49a2dcbbb8
bzip2@1.0.8-5.1
1.0.8-5.1ubuntu0.1
1
adwerx/github-actions-runner:2.276.1-20.04-1840d2b078682
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1
1
agentarea/agentarea-api:latest9e15e16fa758
bzip2@1.0.8-6
no fix listed
1
agentarea/agentarea-mcp-runner:latestd3c209a5d531
bzip2@1.0.8-5+b1
no fix listed
1
agentarea/agentarea-worker:latest1e5cb68ee77a
bzip2@1.0.8-6
no fix listed
1
ahmetfurkandemir/iceberg-rest-fixture-postgresql:1.10.0142231a0b8b7
bzip2@1.0.8-5build1
1.0.8-5ubuntu0.1
1
aibrix/metadata-service:v0.7.063fb81a64377
bzip2@1.0.8-5+b1
no fix listed
1
airbyte/manifest-server:7.28.2deec511b51c3
bzip2@1.0.8-5+b1
no fix listed
1
airbyte/pod-sweeper:1.5.198d2c39d512e
bzip2@1.0.8-5+b1
no fix listed
1
airsonicadvanced/airsonic-advanced:latestf7cbafac2806
bzip2@1.0.8-2
1.0.8-2ubuntu0.1~esm1
1
akaunting/akaunting:3.0.1552811b36ec3a
bzip2@1.0.8-5+b1
no fix listed
1
akeyless/base:latest759e4289fae8
bzip2@1.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
1
aktosecurity/akto-agent-guard-anonymizer:1.1.4d4b100cbdc47
bzip2@1.0.8-6
no fix listed
1

syft 1.42.1 · advisories as of 16 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.