CVE-2026-4360

Medium

Advisory

Published 30 Jun 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.3; base score, highest
EPSS: 0.003; 20th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 551; of 17,787 indexed, latest versions
Container images: 529; deployed by those charts
Fix available: 15 of 16; affected packages

Tarfile.extract() doesn't fully respect filter parameter

Carried by container images the latest versions of 551 of 17,787 indexed charts deploy, on 529 images.

Affected package	Affected versions	Fixed in	Images
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	3.8.10-0ubuntu1~20.04.18+esm7	100
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3, 3.12.3-1ubuntu0.4+10 more	3.12.3-1ubuntu0.17	85
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+16 more	3.10.12-1~22.04.18	80
python3apk	3.11.12-r1, 3.12.8-r1, 3.12.9-r0, 3.12.10-r0+7 more	3.12.14-r0, 3.14.7-r0	75
python3.13deb	3.13.5-2, 3.13.5-2+deb13u2, 3.13.5-2+deb13u4, 3.13.7-1ubuntu0.1	3.13.5-2+deb13u5	74
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	3.6.9-1~18.04ubuntu1.13+esm10	44
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+9 more	2.7.6-8ubuntu0.6+esm30, 2.7.12-1ubuntu0~16.04.18+esm22, 2.7.17-1~18.04ubuntu1.13+esm15, 2.7.18-13ubuntu1.5+esm9	43
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	3.5.2-2ubuntu0~16.04.13+esm25	25
python3.14deb	3.14.4-1, 3.14.4-1ubuntu0.1	3.14.4-1ubuntu0.2	8
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	3.4.3-1ubuntu1~14.04.7+esm21	7
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	no fix listed	3
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1	3.11.0~rc1-1~22.04.1+esm2	2
python3rpm	3.12.9-13.azl3	3.12.9-14	1
python-3.14apk	3.14.2-r2, 3.14.4-r2, 3.14.6-r0	3.14.6-r3	6
python-3.13apk	3.13.7-r0, 3.13.10-r0, 3.13.12-r2	3.13.14-r2	3
python-3.12apk	3.12.0-r1, 3.12.9-r1	3.12.13-r10	2

OSV records: ALPINE-CVE-2026-4360 BIT-python-2026-4360 DEBIAN-CVE-2026-4360 UBUNTU-CVE-2026-4360 CGA-3j98-689h-m79j CGA-8qxw-mxj5-qqfv CGA-jr9q-86mm-jvfc AZL-91749
Also known as: BIT-libpython-2026-4360, BIT-python-min-2026-4360, CGA-fj7c-qx2m-pqr4, CGA-v6c3-6q52-4qfj, CGA-x27p-jmrc-jcmr, PSF-2026-32, USN-8744-1

Charts affected

551 by stars

Chart

Latest

Affected images

Radar Score

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-4360.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	python3.10@3.10.12-1~22.04.16	3.10.12-1~22.04.18

Open the chart page →

7,849

Container images carrying it

529 by charts deploying them

A fixed version is listed for 15 of the 16 affected packages.

Container image	Digest	Package	Fixed in	Used by
sslhep/servicex-did-finder-atlasopenmagic :v1.8.5	54aaf1721d03	python3.13@3.13.5-2+deb13u4	3.13.5-2+deb13u5	1
sslhep/servicex-did-finder-cernopendata :v1.8.5	2cb88ceab5bb	python3.13@3.13.5-2+deb13u4	3.13.5-2+deb13u5	1
sslhep/servicex-did-finder-xrootd :v1.8.5	c284442b44e3	python3.13@3.13.5-2+deb13u4	3.13.5-2+deb13u5	1
stackstorm/st2actionrunner :3.8	88235ba70cad	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2api :3.8	6f56d239d280	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2auth :3.8	33ecfda16608	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2garbagecollector :3.8	4e3f8c7ca52d	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2notifier :3.8	f190a6212195	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2rulesengine :3.8	259503496ff9	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2scheduler :3.8	b1de2055c362	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2sensorcontainer :3.8	b1a338f64773	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2stream :3.8	1c8904a3bf67	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2timersengine :3.8	1bf35bfaf00c	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stackstorm/st2workflowengine :3.8	19fdfffdbba8	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
stashapp/stash :latest	24dbd7607174	python3.8@3.8.5-1~20.04.2	3.8.10-0ubuntu1~20.04.18+esm7	1
stashapp/stash :v0.31.1	df744af5a0c9	python3@3.12.13-r0	3.12.14-r0	1
statcan/ckan :2.9	3921305425b8	python3.8@3.8.5-1~20.04.3	3.8.10-0ubuntu1~20.04.18+esm7	1
streamnative/apache-pulsar-grafana-dashboard-k8s :0.0.16	11bceacec8fb	python3.8@3.8.5-1~20.04.3	3.8.10-0ubuntu1~20.04.18+esm7	1
supabase/realtime :latest	d3aa0c86c7b3	python3.13@3.13.5-2+deb13u4	3.13.5-2+deb13u5	1
supabase/storage-api :v1.60.4	c8eb9858eafe	python3@3.12.13-r0	3.12.14-r0	1
svtechnmaa/svtech_debuger :v1.0.3	a934ffd63d25	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18	1
svtechnmaa/svtech_rundeck :v1.2.2	6e368ace0977	python3.8@3.8.10-0ubuntu1~20.04.9	3.8.10-0ubuntu1~20.04.18+esm7	1
szurubooru/server :2.5	accf2ad9fbc3	python3@3.12.13-r0	3.12.14-r0	1
temporalio/admin-tools :1.29.1-tctl-1.18.4-cli-1.5.0	a3a52e6ca122	python3@3.12.11-r0	3.12.14-r0	1
temporalio/admin-tools :1.28	cfde8170c92f	python3@3.12.12-r0	3.12.14-r0	1
tensorflow/tensorflow :1.6.0-devel	1e3172090703	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	1
thijsvanloef/palworld-server-docker :v2.7.1	401d3eb5c053	python3.13@3.13.5-2+deb13u4	3.13.5-2+deb13u5	1
thijsvanloef/palworld-server-docker :v2.5.0	b4ac9ee22483	python3.13@3.13.5-2+deb13u2	3.13.5-2+deb13u5	1
timescale/timescaledb-ha :pg15-latest	a8e3322e1cf9	python3.10@3.10.6-1~22.04.2ubuntu1	3.10.12-1~22.04.18	1
timescale/timescaledb-ha :pg14.6-ts2.9.1-p1	cdb9ae118899	python3.10@3.10.6-1~22.04.2	3.10.12-1~22.04.18	1
timescale/timescaledb-ha :pg16	d7db8f1085a3	python3.10@3.10.12-1~22.04.17	3.10.12-1~22.04.18	1
timescale/timescaledb-ha :pg17.2-ts2.18.2	e8d0a9cc3db5	python3.10@3.10.12-1~22.04.9	3.10.12-1~22.04.18	1
timescale/timescaledb-ha :pg14-ts2.6-latest	ed719c0cd19d	python3.10@3.10.4-3	3.10.12-1~22.04.18	1
timothyclarke/wptagent :2018-01-23	22c41e5ca7e2	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	1
tinymediamanager/tinymediamanager :5.3.2	2b34dc85099e	python3.13@3.13.5-2	3.13.5-2+deb13u5	1
tomsquest/docker-radicale :3.6.1.0	a594c624c5a6	python3@3.12.12-r0	3.12.14-r0	1
tpdock/freeradius :2.2.9	3da600c95a49	python2.7@2.7.12-1ubuntu0~16.04.2 python3.5@3.5.2-2ubuntu0~16.04.4	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	1
trinodb/trino :405	ee80ab5eeab2	python3.10@3.10.6-1~22.04.2	3.10.12-1~22.04.18	1
trueosiris/vrising :latest	9356f98ad561	python3.10@3.10.12-1~22.04.15	3.10.12-1~22.04.18	1
twentycrm/twenty-postgres-spilo :latest	2f78405a78be	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.18	1
vinanrra/7dtd-server :v0.4.4	f9534490bd2b	python3.6@3.6.9-1~18.04ubuntu1.9	3.6.9-1~18.04ubuntu1.13+esm10	1
voltha/voltha-cli :1.6.0	c4e41e92f046	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.5	2.7.12-1ubuntu0~16.04.18+esm22 3.5.2-2ubuntu0~16.04.13+esm25	1
voltha/voltha-envoy :1.6.0	59ab2a00f712	python3.4@3.4.3-1ubuntu1~14.04.5	3.4.3-1ubuntu1~14.04.7+esm21	1
voltha/voltha-netconf :1.6.0	37f80524c207	python2.7@2.7.12-1ubuntu0~16.04.3	2.7.12-1ubuntu0~16.04.18+esm22	1
voltha/voltha-ofagent :1.6.0	9ee8c1f4428c	python2.7@2.7.12-1ubuntu0~16.04.3	2.7.12-1ubuntu0~16.04.18+esm22	1
voltha/voltha-tester :1.7.0	655c3048a602	python2.7@2.7.12-1ubuntu0~16.04.4	2.7.12-1ubuntu0~16.04.18+esm22	1
voltha/voltha-voltha :1.6.0	ff596b62de59	python2.7@2.7.12-1ubuntu0~16.04.3	2.7.12-1ubuntu0~16.04.18+esm22	1
wallarm/aih-scanner :2.7.11	f1cb26db1f5b	python3.13@3.13.5-2+deb13u4	3.13.5-2+deb13u5	1
wazuh/wazuh-manager :4.4.1	21994f40e0da	python3.8@3.8.10-0ubuntu1~20.04.7	3.8.10-0ubuntu1~20.04.18+esm7	1
wettyoss/wetty :latest	7423b3d40ba2	python3@3.14.5-r0	3.14.7-r0	1