CVE-2026-6100

Critical

Advisory

Published 13 Apr 2026In the index since 5 Sept 2026

Severity: Critical; worst across findings
CVSS: 9.1; base score, highest
EPSS: 0.006; 46th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 601; of 17,787 indexed, latest versions
Container images: 579; deployed by those charts
Fix available: 11 of 16; affected packages

Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure

Carried by container images the latest versions of 601 of 17,787 indexed charts deploy, on 579 images.

Affected package	Affected versions	Fixed in	Images
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+5 more	3.11.2-6+deb12u8	163
python3apk	3.11.12-r1, 3.12.8-r1, 3.12.9-r0, 3.12.10-r0+4 more	3.12.14-r0	63
python3.13deb	3.13.5-2, 3.13.5-2+e30, 3.13.7-1ubuntu0.1	3.13.5-2+deb13u2, 3.13.5-2+e36	23
python-3.14apk	3.14.2-r2, 3.14.4-r2	3.14.4-r3	5
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	3.10.21	3
python-3.13apk	3.13.7-r0, 3.13.10-r0, 3.13.12-r2	3.13.13-r2	3
python-3.12apk	3.12.0-r1, 3.12.9-r1	3.12.13-r3	2
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	no fix listed	100
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+14 more	3.10.12-1~22.04.16	71
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+12 more	no fix listed	54
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3, 3.12.3-1ubuntu0.4+8 more	3.12.3-1ubuntu0.15	48
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	no fix listed	44
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	no fix listed	25
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	no fix listed	7
python3.14deb	3.14.4-1	3.14.4-1ubuntu0.1	2
python3rpm	3.12.9-13.azl3	3.12.9-14	1

OSV records: ALPINE-CVE-2026-6100 BIT-python-2026-6100 CGA-5m77-63wh-vhhh CGA-gw5v-fvh4-9pxr CGA-m7qp-99cp-h7qj DEBIAN-CVE-2026-6100 UBUNTU-CVE-2026-6100 AZL-83051 ECHO-5806-1424-7b47
Also known as: BIT-libpython-2026-6100, BIT-python-min-2026-6100, CGA-hq26-pcqg-hvvp, CGA-mqvf-66wx-9p3p, CGA-r845-9w2j-fj7q, PSF-0000-CVE-2026-6100, PSF-2026-18, USN-8509-1

Charts affected

601 by stars

Chart

Latest

Affected images

Radar Score

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-6100.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

14,100

Container images carrying it

579 by charts deploying them

A fixed version is listed for 11 of the 16 affected packages.

Container image	Digest	Package	Fixed in	Used by
ymuski/geo-checker :5.0.0	5ba7fd8c7bdc	python3@3.12.12-r0	3.12.14-r0	1
zabbix/zabbix-web-nginx-mysql :ubuntu-6.4-latest	0e5f69c4c54e	python3.12@3.12.3-1ubuntu0.4	3.12.3-1ubuntu0.15	1
zabbix/zabbix-web-nginx-pgsql :ubuntu-5.4.6	01de79c31391	python3.8@3.8.10-0ubuntu1~20.04.1	no fix listed	1
zabbix/zabbix-web-nginx-pgsql :ubuntu-7.0.23	7d4d58086515	python3.12@3.12.3-1ubuntu0.11	3.12.3-1ubuntu0.15	1
zabbix/zabbix-web-nginx-pgsql :ubuntu-6.0.8	99e9a090b516	python3.10@3.10.4-3ubuntu0.1	3.10.12-1~22.04.16	1
gcr.io/istio-release/pilot :release-1.0-latest-daily	5ea7b7f3632a	python3.5@3.5.2-2ubuntu0~16.04.5	no fix listed	1
gcr.io/istio-release/proxyv2 :release-1.0-latest-daily	8f9ff98fdbef	python3.5@3.5.2-2ubuntu0~16.04.5	no fix listed	1
gcr.io/ml-pipeline/metadata-writer :2.3.0	9bcfd2abc361	python3.11@3.11.2-6+deb12u3	3.11.2-6+deb12u8	1
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets :0.0.0-main	13e267ad7d94	python3.12@3.12.3-1ubuntu0.10	3.12.3-1ubuntu0.15	1
ghcr.io/appscode/gotenberg :8.25	f9104080d9a7	python3.13@3.13.5-2	3.13.5-2+deb13u2	1
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend :2.0.0	fcbab3a24880	python3@3.12.13-r0	3.12.14-r0	1
ghcr.io/astriaorg/astrotrek :0.1.0	5889bea38e56	python3.11@3.11.2-6+deb12u3	3.11.2-6+deb12u8	1
ghcr.io/avistotelecom/docker-wazuh-agent :4.12.0	8766ba08bf1a	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u8	1
ghcr.io/base/node-reth :v1.1.1	8eb6e492fe3c	python3.12@3.12.3-1ubuntu0.13	3.12.3-1ubuntu0.15	1
ghcr.io/base-org/node :v0.11.1	1aba0ffe55ea	python3.10@3.10.12-1~22.04.7	3.10.12-1~22.04.16	1
ghcr.io/berriai/litellm-database :litellm_stable_release_branch-v1.75.5-stable	ab63d26a8a2c	python-3.13@3.13.7-r0	3.13.13-r2	1
ghcr.io/beslovas/duckdb-ui :1.3.2	72f35584026d	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u8	1
ghcr.io/brittonhayes/arma-reforger :latest	6fde1edc0983	python3.8@3.8.10-0ubuntu1~20.04.6	no fix listed	1
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	python3.12@3.12.3-1ubuntu0.12	3.12.3-1ubuntu0.15	1
ghcr.io/buanet/iobroker :v9.1.2	ca7dc7362968	python3.11@3.11.2-6+deb12u2	3.11.2-6+deb12u8	1
ghcr.io/camptocamp/tetragon-policy-builder :master	0e99f12bb040	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u8	1
ghcr.io/cfi2017/opencve-scheduler :3.0.0	8d943799621b	python3.11@3.11.2-6+deb12u4	3.11.2-6+deb12u8	1
ghcr.io/cosmo-tech/cosmotech-copilot-api :latest	a2be95de450c	python3.13@3.13.5-2	3.13.5-2+deb13u2	1
ghcr.io/cosmo-workspace/dev-code-server :v0.0.3	16fda01ae58a	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u8	1
ghcr.io/danny-avila/librechat :v0.7.8	7fe76551a78e	python3@3.12.10-r0	3.12.14-r0	1
ghcr.io/dask/dask-kubernetes-operator :2026.3.0	3225d2bc6b3c	python3.13@3.13.5-2	3.13.5-2+deb13u2	1
ghcr.io/developmentseed/titiler :0.22.4	8ac53eb38393	python@3.12.8-0	3.10.21	1
ghcr.io/devhatro/clamav-api :1.0.2	ff0cd9db78d3	python3@3.12.9-r0	3.12.14-r0	1
ghcr.io/dfir-iris/iriswebapp_app :v2.4.26	e59ebde55709	python3.13@3.13.5-2	3.13.5-2+deb13u2	1
ghcr.io/djerfy/zabbix-kubernetes-discovery :v1.4.20	7a50c07e7c69	python3.12@3.12.3-1ubuntu0.3	3.12.3-1ubuntu0.15	1
ghcr.io/drewburr-labs/mum-discord-bot :3.1.2	6e82914e1051	python3.11@3.11.2-6	3.11.2-6+deb12u8	1
ghcr.io/edgelesssys/coordinator :v0.5.0	bcd5b8d4c45c	python3.6@3.6.9-1~18.04ubuntu1.4	no fix listed	1
ghcr.io/flanksource/postgres :17.6-497383c	ebcf66281fc1	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u8	1
ghcr.io/formancehq/console-v3 :v1.16.0	c99e8ef2c545	python3@3.12.11-r0	3.12.14-r0	1
ghcr.io/formancehq/portal :v1.16.0	6efef5d19d56	python3@3.12.11-r0	3.12.14-r0	1
ghcr.io/graphprotocol/availability-oracle :sha-28312fd	472a25038957	python3.11@3.11.2-6+deb12u2	3.11.2-6+deb12u8	1
ghcr.io/grycap/im :latest	06a16d4f279f	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.15	1
ghcr.io/haveagitgat/tdarr :2.00.18.2	3fbe4c29d14c	python2.7@2.7.18-1~20.04.1 python3.8@3.8.10-0ubuntu1~20.04.4	no fix listed no fix listed	1
ghcr.io/hotio/qbittorrent :release-5.2.0	07198d49e5b4	python3@3.12.13-r0	3.12.14-r0	1
ghcr.io/htunn/ansible-inspec :0.2.12	cd25a5cc3f1b	python3.13@3.13.5-2	3.13.5-2+deb13u2	1
ghcr.io/invergent-ai/surogate-hub :latest	6d4106724d56	python3.11@3.11.2-6+deb12u7	3.11.2-6+deb12u8	1
ghcr.io/jeremylong/open-vulnerability-data-mirror :v9.0.4	9a69aa14dc3e	python3@3.12.12-r0	3.12.14-r0	1
ghcr.io/jespernohr/dayz-dedicated-server :0.1.1	ec01d3ac7887	python3.12@3.12.3-1ubuntu0.2	3.12.3-1ubuntu0.15	1
ghcr.io/jfwenisch/discord-experiencebot :latest	b52ff07f9f0c	python3.6@3.6.9-1~18.04ubuntu1.12	no fix listed	1
ghcr.io/jfwenisch/steamcmd-manager :v0.4.5	dab685e668d9	python3.12@3.12.3-1ubuntu0.3	3.12.3-1ubuntu0.15	1
ghcr.io/jfwenisch/webtools :v0.1.4	4569cae83c70	python3.12@3.12.3-1ubuntu0.3	3.12.3-1ubuntu0.15	1
ghcr.io/jr0dd/puppeteer :v13.3.2	6047599cd78e	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed	1
ghcr.io/k8s-at-home/bazarr :v1.0.3	fdb5501cdfb9	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed	1
ghcr.io/k8s-at-home/haste-server :latest	827aa2f2389d	python3.8@3.8.10-0ubuntu1~20.04	no fix listed	1
ghcr.io/k8s-at-home/nzbget :v21.1	e5571acd10ce	python3.10@3.10.4-3ubuntu0.1	3.10.12-1~22.04.16	1