CVE-2026-6100

Critical

Advisory

Published 13 Apr 2026In the index since 5 Sept 2026

Severity: Critical; worst across findings
CVSS: 9.1; base score, highest
EPSS: 0.006; 46th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 601; of 17,787 indexed, latest versions
Container images: 579; deployed by those charts
Fix available: 11 of 16; affected packages

Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure

Carried by container images the latest versions of 601 of 17,787 indexed charts deploy, on 579 images.

Affected package	Affected versions	Fixed in	Images
python3.11deb	3.11.0~rc1-1~22.04, 3.11.0~rc1-1~22.04.1, 3.11.2-6, 3.11.2-6+deb12u2+5 more	3.11.2-6+deb12u8	163
python3apk	3.11.12-r1, 3.12.8-r1, 3.12.9-r0, 3.12.10-r0+4 more	3.12.14-r0	63
python3.13deb	3.13.5-2, 3.13.5-2+e30, 3.13.7-1ubuntu0.1	3.13.5-2+deb13u2, 3.13.5-2+e36	23
python-3.14apk	3.14.2-r2, 3.14.4-r2	3.14.4-r3	5
pythonbitnami	3.11.11-0, 3.12.8-0, 3.13.5-1	3.10.21	3
python-3.13apk	3.13.7-r0, 3.13.10-r0, 3.13.12-r2	3.13.13-r2	3
python-3.12apk	3.12.0-r1, 3.12.9-r1	3.12.13-r3	2
python3.8deb	3.8.5-1~20.04, 3.8.5-1~20.04.2, 3.8.5-1~20.04.3, 3.8.10-0ubuntu1~20.04+11 more	no fix listed	100
python3.10deb	3.10.4-3, 3.10.4-3ubuntu0.1, 3.10.6-1~22.04, 3.10.6-1~22.04.1+14 more	3.10.12-1~22.04.16	71
python2.7deb	2.7.6-8, 2.7.6-8ubuntu0.4, 2.7.12-1ubuntu0~16.04.2, 2.7.12-1ubuntu0~16.04.3+12 more	no fix listed	54
python3.12deb	3.12.3-1, 3.12.3-1ubuntu0.2, 3.12.3-1ubuntu0.3, 3.12.3-1ubuntu0.4+8 more	3.12.3-1ubuntu0.15	48
python3.6deb	3.6.6-1~18.04, 3.6.7-1~18.04, 3.6.9-1~18.04, 3.6.9-1~18.04ubuntu1+7 more	no fix listed	44
python3.5deb	3.5.2-2ubuntu0~16.04.1, 3.5.2-2ubuntu0~16.04.4, 3.5.2-2ubuntu0~16.04.5, 3.5.2-2ubuntu0~16.04.9	no fix listed	25
python3.4deb	3.4.0-2ubuntu1, 3.4.3-1ubuntu1~14.04.5, 3.4.3-1ubuntu1~14.04.6, 3.4.3-1ubuntu1~14.04.7	no fix listed	7
python3.14deb	3.14.4-1	3.14.4-1ubuntu0.1	2
python3rpm	3.12.9-13.azl3	3.12.9-14	1

OSV records: ALPINE-CVE-2026-6100 BIT-python-2026-6100 CGA-5m77-63wh-vhhh CGA-gw5v-fvh4-9pxr CGA-m7qp-99cp-h7qj DEBIAN-CVE-2026-6100 UBUNTU-CVE-2026-6100 AZL-83051 ECHO-5806-1424-7b47
Also known as: BIT-libpython-2026-6100, BIT-python-min-2026-6100, CGA-hq26-pcqg-hvvp, CGA-mqvf-66wx-9p3p, CGA-r845-9w2j-fj7q, PSF-0000-CVE-2026-6100, PSF-2026-18, USN-8509-1

Charts affected

601 by stars

Chart

Latest

Affected images

Radar Score

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-6100.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16

Open the chart page →

14,100

Container images carrying it

579 by charts deploying them

A fixed version is listed for 11 of the 16 affected packages.

Container image	Digest	Package	Fixed in	Used by
library/znc :1.10.1	c731c6a9b8b6	python3@3.12.13-r0	3.12.14-r0	1
linode/linode-blockstorage-csi-driver :v1.1.4	09f3282bf53d	python3@3.12.13-r0	3.12.14-r0	1
linuxserver/calibre :version-v5.21.0	a847b5b2d860	python2.7@2.7.17-1~18.04ubuntu1.6 python3.6@3.6.9-1~18.04ubuntu1.4	no fix listed no fix listed	1
linuxserver/calibre-web :0.6.24	241009026e6f	python3.12@3.12.3-1ubuntu0.8	3.12.3-1ubuntu0.15	1
linuxserver/calibre-web :version-0.6.12	938810eca3d3	python3.8@3.8.10-0ubuntu1~20.04	no fix listed	1
linuxserver/codimd :latest	b801bbcf6386	python2.7@2.7.17-1~18.04ubuntu1.2	no fix listed	1
linuxserver/deluge :libtorrentv1-2.2.0-ls40	052eac68ccc0	python3@3.12.10-r1	3.12.14-r0	1
linuxserver/deluge :18.04.1	0ac871624394	python3.6@3.6.9-1~18.04ubuntu1.4	no fix listed	1
linuxserver/deluge :version-2.0.3-2201906121747ubuntu18.04.1	2ce561a95e7b	python3.6@3.6.9-1~18.04ubuntu1.4	no fix listed	1
linuxserver/lazylibrarian :version-1152df82	f93d2560e233	python3.6@3.6.9-1~18.04ubuntu1.4	no fix listed	1
linuxserver/qbittorrent :5.2.2	dd24a5f3db32	python3@3.12.13-r0	3.12.14-r0	1
litellm/litellm-non_root :v1.82.3-stable	09b217802ded	python-3.13@3.13.12-r2	3.13.13-r2	1
loeken/jellyfin :10.11.8	7efbc24e47b0	python3@3.12.13-r0	3.12.14-r0	1
logiqai/flash :v3.10.2	65b996bc7bdc	python3.11@3.11.2-6+deb12u3	3.11.2-6+deb12u8	1
longhornio/longhorn-manager :v1.2.3	dca34321452c	python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed	1
longhornio/longhorn-manager :v1.1.1	ede61fe2a472	python3.6@3.6.9-1~18.04ubuntu1.4	no fix listed	1
louislam/uptime-kuma :2.2.1-slim	059b49d64739	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u8	1
louislam/uptime-kuma :2.5.3	3e24e96c89ef	python3.11@3.11.2-6+deb12u7	3.11.2-6+deb12u8	1
louislam/uptime-kuma :2.0.2	4c364ef96aad	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u8	1
louislam/uptime-kuma :2.4.0	91e963bfda56	python3.11@3.11.2-6+deb12u7	3.11.2-6+deb12u8	1
louislam/uptime-kuma :2.0.2-slim-rootless	9865163f92c1	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u8	1
lsstsqre/nublado2 :2.0.1	b75bf8aaafa4	python2.7@2.7.18-1~20.04.1 python3.8@3.8.10-0ubuntu1~20.04.2	no fix listed no fix listed	1
makersquad/harp-proxy :0.8.1	a40dd258c527	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u8	1
mathesar/mathesar :0.12.0	091757cb01fe	python3.11@3.11.2-6+deb12u7	3.11.2-6+deb12u8	1
mauricenino/dashdot :5.9.2	236997816917	python3@3.12.9-r0	3.12.14-r0	1
mautic/mautic :7-apache	eb8cc73d97e1	python3.11@3.11.2-6+deb12u7	3.11.2-6+deb12u8	1
mbround18/valheim :3.1.0	70bd4da591cd	python3.10@3.10.12-1~22.04.9	3.10.12-1~22.04.16	1
mediagis/nominatim :5.3.2	7923a8e67197	python3.12@3.12.3-1ubuntu0.13	3.12.3-1ubuntu0.15	1
mediagis/nominatim :3.7	c15e941485ef	python3.8@3.8.10-0ubuntu1~20.04.5	no fix listed	1
mediagis/nominatim :4.2	d0eae7b51374	python3.10@3.10.12-1~22.04.3	3.10.12-1~22.04.16	1
middlewareeng/middleware :0.3.1	747d880812f1	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u8	1
mindsdb/mindsdb :latest	163011c09299	python3.13@3.13.5-2	3.13.5-2+deb13u2	1
mintproject/model-catalog-fastapi :7dd88dc5bf1fe6a6d4703ea0a077afee45cb2561	02260d20a21f	python3.11@3.11.2-6+deb12u5	3.11.2-6+deb12u8	1
mlikiowa/napcat-docker :latest	1336a777f9a4	python3.10@3.10.12-1~22.04.6	3.10.12-1~22.04.16	1
moreillon/api-proxy :latest	d7d4a5463525	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u8	1
moreillon/food-manager :latest	e8fd856e593d	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u8	1
moreillon/group-manager :latest	3caa8f710ee0	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u8	1
moreillon/user-manager-mongoose :v5.0.1	d2ee0423b797	python3.11@3.11.2-6	3.11.2-6+deb12u8	1
mshanley80/httpbin2022 :latest	5b189a70c0fb	python3.8@3.8.10-0ubuntu1~20.04.6	no fix listed	1
muhammedgamal/fp23 :latest	74b4cd69b6fa	python3.11@3.11.2-6	3.11.2-6+deb12u8	1
muluder/prograncontrollermcord :0.1.8	43b597a93da7	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	no fix listed no fix listed	1
netboxcommunity/netbox :v3.2.8	3d652dca5351	python3.10@3.10.4-3ubuntu0.1	3.10.12-1~22.04.16	1
nodered/node-red :4.1.2	216e7403aab9	python3@3.12.12-r0	3.12.14-r0	1
offchainlabs/nitro-node :v3.7.6-c0fe95e	9f779fa84b7b	python3.11@3.11.2-6+deb12u6	3.11.2-6+deb12u8	1
offchainlabs/nitro-node :v3.1.0-7d1d84c	e95865866129	python3.11@3.11.2-6+deb12u2	3.11.2-6+deb12u8	1
oled01/automx2 :2025.1.1	05d3e398e675	python@3.13.5-1 python3.11@3.11.2-6+deb12u6	3.10.21 3.11.2-6+deb12u8	1
omecproject/c3po-hssdb :master-latest	28a90cc26716	python2.7@2.7.18-1~20.04.1	no fix listed	1
omecproject/mme-exporter :paging-latest	bcc5f19fd676	python3.6@3.6.9-1~18.04	no fix listed	1
omecproject/onos-progran :1.0.0	5715e5648aa0	python2.7@2.7.12-1ubuntu0~16.04.3 python3.5@3.5.2-2ubuntu0~16.04.4	no fix listed no fix listed	1
omecproject/progran-synchronizer :comac-1.0.0	d109a8e57e71	python2.7@2.7.12-1ubuntu0~16.04.4 python3.5@3.5.2-2ubuntu0~16.04.5	no fix listed no fix listed	1