CVE-2026-85091

High

Advisory

Published 3 Sept 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.3; base score, highest
EPSS: 0.004; 38th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,654; of 17,813 indexed, latest versions
Container images: 2,678; deployed by those charts
Fix available: 2 of 5; affected packages

CVE-2026-85091 affecting package zlib 1.3.2-1

Carried by container images the latest versions of 2,654 of 17,813 indexed charts deploy, on 2,678 images.

Affected package	Affected versions	Fixed in	Images
zlibdeb	1:1.2.8.dfsg-1ubuntu1, 1:1.2.8.dfsg-1ubuntu1.1, 1:1.2.8.dfsg-2ubuntu4, 1:1.2.8.dfsg-2ubuntu4.1+22 more	1:1.3.dfsg+really1.3.1-1+e2	2,599
zlibapk	1.3-r2, 1.3.1-r4, 1.3.1-r5, 1.3.1-r6+6 more	1.3.2.1_rc20260601-r0	78
rsyncdeb	3.1.1-3ubuntu1.1, 3.1.1-3ubuntu1.2, 3.1.1-3ubuntu1.3, 3.1.2-2.1ubuntu1+8 more	no fix listed	30
klibcdeb	2.0.3-0ubuntu1, 2.0.3-0ubuntu1.14.04.3, 2.0.13-4ubuntu0.2	no fix listed	8
zlibrpm	1.3.1-1.azl3	no fix listed	1

OSV records: CGA-64hx-6x96-r8f7 CGA-6ph6-75jp-484p DEBIAN-CVE-2026-85091 UBUNTU-CVE-2026-85091 AZL-99090 ECHO-2e36-531c-37dd
Also known as: CGA-7955-fhww-9pv3, CGA-m46g-37hm-gpgh

Charts affected

2,654 by stars

Chart

Latest

Affected images

Radar Score

endlessh-gozekker6

0.4.0

1 of 1 See more

endlessh-go zekker6 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-85091.

Container image	Digest	Package	Fixed in
ghcr.io/shizunge/endlessh-go :2026.0730.0	8826dad32623	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed

Open the chart page →

493

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-85091.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed

Open the chart page →

1,956

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-85091.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	zlib@1:1.2.11.dfsg-0ubuntu2	no fix listed
yandex/clickhouse-server :21.3.20	4eccfffb01d7	zlib@1:1.2.11.dfsg-2ubuntu1.2	no fix listed

Open the chart page →

9,296

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-85091.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed

Open the chart page →

7,966

Container images carrying it

2,678 by charts deploying them

A fixed version is listed for 2 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
dolibarr/dolibarr :22.0.4	7ad88fc9b13c	zlib@1:1.2.13.dfsg-1	no fix listed	1
domainmod/domainmod :4.23.0	4017bfe4c597	zlib@1:1.2.13.dfsg-1	no fix listed	1
dongjiang1989/lxcfs :v6.0.3	4bf9ae391948	zlib@1:1.2.11.dfsg-2ubuntu1.5	no fix listed	1
dragonflyoss/client :v1.5.5	9fe2a1d6206f	zlib@1:1.2.13.dfsg-1	no fix listed	1
dragonflyoss/client :v0.1.82	edf3e921f4e0	zlib@1:1.2.13.dfsg-1	no fix listed	1
dremio/dremio-oss :24.1.0	80ed2e3b7c43	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed	1
drorivry4/rego :latest	e035d49b15ca	zlib@1:1.2.13.dfsg-1	no fix listed	1
drpcorg/dshackle :0.54.0	8858fae1859d	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed	1
drumsergio/genieacs :1.2.16.0	28244054e1bf	zlib@1:1.2.13.dfsg-1	no fix listed	1
dserio83/velero-api :0.3.1	6b3d9115fee2	zlib@1:1.2.13.dfsg-1	no fix listed	1
dserio83/velero-watchdog :0.1.8	d5deae589229	zlib@1:1.2.13.dfsg-1	no fix listed	1
duck1123/cert-downloader :latest	0e29f19fa67c	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed	1
duck1123/lnd-fileserver :latest	9d6fb247b714	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed	1
dzikoysk/reposilite :3.5.26	4128c2d7a6ba	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	1
dzikoysk/reposilite :3.6.3	90de4c8e6c0e	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	1
eceasy/cli-proxy-api :v7.3.8	6c2c8a790479	zlib@1:1.2.13.dfsg-1	no fix listed	1
eclipseaerios/aerios-k8s-shim :v1.0.0	d4ed3d8e5db4	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
eclipseaerios/hlo-allocator :v3.0.0	3cc1d94cfe96	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
eclipseaerios/hlo-data-aggregator :v3.0.0	b433c2b9f5dc	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
eclipseaerios/hlo-deployment-engine :v3.0.0	d582d39208c7	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
eclipseaerios/hlo-fe-engine :v3.0.0	8ed2df4ca692	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
eclipseaerios/iota-messages-api :latest	e7f5ba0bc64d	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
eclipseaerios/self-awareness-hardware-info :1.4.4	34b72f45b46a	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
eclipseaerios/self-orchestrator :1.2.0	8b123bec5679	zlib@1:1.2.13.dfsg-1	no fix listed	1
eclipseaerios/trust-manager :1.0.0	f55442e2c0ed	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
elastic/apm-server :7.17.6	c7a1c63257d0	zlib@1:1.2.11.dfsg-2ubuntu1.3	no fix listed	1
elastictranscoder/media :627e21dc	963ab3858c6b	zlib@1:1.2.11.dfsg-0ubuntu2	no fix listed	1
elastictranscoder/media-storage :f6d861a0	26208b8c2359	zlib@1:1.2.11.dfsg-0ubuntu2	no fix listed	1
elastictranscoder/transcoder :627e21dc	b4a0327029e6	zlib@1:1.2.11.dfsg-0ubuntu2	no fix listed	1
elastictranscoder/transcoder-handler :627e21dc	5b75d19e2733	zlib@1:1.2.11.dfsg-0ubuntu2	no fix listed	1
elastiflow/flow-collector :7.26.0	fee67842e16b	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	1
electriccoinco/lightwalletd :v0.5.4	2ae3a551e111	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
empathyco/elasticsearch :7.17.2-memlock	03e724e41eeb	zlib@1:1.2.11.dfsg-2ubuntu1.2	no fix listed	1
emqx/ecp-ui :2.5.1	e33e9816f147	zlib@1:1.2.13.dfsg-1	no fix listed	1
emqx/emqx :5.8.9	35b46f7aa7a0	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
emqx/emqx-enterprise :6.3.1	5ecbf93d04e3	zlib@1:1.3.dfsg+really1.3.1-1+dhi3	no fix listed	1
enclavenetworks/enclave :latest	0a99759300d1	zlib@1:1.2.11.dfsg-2ubuntu1.5	no fix listed	1
engrmth/bnkr :2.1.0	6d8464e6f0e8	rsync@3.1.3-8 zlib@1:1.2.11.dfsg-2ubuntu1.2	no fix listed no fix listed	1
enix/san-iscsi-csi :v4.0.2	f963da81ecf7	zlib@1:1.2.11.dfsg-0ubuntu2	no fix listed	1
envoyproxy/envoy :v1.30.9	2956bd9de830	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed	1
envoyproxy/envoy :v1.38.4	447f857a0146	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed	1
envoyproxy/envoy :v1.33.0	56da5afd7df3	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed	1
envoyproxy/envoy :v1.31-latest	caa5b411be16	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed	1
envoyproxy/envoy :v1.34-latest	cfc0678bc03c	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed	1
envoyproxy/envoy :v1.30.1	e596fda6a0ce	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed	1
envoyproxy/envoy :v1.18.2	e8b37c1d7578	zlib@1:1.2.11.dfsg-0ubuntu2	no fix listed	1
eqalpha/keydb :x86_64_v6.3.2	fd9351ce27a7	zlib@1:1.2.11.dfsg-0ubuntu2.2	no fix listed	1
erenozcan17/flask_analytics :v3.1	c9b6f0dfbffc	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
erigontech/erigon :v2.61.2	88706754b627	zlib@1:1.2.13.dfsg-1	no fix listed	1
erigontech/erigon :latest	8cd3fbcbb35d	zlib@1:1.2.13.dfsg-1	no fix listed	1