CVE-2026-85091

High

Advisory

Published 3 Sept 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.3; base score, highest
EPSS: 0.004; 37th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,573; of 17,792 indexed, latest versions
Container images: 2,562; deployed by those charts
Fix available: 2 of 5; affected packages

CVE-2026-85091 affecting package zlib 1.3.2-1

Carried by container images the latest versions of 2,573 of 17,792 indexed charts deploy, on 2,562 images.

Affected package	Affected versions	Fixed in	Images
zlibdeb	1:1.2.8.dfsg-1ubuntu1, 1:1.2.8.dfsg-1ubuntu1.1, 1:1.2.8.dfsg-2ubuntu4, 1:1.2.8.dfsg-2ubuntu4.1+21 more	1:1.3.dfsg+really1.3.1-1+e2	2,467
zlibapk	1.3-r2, 1.3.1-r4, 1.3.1-r5, 1.3.1-r6+6 more	1.3.3-r0	94
rsyncdeb	3.1.1-3ubuntu1.1, 3.1.1-3ubuntu1.2, 3.1.1-3ubuntu1.3, 3.1.2-2.1ubuntu1+8 more	no fix listed	29
klibcdeb	2.0.3-0ubuntu1, 2.0.3-0ubuntu1.14.04.3	no fix listed	7
zlibrpm	1.3.1-1.azl3	no fix listed	1

OSV records: CGA-64hx-6x96-r8f7 CGA-6ph6-75jp-484p DEBIAN-CVE-2026-85091 UBUNTU-CVE-2026-85091 AZL-99090 ECHO-2e36-531c-37dd
Also known as: CGA-7955-fhww-9pv3, CGA-m46g-37hm-gpgh
Trending: Rank 21 in indexed charts, since 5 Sept 2026. See the ranking →

Charts affected

2,573 by stars

Chart	Latest	Affected images	Radar Score

Container images carrying it

2,562 by charts deploying them

A fixed version is listed for 2 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
selenium/hub :3.141.59	02f251d48d5f	zlib@1:1.2.11.dfsg-2ubuntu1.2	no fix listed	3
sigp/lighthouse :latest-amd64	50f66cfebb6d	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed	3
tykio/tyk-dashboard :v5.13.1	0e03b94c153d	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	3
tykio/tyk-gateway-ee :v5.13.1	3e907e675bf9	zlib@1:1.3.dfsg+really1.3.1-1+dhi2	no fix listed	3
vaultwarden/server :1.37.1	ebdfe70701c6	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	3
xenondb/percona :5.7.33	0e26872a2b67	zlib@1:1.2.11.dfsg-2ubuntu1.2	no fix listed	3
ghcr.io/bat-bs/bitnami-pgvector :pg16	19ebe07b4daf	zlib@1:1.2.13.dfsg-1	no fix listed	3
ghcr.io/conductionnl/gateway-ui :stag	6a5594b7b32c	zlib@1:1.2.13.dfsg-1	no fix listed	3
ghcr.io/donkie/spoolman :0.26.1	cf9b41e17b93	zlib@1:1.2.13.dfsg-1	no fix listed	3
ghcr.io/huggingface/text-embeddings-inference :cpu-1.5	0502794a4d86	zlib@1:1.2.13.dfsg-1	no fix listed	3
ghcr.io/quenchworks/images/mariadb	7f506d403668	zlib@1.3.2-r4	1.3.3-r0	3
ghcr.io/quenchworks/images/mysql	65ea66e8db48	zlib@1.3.2-r4	1.3.3-r0	3
ghcr.io/smarter-project/hydra/crismux :main	673d5229df1f	zlib@1:1.2.13.dfsg-1	no fix listed	3
ghcr.io/tremolosecurity/kube-oidc-proxy :1.0.13	a89736c586ba	zlib@1:1.3.dfsg-3.1ubuntu2.2	no fix listed	3
quay.io/argoproj/argocd :v3.5.3	dd3f47d5a5e4	zlib@1:1.3.dfsg+really1.3.1-1ubuntu3.1	no fix listed	3
quay.io/cilium/cilium :v1.20.2	2939231d0d3e	zlib@1:1.3.dfsg+really1.3.1-1ubuntu3.1	no fix listed	3
quay.io/devtron/ai-agent :0.0.1	6545dac92173	zlib@1:1.2.13.dfsg-1	no fix listed	3
quay.io/devtron/argocd-cert-refresh :v10	2b6db27eaf3d	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed	3
quay.io/devtron/casbin :172ef62b-9450794d-464-39422	5bf041aacadd	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	3
quay.io/devtron/chart-sync :94237c18-1021-39419	60566529446a	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	3
quay.io/devtron/chart-sync :3b3d6d0e-836-39296	721b5c9634d4	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	3
quay.io/devtron/devtron :9450794d-930-39415	9795f3f9f031	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	3
quay.io/devtron/google-chat-alert-manager :v2.0.2	39f2c6e0af38	zlib@1:1.2.11.dfsg-2ubuntu1.2	no fix listed	3
quay.io/devtron/hyperion :0874dcaf-280-39287	01d5d8c4cecb	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	3
quay.io/devtron/inception :7beef376-948-31378	4c3b91bebd3d	zlib@1:1.2.8.dfsg-2ubuntu4.3	no fix listed	3
quay.io/devtron/k8s-utils :807ca3c2-488-14005	f296c2ec5db7	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed	3
quay.io/devtron/kubelink :94237c18-314-39417	9d25865295af	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	3
quay.io/devtron/kubelink :09867a9c-564-39289	ea6dd1e4ce71	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	3
quay.io/devtron/notifier :9804331c-372-39294	709c7da19c5a	zlib@1:1.2.13.dfsg-1	no fix listed	3
actualbudget/actual-server :26.9.0	552beab3dec8	zlib@1:1.2.13.dfsg-1	no fix listed	2
alazidis/kube-netlag :1.1.0	0e8c84152201	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	2
apache/apisix :3.18.0-ubuntu	9ee5df1611f9	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	2
apache/druid :37.0.0	0116fb802786	zlib@1:1.2.13.dfsg-1	no fix listed	2
apache/nifi-registry :1.26.0	7cdfd8deec92	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed	2
apache/rocketmq :5.4.0	319cd8a81ed1	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	2
apache/tika :2.9.2.1-full	ae0b86d3c4d0	zlib@1:1.3.dfsg-3.1ubuntu2	no fix listed	2
bitnamilegacy/elasticsearch :9.1.2-debian-12-r0	00176a47afa0	zlib@1:1.2.13.dfsg-1	no fix listed	2
bitnamilegacy/etcd :latest	99b408c15272	zlib@1:1.2.13.dfsg-1	no fix listed	2
bitnamilegacy/mariadb :11.4.5-debian-12-r9	33ce23601fc9	zlib@1:1.2.13.dfsg-1	no fix listed	2
bitnamilegacy/pgpool :4.6.3-debian-12-r0	d3bf3910f148	zlib@1:1.2.13.dfsg-1	no fix listed	2
bitnamilegacy/postgresql :16.4.0-debian-12-r14	94bc968141e7	zlib@1:1.2.13.dfsg-1	no fix listed	2
bitnamilegacy/postgresql-repmgr :17.6.0-debian-12-r2	f12387ec882b	zlib@1:1.2.13.dfsg-1	no fix listed	2
bitnamilegacy/redis :latest	5927ff3702df	zlib@1:1.2.13.dfsg-1	no fix listed	2
bitnamilegacy/valkey-cluster :8.1.3-debian-12-r3	32869e769b7e	zlib@1:1.2.13.dfsg-1	no fix listed	2
bitnami/minideb :latest	ab4d5b45116e	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	2
blockstack/stacks-core :3.2.0.0.0	f79944317326	zlib@1:1.2.13.dfsg-1	no fix listed	2
cagriekin/pg-ha :2.0.1-pg18	99e17aa165df	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	2
cfssl/cfssl :latest :v1.6.5	c9018c2ddf0b	zlib@1:1.2.13.dfsg-1	no fix listed	2
chromedp/headless-shell :148.0.7778.97	313ed7255ae1	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	2
clickhouse/clickhouse-server :24.2	ed9640bfff07	zlib@1:1.2.11.dfsg-2ubuntu1.5	no fix listed	2