StackRadar

CVE-2026-85091

High

Advisory

Published 3 Sept 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.3
base score, highest
EPSS
0.004
38th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,660
of 17,828 indexed, latest versions
Container images
2,682
deployed by those charts
Fix available
2 of 5
affected packages

CVE-2026-85091 affecting package zlib 1.3.2-1

Carried by container images the latest versions of 2,660 of 17,828 indexed charts deploy, on 2,682 images.

Affected packageAffected versionsFixed inImages
zlibdeb1:1.2.8.dfsg-1ubuntu1, 1:1.2.8.dfsg-1ubuntu1.1, 1:1.2.8.dfsg-2ubuntu4, 1:1.2.8.dfsg-2ubuntu4.1+23 more1:1.3.dfsg+really1.3.1-1+e22,633
zlibapk1.3-r2, 1.3.1-r4, 1.3.1-r5, 1.3.1-r6+6 more1.3.2.1_rc20260601-r048
rsyncdeb3.1.1-3ubuntu1.1, 3.1.1-3ubuntu1.2, 3.1.1-3ubuntu1.3, 3.1.2-2.1ubuntu1+9 moreno fix listed31
klibcdeb2.0.3-0ubuntu1, 2.0.3-0ubuntu1.14.04.3, 2.0.4-9ubuntu2, 2.0.13-4ubuntu0.2no fix listed9
zlibrpm1.3.1-1.azl3no fix listed1
OSV records
CGA-64hx-6x96-r8f7CGA-6ph6-75jp-484pDEBIAN-CVE-2026-85091UBUNTU-CVE-2026-85091AZL-99090ECHO-2e36-531c-37dd
Also known as
CGA-7955-fhww-9pv3, CGA-m46g-37hm-gpgh

Charts affected

2,660 by stars
ChartLatestAffected imagesRadar Score
nginx-chartxxoznge-nginx0.1.01 of 1See more

nginx-chart xxoznge-nginx 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-85091.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed

Open the chart page →

1,589
helm-demoyahoon-helm-demoVerified publisher1.0.01 of 1See more

helm-demo yahoon-helm-demo 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-85091.

Container imageDigestPackageFixed in
ghcr.io/yahoon/helm-demo:1.0.02930290a758c
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed

Open the chart page →

1,336
my-nginx-appyasser-nginx-app0.1.01 of 1See more

my-nginx-app yasser-nginx-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-85091.

Container imageDigestPackageFixed in
library/nginx:stabled5792f71a949
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed

Open the chart page →

1,965
api-snapyoukadevVerified publisher0.1.11 of 1See more

api-snap youkadev 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-85091.

Container imageDigestPackageFixed in
youkadev/api-snap:0.1.14db0f9428e67
zlib@1:1.2.13.dfsg-1
no fix listed

Open the chart page →

2,709
zahori-schedulerzahoriVerified publisher1.0.11 of 1See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-85091.

Container imageDigestPackageFixed in
zahoriaut/zahori-scheduler:1.0.047d0979b1184
zlib@1:1.2.11.dfsg-0ubuntu2.2
no fix listed

Open the chart page →

2,482
changedetection-iozekker6Verified publisher1.102.01 of 1See more

changedetection-io zekker6 1.102.0

1 of the 1 container images this version deploys carry CVE-2026-85091.

Container imageDigestPackageFixed in
ghcr.io/dgtlmoon/changedetection.io:0.60.7096dae27b5d6
zlib@1:1.2.13.dfsg-1
no fix listed

Open the chart page →

2,701
endlessh-gozekker6Verified publisher0.4.01 of 1See more

endlessh-go zekker6 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-85091.

Container imageDigestPackageFixed in
ghcr.io/shizunge/endlessh-go:2026.0730.08826dad32623
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed

Open the chart page →

489
NEW_APPzekker6Verified publisher0.0.01 of 1See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-85091.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed

Open the chart page →

1,589
clickhousezloi-space1.2.02 of 3See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-85091.

Container imageDigestPackageFixed in
yandex/clickhouse-client:21.3863f94a0f607
zlib@1:1.2.11.dfsg-0ubuntu2
no fix listed
yandex/clickhouse-server:21.3.204eccfffb01d7
zlib@1:1.2.11.dfsg-2ubuntu1.2
no fix listed

Open the chart page →

9,340
zoo-project-druzoo-projectOfficialVerified publisher0.10.41 of 6See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-85091.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a9a507cb7e2dd
zlib@1:1.2.11.dfsg-2ubuntu9.2
no fix listed

Open the chart page →

8,105

Container images carrying it

2,682 by charts deploying them

A fixed version is listed for 2 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
apache/nifi-registry:1.26.07cdfd8deec92
zlib@1:1.2.11.dfsg-2ubuntu9.2
no fix listed
2
apache/rocketmq:5.4.0319cd8a81ed1
zlib@1:1.3.dfsg-3.1ubuntu2.1
no fix listed
2
apache/tika:2.9.0.092d055a84e9e
zlib@1:1.2.11.dfsg-2ubuntu9.2
no fix listed
2
apache/tika:2.9.2.1-fullae0b86d3c4d0
zlib@1:1.3.dfsg-3.1ubuntu2
no fix listed
2
bitnamilegacy/elasticsearch:9.1.2-debian-12-r000176a47afa0
zlib@1:1.2.13.dfsg-1
no fix listed
2
bitnamilegacy/mariadb:11.4.5-debian-12-r933ce23601fc9
zlib@1:1.2.13.dfsg-1
no fix listed
2
bitnamilegacy/postgresql:16.4.0-debian-12-r1494bc968141e7
zlib@1:1.2.13.dfsg-1
no fix listed
2
bitnamilegacy/redis:latest5927ff3702df
zlib@1:1.2.13.dfsg-1
no fix listed
2
bitnami/minideb:latestab4d5b45116e
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
2
blockstack/stacks-core:3.2.0.0.0f79944317326
zlib@1:1.2.13.dfsg-1
no fix listed
2
cagriekin/pg-ha:2.0.1-pg1899e17aa165df
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
2
cfssl/cfssl:latest:v1.6.5c9018c2ddf0b
zlib@1:1.2.13.dfsg-1
no fix listed
2
chromedp/headless-shell:148.0.7778.97313ed7255ae1
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
2
clickhouse/clickhouse-server:24.2ed9640bfff07
zlib@1:1.2.11.dfsg-2ubuntu1.5
no fix listed
2
cloudflare/cloudflared:2026.6.16d91c121b803
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
2
cribl/cribl:4.20.0dddc9c0f2a52
zlib@1:1.3.dfsg-3.1ubuntu2.2
no fix listed
2
dagster/user-code-example:1.13.24206c454797f7
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
2
datagrok/grok_connect:latestf5876d3aebb8
zlib@1:1.2.11.dfsg-2ubuntu9.2
no fix listed
2
deepflowce/clickhouse-server:22.8.6.71bc1882f75c18
zlib@1:1.2.11.dfsg-2ubuntu1.3
no fix listed
2
eqalpha/keydb:latest6537505c4235
zlib@1:1.2.11.dfsg-2ubuntu1.5
no fix listed
2
eqalpha/keydb:x86_64_v6.3.4eceb1806730c
zlib@1:1.2.11.dfsg-2ubuntu1.5
no fix listed
2
fireflyiii/core:version-6.5.9fe4ecec4c2ba
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
2
fireflyiii/data-importer:version-2.2.3ab52bf932546
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
2
flashcatcloud/categraf:latest42e6ab16472e
zlib@1:1.3.dfsg-3.1ubuntu2.1
no fix listed
2
freeradius/freeradius-server:3.0.2121c8bfa904d8
zlib@1:1.2.11.dfsg-0ubuntu2
no fix listed
2
freikin/dawarich:1.14.511826c67e4b1
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
2
geoservercloud/geoserver-cloud-gateway:1.0-RC3756559ee788a
zlib@1:1.2.11.dfsg-2ubuntu1.2
no fix listed
2
geoservercloud/geoserver-cloud-rest:1.0-RC399540eef78ad
zlib@1:1.2.11.dfsg-2ubuntu1.2
no fix listed
2
geoservercloud/geoserver-cloud-wcs:1.0-RC35c254c53a357
zlib@1:1.2.11.dfsg-2ubuntu1.2
no fix listed
2
geoservercloud/geoserver-cloud-webui:1.0-RC3c687b1cbc891
zlib@1:1.2.11.dfsg-2ubuntu1.2
no fix listed
2
geoservercloud/geoserver-cloud-wfs:1.0-RC35288f320cf36
zlib@1:1.2.11.dfsg-2ubuntu1.2
no fix listed
2
geoservercloud/geoserver-cloud-wms:1.0-RC3a30a60ac6cd0
zlib@1:1.2.11.dfsg-2ubuntu1.2
no fix listed
2
gisaia/arlas-permissions-server:28.0.0e612fc722e02
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
2
gisaia/arlas-persistence-server:28.0.0f667e0ee79be
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
2
gisaia/arlas-server:28.0.04e693e7b6f37
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
2
gjeanmart/safe-ganache-node:latest926264c8f2d1
zlib@1:1.2.13.dfsg-1
no fix listed
2
gotenberg/gotenberg:8.36.087c16b9f3642
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
2
gotenberg/gotenberg:8:8.37.0f29984bd1e22
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
2
gotson/komga:1.26.36c2a967bbe9a
zlib@1:1.3.dfsg+really1.3.1-1ubuntu3
no fix listed
2
gradiant/ueransim:3.2.6015b30d5fa0f
zlib@1:1.2.11.dfsg-2ubuntu9.2
no fix listed
2
grafana/alloy:v1.8.17790f6f7fbd8
zlib@1:1.3.dfsg-3.1ubuntu2.1
no fix listed
2
grafana/alloy:v1.12.2f94b1c82957a
zlib@1:1.3.dfsg-3.1ubuntu2.1
no fix listed
2
graviteeio/apim-gateway:4.12.20-debian8f1a14449381
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
2
graviteeio/apim-management-api:4.12.20-debiand30d085395ca
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
2
hjacobs/kube-downscaler:23.2.0-6-gc9b88e84b2147f47425
zlib@1:1.2.13.dfsg-1
no fix listed
2
homebridge/homebridge:latest77c685a40911
zlib@1:1.3.dfsg-3.1ubuntu2.2
no fix listed
2
honestica/kube-iptables-tailer:master-91a393242fb939
zlib@1:1.2.11.dfsg-2ubuntu1.3
no fix listed
2
hookiesolutions/webhookie:latest0629694246ba
zlib@1:1.2.11.dfsg-2ubuntu1.2
no fix listed
2
hyperledger/besu:22.4-openjdk-latesta674d35eec9a
zlib@1:1.2.11.dfsg-2ubuntu1.3
no fix listed
2
ilum/api:6.7.3624fd09528c8
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
2

syft 1.42.1 · advisories as of 22 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.