StackRadar

CVE-2026-85091

High

Advisory

Published 3 Sept 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.3
base score, highest
EPSS
0.004
38th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,647
of 17,821 indexed, latest versions
Container images
2,673
deployed by those charts
Fix available
2 of 5
affected packages

CVE-2026-85091 affecting package zlib 1.3.2-1

Carried by container images the latest versions of 2,647 of 17,821 indexed charts deploy, on 2,673 images.

Affected packageAffected versionsFixed inImages
zlibdeb1:1.2.8.dfsg-1ubuntu1, 1:1.2.8.dfsg-1ubuntu1.1, 1:1.2.8.dfsg-2ubuntu4, 1:1.2.8.dfsg-2ubuntu4.1+22 more1:1.3.dfsg+really1.3.1-1+e22,622
zlibapk1.3-r2, 1.3.1-r4, 1.3.1-r5, 1.3.1-r6+6 more1.3.2.1_rc20260601-r050
rsyncdeb3.1.1-3ubuntu1.1, 3.1.1-3ubuntu1.2, 3.1.1-3ubuntu1.3, 3.1.2-2.1ubuntu1+9 moreno fix listed31
klibcdeb2.0.3-0ubuntu1, 2.0.3-0ubuntu1.14.04.3, 2.0.4-9ubuntu2, 2.0.13-4ubuntu0.2no fix listed9
zlibrpm1.3.1-1.azl3no fix listed1
OSV records
CGA-64hx-6x96-r8f7CGA-6ph6-75jp-484pDEBIAN-CVE-2026-85091UBUNTU-CVE-2026-85091AZL-99090ECHO-2e36-531c-37dd
Also known as
CGA-7955-fhww-9pv3, CGA-m46g-37hm-gpgh

Charts affected

2,647 by stars
ChartLatestAffected imagesRadar Score

Container images carrying it

2,673 by charts deploying them

A fixed version is listed for 2 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/alethic/auth0-operator-image:1.4.122468990a8521
zlib@1:1.3.dfsg-3.1ubuntu2.1
no fix listed
1
ghcr.io/alexanderwanyoike/the0/runtime:1.14.7459010a02aff
zlib@1:1.3.dfsg-3.1ubuntu2.2
no fix listed
1
ghcr.io/alexmorbo/dell_idrac_fan_controller:v0.1.6-1d110504d551d
zlib@1:1.3.dfsg-3.1ubuntu2.1
no fix listed
1
ghcr.io/almarklein/timetagger:v26.1.3-nonroot18a81afcb249
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/alpineworks/katalog-migrations:v1.0.562c44a384e13
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/analogj/scrutiny:master-omnibus18689773150d
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/analogj/scrutiny:v0.9.2-web71be54e99608
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
1
ghcr.io/angelnu/tt-rss:2.0.100708ba6617f33c9
zlib@1:1.3.dfsg+really1.3.1-1ubuntu3.1
no fix listed
1
ghcr.io/angelscloud/prometheus-optimizer:latest744bc929a579
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets:0.0.0-main13e267ad7d94
zlib@1:1.3.dfsg-3.1ubuntu2.1
no fix listed
1
ghcr.io/apache/flink-kubernetes-operator:c703255e9c2ce635b89
zlib@1:1.2.11.dfsg-2ubuntu9.2
no fix listed
1
ghcr.io/appscode/b3:v2026.9.1178a9fb785ec5
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/appscode/csi-driver-cacerts:v0.6.0ab213b156017
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/appscode/gotenberg:8.25f9104080d9a7
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
1
ghcr.io/appscode/inbox-server:MailetGroup4a2824296412
zlib@1:1.2.11.dfsg-2ubuntu9.2
no fix listed
1
ghcr.io/appscode/s3proxy:sha-a82ca6820518335f9f9
zlib@1:1.2.11.dfsg-2ubuntu9.2
no fix listed
1
ghcr.io/argonix-io/argonix-api:1.0.0951622ae173b
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
1
ghcr.io/argoproj-labs/mcp-for-argocd:v0.9.0dffc6c719d86
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/astradns/astradns-agent:v0.2.9-unbound6ba69487f1b0
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/astriaorg/account-monitor:latest4c8b42890035
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/astriaorg/auctioneer:pr-18391386b7b5e555
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/astriaorg/conductor:1.1.01f97d131b1d1
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/astriaorg/evm-bridge-withdrawer:1.0.29c88e1aff357
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/astriaorg/hermes:0.5.04f33a0a9f75e
zlib@1:1.3.dfsg-3.1ubuntu2.1
no fix listed
1
ghcr.io/astriaorg/sequencer:latest44f82ee0b24c
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/astriaorg/sequencer-relayer:latest5f6c74993f08
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/atuinsh/atuin:18.12.0e953fa9e36ef
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/avistotelecom/docker-wazuh-agent:4.12.08766ba08bf1a
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/backstage/backstage:latest792e262ea504
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
1
ghcr.io/base/node-reth:v1.1.18eb6e492fe3c
zlib@1:1.3.dfsg-3.1ubuntu2.1
no fix listed
1
ghcr.io/base-org/node:v0.11.11aba0ffe55ea
zlib@1:1.2.11.dfsg-2ubuntu9.2
no fix listed
1
ghcr.io/beluga-cloud/jellyfin/jellyfin:10.8.1368f52b993a7f
zlib@1:1.2.11.dfsg-2ubuntu9.2
no fix listed
1
ghcr.io/berriai/litellm:1.102.032cfd7a427f6
zlib@1.3.2-r5
1.3.2.1_rc20260601-r0
1
ghcr.io/berriai/litellm:main-stablec8756e7b9a61
zlib@1.3.2-r5
1.3.2.1_rc20260601-r0
1
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
zlib@1.3.1-r51
1.3.2.1_rc20260601-r0
1
ghcr.io/beslovas/duckdb-ui:1.3.272f35584026d
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/blockscout/smart-contract-verifier:main9a43f0cc5797
zlib@1:1.3.dfsg-3.1ubuntu2.1
no fix listed
1
ghcr.io/botify-labs/airbyte_exporter:2.3.02105b1f33013
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/brittonhayes/arma-reforger:latest6fde1edc0983
zlib@1:1.2.11.dfsg-2ubuntu1.5
no fix listed
1
ghcr.io/browserless/chrome:v2.56.7d600eac6283f
zlib@1:1.3.dfsg-3.1ubuntu2.2
no fix listed
1
ghcr.io/browserless/chromium:v2.55.42ed0183564d7
zlib@1:1.3.dfsg-3.1ubuntu2.1
no fix listed
1
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
zlib@1:1.3.dfsg-3.1ubuntu2.1
no fix listed
1
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/camptocamp/pgbouncer:latest19dc5663cac4
zlib@1:1.3.dfsg+really1.3.1-1+b1
no fix listed
1
ghcr.io/camptocamp/tetragon-policy-builder:master0e99f12bb040
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/camunda-community-hub/zeebe-simple-monitor:2.6.2d9d796a1b846
zlib@1:1.2.11.dfsg-2ubuntu9.2
no fix listed
1
ghcr.io/caninehq/canine:latesta058034ca006
zlib@1:1.2.13.dfsg-1
no fix listed
1
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
zlib@1:1.2.13.dfsg-1
no fix listed
1

syft 1.42.1 · advisories as of 21 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.