CVE-2026-85091

High

Advisory

Published 3 Sept 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.3; base score, highest
EPSS: 0.004; 38th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,654; of 17,813 indexed, latest versions
Container images: 2,678; deployed by those charts
Fix available: 2 of 5; affected packages

CVE-2026-85091 affecting package zlib 1.3.2-1

Carried by container images the latest versions of 2,654 of 17,813 indexed charts deploy, on 2,678 images.

Affected package	Affected versions	Fixed in	Images
zlibdeb	1:1.2.8.dfsg-1ubuntu1, 1:1.2.8.dfsg-1ubuntu1.1, 1:1.2.8.dfsg-2ubuntu4, 1:1.2.8.dfsg-2ubuntu4.1+22 more	1:1.3.dfsg+really1.3.1-1+e2	2,599
zlibapk	1.3-r2, 1.3.1-r4, 1.3.1-r5, 1.3.1-r6+6 more	1.3.2.1_rc20260601-r0	78
rsyncdeb	3.1.1-3ubuntu1.1, 3.1.1-3ubuntu1.2, 3.1.1-3ubuntu1.3, 3.1.2-2.1ubuntu1+8 more	no fix listed	30
klibcdeb	2.0.3-0ubuntu1, 2.0.3-0ubuntu1.14.04.3, 2.0.13-4ubuntu0.2	no fix listed	8
zlibrpm	1.3.1-1.azl3	no fix listed	1

OSV records: CGA-64hx-6x96-r8f7 CGA-6ph6-75jp-484p DEBIAN-CVE-2026-85091 UBUNTU-CVE-2026-85091 AZL-99090 ECHO-2e36-531c-37dd
Also known as: CGA-7955-fhww-9pv3, CGA-m46g-37hm-gpgh

Charts affected

2,654 by stars

Chart

Latest

Affected images

Radar Score

endlessh-gozekker6

0.4.0

1 of 1 See more

endlessh-go zekker6 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-85091.

Container image	Digest	Package	Fixed in
ghcr.io/shizunge/endlessh-go :2026.0730.0	8826dad32623	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed

Open the chart page →

493

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-85091.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed

Open the chart page →

1,956

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-85091.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	zlib@1:1.2.11.dfsg-0ubuntu2	no fix listed
yandex/clickhouse-server :21.3.20	4eccfffb01d7	zlib@1:1.2.11.dfsg-2ubuntu1.2	no fix listed

Open the chart page →

9,296

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-85091.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed

Open the chart page →

7,966

Container images carrying it

2,678 by charts deploying them

A fixed version is listed for 2 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/open-telemetry/demo :3.1.0-flagd-ui	97a3d37e709f	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
ghcr.io/open-telemetry/demo :1.12.0-frontendproxy	9fdec1be03e4	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed	1
ghcr.io/open-telemetry/demo :3.1.0-fraud-detection	a07ee694304b	zlib@1:1.2.13.dfsg-1	no fix listed	1
ghcr.io/open-telemetry/demo :1.12.0-emailservice	a1f5cebb5240	zlib@1:1.2.13.dfsg-1	no fix listed	1
ghcr.io/open-telemetry/demo :1.12.0-shippingservice	a3ca4c02a5df	zlib@1:1.2.13.dfsg-1	no fix listed	1
ghcr.io/open-telemetry/demo :1.12.0-adservice	a59e5eead495	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	1
ghcr.io/open-telemetry/demo :3.1.0-load-generator	b130d6cee6cb	zlib@1:1.2.13.dfsg-1	no fix listed	1
ghcr.io/open-telemetry/demo :1.12.0-recommendationservice	b294a4278407	zlib@1:1.2.13.dfsg-1	no fix listed	1
ghcr.io/open-telemetry/demo :3.1.0-accounting	bfd9d13ac58a	zlib@1:1.3.dfsg-3.1ubuntu2.2	no fix listed	1
ghcr.io/open-telemetry/demo :3.1.0-agent	d0f4ae0b32a8	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
ghcr.io/open-telemetry/demo :3.1.0-ad	dfd7a4697116	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	1
ghcr.io/open-telemetry/demo :3.1.0-frontend-proxy	fd4da88bfeaa	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed	1
ghcr.io/openunison/openunison-k8s :1.0.51	128081dae281	zlib@1:1.3.dfsg-3.1ubuntu2.2	no fix listed	1
ghcr.io/openunison/openunison-k8s-react :1.0.2	afb3e9282952	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed	1
ghcr.io/open-webui/mcpo :git-39b4867	f06525afac6b	zlib@1:1.2.13.dfsg-1	no fix listed	1
ghcr.io/open-webui/open-terminal :0.13.0-slim	dec44673c865	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
ghcr.io/open-webui/terminals :latest	5d2fd44366a4	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
ghcr.io/open-webui/terminals-operator :latest	6287ce8be502	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
ghcr.io/oznu/homebridge :2022-07-08	ff2af53897e7	zlib@1:1.2.11.dfsg-2ubuntu1.3	no fix listed	1
ghcr.io/pabloromeo/clusterplex_orchestrator :1.4.16	0fe80de2d22c	zlib@1:1.2.13.dfsg-1	no fix listed	1
ghcr.io/paperless-ngx/paperless-ngx :2.13.1	0642357c5dbd	zlib@1:1.2.13.dfsg-1	no fix listed	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.13	4b05bcd28e69	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.3	57ad9565bff3	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.5	665f2f5cc548	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
ghcr.io/paperless-ngx/paperless-ngx :2.10.1	a132c2ac7c57	zlib@1:1.2.13.dfsg-1	no fix listed	1
ghcr.io/paperless-ngx/paperless-ngx :2.0.1	ab255bea133e	zlib@1:1.2.13.dfsg-1	no fix listed	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.14	b89f83345532	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
ghcr.io/papra-hq/papra :26.6.2-rootless	a281cb44176d	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
ghcr.io/paradigmxyz/reth :v1.3.12	1e5290e8b743	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed	1
ghcr.io/paradigmxyz/reth :v2.2.0	505fca5e87d6	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	1
ghcr.io/paradigmxyz/reth :latest	8ce703acf113	zlib@1:1.3.dfsg-3.1ubuntu2.2	no fix listed	1
ghcr.io/parmincloud/arvancloud-certmanager-issuer :v1.0.0	0b97452674a3	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
ghcr.io/parmincloud/haproxy-redis-sentinel :1.0.0	40a00a6456ae	zlib@1:1.2.13.dfsg-1	no fix listed	1
ghcr.io/perceptolab/devops-demo-app :0.0.2	cdc0658c40fb	zlib@1:1.2.11.dfsg-0ubuntu2.2	no fix listed	1
ghcr.io/platformrelay/kollect :v0.20.0	c95fa31ead03	zlib@1:1.2.13.dfsg-1	no fix listed	1
ghcr.io/port-labs/port-agent :v0.8.12	c92d1e223f5c	zlib@1:1.3.dfsg+really1.3.1-1+e1	1:1.3.dfsg+really1.3.1-1+e2	1
ghcr.io/privacyengineering/hawk-service :latest	bfedf47bb5e0	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed	1
ghcr.io/pschichtel/s3-backup :0.7.0	17666811f6a7	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
ghcr.io/qovery/iam-eks-user-mapper :main	c41e3efc6097	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
ghcr.io/qubiva/qubiva :v0.3.2	cdf1e3329bfe	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
ghcr.io/quenchworks/images/airflow	66d1498b17ca	zlib@1.3.2-r5	1.3.2.1_rc20260601-r0	1
ghcr.io/quenchworks/images/apisix	2b242df1ab22	zlib@1.3.2-r4	1.3.2.1_rc20260601-r0	1
ghcr.io/quenchworks/images/cassandra	688f215f101f	zlib@1.3.2-r4	1.3.2.1_rc20260601-r0	1
ghcr.io/quenchworks/images/coolify-app	ce43126a3842	zlib@1.3.2-r5	1.3.2.1_rc20260601-r0	1
ghcr.io/quenchworks/images/documentdb	be72db1f2865	zlib@1.3.2-r4	1.3.2.1_rc20260601-r0	1
ghcr.io/quenchworks/images/drupal	1969d8357d81	zlib@1.3.2-r4	1.3.2.1_rc20260601-r0	1
ghcr.io/quenchworks/images/excalidraw	08a23c56caba	zlib@1.3.2-r4	1.3.2.1_rc20260601-r0	1
ghcr.io/quenchworks/images/floci	1c83a712bf07	zlib@1.3.2-r4	1.3.2.1_rc20260601-r0	1
ghcr.io/quenchworks/images/fluent-bit	5d4db482f1b6	zlib@1.3.2-r4	1.3.2.1_rc20260601-r0	1
ghcr.io/quenchworks/images/forgejo	9fde07ee32a0	zlib@1.3.2-r5	1.3.2.1_rc20260601-r0	1