CVE-2026-85091

High

Advisory

Published 3 Sept 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.3; base score, highest
EPSS: 0.004; 38th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,605; of 17,792 indexed, latest versions
Container images: 2,608; deployed by those charts
Fix available: 2 of 5; affected packages

CVE-2026-85091 affecting package zlib 1.3.2-1

Carried by container images the latest versions of 2,605 of 17,792 indexed charts deploy, on 2,608 images.

Affected package	Affected versions	Fixed in	Images
zlibdeb	1:1.2.8.dfsg-1ubuntu1, 1:1.2.8.dfsg-1ubuntu1.1, 1:1.2.8.dfsg-2ubuntu4, 1:1.2.8.dfsg-2ubuntu4.1+22 more	1:1.3.dfsg+really1.3.1-1+e2	2,513
zlibapk	1.3-r2, 1.3.1-r4, 1.3.1-r5, 1.3.1-r6+6 more	1.3.2.1_rc20260601-r0	94
rsyncdeb	3.1.1-3ubuntu1.1, 3.1.1-3ubuntu1.2, 3.1.1-3ubuntu1.3, 3.1.2-2.1ubuntu1+8 more	no fix listed	29
klibcdeb	2.0.3-0ubuntu1, 2.0.3-0ubuntu1.14.04.3	no fix listed	7
zlibrpm	1.3.1-1.azl3	no fix listed	1

OSV records: CGA-64hx-6x96-r8f7 CGA-6ph6-75jp-484p DEBIAN-CVE-2026-85091 UBUNTU-CVE-2026-85091 AZL-99090 ECHO-2e36-531c-37dd
Also known as: CGA-7955-fhww-9pv3, CGA-m46g-37hm-gpgh
Trending: Rank 30 in indexed charts, since 5 Sept 2026. See the ranking →

Charts affected

2,605 by stars

Chart

Latest

Affected images

Radar Score

changedetection-iozekker6

1.99.0

1 of 1 See more

changedetection-io zekker6 1.99.0

1 of the 1 container images this version deploys carry CVE-2026-85091.

Container image	Digest	Package	Fixed in
ghcr.io/dgtlmoon/changedetection.io :0.60.4	7bb6963b730d	zlib@1:1.2.13.dfsg-1	no fix listed

Open the chart page →

2,630

endlessh-gozekker6

0.4.0

1 of 1 See more

endlessh-go zekker6 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-85091.

Container image	Digest	Package	Fixed in
ghcr.io/shizunge/endlessh-go :2026.0730.0	8826dad32623	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed

Open the chart page →

485

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-85091.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed

Open the chart page →

1,861

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-85091.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	zlib@1:1.2.11.dfsg-0ubuntu2	no fix listed
yandex/clickhouse-server :21.3.20	4eccfffb01d7	zlib@1:1.2.11.dfsg-2ubuntu1.2	no fix listed

Open the chart page →

9,272

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-85091.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed

Open the chart page →

7,936

Container images carrying it

2,608 by charts deploying them

A fixed version is listed for 2 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/rss3-network/agentdata :0.1.0	fd8d3e6e4cdf	zlib@1:1.2.13.dfsg-1	no fix listed	2
ghcr.io/salaboy/fmtok8s-agenda-service :v0.0.1-native	6c5efe150958	zlib@1:1.2.11.dfsg-0ubuntu2.2	no fix listed	2
ghcr.io/salaboy/fmtok8s-c4p-service :v0.0.1-native	3f7cc45fd20b	zlib@1:1.2.11.dfsg-0ubuntu2.2	no fix listed	2
ghcr.io/salaboy/fmtok8s-frontend :v0.1.1	03fd01b4f56e	zlib@1:1.2.11.dfsg-2ubuntu9	no fix listed	2
ghcr.io/smarter-project/home-ha-mock :main	95ee018cf558	zlib@1:1.2.13.dfsg-1	no fix listed	2
ghcr.io/smarter-project/hydra/isolated-vm :main	4457b79b24cd	zlib@1:1.2.13.dfsg-1	no fix listed	2
ghcr.io/xeor/karb :1.0.6 :main	647a3c938d31	zlib@1.3.2-r3	1.3.2.1_rc20260601-r0	2
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	zlib@1:1.2.11.dfsg-2ubuntu1.5	no fix listed	2
public.ecr.aws/aktosecurity/akto-api-security-dashboard :1.69.2 :latest	b53a854bd7c1	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	2
public.ecr.aws/cloudnatix/llmariner/model-manager-loader :1.27.0	26ac7263a823	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	2
quay.io/argoproj/argocd :v2.14.11	5fc69e31c755	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	2
quay.io/cilium/cilium-envoy :v1.37.6-1789133542-cbec91f666af0bf742da986d43832932dbb26b82	af7382699576	zlib@1:1.3.dfsg-3.1ubuntu2.2	no fix listed	2
registry.k8s.io/sig-storage/smbplugin :v1.20.3	dc7746bb081e	zlib@1:1.2.13.dfsg-1	no fix listed	2
1dev/server :11.9.0	cd5b12fe5471	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	1
1password/connect-api :1.8.2	e915c0c84397	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
1password/connect-sync :1.8.2	6297ca6136c0	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
48n6e/camellia-redis-proxy :1.4.0-jdk-21-0.0.1	a6ed886fddfc	zlib@1:1.2.13.dfsg-1	no fix listed	1
5200710/hadoop :3.2.3-java8	092d3088a5fb	zlib@1:1.2.11.dfsg-2ubuntu1.5	no fix listed	1
a10networks/acos-prometheus-exporter :latest	8dc58d434d71	zlib@1:1.2.11.dfsg-0ubuntu2	no fix listed	1
aapjeisbaas/wp-frankenphp :v0.2.2	6b261abc7fb0	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
aboogie/login_test_backend :new	9c41a4483ac8	zlib@1:1.2.13.dfsg-1	no fix listed	1
acryldata/datahub-actions :v1.7.0.1	c5fd70130157	zlib@1.3.2-r5	1.3.2.1_rc20260601-r0	1
acryldata/datahub-frontend-react :v1.7.0.1	99513cc1c45e	zlib@1.3.2-r5	1.3.2.1_rc20260601-r0	1
acryldata/datahub-upgrade :v1.7.0.1	c3db54d8fb94	zlib@1.3.2-r5	1.3.2.1_rc20260601-r0	1
actualbudget/actual-server :25.3.1	58fecd9088b7	zlib@1:1.2.13.dfsg-1	no fix listed	1
adamzammit/limesurvey :7.1.1	fdb06d62c22e	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
adorsys/keycloak-config-cli :6.3.0-26.1.0	85be7a45a94c	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	1
adorsys/keycloak-config-cli :6.1.6-25.0.1	eb49a2dcbbb8	zlib@1:1.3.dfsg-3.1ubuntu2	no fix listed	1
adwerx/github-actions-runner :2.276.1-20.04-1	840d2b078682	zlib@1:1.2.11.dfsg-2ubuntu1.2	no fix listed	1
agentarea/agentarea-api :latest	9e15e16fa758	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
agentarea/agentarea-mcp-runner :latest	d3c209a5d531	zlib@1:1.2.13.dfsg-1	no fix listed	1
agentarea/agentarea-worker :latest	1e5cb68ee77a	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
ahmetfurkandemir/iceberg-rest-fixture-postgresql :1.10.0	142231a0b8b7	zlib@1:1.2.11.dfsg-2ubuntu9.2	no fix listed	1
aibrix/metadata-service :v0.7.0	63fb81a64377	zlib@1:1.2.13.dfsg-1	no fix listed	1
airbyte/manifest-server :7.28.2	deec511b51c3	zlib@1:1.2.13.dfsg-1	no fix listed	1
airbyte/pod-sweeper :1.5.1	98d2c39d512e	zlib@1:1.2.13.dfsg-1	no fix listed	1
airsonicadvanced/airsonic-advanced :latest	f7cbafac2806	zlib@1:1.2.11.dfsg-2ubuntu1.2	no fix listed	1
akaunting/akaunting :3.0.15	52811b36ec3a	zlib@1:1.2.13.dfsg-1	no fix listed	1
akeyless/base :latest	759e4289fae8	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	1
akeyless/gateway :5.4.0	d4768a9b089c	zlib@1:1.3.dfsg-3.1ubuntu2.2	no fix listed	1
aktosecurity/akto-agent-guard-anonymizer :1.1.4	d4b100cbdc47	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
aktosecurity/akto-agent-guard-embedder :1.1.4	dbc566b2376c	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
aktosecurity/akto-agent-guard-worker :1.1.4	666eaffd5362	zlib@1:1.3.dfsg+really1.3.1-1+b1	no fix listed	1
aktosecurity/akto-api-security-dashboard :latest	3aeaee66bc66	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	1
aktosecurity/akto-threat-detection-backend :latest	15ebb75b94dc	zlib@1:1.3.dfsg+really1.3.1-1ubuntu3.1	no fix listed	1
aktosecurity/akto-threat-detection-backend :1.15.7	a6c1b933517f	zlib@1:1.3.dfsg+really1.3.1-1ubuntu3	no fix listed	1
aktosecurity/data-ingestion-service	213aded7adc5	zlib@1:1.3.dfsg-3.1ubuntu2.1	no fix listed	1
aktosecurity/data-ingestion-service :1.4.9	46ed5bcb04b2	zlib@1:1.3.dfsg+really1.3.1-1ubuntu3	no fix listed	1
aktosecurity/data-ingestion-service :1.5.3	5d4eab1c36b9	zlib@1:1.3.dfsg+really1.3.1-1ubuntu3	no fix listed	1
aktosecurity/mini-runtime :1.72.15	498e3e35ecc2	zlib@1:1.3.dfsg+really1.3.1-1ubuntu3	no fix listed	1