StackRadar

CVE-2026-85999

Medium

Advisory

Published 17 Sept 2026In the index since 18 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
91
of 17,803 indexed, latest versions
Container images
101
deployed by those charts
Fix available
1 of 1
affected package

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)

Carried by container images the latest versions of 91 of 17,803 indexed charts deploy, on 101 images.

Affected packageAffected versionsFixed inImages
soupsievepypi1.9.5, 1.9.6, 2.2, 2.2.1+11 more2.9.0101
OSV records
GHSA-j934-xhv5-fg8f

Charts affected

91 by stars
ChartLatestAffected imagesRadar Score
whooglegeek-cookbookVerified publisher3.4.21 of 1See more

whoogle geek-cookbook 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
benbusby/whoogle-search:0.5.4f77f7e6e4ad2
soupsieve@1.9.5
2.9.0

Open the chart page →

2,072
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
soupsieve@2.6
2.9.0

Open the chart page →

4,835
erpnextimprowisedVerified publisher3.3.01 of 3See more

erpnext improwised 3.3.0

1 of the 3 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
improwised/erpnext-worker:v13.4.197280b55cbd4
soupsieve@2.2.1
2.9.0

Open the chart page →

6,566
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
soupsieve@2.8.3
2.9.0

Open the chart page →

18,066
13ftjeffrescVerified publisher0.2.01 of 1See more

13ft jeffresc 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
ghcr.io/wasi-master/13ft:0.3.4563ce7794a71
soupsieve@2.6
2.9.0

Open the chart page →

898
jx-app-datadogjenkins-x0.0.101 of 2See more

jx-app-datadog jenkins-x 0.0.10

1 of the 2 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
datadog/agent:6aad9994de6a7
soupsieve@1.9.6
2.9.0

Open the chart page →

4,087
bazarrk8s-home-lab-repo11.3.21 of 1See more

bazarr k8s-home-lab-repo 11.3.2

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
soupsieve@2.3.2.post1
2.9.0

Open the chart page →

1,801
beetsk8s-home-lab-repo3.1.11 of 1See more

beets k8s-home-lab-repo 3.1.1

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
ghcr.io/home-operations/beets:2.3.1cc4975f1a0be
soupsieve@2.7
2.9.0

Open the chart page →

2,752
music-assistantkarljorgensen0.1.31 of 1See more

music-assistant karljorgensen 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
soupsieve@2.8.3
2.9.0

Open the chart page →

7,163
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
soupsieve@2.5
2.9.0

Open the chart page →

6,494
mindsdbkronkltdVerified publisher0.1.01 of 1See more

mindsdb kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
mindsdb/mindsdb:latest163011c09299
soupsieve@2.8.3
2.9.0

Open the chart page →

9,856
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
soupsieve@2.6
2.9.0

Open the chart page →

8,559
jupyterhubkubeblocksVerified publisher0.1.01 of 7See more

jupyterhub kubeblocks 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
soupsieve@2.4.1
2.9.0

Open the chart page →

7,404
kyso-nbdimekyso1.0.01 of 1See more

kyso-nbdime kyso 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
kyso/kyso-nbdime:latest4aa9d38ee81d
soupsieve@2.3.2.post1
2.9.0

Open the chart page →

2,832
linkdinglinkding0.2.31 of 1See more

linkding linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
sissbruecker/linkding:1.41.0-plusa222fb777e1f
soupsieve@2.6
2.9.0

Open the chart page →

38,429
bazarrm0nsterrr-bazarrVerified publisher2.3.11 of 1See more

bazarr m0nsterrr-bazarr 2.3.1

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
ghcr.io/home-operations/bazarr:1.6.1e5d192a6f62a
soupsieve@2.8.4
2.9.0

Open the chart page →

125
errbotmidokura-communityVerified publisher0.0.51 of 1See more

errbot midokura-community 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
errbotio/errbot:6.1.900ee4e0953ab
soupsieve@2.3.2.post1
2.9.0

Open the chart page →

2,258
fossologymidokura-communityVerified publisher0.2.21 of 2See more

fossology midokura-community 0.2.2

1 of the 2 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
fossology/fossology:4.2.18bd1f22ba7bb
soupsieve@2.3.2.post1
2.9.0

Open the chart page →

3,306
libretranslateobeoneVerified publisher1.0.71 of 1See more

libretranslate obeone 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
libretranslate/libretranslate:v1.9.61de2d7056bb8
soupsieve@2.8.4
2.9.0

Open the chart page →

2,045
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
onyxdotapp/onyx-backend:latest473fdffe4e67
soupsieve@2.8.4
2.9.0

Open the chart page →

6,697
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.01 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

1 of the 40 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
yetiplatform/yeti:2.9.09bcbe2650a14
soupsieve@2.6
2.9.0

Open the chart page →

184,580
yetiosdfir-infrastructureVerified publisher1.0.51 of 4See more

yeti osdfir-infrastructure 1.0.5

1 of the 4 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
yetiplatform/yeti:latest9c3006cedcca
soupsieve@2.6
2.9.0

Open the chart page →

6,756
devpiowan-charts0.1.01 of 1See more

devpi owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
owanio1992/devpi:6.16.04ade8e1e4d7e
soupsieve@2.7
2.9.0

Open the chart page →

524
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
soupsieve@2.8.1
2.9.0

Open the chart page →

4,852
linkdingpascaliskeVerified publisher3.0.01 of 1See more

linkding pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
ghcr.io/sissbruecker/linkding:1.45.061b2eb9eed8e
soupsieve@2.8.1
2.9.0

Open the chart page →

3,907
email-managerphntom0.1.221 of 2See more

email-manager phntom 0.1.22

1 of the 2 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
phntom/email-manager:0.1.22d8e2a9f2f085
soupsieve@2.4
2.9.0

Open the chart page →

2,577
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
soupsieve@2.6
2.9.0

Open the chart page →

21,370
kresusrm3lVerified publisher0.2.11 of 3See more

kresus rm3l 0.2.1

1 of the 3 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
bnjbvr/kresus:0.22.137e216b182c8
soupsieve@2.6
2.9.0

Open the chart page →

15,770
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
soupsieve@2.6
2.9.0

Open the chart page →

9,743
agentdatarss30.1.01 of 1See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
soupsieve@2.6
2.9.0

Open the chart page →

3,566
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
soupsieve@2.6
2.9.0

Open the chart page →

4,772
tandoorrtomik-helm-chartsVerified publisher0.0.11 of 1See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
vabene1111/recipes:2.3.50f8d061895e9
soupsieve@2.8
2.9.0

Open the chart page →

4,575
linkdingrubxkubeVerified publisher1.2.41 of 1See more

linkding rubxkube 1.2.4

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
sissbruecker/linkding:1.47.0e35cb50e0581
soupsieve@2.8.4
2.9.0

Open the chart page →

2,088
airflowsb-helm-charts0.3.01 of 1See more

airflow sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
apache/airflow:2.8.1e5560ad0b86e
soupsieve@2.5
2.9.0

Open the chart page →

10,269
syncstorageschichtelVerified publisher0.1.11 of 1See more

syncstorage schichtel 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
mozilla/syncstorage-rs:0.15.893752877dced
soupsieve@2.5
2.9.0

Open the chart page →

1,328
search-proxysearch-proxy2026.38.01 of 1See more

search-proxy search-proxy 2026.38.0

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
ghcr.io/unique-ag/ai/search-proxy:2026.38.0aa6699b027bb
soupsieve@2.8.4
2.9.0

Open the chart page →

1,323
backendsignalen4.24.01 of 4See more

backend signalen 4.24.0

1 of the 4 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
signalen/backend:2.50.14760256000738
soupsieve@2.8.4
2.9.0

Open the chart page →

11,751
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
soupsieve@2.3.2.post1
2.9.0

Open the chart page →

5,621
stashswuuper-githubVerified publisher0.1.161 of 1See more

stash swuuper-github 0.1.16

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
stashapp/stash:v0.31.1df744af5a0c9
soupsieve@2.8.3
2.9.0

Open the chart page →

2,409
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
soupsieve@2.6
2.9.0

Open the chart page →

5,418
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-85999.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
soupsieve@2.7
2.9.0

Open the chart page →

7,741

Container images carrying it

101 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/devtron/ai-agent:0.0.16545dac92173
soupsieve@2.6
2.9.0
3
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
soupsieve@2.6
2.9.0
2
apache/airflow:2.8.4-python3.964e58748b6b9
soupsieve@2.5
2.9.0
1
apache/airflow:2.10.2-python3.9ce90bdc3d2af
soupsieve@2.6
2.9.0
1
apache/airflow:2.8.1e5560ad0b86e
soupsieve@2.5
2.9.0
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
soupsieve@2.6
2.9.0
1
aristidetm/basic-notebook:3.6.5469dbc951224
soupsieve@2.5
2.9.0
1
assistiot/fl_training_collector:latest792715dd3084
soupsieve@2.2.1
2.9.0
1
benbusby/whoogle-search:0.5.4f77f7e6e4ad2
soupsieve@1.9.5
2.9.0
1
bnjbvr/kresus:0.22.137e216b182c8
soupsieve@2.6
2.9.0
1
datadog/agent:6aad9994de6a7
soupsieve@1.9.6
2.9.0
1
errbotio/errbot:6.1.900ee4e0953ab
soupsieve@2.3.2.post1
2.9.0
1
fossology/fossology:4.2.18bd1f22ba7bb
soupsieve@2.3.2.post1
2.9.0
1
gpappsoft/privacyidea-docker:3.12.2af7841adad26
soupsieve@2.6
2.9.0
1
grafana/oncall:v1.16.5499851658393
soupsieve@2.7
2.9.0
1
hkotel/mealie:api-v1.0.0beta-2a7e6b6abe087
soupsieve@2.3.2.post1
2.9.0
1
homeassistant/home-assistant:2023.10.3021e2afc6e57
soupsieve@2.5
2.9.0
1
homeassistant/home-assistant:2023.12.48d000332b09b
soupsieve@2.5
2.9.0
1
improwised/erpnext-worker:v13.4.197280b55cbd4
soupsieve@2.2.1
2.9.0
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
soupsieve@2.8.3
2.9.0
1
jaedb/iris:latest048cfbf58d57
soupsieve@2.7
2.9.0
1
jonasal/devpi-server:6.17.0-alpineec1eee99a18d
soupsieve@2.8.1
2.9.0
1
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
soupsieve@2.4.1
2.9.0
1
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
soupsieve@2.8.3
2.9.0
1
kyso/kyso-nbdime:latest4aa9d38ee81d
soupsieve@2.3.2.post1
2.9.0
1
langgenius/dify-agent-backend:1.16.1097d3fd27a7b
soupsieve@2.8.3
2.9.0
1
langgenius/dify-api:1.0.0066035f93856
soupsieve@2.6
2.9.0
1
langgenius/dify-api:1.16.1dcefa5f7c47c
soupsieve@2.8.4
2.9.0
1
langgenius/dify-api:0.6.11fca918260dd6
soupsieve@2.5
2.9.0
1
libretranslate/libretranslate:v1.9.61de2d7056bb8
soupsieve@2.8.4
2.9.0
1
linuxserver/bazarr:latesta20fb11a440d
soupsieve@2.8.4
2.9.0
1
linuxserver/beets:1.5.0e36d16f7341c
soupsieve@2.3.1
2.9.0
1
linuxserver/calibre-web:0.6.24241009026e6f
soupsieve@2.7
2.9.0
1
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
soupsieve@1.9.6
2.9.0
1
loeken/home-assistant:2026.5.14ce6abc553b3
soupsieve@2.8.3
2.9.0
1
mindsdb/mindsdb:latest163011c09299
soupsieve@2.8.3
2.9.0
1
mozilla/syncserver:latest016162bf39d8
soupsieve@1.9.5
2.9.0
1
mozilla/syncstorage-rs:0.15.893752877dced
soupsieve@2.5
2.9.0
1
onyxdotapp/onyx-backend:latest473fdffe4e67
soupsieve@2.8.4
2.9.0
1
opea/web-retriever-chroma:1.0fe08165d7770
soupsieve@2.6
2.9.0
1
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
soupsieve@2.7
2.9.0
1
opencsghq/csgbot:v0.6.9-ee7d0271e26521
soupsieve@2.8.3
2.9.0
1
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
soupsieve@2.7
2.9.0
1
opennode/waldur-mastermind:8.1.24c82b15d9042
soupsieve@2.8.4
2.9.0
1
openstackhelm/heat:wallaby-ubuntu_focalf728510bab3c
soupsieve@2.2
2.9.0
1
openvpn/openvpn-as:latest2253c10ec652
soupsieve@2.5
2.9.0
1
owanio1992/devpi:6.16.04ade8e1e4d7e
soupsieve@2.7
2.9.0
1
pangeo/base-notebook:2024.01.155fbe688a4f80
soupsieve@2.5
2.9.0
1
phntom/email-manager:0.1.22d8e2a9f2f085
soupsieve@2.4
2.9.0
1
signalen/backend:2.50.14760256000738
soupsieve@2.8.4
2.9.0
1

syft 1.42.1 · advisories as of 18 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.