StackRadar

CVE-2026-86000

Medium

Advisory

Published 17 Sept 2026In the index since 18 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
91
of 17,803 indexed, latest versions
Container images
101
deployed by those charts
Fix available
1 of 1
affected package

Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns

Carried by container images the latest versions of 91 of 17,803 indexed charts deploy, on 101 images.

Affected packageAffected versionsFixed inImages
soupsievepypi1.9.5, 1.9.6, 2.2, 2.2.1+11 more2.9.0101
OSV records
GHSA-gjv8-xp57-g29c

Charts affected

91 by stars
ChartLatestAffected imagesRadar Score
whooglegeek-cookbookVerified publisher3.4.21 of 1See more

whoogle geek-cookbook 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
benbusby/whoogle-search:0.5.4f77f7e6e4ad2
soupsieve@1.9.5
2.9.0

Open the chart page →

2,072
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
soupsieve@2.6
2.9.0

Open the chart page →

4,835
erpnextimprowisedVerified publisher3.3.01 of 3See more

erpnext improwised 3.3.0

1 of the 3 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
improwised/erpnext-worker:v13.4.197280b55cbd4
soupsieve@2.2.1
2.9.0

Open the chart page →

6,566
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
soupsieve@2.8.3
2.9.0

Open the chart page →

18,066
13ftjeffrescVerified publisher0.2.01 of 1See more

13ft jeffresc 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
ghcr.io/wasi-master/13ft:0.3.4563ce7794a71
soupsieve@2.6
2.9.0

Open the chart page →

898
jx-app-datadogjenkins-x0.0.101 of 2See more

jx-app-datadog jenkins-x 0.0.10

1 of the 2 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
datadog/agent:6aad9994de6a7
soupsieve@1.9.6
2.9.0

Open the chart page →

4,087
bazarrk8s-home-lab-repo11.3.21 of 1See more

bazarr k8s-home-lab-repo 11.3.2

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
soupsieve@2.3.2.post1
2.9.0

Open the chart page →

1,801
beetsk8s-home-lab-repo3.1.11 of 1See more

beets k8s-home-lab-repo 3.1.1

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
ghcr.io/home-operations/beets:2.3.1cc4975f1a0be
soupsieve@2.7
2.9.0

Open the chart page →

2,752
music-assistantkarljorgensen0.1.31 of 1See more

music-assistant karljorgensen 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
soupsieve@2.8.3
2.9.0

Open the chart page →

7,163
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
soupsieve@2.5
2.9.0

Open the chart page →

6,494
mindsdbkronkltdVerified publisher0.1.01 of 1See more

mindsdb kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
mindsdb/mindsdb:latest163011c09299
soupsieve@2.8.3
2.9.0

Open the chart page →

9,856
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
soupsieve@2.6
2.9.0

Open the chart page →

8,559
jupyterhubkubeblocksVerified publisher0.1.01 of 7See more

jupyterhub kubeblocks 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
jupyterhub/k8s-singleuser-sample:3.0.1-0.dev.git.6287.hbfb05cd68e4778efec8e
soupsieve@2.4.1
2.9.0

Open the chart page →

7,404
kyso-nbdimekyso1.0.01 of 1See more

kyso-nbdime kyso 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
kyso/kyso-nbdime:latest4aa9d38ee81d
soupsieve@2.3.2.post1
2.9.0

Open the chart page →

2,832
linkdinglinkding0.2.31 of 1See more

linkding linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
sissbruecker/linkding:1.41.0-plusa222fb777e1f
soupsieve@2.6
2.9.0

Open the chart page →

38,429
bazarrm0nsterrr-bazarrVerified publisher2.3.11 of 1See more

bazarr m0nsterrr-bazarr 2.3.1

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
ghcr.io/home-operations/bazarr:1.6.1e5d192a6f62a
soupsieve@2.8.4
2.9.0

Open the chart page →

125
errbotmidokura-communityVerified publisher0.0.51 of 1See more

errbot midokura-community 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
errbotio/errbot:6.1.900ee4e0953ab
soupsieve@2.3.2.post1
2.9.0

Open the chart page →

2,258
fossologymidokura-communityVerified publisher0.2.21 of 2See more

fossology midokura-community 0.2.2

1 of the 2 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
fossology/fossology:4.2.18bd1f22ba7bb
soupsieve@2.3.2.post1
2.9.0

Open the chart page →

3,306
libretranslateobeoneVerified publisher1.0.71 of 1See more

libretranslate obeone 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
libretranslate/libretranslate:v1.9.61de2d7056bb8
soupsieve@2.8.4
2.9.0

Open the chart page →

2,045
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
onyxdotapp/onyx-backend:latest473fdffe4e67
soupsieve@2.8.4
2.9.0

Open the chart page →

6,697
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.01 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

1 of the 40 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
yetiplatform/yeti:2.9.09bcbe2650a14
soupsieve@2.6
2.9.0

Open the chart page →

184,580
yetiosdfir-infrastructureVerified publisher1.0.51 of 4See more

yeti osdfir-infrastructure 1.0.5

1 of the 4 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
yetiplatform/yeti:latest9c3006cedcca
soupsieve@2.6
2.9.0

Open the chart page →

6,756
devpiowan-charts0.1.01 of 1See more

devpi owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
owanio1992/devpi:6.16.04ade8e1e4d7e
soupsieve@2.7
2.9.0

Open the chart page →

524
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
soupsieve@2.8.1
2.9.0

Open the chart page →

4,852
linkdingpascaliskeVerified publisher3.0.01 of 1See more

linkding pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
ghcr.io/sissbruecker/linkding:1.45.061b2eb9eed8e
soupsieve@2.8.1
2.9.0

Open the chart page →

3,907
email-managerphntom0.1.221 of 2See more

email-manager phntom 0.1.22

1 of the 2 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
phntom/email-manager:0.1.22d8e2a9f2f085
soupsieve@2.4
2.9.0

Open the chart page →

2,577
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
soupsieve@2.6
2.9.0

Open the chart page →

21,370
kresusrm3lVerified publisher0.2.11 of 3See more

kresus rm3l 0.2.1

1 of the 3 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
bnjbvr/kresus:0.22.137e216b182c8
soupsieve@2.6
2.9.0

Open the chart page →

15,770
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
soupsieve@2.6
2.9.0

Open the chart page →

9,743
agentdatarss30.1.01 of 1See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
soupsieve@2.6
2.9.0

Open the chart page →

3,566
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
soupsieve@2.6
2.9.0

Open the chart page →

4,772
tandoorrtomik-helm-chartsVerified publisher0.0.11 of 1See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
vabene1111/recipes:2.3.50f8d061895e9
soupsieve@2.8
2.9.0

Open the chart page →

4,575
linkdingrubxkubeVerified publisher1.2.41 of 1See more

linkding rubxkube 1.2.4

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
sissbruecker/linkding:1.47.0e35cb50e0581
soupsieve@2.8.4
2.9.0

Open the chart page →

2,088
airflowsb-helm-charts0.3.01 of 1See more

airflow sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
apache/airflow:2.8.1e5560ad0b86e
soupsieve@2.5
2.9.0

Open the chart page →

10,269
syncstorageschichtelVerified publisher0.1.11 of 1See more

syncstorage schichtel 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
mozilla/syncstorage-rs:0.15.893752877dced
soupsieve@2.5
2.9.0

Open the chart page →

1,328
search-proxysearch-proxy2026.38.01 of 1See more

search-proxy search-proxy 2026.38.0

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
ghcr.io/unique-ag/ai/search-proxy:2026.38.0aa6699b027bb
soupsieve@2.8.4
2.9.0

Open the chart page →

1,323
backendsignalen4.24.01 of 4See more

backend signalen 4.24.0

1 of the 4 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
signalen/backend:2.50.14760256000738
soupsieve@2.8.4
2.9.0

Open the chart page →

11,751
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
soupsieve@2.3.2.post1
2.9.0

Open the chart page →

5,621
stashswuuper-githubVerified publisher0.1.161 of 1See more

stash swuuper-github 0.1.16

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
stashapp/stash:v0.31.1df744af5a0c9
soupsieve@2.8.3
2.9.0

Open the chart page →

2,409
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
soupsieve@2.6
2.9.0

Open the chart page →

5,418
calibre-webvista0.1.31 of 1See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-86000.

Container imageDigestPackageFixed in
linuxserver/calibre-web:0.6.24241009026e6f
soupsieve@2.7
2.9.0

Open the chart page →

7,741

Container images carrying it

101 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
sissbruecker/linkding:1.35.00c5dddf0b37c
soupsieve@2.6
2.9.0
1
sissbruecker/linkding:1.41.0-plusa222fb777e1f
soupsieve@2.6
2.9.0
1
sissbruecker/linkding:1.47.0e35cb50e0581
soupsieve@2.8.4
2.9.0
1
stackstorm/st2actionrunner:3.888235ba70cad
soupsieve@2.5
2.9.0
1
stackstorm/st2api:3.86f56d239d280
soupsieve@2.5
2.9.0
1
stackstorm/st2auth:3.833ecfda16608
soupsieve@2.5
2.9.0
1
stackstorm/st2garbagecollector:3.84e3f8c7ca52d
soupsieve@2.5
2.9.0
1
stackstorm/st2notifier:3.8f190a6212195
soupsieve@2.5
2.9.0
1
stackstorm/st2rulesengine:3.8259503496ff9
soupsieve@2.5
2.9.0
1
stackstorm/st2scheduler:3.8b1de2055c362
soupsieve@2.5
2.9.0
1
stackstorm/st2sensorcontainer:3.8b1a338f64773
soupsieve@2.5
2.9.0
1
stackstorm/st2stream:3.81c8904a3bf67
soupsieve@2.5
2.9.0
1
stackstorm/st2timersengine:3.81bf35bfaf00c
soupsieve@2.5
2.9.0
1
stackstorm/st2workflowengine:3.819fdfffdbba8
soupsieve@2.5
2.9.0
1
stashapp/stash:v0.31.1df744af5a0c9
soupsieve@2.8.3
2.9.0
1
tachyongroup/mlflow-deployment-controller:mlflow-controller-0.1.87e79b9000856
soupsieve@2.4
2.9.0
1
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
soupsieve@2.4
2.9.0
1
tombursch/kitchenowl-backend:v0.7.8b48e4ab727cd
soupsieve@2.8.3
2.9.0
1
vabene1111/recipes:2.3.50f8d061895e9
soupsieve@2.8
2.9.0
1
vabene1111/recipes:1.0.5.2ec4e9e2905b0
soupsieve@2.3.1
2.9.0
1
wger/server:2.6997ead43aabd
soupsieve@2.8.4
2.9.0
1
yetiplatform/yeti:2.9.09bcbe2650a14
soupsieve@2.6
2.9.0
1
yetiplatform/yeti:latest9c3006cedcca
soupsieve@2.6
2.9.0
1
ghcr.io/dask/dask-notebook:2024.1.0f53bde3acd4f
soupsieve@2.5
2.9.0
1
ghcr.io/dgtlmoon/changedetection.io:0.39.4f1ce4c56ccaa
soupsieve@2.3.1
2.9.0
1
ghcr.io/getsentry/sentry:26.7.27c5052aa4e3c
soupsieve@2.8.4
2.9.0
1
ghcr.io/hemslo/chat-search:latest39d48995a5bd
soupsieve@2.5
2.9.0
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
soupsieve@2.6
2.9.0
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
soupsieve@2.8.1
2.9.0
1
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
soupsieve@2.3.2.post1
2.9.0
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
soupsieve@2.5
2.9.0
1
ghcr.io/home-operations/bazarr:1.5.680cb090162b4
soupsieve@2.3.2.post1
2.9.0
1
ghcr.io/home-operations/bazarr:1.6.1e5d192a6f62a
soupsieve@2.8.4
2.9.0
1
ghcr.io/home-operations/beets:2.3.1cc4975f1a0be
soupsieve@2.7
2.9.0
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
soupsieve@2.8.3
2.9.0
1
ghcr.io/linuxserver/mylar3:version-v0.5.3b96f0e97ab3f
soupsieve@2.2.1
2.9.0
1
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
soupsieve@2.3.2.post1
2.9.0
1
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
soupsieve@2.3.2.post1
2.9.0
1
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
soupsieve@2.8
2.9.0
1
ghcr.io/mirio/verbacap:v1.5.084928e2fc4f2
soupsieve@2.5
2.9.0
1
ghcr.io/music-assistant/server:2.7.53522e8a7a8f0
soupsieve@2.8.1
2.9.0
1
ghcr.io/music-assistant/server:2.9.950666a6f8d7f
soupsieve@2.8.4
2.9.0
1
ghcr.io/music-assistant/server:2.8.7eef3ee7810d0
soupsieve@2.8.3
2.9.0
1
ghcr.io/porelli/firefox-sync:syncstorage-rs-mysql-0.18.27d244e514216
soupsieve@2.7
2.9.0
1
ghcr.io/sissbruecker/linkding:1.45.061b2eb9eed8e
soupsieve@2.8.1
2.9.0
1
ghcr.io/tandoorrecipes/recipes:1.5.31063eb446e298
soupsieve@2.6
2.9.0
1
ghcr.io/unique-ag/ai/search-proxy:2026.38.0aa6699b027bb
soupsieve@2.8.4
2.9.0
1
ghcr.io/wasi-master/13ft:0.3.4563ce7794a71
soupsieve@2.6
2.9.0
1
ghcr.io/wgbh-mla/ov-wag:v1.1.06df27f944fe8
soupsieve@2.7
2.9.0
1
public.ecr.aws/datadog/agent:7.73.0f4925b15ce94
soupsieve@2.8
2.9.0
1

syft 1.42.1 · advisories as of 18 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.