CVE-2026-18374

Medium

Advisory

Published 27 Aug 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 4.9; base score, highest
EPSS: 0.002; 5th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,754; of 17,813 indexed, latest versions
Container images: 2,809; deployed by those charts
Fix available: 2 of 5; affected packages

CVE-2026-18374 affecting package glibc 2.38-21

Carried by container images the latest versions of 2,754 of 17,813 indexed charts deploy, on 2,809 images.

Affected package	Affected versions	Fixed in	Images
glibcdeb	2.23-0ubuntu5, 2.23-0ubuntu7, 2.23-0ubuntu9, 2.23-0ubuntu10+66 more	2.41-12+deb13u3+e7	2,717
eglibcdeb	2.19-0ubuntu6.3, 2.19-0ubuntu6.6, 2.19-0ubuntu6.13, 2.19-0ubuntu6.14+1 more	no fix listed	7
glibc-2.44apk	2.44-r1, 2.44-r4, 2.44-r5	2.44-r6	63
glibcrpm	2.38-16.azl3, 2.38-18.azl3, 2.38-20.azl3	no fix listed	19
glibc-2.43apk	2.43-r14	no fix listed	3

OSV records: DEBIAN-CVE-2026-18374 UBUNTU-CVE-2026-18374 AZL-98042 CGA-27g8-4xhq-hhr3 CGA-2w63-hvq4-f4pc ECHO-9169-1fd9-0c1c
Also known as: CGA-2r7g-4qmv-r3hh, CGA-3qmp-39qm-cjf8, CGA-3xw7-x4r7-x678, CGA-5g65-xm2q-rjhf, CGA-5wh2-vg99-j76x, CGA-63j2-v7q6-8x84, CGA-6rf5-rrq5-7pff, CGA-772j-3386-6g56, CGA-79v3-g2j9-ffq2, CGA-8hxc-pvg5-xr9j, CGA-c62g-2q4h-pjjg, CGA-f52m-j726-w2p6, CGA-h33h-m88h-4gc6, CGA-m923-g68q-v4rq, CGA-m9qj-fr43-382g, CGA-mm85-9c9x-q266, CGA-rh5w-p243-vcf7, CGA-v3jf-jvqj-vgxj, CGA-x2q5-w2xg-rgqc, CGA-x3rq-r7j3-jgpx

Charts affected

2,754 by stars

Chart

Latest

Affected images

Radar Score

endlessh-gozekker6

0.4.0

1 of 1 See more

endlessh-go zekker6 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-18374.

Container image	Digest	Package	Fixed in
ghcr.io/shizunge/endlessh-go :2026.0730.0	8826dad32623	glibc@2.41-12+deb13u3	no fix listed

Open the chart page →

493

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-18374.

Container image	Digest	Package	Fixed in
library/nginx :latest	05b8cb60c354	glibc@2.41-12+deb13u3	no fix listed

Open the chart page →

1,956

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-18374.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	glibc@2.27-3ubuntu1.4	no fix listed
yandex/clickhouse-server :21.3.20	4eccfffb01d7	glibc@2.31-0ubuntu9.2	no fix listed

Open the chart page →

9,296

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-18374.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	glibc@2.35-0ubuntu3.14	no fix listed

Open the chart page →

7,966

Container images carrying it

2,809 by charts deploying them

A fixed version is listed for 2 of the 5 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/dfir-iris/iriswebapp_app :v2.4.26	e59ebde55709	glibc@2.41-12	no fix listed	1
ghcr.io/dgtlmoon/changedetection.io :0.60.3 :latest	ecacd9fd0c66	glibc@2.36-9+deb12u14	no fix listed	1
ghcr.io/dgtlmoon/changedetection.io :0.60.5	f69554198005	glibc@2.36-9+deb12u14	no fix listed	1
ghcr.io/ding113/claude-code-hub :latest	87f9e8a92bd7	glibc@2.41-12+deb13u3	no fix listed	1
ghcr.io/djcass44/cso-proxy :cccf49fd	b360d44125ad	glibc@2.27-3ubuntu1.4	no fix listed	1
ghcr.io/djerfy/zabbix-kubernetes-discovery :v1.4.20	7a50c07e7c69	glibc@2.39-0ubuntu8.3	no fix listed	1
ghcr.io/donkie/spoolman :0.24.0	42135965c42d	glibc@2.36-9+deb12u14	no fix listed	1
ghcr.io/dragoangel/mcrouter :v2026.06.29.00	42afcffe67d0	glibc@2.39-0ubuntu8.7	no fix listed	1
ghcr.io/drakkan/sftpgo :v2.7.5	9011fe608d33	glibc@2.41-12+deb13u3	no fix listed	1
ghcr.io/drewburr-labs/evobot :3.0.0	4ddbb244c82f	glibc@2.36-9+deb12u3	no fix listed	1
ghcr.io/drewburr-labs/mum-discord-bot :3.1.2	6e82914e1051	glibc@2.36-9+deb12u3	no fix listed	1
ghcr.io/dynamic-config-rs/dynamic-config-webhook :v0.3.0	f00f02c53f66	glibc@2.36-9+deb12u14	no fix listed	1
ghcr.io/dysnix/docker-bitcoind :0.29.0	490ca8e3dd21	glibc@2.39-0ubuntu8.4	no fix listed	1
ghcr.io/edgelesssys/coordinator :v0.5.0	bcd5b8d4c45c	glibc@2.27-3ubuntu1.4	no fix listed	1
ghcr.io/edgelesssys/edgelessdb-sgx-1gb :v0.3.2	7e1d7a11a11a	glibc@2.31-0ubuntu9.9	no fix listed	1
ghcr.io/edgelesssys/marblerun/coordinator :v1.9.2	e589db0d0a2c	glibc@2.35-0ubuntu3.14	no fix listed	1
ghcr.io/eenchev/prometheus-universal-exporter :latest	99122b443cf9	glibc@2.41-12+deb13u4	no fix listed	1
ghcr.io/egos-tech/smtp :1.2.2	b5451793ad91	glibc@2.41-12+deb13u2	no fix listed	1
ghcr.io/elastiflow/mermin :v0.4.1	205053c8a3e2	glibc@2.41-12+deb13u3	no fix listed	1
ghcr.io/element-hq/matrix-authentication-service :1.24.0	52c18ffcc940	glibc@2.41-12+deb13u3	no fix listed	1
ghcr.io/element-hq/matrix-authentication-service :0.14.0	834ea54370f0	glibc@2.36-9+deb12u9	no fix listed	1
ghcr.io/element-hq/synapse :v1.111.0	22ae556e0de4	glibc@2.36-9+deb12u7	no fix listed	1
ghcr.io/emissary-ingress/emissary :4.1.0	4a981156abee	glibc@2.36-9+deb12u14	no fix listed	1
ghcr.io/enderdash-com/enderdash-agent :latest	8525a1a67958	glibc@2.39-0ubuntu8.8	no fix listed	1
ghcr.io/ente/web :5ab0c5b4c7a89c4e470ef6f793600da33cebf35d	3f4864eb7f11	glibc@2.41-12+deb13u3	no fix listed	1
ghcr.io/erlkoenig91/prompt-db-backend :1.0.7	ab120359810d	glibc@2.41-12+deb13u3	no fix listed	1
ghcr.io/eslupmi/impulse :v3.7.0	3ded1b7ebca0	glibc@2.41-12+deb13u3	no fix listed	1
ghcr.io/esphome/esphome :latest	000c5ee5ee96	glibc@2.41-12+deb13u3	no fix listed	1
ghcr.io/esphome/esphome :2026.4.0	78a82d810709	glibc@2.36-9+deb12u13	no fix listed	1
ghcr.io/ferama/rospo :v0.12.0	ab40c1745534	glibc@2.36-9+deb12u3	no fix listed	1
ghcr.io/ferama/vipien :v0.5.3	923a3f704b21	glibc@2.31-0ubuntu9.7	no fix listed	1
ghcr.io/feresberbeche/alertigate :2.0.0	7b9bba80f207	glibc@2.41-12+deb13u3	no fix listed	1
ghcr.io/ferriskey/ferriskey-api :0.8.0	7b479fc31340	glibc@2.36-9+deb12u14	no fix listed	1
ghcr.io/firecrawl/firecrawl :2.11.359	87ebe1dc85b0	glibc@2.36-9+deb12u14	no fix listed	1
ghcr.io/firecrawl/nuq-postgres :latest	f9388bd25ae2	glibc@2.41-12+deb13u2	no fix listed	1
ghcr.io/firecrawl/playwright-service :latest	1f6eba640320	glibc@2.36-9+deb12u10	no fix listed	1
ghcr.io/firestoned/bindy :v0.6.3	4c939255f5d6	glibc-2.44@2.44-r5	2.44-r6	1
ghcr.io/flanksource/facet :0.1.72	37237038be15	glibc@2.36-9+deb12u14	no fix listed	1
ghcr.io/flanksource/mission-control-ai-assistant :1.0.12	29a635cbeeb5	glibc@2.36-9+deb12u13	no fix listed	1
ghcr.io/flanksource/postgres :17.6-497383c	ebcf66281fc1	glibc@2.36-9+deb12u13	no fix listed	1
ghcr.io/flaresolverr/flaresolverr :v3.4.0	ab535d1fef5d	glibc@2.36-9+deb12u10	no fix listed	1
ghcr.io/fluent/fluentd-aggregator-docker-image :2.1.0	ad25916eebbb	glibc@2.41-12+deb13u3	no fix listed	1
ghcr.io/formancehq/console :console-on.v1.1.1	a4d32c2f68b3	glibc@2.36-9+deb12u10	no fix listed	1
ghcr.io/formancehq/ledger :v1.9.2	03c1ddbda33b	glibc@2.35-0ubuntu3.1	no fix listed	1
ghcr.io/formancehq/membership :v1.11.0	24a0113d5fb0	glibc@2.35-0ubuntu3.10	no fix listed	1
ghcr.io/gamosoft/notediscovery :0.31.5	c06aa0fa9a85	glibc@2.41-12+deb13u3	no fix listed	1
ghcr.io/gearbox-protocol/safe-watcher :1.2.1	4e92a4508bee	glibc@2.36-9+deb12u9	no fix listed	1
ghcr.io/getsentry/relay :26.7.2	cd29b88c1d72	glibc@2.41-12+deb13u3	no fix listed	1
ghcr.io/getsentry/sentry :26.7.2	7c5052aa4e3c	glibc@2.36-9+deb12u14	no fix listed	1
ghcr.io/getsentry/snuba :26.7.2	10f8d164109b	glibc@2.41-12+deb13u3	no fix listed	1