StackRadar

CVE-2026-2006

High

Advisory

Published 12 Feb 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.8
base score, highest
EPSS
0.011
64th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
232
of 17,781 indexed, latest versions
Container images
207
deployed by those charts
Fix available
9 of 13
affected packages

PostgreSQL missing validation of multibyte character length executes arbitrary code

Carried by container images the latest versions of 232 of 17,781 indexed charts deploy, on 207 images.

Affected packageAffected versionsFixed inImages
postgresql-15deb15.3-0+deb12u1, 15.3-1.pgdg120+1, 15.4-2.pgdg120+1, 15.5-0+deb12u1+10 more15.16-0+deb12u1102
postgresqlbitnami11.8.0-10, 11.12.0-7, 14.4.0-0, 14.4.0-11+25 more14.21.030
postgresql-12deb12.7-0ubuntu0.20.04.1, 12.8-0ubuntu0.20.04.1, 12.9-0ubuntu0.20.04.1, 12.11-0ubuntu0.20.04.1+2 moreno fix listed17
postgresql-17deb17.5-1, 17.5-1.pgdg130+1, 17.6-0+deb13u1, 17.6-1build1+2 more17.8-0+deb13u1, 17.9-0ubuntu0.25.10.115
postgresql-14deb14.3-1.pgdg22.04+1, 14.4-0ubuntu0.22.04.1, 14.5-0ubuntu0.22.04.1, 14.6-1.pgdg22.04+1+5 more14.22-0ubuntu0.22.04.113
PostgreSQLbitnami15.3.0, 15.4.0, 15.5.0-42, 16.0.0+6 more14.21.011
postgresql17apk17.2-r0, 17.4-r0, 17.5-r0, 17.6-r0+1 more17.8-r08
postgresql-10deb10.6-0ubuntu0.18.04.1, 10.10-0ubuntu0.18.04.1, 10.12-0ubuntu0.18.04.1, 10.14-0ubuntu0.18.04.1+1 moreno fix listed6
postgresql-16deb16.2-1ubuntu4, 16.6-0ubuntu0.24.04.1, 16.9-0ubuntu0.24.04.1, 16.10-0ubuntu0.24.04.116.13-0ubuntu0.24.04.15
postgresql16apk16.3-r0, 16.9-r016.12-r05
postgresql-9.5deb9.5.10-0ubuntu0.16.04, 9.5.14-0ubuntu0.16.04no fix listed3
postgresql18apk18.1-r018.2-r01
postgresql-9.3deb9.3.22-0ubuntu0.14.04no fix listed1
OSV records
ALPINE-CVE-2026-2006BIT-postgresql-2026-2006DEBIAN-CVE-2026-2006UBUNTU-CVE-2026-2006
Also known as
USN-8072-1

Charts affected

232 by stars
ChartLatestAffected imagesRadar Score
linkdingdeimosfr-charts1.0.31 of 1See more

linkding deimosfr-charts 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
sissbruecker/linkding:1.35.00c5dddf0b37c
postgresql-15@15.8-0+deb12u1
15.16-0+deb12u1

Open the chart page →

6,075
apachedevops0.1.01 of 4See more

apache devops 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
ghcr.io/codingducksrl/laravel:8.15be52524664c
postgresql-14@14.5-0ubuntu0.22.04.1
14.22-0ubuntu0.22.04.1

Open the chart page →

30,031
laraveldevops0.10.31 of 4See more

laravel devops 0.10.3

1 of the 4 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
ghcr.io/codingducksrl/laravel:8.15be52524664c
postgresql-14@14.5-0ubuntu0.22.04.1
14.22-0ubuntu0.22.04.1

Open the chart page →

29,033
devtron-enterprisedevtron48.0.01 of 28See more

devtron-enterprise devtron 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
postgresql-15@15.14-0+deb12u1
15.16-0+deb12u1

Open the chart page →

68,240
devtron-enterprisedevtron-labs48.0.01 of 28See more

devtron-enterprise devtron-labs 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
postgresql-15@15.14-0+deb12u1
15.16-0+deb12u1

Open the chart page →

68,240
dial-admindialVerified publisher0.18.01 of 3See more

dial-admin dial 0.18.0

1 of the 3 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:17.5.0-debian-12-r1285198aae0aed
postgresql@17.5.0-9
14.21.0

Open the chart page →

4,046
wizarrdjjudas21Verified publisher0.1.51 of 1See more

wizarr djjudas21 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
ghcr.io/wizarrrr/wizarr:4.2.0-beta.3d19d886d5090
postgresql-15@15.5-0+deb12u1
15.16-0+deb12u1

Open the chart page →

14,627
codecovdoubanVerified publisher0.2.41 of 8See more

codecov douban 0.2.4

1 of the 8 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg14.6-ts2.9.1-p1cdb9ae118899
postgresql-14@14.6-1.pgdg22.04+1
14.22-0ubuntu0.22.04.1

Open the chart page →

24,917
drogue-cloud-examplesdrogue-iotVerified publisher0.7.111 of 6See more

drogue-cloud-examples drogue-iot 0.7.11

1 of the 6 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg14-ts2.6-latested719c0cd19d
postgresql-14@14.3-1.pgdg22.04+1
14.22-0ubuntu0.22.04.1

Open the chart page →

30,699
iotaeclipse-aeriosVerified publisher1.0.21 of 4See more

iota eclipse-aerios 1.0.2

1 of the 4 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
eclipseaerios/iota-messages-api:lateste7f5ba0bc64d
postgresql-17@17.6-0+deb13u1
17.8-0+deb13u1

Open the chart page →

13,391
heimdallegebackVerified publisher2.0.41 of 1See more

heimdall egeback 2.0.4

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
linuxserver/heimdall:2.6.371597f4461e4
postgresql16@16.9-r0
16.12-r0

Open the chart page →

1,664
rommernail-romm1.0.11 of 1See more

romm ernail-romm 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
rommapp/romm:4.4.1b909e95d1aab
postgresql17@17.7-r0
17.8-r0

Open the chart page →

2,896
doraethereum-helm-chartsVerified publisher1.0.121 of 2See more

dora ethereum-helm-charts 1.0.12

1 of the 2 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:15.3.0-debian-11-r7cc301eef7436
postgresql@15.3.0-3
PostgreSQL@15.3.0
14.21.0
14.21.0

Open the chart page →

2,991
ferriscompanyferriscompany0.1.01 of 1See more

ferriscompany ferriscompany 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
ghcr.io/libreconnect/ferriscompany:0.1.0-rc6ed86db9f0efe
postgresql-15@15.8-0+deb12u1
15.16-0+deb12u1

Open the chart page →

10,741
business-api-ecosystemfiware1.1.01 of 4See more

business-api-ecosystem fiware 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
fiware/biz-ecosystem-logic-proxy:11.20.3d551a13e8278
postgresql-15@15.13-0+deb12u1
15.16-0+deb12u1

Open the chart page →

64,489
mission-controlflanksourceVerified publisher0.1.3361 of 8See more

mission-control flanksource 0.1.336

1 of the 8 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
ghcr.io/flanksource/postgres:17.6-497383cebcf66281fc1
postgresql-15@15.14-1.pgdg12+1
15.16-0+deb12u1

Open the chart page →

8,902
borgmaticgabe565Verified publisher0.10.11 of 1See more

borgmatic gabe565 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
ghcr.io/borgmatic-collective/borgmatic:1.9.9835b72878606
postgresql17@17.2-r0
17.8-r0

Open the chart page →

2,438
openkmgeek-cookbookVerified publisher4.2.01 of 1See more

openkm geek-cookbook 4.2.0

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
openkm/openkm-ce:6.3.113bc465a7461b
postgresql-12@12.12-0ubuntu0.20.04.1
no fix listed

Open the chart page →

27,949
octoboxhalkeye0.1.11 of 1See more

octobox halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
octoboxio/octobox:latestd909041c46eb
postgresql18@18.1-r0
18.2-r0

Open the chart page →

3,255
hatchet-hahatchetOfficialVerified publisher0.18.01 of 8See more

hatchet-ha hatchet 0.18.0

1 of the 8 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:17.6.0-debian-12-r4926356130b77
postgresql@17.6.0-2
14.21.0

Open the chart page →

7,344
hatchet-stackhatchetOfficialVerified publisher0.18.01 of 8See more

hatchet-stack hatchet 0.18.0

1 of the 8 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:17.6.0-debian-12-r4926356130b77
postgresql@17.6.0-2
14.21.0

Open the chart page →

7,344
heliconehelicone0.1.421 of 14See more

helicone helicone 0.1.42

1 of the 14 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
helicone/supabase-migration-runner:v2025.03.05-14a913936c97b
postgresql-15@15.3-0+deb12u1
15.16-0+deb12u1

Open the chart page →

24,995
middlewarehelmforgeVerified publisher1.2.61 of 4See more

middleware helmforge 1.2.6

1 of the 4 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
middlewareeng/middleware:0.3.1747d880812f1
postgresql-15@15.13-0+deb12u1
15.16-0+deb12u1

Open the chart page →

9,653
myapphelmingapp0.1.01 of 1See more

myapp helmingapp 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
muhammedgamal/fp23:latest74b4cd69b6fa
postgresql-15@15.6-0+deb12u1
15.16-0+deb12u1

Open the chart page →

12,607
openaevhelm-openbasVerified publisher2.0.51 of 7See more

openaev helm-openbas 2.0.5

1 of the 7 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:17.6.0-debian-12-r4926356130b77
postgresql@17.6.0-2
14.21.0

Open the chart page →

7,437
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:17.6.0-debian-12-r4926356130b77
postgresql@17.6.0-2
14.21.0

Open the chart page →

25,017
nominatimheywood8-helm-chartsVerified publisher3.10.81 of 3See more

nominatim heywood8-helm-charts 3.10.8

1 of the 3 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
mediagis/nominatim:4.2d0eae7b51374
postgresql-14@14.10-0ubuntu0.22.04.1
14.22-0ubuntu0.22.04.1

Open the chart page →

14,290
paperlesshomelabcihelmchartstestVerified publisher9.1.91 of 1See more

paperless homelabcihelmchartstest 9.1.9

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.0.1ab255bea133e
postgresql-15@15.5-0+deb12u1
15.16-0+deb12u1

Open the chart page →

16,384
bluesky-pdsijmacd1.0.01 of 2See more

bluesky-pds ijmacd 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
arunvelsriram/utils:latest655ad18fd8d6
postgresql-16@16.9-0ubuntu0.24.04.1
16.13-0ubuntu0.24.04.1

Open the chart page →

8,967
ilum-hive-metastoreilumVerified publisher1.2.01 of 2See more

ilum-hive-metastore ilum 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:16233f361c5819
postgresql@16.6.0-1
14.21.0

Open the chart page →

3,571
ilum-marquezilumVerified publisher6.7.01 of 3See more

ilum-marquez ilum 6.7.0

1 of the 3 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:16233f361c5819
postgresql@16.6.0-1
14.21.0

Open the chart page →

6,254
ilum-unity-catalogilumVerified publisher0.1.01 of 4See more

ilum-unity-catalog ilum 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
unitycatalog/unitycatalog-ui:main-aadc6fc3a688197b218
postgresql-15@15.13-0+deb12u1
15.16-0+deb12u1

Open the chart page →

11,812
plausible-analyticsimioVerified publisher0.4.21 of 5See more

plausible-analytics imio 0.4.2

1 of the 5 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:17.6.0-debian-12-r0de520acd66fc
postgresql@17.6.0-0
14.21.0

Open the chart page →

10,418
pgcatimprowisedVerified publisher0.1.01 of 1See more

pgcat improwised 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
ghcr.io/postgresml/pgcat:main245f9d2f5f5b
postgresql-15@15.5-0+deb12u1
15.16-0+deb12u1

Open the chart page →

3,775
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
postgresql-15@15.5-0+deb12u1
15.16-0+deb12u1

Open the chart page →

17,852
daveit-at-mOfficialVerified publisher0.2.152 of 11See more

dave it-at-m 0.2.15

2 of the 11 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:latest42a8200d3597
postgresql@17.5.0-14
14.21.0
bitnamilegacy/postgresql:17.6.0-debian-12-r0de520acd66fc
postgresql@17.6.0-0
14.21.0

Open the chart page →

15,089
opencloudjacobcolvinVerified publisher0.2.31 of 13See more

opencloud jacobcolvin 0.2.3

1 of the 13 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
apache/tika:2.9.2.1-fullae0b86d3c4d0
postgresql-16@16.2-1ubuntu4
16.13-0ubuntu0.24.04.1

Open the chart page →

45,239
ja-shortenerja-shortenerVerified publisher0.1.01 of 2See more

ja-shortener ja-shortener 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
cr0hn/ja-shortener:v0.1.414482d0bc4a1
postgresql17@17.5-r0
17.8-r0

Open the chart page →

2,089
image-storage-servicejtektVerified publisher0.4.31 of 4See more

image-storage-service jtekt 0.4.3

1 of the 4 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
postgresql-15@15.8-0+deb12u1
15.16-0+deb12u1

Open the chart page →

22,589
shinsei-managerjtektVerified publisher0.2.03 of 8See more

shinsei-manager jtekt 0.2.0

3 of the 8 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
moreillon/api-proxy:latestd7d4a5463525
postgresql-15@15.13-0+deb12u1
15.16-0+deb12u1
moreillon/user-manager:v5.0.2e1c9bfab5c16
postgresql-15@15.5-0+deb12u1
15.16-0+deb12u1
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
postgresql-15@15.6-0+deb12u1
15.16-0+deb12u1

Open the chart page →

63,461
time-series-storagejtektVerified publisher0.1.101 of 2See more

time-series-storage jtekt 0.1.10

1 of the 2 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
public.ecr.aws/jtekt-corporation/time-series-storage-service:v1.5.1046ef5c9ed50
postgresql-15@15.3-0+deb12u1
15.16-0+deb12u1

Open the chart page →

16,600
librephotosk8sonlabVerified publisher1.1.61 of 7See more

librephotos k8sonlab 1.1.6

1 of the 7 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:latest42a8200d3597
postgresql@17.5.0-14
14.21.0

Open the chart page →

14,801
kestra-starterkestraOfficialVerified publisher2.0.11 of 5See more

kestra-starter kestra 2.0.1

1 of the 5 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
library/postgres:17.5aadf2c0696f5
postgresql-17@17.5-1.pgdg130+1
17.8-0+deb13u1

Open the chart page →

5,455
cdashkitwareVerified publisher0.19.01 of 3See more

cdash kitware 0.19.0

1 of the 3 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:17.2.0-debian-12-r5cf63048c9209
postgresql@17.2.0-4
14.21.0

Open the chart page →

12,062
visual-regression-trackerkokuwa5.1.01 of 4See more

visual-regression-tracker kokuwa 5.1.0

1 of the 4 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:16.3.0-debian-12-r15fdc6979dbc53
postgresql@16.3.0-12
14.21.0

Open the chart page →

9,098
kubeflowkromanow94-kubeflow0.5.12 of 30See more

kubeflow kromanow94-kubeflow 0.5.1

2 of the 30 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
library/python:3.7eedf63967cdb
postgresql-15@15.3-0+deb12u1
15.16-0+deb12u1
gcr.io/ml-pipeline/metadata-writer:2.3.09bcfd2abc361
postgresql-15@15.8-0+deb12u1
15.16-0+deb12u1

Open the chart page →

70,530
network-enforcerkubewardenVerified publisher0.1.21 of 3See more

network-enforcer kubewarden 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
fluent/fluent-bit:4.0.4ca08b7d2df5b
postgresql-15@15.13-0+deb12u1
15.16-0+deb12u1

Open the chart page →

2,545
linkdinglinkding0.2.31 of 1See more

linkding linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
sissbruecker/linkding:1.41.0-plusa222fb777e1f
postgresql-15@15.13-0+deb12u1
15.16-0+deb12u1

Open the chart page →

37,942
nublado2lsst-sqre0.8.51 of 2See more

nublado2 lsst-sqre 0.8.5

1 of the 2 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
lsstsqre/nublado2:2.0.1b75bf8aaafa4
postgresql-12@12.9-0ubuntu0.20.04.1
no fix listed

Open the chart page →

17,779
meerschaummeerschaumVerified publisher0.2.01 of 1See more

meerschaum meerschaum 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bmeares/meerschaum:2.8.48e9c5bacaa82
postgresql-15@15.10-0+deb12u1
15.16-0+deb12u1

Open the chart page →

5,823

Container images carrying it

207 by charts deploying them

A fixed version is listed for 9 of the 13 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/zoriya/kyoo_scanner:4.7.17dc0ee57b628
postgresql-15@15.10-0+deb12u1
15.16-0+deb12u1
1
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
postgresql-15@15.8-0+deb12u1
15.16-0+deb12u1
1
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
postgresql-15@15.6-0+deb12u1
15.16-0+deb12u1
1
public.ecr.aws/jtekt-corporation/time-series-storage-service:v1.5.1046ef5c9ed50
postgresql-15@15.3-0+deb12u1
15.16-0+deb12u1
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
postgresql-15@15.8-0+deb12u1
15.16-0+deb12u1
1
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
postgresql-15@15.5-0+deb12u1
15.16-0+deb12u1
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
postgresql-15@15.3-0+deb12u1
15.16-0+deb12u1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.