StackRadar

CVE-2026-2006

High

Advisory

Published 12 Feb 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.8
base score, highest
EPSS
0.011
64th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
232
of 17,781 indexed, latest versions
Container images
207
deployed by those charts
Fix available
9 of 13
affected packages

PostgreSQL missing validation of multibyte character length executes arbitrary code

Carried by container images the latest versions of 232 of 17,781 indexed charts deploy, on 207 images.

Affected packageAffected versionsFixed inImages
postgresql-15deb15.3-0+deb12u1, 15.3-1.pgdg120+1, 15.4-2.pgdg120+1, 15.5-0+deb12u1+10 more15.16-0+deb12u1102
postgresqlbitnami11.8.0-10, 11.12.0-7, 14.4.0-0, 14.4.0-11+25 more14.21.030
postgresql-12deb12.7-0ubuntu0.20.04.1, 12.8-0ubuntu0.20.04.1, 12.9-0ubuntu0.20.04.1, 12.11-0ubuntu0.20.04.1+2 moreno fix listed17
postgresql-17deb17.5-1, 17.5-1.pgdg130+1, 17.6-0+deb13u1, 17.6-1build1+2 more17.8-0+deb13u1, 17.9-0ubuntu0.25.10.115
postgresql-14deb14.3-1.pgdg22.04+1, 14.4-0ubuntu0.22.04.1, 14.5-0ubuntu0.22.04.1, 14.6-1.pgdg22.04+1+5 more14.22-0ubuntu0.22.04.113
PostgreSQLbitnami15.3.0, 15.4.0, 15.5.0-42, 16.0.0+6 more14.21.011
postgresql17apk17.2-r0, 17.4-r0, 17.5-r0, 17.6-r0+1 more17.8-r08
postgresql-10deb10.6-0ubuntu0.18.04.1, 10.10-0ubuntu0.18.04.1, 10.12-0ubuntu0.18.04.1, 10.14-0ubuntu0.18.04.1+1 moreno fix listed6
postgresql-16deb16.2-1ubuntu4, 16.6-0ubuntu0.24.04.1, 16.9-0ubuntu0.24.04.1, 16.10-0ubuntu0.24.04.116.13-0ubuntu0.24.04.15
postgresql16apk16.3-r0, 16.9-r016.12-r05
postgresql-9.5deb9.5.10-0ubuntu0.16.04, 9.5.14-0ubuntu0.16.04no fix listed3
postgresql18apk18.1-r018.2-r01
postgresql-9.3deb9.3.22-0ubuntu0.14.04no fix listed1
OSV records
ALPINE-CVE-2026-2006BIT-postgresql-2026-2006DEBIAN-CVE-2026-2006UBUNTU-CVE-2026-2006
Also known as
USN-8072-1

Charts affected

232 by stars
ChartLatestAffected imagesRadar Score
memgptmemgptVerified publisher0.3.191 of 2See more

memgpt memgpt 0.3.19

1 of the 2 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
ankane/pgvector:v0.5.1d3a9d8ac27bb
postgresql-15@15.4-2.pgdg120+1
15.16-0+deb12u1

Open the chart page →

5,866
mini-blogmini-blog-helm0.1.01 of 3See more

mini-blog mini-blog-helm 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
beyzkaya/blog-backend:v1.0.112a6a3d1c5f9
postgresql-15@15.13-0+deb12u1
15.16-0+deb12u1

Open the chart page →

13,010
MINTmint8.0.21 of 15See more

MINT mint 8.0.2

1 of the 15 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
mintproject/model-catalog-fastapi:7dd88dc5bf1fe6a6d4703ea0a077afee45cb256102260d20a21f
postgresql-15@15.12-0+deb12u2
15.16-0+deb12u1

Open the chart page →

43,341
user-manager-mongodbmoreillonVerified publisher0.6.21 of 4See more

user-manager-mongodb moreillon 0.6.2

1 of the 4 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
moreillon/user-manager-mongoose:v5.0.1d2ee0423b797
postgresql-15@15.5-0+deb12u1
15.16-0+deb12u1

Open the chart page →

25,704
user-manager-neo4jmoreillonVerified publisher0.9.71 of 6See more

user-manager-neo4j moreillon 0.9.7

1 of the 6 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
moreillon/user-manager:v5.0.2e1c9bfab5c16
postgresql-15@15.5-0+deb12u1
15.16-0+deb12u1

Open the chart page →

30,363
mum-discord-botmum-discord-botVerified publisher0.3.71 of 1See more

mum-discord-bot mum-discord-bot 0.3.7

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
ghcr.io/drewburr-labs/mum-discord-bot:3.1.26e82914e1051
postgresql-15@15.5-0+deb12u1
15.16-0+deb12u1

Open the chart page →

13,686
danboorumy0nVerified publisher0.0.21 of 1See more

danbooru my0n 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
postgresql-14@14.5-0ubuntu0.22.04.1
14.22-0ubuntu0.22.04.1

Open the chart page →

12,791
danbooru-stackmy0nVerified publisher0.0.31 of 4See more

danbooru-stack my0n 0.0.3

1 of the 4 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
ghcr.io/danbooru/danbooru:9cab67c0ac72a8c52289302c519715ceec2372d95f545698e907
postgresql-14@14.5-0ubuntu0.22.04.1
14.22-0ubuntu0.22.04.1

Open the chart page →

12,791
akauntingnas-helm-chartsVerified publisher1.0.31 of 2See more

akaunting nas-helm-charts 1.0.3

1 of the 2 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
akaunting/akaunting:3.0.1552811b36ec3a
postgresql-15@15.3-0+deb12u1
15.16-0+deb12u1

Open the chart page →

12,813
betydbncsaVerified publisher0.6.11 of 4See more

betydb ncsa 0.6.1

1 of the 4 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:11.8.0c3f10b41989f
postgresql@11.8.0-10
14.21.0

Open the chart page →

9,542
incorencsaVerified publisher1.38.01 of 29See more

incore ncsa 1.38.0

1 of the 29 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:16.4.03ba6e6f11388
postgresql@16.4.0-20
14.21.0

Open the chart page →

15,369
smilencsaVerified publisher1.1.04 of 23See more

smile ncsa 1.1.0

4 of the 23 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
socialmediamacroscope/histogram:0.1.26418f9bdb4d2
postgresql-15@15.3-0+deb12u1
15.16-0+deb12u1
socialmediamacroscope/network_analysis:0.1.3b351c21422e6
postgresql-15@15.3-0+deb12u1
15.16-0+deb12u1
socialmediamacroscope/preprocessing:0.1.3ca863306314b
postgresql-15@15.3-0+deb12u1
15.16-0+deb12u1
socialmediamacroscope/topic_modeling:0.1.3fa490acac2f8
postgresql-15@15.3-0+deb12u1
15.16-0+deb12u1

Open the chart page →

109,294
node-appnode-app-lili1.0.01 of 1See more

node-app node-app-lili 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
laly9999/node-app:1dd0e503913e1
postgresql-15@15.13-0+deb12u1
15.16-0+deb12u1

Open the chart page →

10,218
nominatimnominatim-chart1.3.02 of 3See more

nominatim nominatim-chart 1.3.0

2 of the 3 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
mediagis/nominatim:3.7c15e941485ef
postgresql-12@12.12-0ubuntu0.20.04.1
no fix listed
robjuz/postgresql-nominatim:latest805c7bab76df
postgresql@11.12.0-7
14.21.0

Open the chart page →

22,658
notes-admin-front-helm-chartnotesprojectchart0.1.01 of 1See more

notes-admin-front-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
vlebediantsev/notes-admin-front:latest007c6670ff48
postgresql-15@15.3-0+deb12u1
15.16-0+deb12u1

Open the chart page →

15,132
notes-project-fromt-helm-chartnotesprojectchart0.1.01 of 1See more

notes-project-fromt-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
vlebediantsev/notes-project-front:latest945675fd2636
postgresql-15@15.3-0+deb12u1
15.16-0+deb12u1

Open the chart page →

15,206
registration-ms-front-helm-chartnotesprojectchart0.1.01 of 1See more

registration-ms-front-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
vlebediantsev/registration-ms-front-app-host:latest54f69d116c50
postgresql-15@15.3-0+deb12u1
15.16-0+deb12u1

Open the chart page →

15,187
apicurioone-acre-fundVerified publisher2.3.01 of 5See more

apicurio one-acre-fund 2.3.0

1 of the 5 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:14.4.0-debian-11-r237e7ebb082031
postgresql@14.4.0-11
14.21.0

Open the chart page →

18,667
comacopencord1.0.02 of 9See more

comac opencord 1.0.0

2 of the 9 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
postgresql-9.5@9.5.14-0ubuntu0.16.04
no fix listed
omecproject/progran-synchronizer:comac-1.0.0d109a8e57e71
postgresql-9.5@9.5.14-0ubuntu0.16.04
no fix listed

Open the chart page →

88,546
comac-platformopencord0.0.171 of 11See more

comac-platform opencord 0.0.17

1 of the 11 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
omecproject/mcord-synchronizer:comac-1.0.0cfdb566dd949
postgresql-9.5@9.5.14-0ubuntu0.16.04
no fix listed

Open the chart page →

26,211
freeradiusopencord1.0.41 of 1See more

freeradius opencord 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
freeradius/freeradius-server:3.0.2121c8bfa904d8
postgresql-10@10.12-0ubuntu0.18.04.1
no fix listed

Open the chart page →

15,702
sebaopencord1.0.01 of 17See more

seba opencord 1.0.0

1 of the 17 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
tpdock/freeradius:2.2.93da600c95a49
postgresql-9.5@9.5.10-0ubuntu0.16.04
no fix listed

Open the chart page →

93,855
voltha-infraopencord2.14.01 of 10See more

voltha-infra opencord 2.14.0

1 of the 10 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
freeradius/freeradius-server:3.0.2121c8bfa904d8
postgresql-10@10.12-0ubuntu0.18.04.1
no fix listed

Open the chart page →

41,044
opencost-parquet-exporteropencostVerified publisher0.3.11 of 1See more

opencost-parquet-exporter opencost 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
ghcr.io/opencost/opencost-parquet-exporter:v0.2.1ce85ef0ce665
postgresql-15@15.10-0+deb12u1
15.16-0+deb12u1

Open the chart page →

10,978
hiveopstty0.1.81 of 4See more

hive opstty 0.1.8

1 of the 4 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:16233f361c5819
postgresql@16.6.0-1
14.21.0

Open the chart page →

4,523
radiusp2p-avs0.1.01 of 1See more

radius p2p-avs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
theradius/loggia:0.463ba348546ec
postgresql-15@15.5-0+deb12u1
15.16-0+deb12u1

Open the chart page →

12,350
ungatep2p-avs0.1.02 of 3See more

ungate p2p-avs 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
xom4ekp2p/infini-route-attestators-public-mainnet-attester:latestd0e0aa238b02
postgresql-15@15.8-0+deb12u1
15.16-0+deb12u1
xom4ekp2p/infini-route-attestators-public-mainnet-avs-webapi:latest2745b5fd8785
postgresql-15@15.8-0+deb12u1
15.16-0+deb12u1

Open the chart page →

27,373
linkdingpascaliskeVerified publisher3.0.01 of 1See more

linkding pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
ghcr.io/sissbruecker/linkding:1.45.061b2eb9eed8e
postgresql-17@17.6-0+deb13u1
17.8-0+deb13u1

Open the chart page →

3,854
vaultwardenpascaliskeVerified publisher2.0.01 of 1See more

vaultwarden pascaliske 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
ghcr.io/dani-garcia/vaultwarden:1.35.2d89a6d21e361
postgresql-17@17.6-0+deb13u1
17.8-0+deb13u1

Open the chart page →

3,408
matomopetbattle11.0.11 of 2See more

matomo petbattle 11.0.1

1 of the 2 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bitnamilegacy/matomo:5.3.2-debian-12-r13f02c000c54b1
postgresql-15@15.13-0+deb12u1
15.16-0+deb12u1

Open the chart page →

11,061
pgcatpgcatVerified publisher0.2.51 of 1See more

pgcat pgcat 0.2.5

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
ghcr.io/postgresml/pgcat:main245f9d2f5f5b
postgresql-15@15.5-0+deb12u1
15.16-0+deb12u1

Open the chart page →

3,775
falcon-asgi-serverphanVerified publisher0.1.01 of 1See more

falcon-asgi-server phan 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
phan2410/falcon-asgi-server:0.1.04a86d138832d
postgresql-15@15.12-0+deb12u2
15.16-0+deb12u1

Open the chart page →

8,189
phronetisphronetis0.1.271 of 2See more

phronetis phronetis 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
knspar/phronetis-operator:0.1.60c4f0543ee58
postgresql-15@15.6-0+deb12u1
15.16-0+deb12u1

Open the chart page →

16,196
subgraph-oraclepinaxVerified publisher0.0.11 of 1See more

subgraph-oracle pinax 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
ghcr.io/graphprotocol/availability-oracle:sha-28312fd472a25038957
postgresql-15@15.7-0+deb12u1
15.16-0+deb12u1

Open the chart page →

11,347
pingdom-operatorpingdom-operator0.0.201 of 1See more

pingdom-operator pingdom-operator 0.0.20

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
ghcr.io/nefelim4ag/pingdom-operator:0.0.15f8c7afdcf439
postgresql-15@15.7-0+deb12u1
15.16-0+deb12u1

Open the chart page →

11,923
planectlplanectlVerified publisher0.7.01 of 10See more

planectl planectl 0.7.0

1 of the 10 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:17.6.0-debian-12-r4926356130b77
postgresql@17.6.0-2
14.21.0

Open the chart page →

25,934
pod-birdspod-birds0.1.01 of 1See more

pod-birds pod-birds 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
teknas09/bird-pod:latest12a1fa85c4aa
postgresql-15@15.6-0+deb12u1
15.16-0+deb12u1

Open the chart page →

12,912
polyaxonpolyaxon2.16.41 of 5See more

polyaxon polyaxon 2.16.4

1 of the 5 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:16.4.0-debian-12-r1102e2f47a405e
postgresql@16.4.0-10
14.21.0

Open the chart page →

13,741
pyredispyredis-helm0.1.01 of 2See more

pyredis pyredis-helm 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
avinash263/pyredis263:latestaa2b8727f1a6
postgresql-15@15.3-0+deb12u1
15.16-0+deb12u1

Open the chart page →

14,537
mychartpythonweb0.1.01 of 1See more

mychart pythonweb 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
qichenxu4pd/pythonexample:1.0f3a8502bc21b
postgresql-15@15.6-0+deb12u1
15.16-0+deb12u1

Open the chart page →

12,566
mypythonpythonweb0.1.01 of 1See more

mypython pythonweb 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
qichenxu4pd/pythonexample:1.0f3a8502bc21b
postgresql-15@15.6-0+deb12u1
15.16-0+deb12u1

Open the chart page →

12,566
rdfoxrdfox-helm-chart0.1.22 of 2See more

rdfox rdfox-helm-chart 0.1.2

2 of the 2 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
oxfordsemantic/rdfox:5.6db17910eb855
postgresql-12@12.9-0ubuntu0.20.04.1
no fix listed
oxfordsemantic/rdfox-init:5.6baf570ff968d
postgresql-12@12.9-0ubuntu0.20.04.1
no fix listed

Open the chart page →

12,802
retromretsamedocVerified publisher2026.2.51 of 1See more

retrom retsamedoc 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
postgresql-15@15.10-0+deb12u1
15.16-0+deb12u1

Open the chart page →

7,084
revwallet-apirevwallet0.7.121 of 1See more

revwallet-api revwallet 0.7.12

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
arthurjguerra18/revwallet:v0.7.12f540af20b307
postgresql-15@15.8-0+deb12u1
15.16-0+deb12u1

Open the chart page →

5,790
kresusrm3lVerified publisher0.2.12 of 3See more

kresus rm3l 0.2.1

2 of the 3 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:17.5.0-debian-12-r16687034f33da6
postgresql@17.5.0-11
14.21.0
bnjbvr/kresus:0.22.137e216b182c8
postgresql-15@15.10-0+deb12u1
15.16-0+deb12u1

Open the chart page →

15,591
matrix-stackrock8sVerified publisher0.8.11 of 7See more

matrix-stack rock8s 0.8.1

1 of the 7 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.127.1c3c4a9de2a0b
postgresql-15@15.12-0+deb12u2
15.16-0+deb12u1

Open the chart page →

9,256
rocketchat-voiprocketchat-server0.1.01 of 1See more

rocketchat-voip rocketchat-server 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
rocketchat/freeswitch:stablecfba5c20a5cc
postgresql-15@15.13-0+deb12u1
15.16-0+deb12u1

Open the chart page →

5,683
devtron-enterpriseromholdings48.0.01 of 28See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
postgresql-15@15.14-0+deb12u1
15.16-0+deb12u1

Open the chart page →

68,240
paperless-ngxrtomik-helm-chartsVerified publisher0.0.51 of 1See more

paperless-ngx rtomik-helm-charts 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:2.20.357ad9565bff3
postgresql-17@17.6-0+deb13u1
17.8-0+deb13u1

Open the chart page →

10,605
tandoorrtomik-helm-chartsVerified publisher0.0.11 of 1See more

tandoor rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-2006.

Container imageDigestPackageFixed in
vabene1111/recipes:2.3.50f8d061895e9
postgresql17@17.7-r0
17.8-r0

Open the chart page →

4,499

Container images carrying it

207 by charts deploying them

A fixed version is listed for 9 of the 13 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/zoriya/kyoo_scanner:4.7.17dc0ee57b628
postgresql-15@15.10-0+deb12u1
15.16-0+deb12u1
1
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
postgresql-15@15.8-0+deb12u1
15.16-0+deb12u1
1
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
postgresql-15@15.6-0+deb12u1
15.16-0+deb12u1
1
public.ecr.aws/jtekt-corporation/time-series-storage-service:v1.5.1046ef5c9ed50
postgresql-15@15.3-0+deb12u1
15.16-0+deb12u1
1
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
postgresql-15@15.8-0+deb12u1
15.16-0+deb12u1
1
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
postgresql-15@15.5-0+deb12u1
15.16-0+deb12u1
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
postgresql-15@15.3-0+deb12u1
15.16-0+deb12u1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.