StackRadar

CVE-2026-33815

Critical

Advisory

Published 7 Apr 2026In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.006
47th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
182
of 17,781 indexed, latest versions
Container images
180
deployed by those charts
Fix available
1 of 1
affected package

pgx contains memory-safety vulnerability

Carried by container images the latest versions of 182 of 17,781 indexed charts deploy, on 180 images.

Affected packageAffected versionsFixed inImages
github.com/jackc/pgx/v5golangv5.0.4, v5.2.0, v5.3.0, v5.3.1+15 more5.9.0180
OSV records
GHSA-xgrm-4fwx-7qm8
Also known as
GO-2026-4771

Charts affected

182 by stars
ChartLatestAffected imagesRadar Score
cloudnative-pgradar-baseVerified publisher0.23.21 of 1See more

cloudnative-pg radar-base 0.23.2

1 of the 1 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
ghcr.io/cloudnative-pg/cloudnative-pg:1.25.1b5210df46c05
github.com/jackc/pgx/v5@v5.7.2
5.9.0

Open the chart page →

849
kubecostradar-baseVerified publisher1.0.01 of 7See more

kubecost radar-base 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
grafana/grafana:11.4.0d8ea37798ccc
github.com/jackc/pgx/v5@v5.5.5
5.9.0

Open the chart page →

9,355
radar-grafanaradar-baseVerified publisher0.1.41 of 2See more

radar-grafana radar-base 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
grafana/grafana:11.6.062d2b9d20a19
github.com/jackc/pgx/v5@v5.7.2
5.9.0

Open the chart page →

1,667
radar-hydraradar-baseVerified publisher0.3.41 of 2See more

radar-hydra radar-base 0.3.4

1 of the 2 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
oryd/hydra:v2.3.0b94007e19a1f
github.com/jackc/pgx/v5@v5.6.0
5.9.0

Open the chart page →

2,177
radar-kratosradar-baseVerified publisher0.1.51 of 1See more

radar-kratos radar-base 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
oryd/kratos:v1.3.1fe2428f103a6
github.com/jackc/pgx/v5@v5.6.0
5.9.0

Open the chart page →

1,561
regoregoOfficialVerified publisher0.1.31 of 1See more

rego rego 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
drorivry4/rego:lateste035d49b15ca
github.com/jackc/pgx/v5@v5.4.3
5.9.0

Open the chart page →

2,919
monitoringrocketchat-server0.0.171 of 9See more

monitoring rocketchat-server 0.0.17

1 of the 9 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.143.03bc07732530c
github.com/jackc/pgx/v5@v5.8.0
5.9.0

Open the chart page →

6,859
devtron-enterpriseromholdings48.0.01 of 28See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
quay.io/devtron/migrator:v4.16.2fbeaef7a8566
github.com/jackc/pgx/v5@v5.3.1
5.9.0

Open the chart page →

68,240
devtron-operatorromholdings0.23.31 of 11See more

devtron-operator romholdings 0.23.3

1 of the 11 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
quay.io/devtron/migrator:v4.16.2fbeaef7a8566
github.com/jackc/pgx/v5@v5.3.1
5.9.0

Open the chart page →

32,902
migrantromholdings0.0.31 of 1See more

migrant romholdings 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
migrate/migrate:latestcc4ad8e19d66
github.com/jackc/pgx/v5@v5.5.4
5.9.0

Open the chart page →

734
donetickrtomik-helm-chartsVerified publisher1.0.61 of 1See more

donetick rtomik-helm-charts 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
donetick/donetick:v0.1.60849a43d9e363
github.com/jackc/pgx/v5@v5.5.4
5.9.0

Open the chart page →

1,511
gotifyrubxkubeVerified publisher1.3.31 of 1See more

gotify rubxkube 1.3.3

1 of the 1 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
gotify/server:3.1.0be44495e4609
github.com/jackc/pgx/v5@v5.7.6
5.9.0

Open the chart page →

320
spindlerubxkubeVerified publisher0.1.11 of 2See more

spindle rubxkube 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
ghcr.io/qjoly/spindle:v1.16.1-alphaaab0c99d313f
github.com/jackc/pgx/v5@v5.8.0
5.9.0

Open the chart page →

1,438
sagawisesagawiseVerified publisher0.1.01 of 3See more

sagawise sagawise 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
venturenox/sagawise:latestc11d32f18718
github.com/jackc/pgx/v5@v5.7.1
5.9.0

Open the chart page →

4,178
grafanasb-helm-charts0.4.01 of 1See more

grafana sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
grafana/grafana:12.2.22ebef928d7e5
github.com/jackc/pgx/v5@v5.7.5
5.9.0

Open the chart page →

1,795
ccx-monitoringseveralnines0.6.211 of 7See more

ccx-monitoring severalnines 0.6.21

1 of the 7 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
grafana/grafana:12.3.12175aaa91c96
github.com/jackc/pgx/v5@v5.7.6
5.9.0

Open the chart page →

7,708
apache-shardingsphere-operator-chartsshardingsphere0.3.01 of 2See more

apache-shardingsphere-operator-charts shardingsphere 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
apache/shardingsphere-operator:0.3.0ffe68d6b99c0
github.com/jackc/pgx/v5@v5.3.1
5.9.0

Open the chart page →

1,698
bffshortlink0.2.11 of 1See more

bff shortlink 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
registry.gitlab.com/shortlink-org/shortlink/bff:latestf2194e526915
github.com/jackc/pgx/v5@v5.8.0
5.9.0

Open the chart page →

1,690
linkshortlink0.7.31 of 1See more

link shortlink 0.7.3

1 of the 1 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
registry.gitlab.com/shortlink-org/shortlink/link:latest86d87291ffd4
github.com/jackc/pgx/v5@v5.8.0
5.9.0

Open the chart page →

1,674
ctlogsigstoreVerified publisher0.2.681 of 4See more

ctlog sigstore 0.2.68

1 of the 4 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
ghcr.io/sigstore/scaffolding/ct_server:v0.7.3166664ba563e7
github.com/jackc/pgx/v5@v5.7.5
5.9.0

Open the chart page →

2,728
counter-dhlsikademo0.3.01 of 3See more

counter-dhl sikademo 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
ondrejsika/counter:latestd95eaeee2172
github.com/jackc/pgx/v5@v5.5.5
5.9.0

Open the chart page →

4,820
cost-analyzersoftonic2.5.51 of 6See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
grafana/grafana:11.5.28b37a2f028f1
github.com/jackc/pgx/v5@v5.7.1
5.9.0

Open the chart page →

7,901
kedasoftonic2.17.02 of 3See more

keda softonic 2.17.0

2 of the 3 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
ghcr.io/kedacore/keda:2.17.0112fc427d933
github.com/jackc/pgx/v5@v5.7.4
5.9.0
ghcr.io/kedacore/keda-metrics-apiserver:2.17.0167fd532bd43
github.com/jackc/pgx/v5@v5.7.4
5.9.0

Open the chart page →

2,583
kube-prometheus-stacksoftonic81.5.11 of 6See more

kube-prometheus-stack softonic 81.5.1

1 of the 6 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
grafana/grafana:12.3.2ba93c9d192e5
github.com/jackc/pgx/v5@v5.7.6
5.9.0

Open the chart page →

4,974
wonder-mesh-netstrrl-helm2026.629.02 of 3See more

wonder-mesh-net strrl-helm 2026.629.0

2 of the 3 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
headscale/headscale:0.27.1cd37b3001857
github.com/jackc/pgx/v5@v5.7.6
5.9.0
ghcr.io/strrl/wonder-mesh-net:v2026.629.0625b140372fd
github.com/jackc/pgx/v5@v5.8.0
5.9.0

Open the chart page →

5,063
orchestratorsubstraVerified publisher8.8.01 of 3See more

orchestrator substra 8.8.0

1 of the 3 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
ghcr.io/substra/orchestrator-server:1.0.0647e45284a80
github.com/jackc/pgx/v5@v5.3.1
5.9.0

Open the chart page →

2,991
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
github.com/jackc/pgx/v5@v5.6.0
5.9.0

Open the chart page →

3,460
truefoundry-monitoringtruefoundryVerified publisher0.1.61 of 8See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
grafana/grafana:12.3.070d9599b186c
github.com/jackc/pgx/v5@v5.7.6
5.9.0

Open the chart page →

4,526
gateway-control-planewallarmVerified publisher0.2.02 of 2See more

gateway-control-plane wallarm 0.2.0

2 of the 2 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
timescale/timescaledb:latest-pg17bc8527e62f70
github.com/jackc/pgx/v5@v5.7.2
5.9.0
wallarm/gateway-control-plane:0.2.0a321bc974a19
github.com/jackc/pgx/v5@v5.8.0
5.9.0

Open the chart page →

1,455
argo-eventswenerme2.4.271 of 1See more

argo-events wenerme 2.4.27

1 of the 1 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
github.com/jackc/pgx/v5@v5.7.5
5.9.0

Open the chart page →

969
wexa-studiowexa-studio1.2.02 of 15See more

wexa-studio wexa-studio 1.2.0

2 of the 15 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
github.com/jackc/pgx/v5@v5.7.4
5.9.0
temporalio/server:1.29.1c1e3326b2ce1
github.com/jackc/pgx/v5@v5.7.4
5.9.0

Open the chart page →

14,983
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-33815.

Container imageDigestPackageFixed in
grafana/grafana:11.5.15781759b3d27
github.com/jackc/pgx/v5@v5.7.1
5.9.0

Open the chart page →

9,381

Container images carrying it

180 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
grafana/grafana:12.2.22ebef928d7e5
github.com/jackc/pgx/v5@v5.7.5
5.9.0
1
grafana/grafana:12.2.135c41e0fd029
github.com/jackc/pgx/v5@v5.7.5
5.9.0
1
grafana/grafana:11.2.2-security-01464eac539793
github.com/jackc/pgx/v5@v5.5.5
5.9.0
1
grafana/grafana:11.5.15781759b3d27
github.com/jackc/pgx/v5@v5.7.1
5.9.0
1
grafana/grafana:11.6.062d2b9d20a19
github.com/jackc/pgx/v5@v5.7.2
5.9.0
1
grafana/grafana:12.3.070d9599b186c
github.com/jackc/pgx/v5@v5.7.6
5.9.0
1
grafana/grafana:12.2.074144189b384
github.com/jackc/pgx/v5@v5.7.5
5.9.0
1
grafana/grafana:11.5.28b37a2f028f1
github.com/jackc/pgx/v5@v5.7.1
5.9.0
1
grafana/grafana:12.1.1a1701c218024
github.com/jackc/pgx/v5@v5.7.5
5.9.0
1
grafana/grafana:12.0.2b5b59bfc7561
github.com/jackc/pgx/v5@v5.7.5
5.9.0
1
grafana/grafana:12.3.2ba93c9d192e5
github.com/jackc/pgx/v5@v5.7.6
5.9.0
1
grafana/grafana:11.3.1fa801ab6e1ae
github.com/jackc/pgx/v5@v5.5.5
5.9.0
1
grafana/otel-lgtm:0.11.1009d8c3ce4f3a
github.com/jackc/pgx/v5@v5.7.5
5.9.0
1
gresearch/armada-executor:latest393aff4aa8f2
github.com/jackc/pgx/v5@v5.8.0
5.9.0
1
gresearch/armada-lookout:latestf5e3226f1d33
github.com/jackc/pgx/v5@v5.8.0
5.9.0
1
gresearch/armada-lookout-ingester:latest3df14cda1855
github.com/jackc/pgx/v5@v5.8.0
5.9.0
1
gresearch/armada-scheduler:latest6141a6213fcb
github.com/jackc/pgx/v5@v5.8.0
5.9.0
1
gresearch/fasttrackml:latest16d1228220fc
github.com/jackc/pgx/v5@v5.5.5
5.9.0
1
hashicorp/boundary:0.15.3339b78b61750
github.com/jackc/pgx/v5@v5.5.5
5.9.0
1
hashicorp/boundary:0.21.037bf86488b74
github.com/jackc/pgx/v5@v5.7.6
5.9.0
1
headscale/headscale:0.25.1a7a8ae9616bb
github.com/jackc/pgx/v5@v5.7.1
5.9.0
1
headscale/headscale:0.27.1cd37b3001857
github.com/jackc/pgx/v5@v5.7.6
5.9.0
1
instill/artifact-backend:b28766ac4a393e601ed
github.com/jackc/pgx/v5@v5.7.6
5.9.0
1
instill/mgmt-backend:d0933d4ebe12f77a3f9
github.com/jackc/pgx/v5@v5.7.6
5.9.0
1
instill/model-backend:611f0f2e980125e5ba5
github.com/jackc/pgx/v5@v5.7.6
5.9.0
1
ispras/svacer:11-2-042aa9fa9f189
github.com/jackc/pgx/v5@v5.7.4
5.9.0
1
juicedata/juicefs-csi-driver:v0.20.043978fc60798
github.com/jackc/pgx/v5@v5.3.1
5.9.0
1
kubeshop/tracetest:v1.7.173d7e3a2db43
github.com/jackc/pgx/v5@v5.4.2
5.9.0
1
langgenius/dify-plugin-daemon:0.5.1-local8269050f192e
github.com/jackc/pgx/v5@v5.5.5
5.9.0
1
layer5/meshery:stable-latest78a8be21bef3
github.com/jackc/pgx/v5@v5.7.2
5.9.0
1
layer5/meshery-consul:stable-latest25a4cc38abcd
github.com/jackc/pgx/v5@v5.4.3
5.9.0
1
layer5/meshery-istio:stable-latestfde47c141ec6
github.com/jackc/pgx/v5@v5.4.3
5.9.0
1
layer5/meshery-linkerd:stable-latestb99c73bac1f5
github.com/jackc/pgx/v5@v5.5.4
5.9.0
1
logiqai/flash:v3.10.265b996bc7bdc
github.com/jackc/pgx/v5@v5.5.5
5.9.0
1
megaease/easegress:latestfad1c7452958
github.com/jackc/pgx/v5@v5.7.6
5.9.0
1
netbirdio/management:0.45.10c9994b393ea
github.com/jackc/pgx/v5@v5.5.5
5.9.0
1
netbirdio/netbird-server:0.77.1e71f39cefcd9
github.com/jackc/pgx/v5@v5.5.5
5.9.0
1
ondrejsika/counter:latestd95eaeee2172
github.com/jackc/pgx/v5@v5.5.5
5.9.0
1
opencsghq/gitlab-gitaly:v17.5.0bdd2c58b9744
github.com/jackc/pgx/v5@v5.7.0
5.9.0
1
openfga/openfga:v1.9.25e94966c11df
github.com/jackc/pgx/v5@v5.7.5
5.9.0
1
orbitalreg/orbitalreg-api:0.1.045f2620337af
github.com/jackc/pgx/v5@v5.5.5
5.9.0
1
oryd/hydra:v2.3.0b94007e19a1f
github.com/jackc/pgx/v5@v5.6.0
5.9.0
1
oryd/hydra:v26.2.0ff67c7fb5f95
github.com/jackc/pgx/v5@v5.7.5
5.9.0
1
oryd/keto:v26.2.0bfdb8b9e283a
github.com/jackc/pgx/v5@v5.7.5
5.9.0
1
oryd/kratos:v26.2.02a13bb8d362c
github.com/jackc/pgx/v5@v5.7.5
5.9.0
1
otel/opentelemetry-collector-contrib:0.114.037fa87091cfa
github.com/jackc/pgx/v5@v5.7.1
5.9.0
1
otel/opentelemetry-collector-contrib:0.143.03bc07732530c
github.com/jackc/pgx/v5@v5.8.0
5.9.0
1
otel/opentelemetry-collector-contrib:0.113.05ac3e0ba2b0b
github.com/jackc/pgx/v5@v5.7.1
5.9.0
1
otel/opentelemetry-collector-contrib:0.108.0923eb1cfae32
github.com/jackc/pgx/v5@v5.6.0
5.9.0
1
otel/opentelemetry-collector-contrib:0.145.0a7343f018690
github.com/jackc/pgx/v5@v5.8.0
5.9.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.