StackRadar

CVE-2026-33816

Critical

Advisory

Published 7 Apr 2026In the index since 5 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
182
of 17,781 indexed, latest versions
Container images
180
deployed by those charts
Fix available
1 of 1
affected package

Memory-safety vulnerability in github.com/jackc/pgx/v5.

Carried by container images the latest versions of 182 of 17,781 indexed charts deploy, on 180 images.

Affected packageAffected versionsFixed inImages
github.com/jackc/pgx/v5golangv5.0.4, v5.2.0, v5.3.0, v5.3.1+15 more5.9.0180
OSV records
GHSA-9jj7-4m8r-rfcm
Also known as
GO-2026-4772

Charts affected

182 by stars
ChartLatestAffected imagesRadar Score
cloudnative-pgradar-baseVerified publisher0.23.21 of 1See more

cloudnative-pg radar-base 0.23.2

1 of the 1 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
ghcr.io/cloudnative-pg/cloudnative-pg:1.25.1b5210df46c05
github.com/jackc/pgx/v5@v5.7.2
5.9.0

Open the chart page →

849
kubecostradar-baseVerified publisher1.0.01 of 7See more

kubecost radar-base 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
grafana/grafana:11.4.0d8ea37798ccc
github.com/jackc/pgx/v5@v5.5.5
5.9.0

Open the chart page →

9,355
radar-grafanaradar-baseVerified publisher0.1.41 of 2See more

radar-grafana radar-base 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
grafana/grafana:11.6.062d2b9d20a19
github.com/jackc/pgx/v5@v5.7.2
5.9.0

Open the chart page →

1,667
radar-hydraradar-baseVerified publisher0.3.41 of 2See more

radar-hydra radar-base 0.3.4

1 of the 2 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
oryd/hydra:v2.3.0b94007e19a1f
github.com/jackc/pgx/v5@v5.6.0
5.9.0

Open the chart page →

2,177
radar-kratosradar-baseVerified publisher0.1.51 of 1See more

radar-kratos radar-base 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
oryd/kratos:v1.3.1fe2428f103a6
github.com/jackc/pgx/v5@v5.6.0
5.9.0

Open the chart page →

1,561
regoregoOfficialVerified publisher0.1.31 of 1See more

rego rego 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
drorivry4/rego:lateste035d49b15ca
github.com/jackc/pgx/v5@v5.4.3
5.9.0

Open the chart page →

2,919
monitoringrocketchat-server0.0.171 of 9See more

monitoring rocketchat-server 0.0.17

1 of the 9 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.143.03bc07732530c
github.com/jackc/pgx/v5@v5.8.0
5.9.0

Open the chart page →

6,859
devtron-enterpriseromholdings48.0.01 of 28See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
quay.io/devtron/migrator:v4.16.2fbeaef7a8566
github.com/jackc/pgx/v5@v5.3.1
5.9.0

Open the chart page →

68,240
devtron-operatorromholdings0.23.31 of 11See more

devtron-operator romholdings 0.23.3

1 of the 11 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
quay.io/devtron/migrator:v4.16.2fbeaef7a8566
github.com/jackc/pgx/v5@v5.3.1
5.9.0

Open the chart page →

32,902
migrantromholdings0.0.31 of 1See more

migrant romholdings 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
migrate/migrate:latestcc4ad8e19d66
github.com/jackc/pgx/v5@v5.5.4
5.9.0

Open the chart page →

734
donetickrtomik-helm-chartsVerified publisher1.0.61 of 1See more

donetick rtomik-helm-charts 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
donetick/donetick:v0.1.60849a43d9e363
github.com/jackc/pgx/v5@v5.5.4
5.9.0

Open the chart page →

1,511
gotifyrubxkubeVerified publisher1.3.31 of 1See more

gotify rubxkube 1.3.3

1 of the 1 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
gotify/server:3.1.0be44495e4609
github.com/jackc/pgx/v5@v5.7.6
5.9.0

Open the chart page →

320
spindlerubxkubeVerified publisher0.1.11 of 2See more

spindle rubxkube 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
ghcr.io/qjoly/spindle:v1.16.1-alphaaab0c99d313f
github.com/jackc/pgx/v5@v5.8.0
5.9.0

Open the chart page →

1,438
sagawisesagawiseVerified publisher0.1.01 of 3See more

sagawise sagawise 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
venturenox/sagawise:latestc11d32f18718
github.com/jackc/pgx/v5@v5.7.1
5.9.0

Open the chart page →

4,178
grafanasb-helm-charts0.4.01 of 1See more

grafana sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
grafana/grafana:12.2.22ebef928d7e5
github.com/jackc/pgx/v5@v5.7.5
5.9.0

Open the chart page →

1,795
ccx-monitoringseveralnines0.6.211 of 7See more

ccx-monitoring severalnines 0.6.21

1 of the 7 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
grafana/grafana:12.3.12175aaa91c96
github.com/jackc/pgx/v5@v5.7.6
5.9.0

Open the chart page →

7,708
apache-shardingsphere-operator-chartsshardingsphere0.3.01 of 2See more

apache-shardingsphere-operator-charts shardingsphere 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
apache/shardingsphere-operator:0.3.0ffe68d6b99c0
github.com/jackc/pgx/v5@v5.3.1
5.9.0

Open the chart page →

1,698
bffshortlink0.2.11 of 1See more

bff shortlink 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
registry.gitlab.com/shortlink-org/shortlink/bff:latestf2194e526915
github.com/jackc/pgx/v5@v5.8.0
5.9.0

Open the chart page →

1,690
linkshortlink0.7.31 of 1See more

link shortlink 0.7.3

1 of the 1 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
registry.gitlab.com/shortlink-org/shortlink/link:latest86d87291ffd4
github.com/jackc/pgx/v5@v5.8.0
5.9.0

Open the chart page →

1,674
ctlogsigstoreVerified publisher0.2.681 of 4See more

ctlog sigstore 0.2.68

1 of the 4 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
ghcr.io/sigstore/scaffolding/ct_server:v0.7.3166664ba563e7
github.com/jackc/pgx/v5@v5.7.5
5.9.0

Open the chart page →

2,728
counter-dhlsikademo0.3.01 of 3See more

counter-dhl sikademo 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
ondrejsika/counter:latestd95eaeee2172
github.com/jackc/pgx/v5@v5.5.5
5.9.0

Open the chart page →

4,820
cost-analyzersoftonic2.5.51 of 6See more

cost-analyzer softonic 2.5.5

1 of the 6 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
grafana/grafana:11.5.28b37a2f028f1
github.com/jackc/pgx/v5@v5.7.1
5.9.0

Open the chart page →

7,901
kedasoftonic2.17.02 of 3See more

keda softonic 2.17.0

2 of the 3 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
ghcr.io/kedacore/keda:2.17.0112fc427d933
github.com/jackc/pgx/v5@v5.7.4
5.9.0
ghcr.io/kedacore/keda-metrics-apiserver:2.17.0167fd532bd43
github.com/jackc/pgx/v5@v5.7.4
5.9.0

Open the chart page →

2,583
kube-prometheus-stacksoftonic81.5.11 of 6See more

kube-prometheus-stack softonic 81.5.1

1 of the 6 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
grafana/grafana:12.3.2ba93c9d192e5
github.com/jackc/pgx/v5@v5.7.6
5.9.0

Open the chart page →

4,974
wonder-mesh-netstrrl-helm2026.629.02 of 3See more

wonder-mesh-net strrl-helm 2026.629.0

2 of the 3 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
headscale/headscale:0.27.1cd37b3001857
github.com/jackc/pgx/v5@v5.7.6
5.9.0
ghcr.io/strrl/wonder-mesh-net:v2026.629.0625b140372fd
github.com/jackc/pgx/v5@v5.8.0
5.9.0

Open the chart page →

5,063
orchestratorsubstraVerified publisher8.8.01 of 3See more

orchestrator substra 8.8.0

1 of the 3 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
ghcr.io/substra/orchestrator-server:1.0.0647e45284a80
github.com/jackc/pgx/v5@v5.3.1
5.9.0

Open the chart page →

2,991
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
github.com/jackc/pgx/v5@v5.6.0
5.9.0

Open the chart page →

3,460
truefoundry-monitoringtruefoundryVerified publisher0.1.61 of 8See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
grafana/grafana:12.3.070d9599b186c
github.com/jackc/pgx/v5@v5.7.6
5.9.0

Open the chart page →

4,526
gateway-control-planewallarmVerified publisher0.2.02 of 2See more

gateway-control-plane wallarm 0.2.0

2 of the 2 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
timescale/timescaledb:latest-pg17bc8527e62f70
github.com/jackc/pgx/v5@v5.7.2
5.9.0
wallarm/gateway-control-plane:0.2.0a321bc974a19
github.com/jackc/pgx/v5@v5.8.0
5.9.0

Open the chart page →

1,455
argo-eventswenerme2.4.271 of 1See more

argo-events wenerme 2.4.27

1 of the 1 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
github.com/jackc/pgx/v5@v5.7.5
5.9.0

Open the chart page →

969
wexa-studiowexa-studio1.2.02 of 15See more

wexa-studio wexa-studio 1.2.0

2 of the 15 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
github.com/jackc/pgx/v5@v5.7.4
5.9.0
temporalio/server:1.29.1c1e3326b2ce1
github.com/jackc/pgx/v5@v5.7.4
5.9.0

Open the chart page →

14,983
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-33816.

Container imageDigestPackageFixed in
grafana/grafana:11.5.15781759b3d27
github.com/jackc/pgx/v5@v5.7.1
5.9.0

Open the chart page →

9,381

Container images carrying it

180 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
otel/opentelemetry-collector-contrib:0.139.0faf125d656fa
github.com/jackc/pgx/v5@v5.7.6
5.9.0
1
pgsharding/spqr-router:nightly-2.8.3-1839-f66048d84734940216d3
github.com/jackc/pgx/v5@v5.7.6
5.9.0
1
pomerium/pomerium:v0.22.19c69b10a2126
github.com/jackc/pgx/v5@v5.3.1
5.9.0
1
rancher/k3s:v1.28.2-k3s18c2599ecfca8
github.com/jackc/pgx/v5@v5.4.2
5.9.0
1
reportportal/migrations:5.15.4464468240d7b
github.com/jackc/pgx/v5@v5.5.4
5.9.0
1
temporalio/admin-tools:1.26.237e2e33dbd7b
github.com/jackc/pgx/v5@v5.6.0
5.9.0
1
temporalio/admin-tools:1.29.1-tctl-1.18.4-cli-1.5.0a3a52e6ca122
github.com/jackc/pgx/v5@v5.7.4
5.9.0
1
temporalio/admin-tools:1.25.0-tctl-1.18.1-cli-1.0.0cda4901bab53
github.com/jackc/pgx/v5@v5.6.0
5.9.0
1
temporalio/admin-tools:1.28cfde8170c92f
github.com/jackc/pgx/v5@v5.7.2
5.9.0
1
temporalio/auto-setup:1.29.15b3502a3b685
github.com/jackc/pgx/v5@v5.7.2
5.9.0
1
temporalio/auto-setup:1.27.2b44cbfeb43db
github.com/jackc/pgx/v5@v5.7.2
5.9.0
1
temporalio/server:1.26.21e2626efcbc1
github.com/jackc/pgx/v5@v5.6.0
5.9.0
1
temporalio/server:1.25.08a5798191dea
github.com/jackc/pgx/v5@v5.5.5
5.9.0
1
temporalio/server:1.29.1c1e3326b2ce1
github.com/jackc/pgx/v5@v5.7.4
5.9.0
1
timescale/timescaledb:latest-pg16289d55704b1b
github.com/jackc/pgx/v5@v5.7.2
5.9.0
1
timescale/timescaledb:2.30.0-pg173113d12b7839
github.com/jackc/pgx/v5@v5.7.2
5.9.0
1
timescale/timescaledb:latest-pg17bc8527e62f70
github.com/jackc/pgx/v5@v5.7.2
5.9.0
1
timescale/timescaledb-ha:pg16d7db8f1085a3
github.com/jackc/pgx/v5@v5.7.2
5.9.0
1
venturenox/sagawise:latestc11d32f18718
github.com/jackc/pgx/v5@v5.7.1
5.9.0
1
wallarm/gateway-control-plane:0.2.0a321bc974a19
github.com/jackc/pgx/v5@v5.8.0
5.9.0
1
gcr.io/kasten-images/restorectl:8.0.145a0884f9a90c
github.com/jackc/pgx/v5@v5.7.5
5.9.0
1
ghcr.io/0xerr0r/blocky:v0.29.0a6d99f323d30
github.com/jackc/pgx/v5@v5.7.5
5.9.0
1
ghcr.io/alpineworks/katalog-backend:v1.0.77e7a26393cd1
github.com/jackc/pgx/v5@v5.5.5
5.9.0
1
ghcr.io/alpineworks/katalog-migrations:v1.0.562c44a384e13
github.com/jackc/pgx/v5@v5.5.4
5.9.0
1
ghcr.io/appscode/pgoutbox:v0.0.4a96e06ec5e9f
github.com/jackc/pgx/v5@v5.8.0
5.9.0
1
ghcr.io/astriaorg/astria-indexer:0.1.05cf1e5709820
github.com/jackc/pgx/v5@v5.5.4
5.9.0
1
ghcr.io/astriaorg/astria-indexer-api:0.1.03490d9900af1
github.com/jackc/pgx/v5@v5.5.4
5.9.0
1
ghcr.io/bitmagnet-io/bitmagnet:v0.10b6373349a301
github.com/jackc/pgx/v5@v5.7.2
5.9.0
1
ghcr.io/bitmagnet-io/bitmagnet:v0.10.0cf2c16fac5b5
github.com/jackc/pgx/v5@v5.7.2
5.9.0
1
ghcr.io/botify-labs/airbyte_exporter:2.3.02105b1f33013
github.com/jackc/pgx/v5@v5.5.2
5.9.0
1
ghcr.io/camptocamp/terraboard:v2.3.0df53e2c8998c
github.com/jackc/pgx/v5@v5.4.3
5.9.0
1
ghcr.io/cerbos/cerbos:0.51.08d35a64e4a99
github.com/jackc/pgx/v5@v5.8.0
5.9.0
1
ghcr.io/cloudnative-pg/cloudnative-pg:1.28.034198e85b6e6
github.com/jackc/pgx/v5@v5.7.6
5.9.0
1
ghcr.io/cloudnative-pg/cloudnative-pg:1.21.19f707d91de1c
github.com/jackc/pgx/v5@v5.4.3
5.9.0
1
ghcr.io/devops-ia/steampipe:v2.4.1a982103d91d3
github.com/jackc/pgx/v5@v5.7.6
5.9.0
1
ghcr.io/ethpandaops/benchmarkoor:latest5470b2ec3161
github.com/jackc/pgx/v5@v5.6.0
5.9.0
1
ghcr.io/ferretdb/ferretdb:2.7.05706414241eb
github.com/jackc/pgx/v5@v5.7.6
5.9.0
1
ghcr.io/formancehq/membership:v1.11.024a0113d5fb0
github.com/jackc/pgx/v5@v5.7.5
5.9.0
1
ghcr.io/gabe565/limo:latest6dfdbc9853bb
github.com/jackc/pgx/v5@v5.3.0
5.9.0
1
ghcr.io/glassflow/glassflow-etl-migration:v3.2.07db1a1bf3dae
github.com/jackc/pgx/v5@v5.5.4
5.9.0
1
ghcr.io/goauthentik/server:2026.2.146a71d75dfd3
github.com/jackc/pgx/v5@v5.8.0
5.9.0
1
ghcr.io/gurucomputing/headscale-ui:2026.03.17015f5ba04bcb
github.com/jackc/pgx/v5@v5.6.0
5.9.0
1
ghcr.io/huseyinbabal/kubetag:lateste161eddc59a0
github.com/jackc/pgx/v5@v5.7.6
5.9.0
1
ghcr.io/imcitius/checker-edge:1.1.1174426c1fe00f
github.com/jackc/pgx/v5@v5.8.0
5.9.0
1
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
github.com/jackc/pgx/v5@v5.6.0
5.9.0
1
ghcr.io/juanfont/headscale:v0.25.097febecbe6cb
github.com/jackc/pgx/v5@v5.7.1
5.9.0
1
ghcr.io/kedacore/keda:2.16.002348a19aeae
github.com/jackc/pgx/v5@v5.7.1
5.9.0
1
ghcr.io/kedacore/keda:2.17.0112fc427d933
github.com/jackc/pgx/v5@v5.7.4
5.9.0
1
ghcr.io/kedacore/keda:2.17.272dc058e478d
github.com/jackc/pgx/v5@v5.7.4
5.9.0
1
ghcr.io/kedacore/keda-metrics-apiserver:2.17.0167fd532bd43
github.com/jackc/pgx/v5@v5.7.4
5.9.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.