StackRadar

CVE-2026-61801

Medium

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
Medium
worst across findings
CVSS
5.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
630
of 18,071 indexed, latest versions
Container images
314
deployed by those charts
Fix available
1 of 1
affected package

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

Carried by container images the latest versions of 630 of 18,071 indexed charts deploy, on 314 images.

Affected packageAffected versionsFixed inImages
github.com/moby/sys/usergolangv0.1.0, v0.2.0, v0.3.0, v0.4.00.4.1314
OSV records
GHSA-mjcv-p78q-w5fw
Trending
Rank 20 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

630 by stars
ChartLatestAffected imagesRadar Score
nextcloudsb-helm-charts0.4.01 of 2See more

nextcloud sb-helm-charts 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

11,268
postgresqlsb-helm-charts0.4.01 of 1See more

postgresql sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16.11468e1f126ca5
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,003
redissb-helm-charts0.4.01 of 1See more

redis sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redis:7.4.1-alpinec1e88455c852
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,103
wordpresssb-helm-charts0.4.01 of 2See more

wordpress sb-helm-charts 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.0-debian9382e4f6f7f0
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

15,210
postgresscalified-postgresVerified publisher18.4.01 of 1See more

postgres scalified-postgres 18.4.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.4a02db8cac496
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,258
sonarqubescalified-sonarqubeVerified publisher26.9.01 of 2See more

sonarqube scalified-sonarqube 26.9.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

607
secret-managersecret-managerVerified publisher1.0.01 of 4See more

secret-manager secret-manager 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:9.0.192dc86967801
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

7,359
pagessekharpkube1.0.01 of 3See more

pages sekharpkube 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
postgresself-hosters-by-nightVerified publisher0.14.31 of 1See more

postgres self-hosters-by-night 0.14.3

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.11090bc3a8ccf
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,003
service-exampleservice-example-10.1.01 of 7See more

service-example service-example-1 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:latestbac22ea7710d
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

11,195
serviceexampleserviceexample-chart0.3.01 of 4See more

serviceexample serviceexample-chart 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:latestbac22ea7710d
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,821
serviceexampleservice-example-helm-chart0.1.01 of 4See more

serviceexample service-example-helm-chart 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:latestbac22ea7710d
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,891
first-chartshashkist-test0.1.01 of 3See more

first-chart shashkist-test 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:latest9d48c42f8341
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,680
pagesshrutiujlan-pages1.0.01 of 3See more

pages shrutiujlan-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
hedgedocsi-gitops0.12.31 of 2See more

hedgedoc si-gitops 0.12.3

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.43a82e1f56c8f
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,736
postgresqlsignoz0.0.21 of 1See more

postgresql signoz 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15c961aa287d86
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,636
olmsikalabs0.3.01 of 2See more

olm sikalabs 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/operator-framework/olmdigest-pinned40d0363f4aa6
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,738
sikalabs-harbor-master-snapshotsikalabs2023.6.201 of 8See more

sikalabs-harbor-master-snapshot sikalabs 2023.6.20

1 of the 8 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:devd051158f1fd0
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

2,601
pgbouncersinextraVerified publisher0.17.01 of 1See more

pgbouncer sinextra 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/sergelogvinov/pgbouncer:16.1518f1121ba0a4
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,445
teamcitysinextraVerified publisher1.0.21 of 3See more

teamcity sinextra 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/docker:26.1-dinddd43b430341a
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,993
mariadbsitepilot1.0.31 of 1See more

mariadb sitepilot 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:10.623616f0bd3af
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,168
oi-slurm-cluster-chartslurm-cluster-chart0.25.11 of 4See more

oi-slurm-cluster-chart slurm-cluster-chart 0.25.1

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:10.10334b315c10e5
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,482
slurm-cluster-chartslurm-cluster-chart0.25.01 of 4See more

slurm-cluster-chart slurm-cluster-chart 0.25.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:10.10334b315c10e5
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,482
axonhubsnubisks0.1.01 of 3See more

axonhub snubisks 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

924
buildkitsomaz94Verified publisher0.1.41 of 1See more

buildkit somaz94 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
moby/buildkit:v0.33.06c2fa84a6b61
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

1,041
spacecapybara-chartspacecapy1.0.491 of 2See more

spacecapybara-chart spacecapy 1.0.49

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

13,224
pagessrinipages1.0.01 of 3See more

pages srinipages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
steadybit-agentsteadybit3.1.1792 of 6See more

steadybit-agent steadybit 3.1.179

2 of the 6 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/steadybit/extension-container:v1.8.2a1ce3f58f354
github.com/moby/sys/user@v0.4.0
0.4.1
ghcr.io/steadybit/extension-host:v1.8.332740e34b30a
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

4,957
pagesstephendillondell1.0.01 of 3See more

pages stephendillondell 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
orchestratorsubstraVerified publisher8.8.01 of 3See more

orchestrator substra 8.8.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17c6222b54873a
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,558
substra-backendsubstraVerified publisher26.15.31 of 7See more

substra-backend substra 26.15.3

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:172d2b8998d310
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,158
pagessunilb2590-pages1.0.01 of 3See more

pages sunilb2590-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
icinga2svtech-public-helm-charts1.0.01 of 4See more

icinga2 svtech-public-helm-charts 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redis:7.2.3a7cee7c8178f
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,965
stateful-data-generatortalhajuikar-helm-charts0.1.21 of 2See more

stateful-data-generator talhajuikar-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,595
act-runnertektonops0.1.21 of 2See more

act-runner tektonops 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
gitea/act_runner:nightly7940221bcfc9
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

5,224
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15-alpinef7d23353e1b1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

10,917
terminusterminusVerified publisher1.1.01 of 1See more

terminus terminus 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/terminus-io/enforcer:v1.1.0f21b905610d6
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

979
pagestest43221.0.01 of 3See more

pages test4322 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
flask-contactstest-configmap1.0.11 of 3See more

flask-contacts test-configmap 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,392
the0the0Verified publisher0.11.12 of 9See more

the0 the0 0.11.1

2 of the 9 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:7-jammyf71f6d0913c9
github.com/moby/sys/user@v0.1.0
0.4.1
library/postgres:15-alpinef7d23353e1b1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,924
thingsboardthingsboardVerified publisher0.1.31 of 12See more

thingsboard thingsboard 0.1.3

1 of the 12 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:122f2a8c2a7d10
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

29,668
pagesthiru-pages1.0.01 of 3See more

pages thiru-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
pagesthuy-pages1.0.01 of 3See more

pages thuy-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
todolist-charttodolist-chart0.1.71 of 10See more

todolist-chart todolist-chart 0.1.7

1 of the 10 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

7,433
netbirdtotmicro1.8.21 of 4See more

netbird totmicro 1.8.2

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
netbirdio/management:0.60.252682e5f48f9
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

7,601
apptreenityVerified publisher0.1.531 of 2See more

app treenity 0.1.53

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17c6222b54873a
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,649
treenitytreenityVerified publisher0.1.31 of 4See more

treenity treenity 0.1.3

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:14ceef4a62198b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,852
harbor-scanner-trivytrivy-operator0.31.21 of 1See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.31.26e790e233872
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,005
traceetrivy-operator0.24.11 of 1See more

tracee trivy-operator 0.24.1

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
aquasec/tracee:0.24.1cfbbfee972e6
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

1,660
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,641

Container images carrying it

314 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
library/mariadb:10.10334b315c10e5
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/mariadb:12.0.2:12.0-noble607835cd628b
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/mariadb:11.3.2e101f9db3191
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/mongo:8.0.20098862b1339f
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/mongo:7.01f995ad6fdb9
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/mongo:5.041108d183e97
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/mongo:7.0-jammy:7-jammyf71f6d0913c9
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/mysql:8:8.4:8.4.110744ee5ef89c
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/mysql:8.4.2ac80b6e09e5b
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/postgres:18.11090bc3a8ccf
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/postgres:17-bookworm3645570cccdf
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/postgres:16.24aea012537ed
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/postgres:18.3-alpine:18.3-alpine3.2354451ecb8ab3
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/postgres:18.06f3e42ad37de
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/postgres:17.5aadf2c0696f5
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/postgres:17c6222b54873a
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/postgres:16.4e62fbf9d3e2b
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/postgres:13-alpinefb9065b6e3e2
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/redis148bb5411c18
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/redis:7.2.3a7cee7c8178f
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/redmine:6.1.3-trixief474a901faec
github.com/moby/sys/user@v0.1.0
0.4.1
2
moby/buildkit:v0.32.2-rootless504731e577c2
github.com/moby/sys/user@v0.4.0
0.4.1
2
pgautoupgrade/pgautoupgrade:18-alpine2245aabc5b80
github.com/moby/sys/user@v0.1.0
0.4.1
2
pgvector/pgvector:pg167b822b0aac60
github.com/moby/sys/user@v0.1.0
0.4.1
2
pgvector/pgvector:0.8.5-pg18-trixie9d2e61c7352b
github.com/moby/sys/user@v0.1.0
0.4.1
2
timescale/timescaledb:latest-pg156343bdc87ca1
github.com/moby/sys/user@v0.1.0
0.4.1
2
timescale/timescaledb:2.30.2-pg17:latest-pg17b346edcdb51a
github.com/moby/sys/user@v0.1.0
0.4.1
2
uselagoon/docker-host:v3.6.12c89ed939b8b
github.com/moby/sys/user@v0.4.0
0.4.1
2
ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0bcf63357191b
github.com/moby/sys/user@v0.1.0
0.4.1
2
quay.io/openshift/origin-cli:lateste7965645fac6
github.com/moby/sys/user@v0.4.0
0.4.1
2
1dev/server:11.9.0cd5b12fe5471
github.com/moby/sys/user@v0.4.0
0.4.1
1
airbyte/db:2.3.000cc017f0393
github.com/moby/sys/user@v0.1.0
0.4.1
1
akeyless/k8s-webhook-server:0.39.0996cd9afb3b4
github.com/moby/sys/user@v0.3.0
0.4.1
1
andrewmackrodt/firefox-x11:142.0.1-r133f9080470c9
github.com/moby/sys/user@v0.1.0
0.4.1
1
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
github.com/moby/sys/user@v0.3.0
0.4.1
1
appwrite/appwrite:1.9.01aaa70127114
github.com/moby/sys/user@v0.4.0
0.4.1
1
appwrite/appwrite:2.3.034ef77fb6e87
github.com/moby/sys/user@v0.4.0
0.4.1
1
aquasec/harbor-scanner-trivy:0.31.26e790e233872
github.com/moby/sys/user@v0.1.0
0.4.1
1
aquasec/tracee:0.24.1cfbbfee972e6
github.com/moby/sys/user@v0.3.0
0.4.1
1
aquasec/trivy:0.69.3bcc376de8d77
github.com/moby/sys/user@v0.4.0
0.4.1
1
artifacthub/scanner:v1.23.02d8365601f0e
github.com/moby/sys/user@v0.4.0
0.4.1
1
artifacthub/scanner:v1.19.0323d026e78c3
github.com/moby/sys/user@v0.1.0
0.4.1
1
artifacthub/tracker:v1.23.05368d21a6e5c
github.com/moby/sys/user@v0.4.0
0.4.1
1
blackducksoftware/bdba-pgupgrader:2026.9.0b805c1f607e0
github.com/moby/sys/user@v0.1.0
0.4.1
1
blackducksoftware/blackduck-alert-db:8.4.1ad33e84750f1
github.com/moby/sys/user@v0.1.0
0.4.1
1
buall/postgres-stack:18.6881a785642cb
github.com/moby/sys/user@v0.1.0
0.4.1
1
concourse/concourse:8.3.1c9d48dfbf4f9
github.com/moby/sys/user@v0.4.0
0.4.1
1
dannielkil/book-db:latest433290c5c1db
github.com/moby/sys/user@v0.1.0
0.4.1
1
datadog/agent:6aad9994de6a7
github.com/moby/sys/user@v0.1.0
0.4.1
1
ethpandaops/panda-pulse:latestad6fc3b3e6b8
github.com/moby/sys/user@v0.4.0
0.4.1
1

syft 1.42.1 · advisories as of 9 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.