StackRadar

CVE-2026-61801

Medium

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
Medium
worst across findings
CVSS
5.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
630
of 18,071 indexed, latest versions
Container images
314
deployed by those charts
Fix available
1 of 1
affected package

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

Carried by container images the latest versions of 630 of 18,071 indexed charts deploy, on 314 images.

Affected packageAffected versionsFixed inImages
github.com/moby/sys/usergolangv0.1.0, v0.2.0, v0.3.0, v0.4.00.4.1314
OSV records
GHSA-mjcv-p78q-w5fw
Trending
Rank 20 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

630 by stars
ChartLatestAffected imagesRadar Score
pagespages-sushi1.0.01 of 3See more

pages pages-sushi 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
pagespages-vasanth58141.0.01 of 3See more

pages pages-vasanth5814 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
pagespages-vjp1.0.01 of 3See more

pages pages-vjp 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
paperclippaperclip-helmVerified publisher0.3.01 of 3See more

paperclip paperclip-helm 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17-alpineb0f9560a2de0
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

607
parcaparca-rr0.1.01 of 2See more

parca parca-rr 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/parca-dev/parca-agent:v0.42.0adc0eeb4dd05
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

3,239
minecraftpaul1365972-mc3.0.11 of 1See more

minecraft paul1365972-mc 3.0.1

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
itzg/minecraft-server:latest7b728e72b26b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

38,590
pagespawan-pages1.0.01 of 3See more

pages pawan-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
pet-battle-infrapetbattle1.0.321 of 2See more

pet-battle-infra petbattle 1.0.32

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest486bf8e8f5b5
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

17,616
pet-battle-tournamentpetbattle1.0.401 of 3See more

pet-battle-tournament petbattle 1.0.40

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest486bf8e8f5b5
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

17,616
pagespighosh-pages1.0.01 of 3See more

pages pighosh-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
planectlplanectlVerified publisher0.7.02 of 10See more

planectl planectl 0.7.0

2 of the 10 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
gitea/act_runner:0.2.11c57233403eff
github.com/moby/sys/user@v0.1.0
0.4.1
library/redis:7.4.2-alpine02419de7eddf
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

31,062
libretimepodzone-chartsVerified publisher0.4.11 of 9See more

libretime podzone-charts 0.4.1

1 of the 9 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16.24aea012537ed
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

13,036
svc-postgrespostgres-fiap-lanches0.1.01 of 1See more

svc-postgres postgres-fiap-lanches 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:latest86c951e05bf5
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,753
pagesprasanthi1.0.01 of 3See more

pages prasanthi 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
prompt-dbprompt-dbVerified publisher1.0.71 of 3See more

prompt-db prompt-db 1.0.7

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,059
flaskDiaryptj-miniproject2.1.21 of 2See more

flaskDiary ptj-miniproject 2.1.2

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,654
powerdnspuckpuck2.0.01 of 4See more

powerdns puckpuck 2.0.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18-alpine77f585114c32
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,703
pumperlypumperlyVerified publisher0.2.01 of 3See more

pumperly pumperly 0.2.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
postgis/postgis:17-3.4-alpine5a1dbedac34e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,857
game-serverpvillaverdeVerified publisher1.0.61 of 1See more

game-server pvillaverde 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/itzg/minecraft-server:latest0c09bc50031e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,820
qantas-apiqantas-helm0.1.01 of 3See more

qantas-api qantas-helm 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:172d2b8998d310
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,636
unifiqaoruVerified publisher1.1.61 of 2See more

unifi qaoru 1.1.6

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:7.0-jammyf71f6d0913c9
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,976
qubivaqubiva0.3.21 of 3See more

qubiva qubiva 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:79854f7139445
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

8,053
buildkitquench-buildkitVerified publisher0.0.51 of 1See more

buildkit quench-buildkit 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/buildkitdigest-pinnedbf7f2eee87df
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

127
tykquench-tykVerified publisher0.0.231 of 2See more

tyk quench-tyk 0.0.23

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/tykdigest-pinned2d16b28a72f3
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

204
rad-pluginsradOfficialVerified publisher2.4.151 of 5See more

rad-plugins rad 2.4.15

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
public.ecr.aws/n8h5y2v5/rad-security/rad-sbom:v1.1.710f5aeaf1a77e
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

427
rancher-auto-registerrancher-auto-registerVerified publisher0.1.01 of 1See more

rancher-auto-register rancher-auto-register 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/ci-tools/tools:mainaa62b23f2b5e
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

2,399
pagesranjinigogga1.0.01 of 3See more

pages ranjinigogga 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
pagesrebecca-pages1.0.01 of 3See more

pages rebecca-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
gitops-operatorredhat-cop0.10.61 of 1See more

gitops-operator redhat-cop 0.10.6

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest486bf8e8f5b5
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

1,474
ploigosredhat-cop0.0.91 of 2See more

ploigos redhat-cop 0.0.9

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest486bf8e8f5b5
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

13,774
redminerestic-pvc-backupVerified publisher0.2.61 of 1See more

redmine restic-pvc-backup 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redmine:6.1.3-trixief474a901faec
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,471
retromretsamedocVerified publisher2026.2.51 of 1See more

retrom retsamedoc 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

8,297
olivetinrm3lVerified publisher0.2.01 of 1See more

olivetin rm3l 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/olivetin/olivetin:2025.2.19a89958921526
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

1,954
pagesroccohiggins-pages1.0.01 of 3See more

pages roccohiggins-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
matrix-stackrock8sVerified publisher0.8.11 of 7See more

matrix-stack rock8s 0.8.1

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17-alpineb0f9560a2de0
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

11,478
migration-incluster-cdromholdings0.10.01 of 1See more

migration-incluster-cd romholdings 0.10.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:122f2a8c2a7d10
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,908
rommromm-helm-chartVerified publisher1.5.51 of 3See more

romm romm-helm-chart 1.5.5

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:116422478cb8e1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,667
pagesronan-pages1.0.01 of 3See more

pages ronan-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
routehub-serverroutehub-helm1.0.11 of 3See more

routehub-server routehub-helm 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:latest74935e722416
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

8,032
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redis:7.2.4-alpinec8bb255c3559
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,900
spindlerubxkubeVerified publisher0.1.21 of 2See more

spindle rubxkube 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/docker:29.8.1-dind3f3c01aaaebf
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

1,683
tranquil-pdsrubxkubeVerified publisher0.2.01 of 2See more

tranquil-pds rubxkube 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18-alpine77f585114c32
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

616
rybbitrybbit-helm1.3.21 of 7See more

rybbit rybbit-helm 1.3.2

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15-alpinef7d23353e1b1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

8,545
housekeepersaashousekeeper1.0.01 of 14See more

housekeeper saashousekeeper 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,784
pagessamanvithkaranth1.0.01 of 3See more

pages samanvithkaranth 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
samplesample0.1.01 of 2See more

sample sample 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:noble61dd87ff554d
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,392
pagessarubits-pages1.0.01 of 3See more

pages sarubits-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
keycloaksb-helm-charts0.3.01 of 2See more

keycloak sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,957
mongodbsb-helm-charts0.4.01 of 1See more

mongodb sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:7.0.140032d2ca20db
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,120
mysqlsb-helm-charts0.4.01 of 1See more

mysql sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.4.3106d5197fd8e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,874

Container images carrying it

314 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
galaxy/pulsar-kubernetes:0.15.7e50a890e24c9
github.com/moby/sys/user@v0.3.0
0.4.1
1
ghusta/postgres-world-db:latest879d0919fdcc
github.com/moby/sys/user@v0.1.0
0.4.1
1
gitea/act_runner:0.2.11-dind-rootless6120b1165f3a
github.com/moby/sys/user@v0.1.0
0.4.1
1
gitea/act_runner:nightly7940221bcfc9
github.com/moby/sys/user@v0.4.0
0.4.1
1
gitea/act_runner:0.3.08368754bb612
github.com/moby/sys/user@v0.3.0
0.4.1
1
gitea/act_runner:latestb5c35d6bdbb9
github.com/moby/sys/user@v0.4.0
0.4.1
1
gitea/act_runner:0.3.1c2a169c5e998
github.com/moby/sys/user@v0.4.0
0.4.1
1
gitea/act_runner:0.2.11c57233403eff
github.com/moby/sys/user@v0.1.0
0.4.1
1
goharbor/trivy-adapter-photon:v2.14.35c6f7162804c
github.com/moby/sys/user@v0.4.0
0.4.1
1
goharbor/trivy-adapter-photon:devd051158f1fd0
github.com/moby/sys/user@v0.4.0
0.4.1
1
gradiant/open5gs-dbctl:0.10.3332031245fce
github.com/moby/sys/user@v0.1.0
0.4.1
1
grafana/alloy:v1.5.101a63f4e032c
github.com/moby/sys/user@v0.3.0
0.4.1
1
grafana/alloy:v1.4.306bdcbb51fc2
github.com/moby/sys/user@v0.1.0
0.4.1
1
grafana/alloy:v1.11.38c7256f412fe
github.com/moby/sys/user@v0.4.0
0.4.1
1
grafana/alloy:v1.12.2f94b1c82957a
github.com/moby/sys/user@v0.4.0
0.4.1
1
hashicorp/boundary:0.21.037bf86488b74
github.com/moby/sys/user@v0.4.0
0.4.1
1
hashicorp/boundary:latest76a201954ca0
github.com/moby/sys/user@v0.4.0
0.4.1
1
hfoxy4/kubefaas-builder:main-2afc7570bfb65aaad93
github.com/moby/sys/user@v0.1.0
0.4.1
1
itzg/bungeecord:latest7b7ff61d2a60
github.com/moby/sys/user@v0.1.0
0.4.1
1
itzg/minecraft-server:latest7b728e72b26b
github.com/moby/sys/user@v0.1.0
0.4.1
1
itzg/minecraft-server:2026.9.2de5d1b1a83eb
github.com/moby/sys/user@v0.1.0
0.4.1
1
kenchrcum/fluxcd-helm-upgrader:0.7.7c326e28a8f5f
github.com/moby/sys/user@v0.4.0
0.4.1
1
kubearmor/kubearmor:stablea08141311045
github.com/moby/sys/user@v0.4.0
0.4.1
1
kusionstack/kusion:v0.14.0126c8f0b0976
github.com/moby/sys/user@v0.3.0
0.4.1
1
layer5/meshery:stable-latest78a8be21bef3
github.com/moby/sys/user@v0.3.0
0.4.1
1
library/cassandra:4.00909b1681015
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/docker:29.3.0-dind-alpine3.231ba18449911d
github.com/moby/sys/user@v0.4.0
0.4.1
1
library/docker:27.0.1-dind2416984b43dd
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/docker:28.5.2-dind2a232a42256f
github.com/moby/sys/user@v0.4.0
0.4.1
1
library/docker:dind-rootless3acba49741f1
github.com/moby/sys/user@v0.4.0
0.4.1
1
library/docker:29.8.1-dind:dind:latest3f3c01aaaebf
github.com/moby/sys/user@v0.4.0
0.4.1
1
library/docker:dind7dcdfc4a2024
github.com/moby/sys/user@v0.4.0
0.4.1
1
library/docker:27-cli851f91d24121
github.com/moby/sys/user@v0.3.0
0.4.1
1
library/docker:28.3.3-dinda56b3bdde893
github.com/moby/sys/user@v0.4.0
0.4.1
1
library/docker:27-dindaa3df78ecf32
github.com/moby/sys/user@v0.3.0
0.4.1
1
library/docker:26.1-dinddd43b430341a
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/ghost:6.37.01ef2e532ca4d
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/ghost:6.25.12654b1e90413
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/ghost:6.41.129773d6be407
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/ghost:6.39.0-alpine77196da4b0df
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/ghost:6.65.090592b712b6b
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/ghost:6.65.0-alpine3.23fea3264f902e
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/influxdb:2.8983c696655e8
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mariadb:10.422edfe1c7834
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mariadb:12.0.25b6a1eac15b8
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mariadb:12.3.2628f228f0fd5
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mariadb:116422478cb8e1
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mariadb:11.8.46b848cb24fbb
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mariadb:10.6.218a16204dc96c
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mariadb:12.3.2a02fe89cb597
github.com/moby/sys/user@v0.1.0
0.4.1
1

syft 1.42.1 · advisories as of 9 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.