StackRadar

CVE-2026-61801

Medium

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
Medium
worst across findings
CVSS
5.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
630
of 18,071 indexed, latest versions
Container images
314
deployed by those charts
Fix available
1 of 1
affected package

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

Carried by container images the latest versions of 630 of 18,071 indexed charts deploy, on 314 images.

Affected packageAffected versionsFixed inImages
github.com/moby/sys/usergolangv0.1.0, v0.2.0, v0.3.0, v0.4.00.4.1314
OSV records
GHSA-mjcv-p78q-w5fw
Trending
Rank 20 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

630 by stars
ChartLatestAffected imagesRadar Score
nextcloudsb-helm-charts0.4.01 of 2See more

nextcloud sb-helm-charts 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

11,268
postgresqlsb-helm-charts0.4.01 of 1See more

postgresql sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16.11468e1f126ca5
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,003
redissb-helm-charts0.4.01 of 1See more

redis sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redis:7.4.1-alpinec1e88455c852
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,103
wordpresssb-helm-charts0.4.01 of 2See more

wordpress sb-helm-charts 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.0-debian9382e4f6f7f0
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

15,210
postgresscalified-postgresVerified publisher18.4.01 of 1See more

postgres scalified-postgres 18.4.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.4a02db8cac496
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,258
sonarqubescalified-sonarqubeVerified publisher26.9.01 of 2See more

sonarqube scalified-sonarqube 26.9.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

607
secret-managersecret-managerVerified publisher1.0.01 of 4See more

secret-manager secret-manager 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:9.0.192dc86967801
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

7,359
pagessekharpkube1.0.01 of 3See more

pages sekharpkube 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
postgresself-hosters-by-nightVerified publisher0.14.31 of 1See more

postgres self-hosters-by-night 0.14.3

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.11090bc3a8ccf
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,003
service-exampleservice-example-10.1.01 of 7See more

service-example service-example-1 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:latestbac22ea7710d
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

11,195
serviceexampleserviceexample-chart0.3.01 of 4See more

serviceexample serviceexample-chart 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:latestbac22ea7710d
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,821
serviceexampleservice-example-helm-chart0.1.01 of 4See more

serviceexample service-example-helm-chart 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:latestbac22ea7710d
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,891
first-chartshashkist-test0.1.01 of 3See more

first-chart shashkist-test 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:latest9d48c42f8341
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,680
pagesshrutiujlan-pages1.0.01 of 3See more

pages shrutiujlan-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
hedgedocsi-gitops0.12.31 of 2See more

hedgedoc si-gitops 0.12.3

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.43a82e1f56c8f
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,736
postgresqlsignoz0.0.21 of 1See more

postgresql signoz 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15c961aa287d86
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,636
olmsikalabs0.3.01 of 2See more

olm sikalabs 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/operator-framework/olmdigest-pinned40d0363f4aa6
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,738
sikalabs-harbor-master-snapshotsikalabs2023.6.201 of 8See more

sikalabs-harbor-master-snapshot sikalabs 2023.6.20

1 of the 8 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:devd051158f1fd0
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

2,601
pgbouncersinextraVerified publisher0.17.01 of 1See more

pgbouncer sinextra 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/sergelogvinov/pgbouncer:16.1518f1121ba0a4
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,445
teamcitysinextraVerified publisher1.0.21 of 3See more

teamcity sinextra 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/docker:26.1-dinddd43b430341a
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,993
mariadbsitepilot1.0.31 of 1See more

mariadb sitepilot 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:10.623616f0bd3af
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,168
oi-slurm-cluster-chartslurm-cluster-chart0.25.11 of 4See more

oi-slurm-cluster-chart slurm-cluster-chart 0.25.1

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:10.10334b315c10e5
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,482
slurm-cluster-chartslurm-cluster-chart0.25.01 of 4See more

slurm-cluster-chart slurm-cluster-chart 0.25.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:10.10334b315c10e5
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,482
axonhubsnubisks0.1.01 of 3See more

axonhub snubisks 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

924
buildkitsomaz94Verified publisher0.1.41 of 1See more

buildkit somaz94 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
moby/buildkit:v0.33.06c2fa84a6b61
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

1,041
spacecapybara-chartspacecapy1.0.491 of 2See more

spacecapybara-chart spacecapy 1.0.49

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

13,224
pagessrinipages1.0.01 of 3See more

pages srinipages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
steadybit-agentsteadybit3.1.1792 of 6See more

steadybit-agent steadybit 3.1.179

2 of the 6 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/steadybit/extension-container:v1.8.2a1ce3f58f354
github.com/moby/sys/user@v0.4.0
0.4.1
ghcr.io/steadybit/extension-host:v1.8.332740e34b30a
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

4,957
pagesstephendillondell1.0.01 of 3See more

pages stephendillondell 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
orchestratorsubstraVerified publisher8.8.01 of 3See more

orchestrator substra 8.8.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17c6222b54873a
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,558
substra-backendsubstraVerified publisher26.15.31 of 7See more

substra-backend substra 26.15.3

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:172d2b8998d310
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,158
pagessunilb2590-pages1.0.01 of 3See more

pages sunilb2590-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
icinga2svtech-public-helm-charts1.0.01 of 4See more

icinga2 svtech-public-helm-charts 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redis:7.2.3a7cee7c8178f
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,965
stateful-data-generatortalhajuikar-helm-charts0.1.21 of 2See more

stateful-data-generator talhajuikar-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,595
act-runnertektonops0.1.21 of 2See more

act-runner tektonops 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
gitea/act_runner:nightly7940221bcfc9
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

5,224
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15-alpinef7d23353e1b1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

10,917
terminusterminusVerified publisher1.1.01 of 1See more

terminus terminus 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/terminus-io/enforcer:v1.1.0f21b905610d6
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

979
pagestest43221.0.01 of 3See more

pages test4322 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
flask-contactstest-configmap1.0.11 of 3See more

flask-contacts test-configmap 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,392
the0the0Verified publisher0.11.12 of 9See more

the0 the0 0.11.1

2 of the 9 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:7-jammyf71f6d0913c9
github.com/moby/sys/user@v0.1.0
0.4.1
library/postgres:15-alpinef7d23353e1b1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,924
thingsboardthingsboardVerified publisher0.1.31 of 12See more

thingsboard thingsboard 0.1.3

1 of the 12 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:122f2a8c2a7d10
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

29,668
pagesthiru-pages1.0.01 of 3See more

pages thiru-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
pagesthuy-pages1.0.01 of 3See more

pages thuy-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
todolist-charttodolist-chart0.1.71 of 10See more

todolist-chart todolist-chart 0.1.7

1 of the 10 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

7,433
netbirdtotmicro1.8.21 of 4See more

netbird totmicro 1.8.2

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
netbirdio/management:0.60.252682e5f48f9
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

7,601
apptreenityVerified publisher0.1.531 of 2See more

app treenity 0.1.53

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17c6222b54873a
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,649
treenitytreenityVerified publisher0.1.31 of 4See more

treenity treenity 0.1.3

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:14ceef4a62198b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,852
harbor-scanner-trivytrivy-operator0.31.21 of 1See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.31.26e790e233872
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,005
traceetrivy-operator0.24.11 of 1See more

tracee trivy-operator 0.24.1

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
aquasec/tracee:0.24.1cfbbfee972e6
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

1,660
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,641

Container images carrying it

314 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
galaxy/pulsar-kubernetes:0.15.7e50a890e24c9
github.com/moby/sys/user@v0.3.0
0.4.1
1
ghusta/postgres-world-db:latest879d0919fdcc
github.com/moby/sys/user@v0.1.0
0.4.1
1
gitea/act_runner:0.2.11-dind-rootless6120b1165f3a
github.com/moby/sys/user@v0.1.0
0.4.1
1
gitea/act_runner:nightly7940221bcfc9
github.com/moby/sys/user@v0.4.0
0.4.1
1
gitea/act_runner:0.3.08368754bb612
github.com/moby/sys/user@v0.3.0
0.4.1
1
gitea/act_runner:latestb5c35d6bdbb9
github.com/moby/sys/user@v0.4.0
0.4.1
1
gitea/act_runner:0.3.1c2a169c5e998
github.com/moby/sys/user@v0.4.0
0.4.1
1
gitea/act_runner:0.2.11c57233403eff
github.com/moby/sys/user@v0.1.0
0.4.1
1
goharbor/trivy-adapter-photon:v2.14.35c6f7162804c
github.com/moby/sys/user@v0.4.0
0.4.1
1
goharbor/trivy-adapter-photon:devd051158f1fd0
github.com/moby/sys/user@v0.4.0
0.4.1
1
gradiant/open5gs-dbctl:0.10.3332031245fce
github.com/moby/sys/user@v0.1.0
0.4.1
1
grafana/alloy:v1.5.101a63f4e032c
github.com/moby/sys/user@v0.3.0
0.4.1
1
grafana/alloy:v1.4.306bdcbb51fc2
github.com/moby/sys/user@v0.1.0
0.4.1
1
grafana/alloy:v1.11.38c7256f412fe
github.com/moby/sys/user@v0.4.0
0.4.1
1
grafana/alloy:v1.12.2f94b1c82957a
github.com/moby/sys/user@v0.4.0
0.4.1
1
hashicorp/boundary:0.21.037bf86488b74
github.com/moby/sys/user@v0.4.0
0.4.1
1
hashicorp/boundary:latest76a201954ca0
github.com/moby/sys/user@v0.4.0
0.4.1
1
hfoxy4/kubefaas-builder:main-2afc7570bfb65aaad93
github.com/moby/sys/user@v0.1.0
0.4.1
1
itzg/bungeecord:latest7b7ff61d2a60
github.com/moby/sys/user@v0.1.0
0.4.1
1
itzg/minecraft-server:latest7b728e72b26b
github.com/moby/sys/user@v0.1.0
0.4.1
1
itzg/minecraft-server:2026.9.2de5d1b1a83eb
github.com/moby/sys/user@v0.1.0
0.4.1
1
kenchrcum/fluxcd-helm-upgrader:0.7.7c326e28a8f5f
github.com/moby/sys/user@v0.4.0
0.4.1
1
kubearmor/kubearmor:stablea08141311045
github.com/moby/sys/user@v0.4.0
0.4.1
1
kusionstack/kusion:v0.14.0126c8f0b0976
github.com/moby/sys/user@v0.3.0
0.4.1
1
layer5/meshery:stable-latest78a8be21bef3
github.com/moby/sys/user@v0.3.0
0.4.1
1
library/cassandra:4.00909b1681015
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/docker:29.3.0-dind-alpine3.231ba18449911d
github.com/moby/sys/user@v0.4.0
0.4.1
1
library/docker:27.0.1-dind2416984b43dd
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/docker:28.5.2-dind2a232a42256f
github.com/moby/sys/user@v0.4.0
0.4.1
1
library/docker:dind-rootless3acba49741f1
github.com/moby/sys/user@v0.4.0
0.4.1
1
library/docker:29.8.1-dind:dind:latest3f3c01aaaebf
github.com/moby/sys/user@v0.4.0
0.4.1
1
library/docker:dind7dcdfc4a2024
github.com/moby/sys/user@v0.4.0
0.4.1
1
library/docker:27-cli851f91d24121
github.com/moby/sys/user@v0.3.0
0.4.1
1
library/docker:28.3.3-dinda56b3bdde893
github.com/moby/sys/user@v0.4.0
0.4.1
1
library/docker:27-dindaa3df78ecf32
github.com/moby/sys/user@v0.3.0
0.4.1
1
library/docker:26.1-dinddd43b430341a
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/ghost:6.37.01ef2e532ca4d
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/ghost:6.25.12654b1e90413
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/ghost:6.41.129773d6be407
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/ghost:6.39.0-alpine77196da4b0df
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/ghost:6.65.090592b712b6b
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/ghost:6.65.0-alpine3.23fea3264f902e
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/influxdb:2.8983c696655e8
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mariadb:10.422edfe1c7834
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mariadb:12.0.25b6a1eac15b8
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mariadb:12.3.2628f228f0fd5
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mariadb:116422478cb8e1
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mariadb:11.8.46b848cb24fbb
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mariadb:10.6.218a16204dc96c
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mariadb:12.3.2a02fe89cb597
github.com/moby/sys/user@v0.1.0
0.4.1
1

syft 1.42.1 · advisories as of 9 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.