StackRadar

CVE-2026-61801

Medium

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
Medium
worst across findings
CVSS
5.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
630
of 18,071 indexed, latest versions
Container images
314
deployed by those charts
Fix available
1 of 1
affected package

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

Carried by container images the latest versions of 630 of 18,071 indexed charts deploy, on 314 images.

Affected packageAffected versionsFixed inImages
github.com/moby/sys/usergolangv0.1.0, v0.2.0, v0.3.0, v0.4.00.4.1314
OSV records
GHSA-mjcv-p78q-w5fw
Trending
Rank 20 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

630 by stars
ChartLatestAffected imagesRadar Score
pagespages-sushi1.0.01 of 3See more

pages pages-sushi 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
pagespages-vasanth58141.0.01 of 3See more

pages pages-vasanth5814 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
pagespages-vjp1.0.01 of 3See more

pages pages-vjp 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
paperclippaperclip-helmVerified publisher0.3.01 of 3See more

paperclip paperclip-helm 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17-alpineb0f9560a2de0
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

607
parcaparca-rr0.1.01 of 2See more

parca parca-rr 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/parca-dev/parca-agent:v0.42.0adc0eeb4dd05
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

3,239
minecraftpaul1365972-mc3.0.11 of 1See more

minecraft paul1365972-mc 3.0.1

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
itzg/minecraft-server:latest7b728e72b26b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

38,590
pagespawan-pages1.0.01 of 3See more

pages pawan-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
pet-battle-infrapetbattle1.0.321 of 2See more

pet-battle-infra petbattle 1.0.32

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest486bf8e8f5b5
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

17,616
pet-battle-tournamentpetbattle1.0.401 of 3See more

pet-battle-tournament petbattle 1.0.40

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest486bf8e8f5b5
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

17,616
pagespighosh-pages1.0.01 of 3See more

pages pighosh-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
planectlplanectlVerified publisher0.7.02 of 10See more

planectl planectl 0.7.0

2 of the 10 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
gitea/act_runner:0.2.11c57233403eff
github.com/moby/sys/user@v0.1.0
0.4.1
library/redis:7.4.2-alpine02419de7eddf
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

31,062
libretimepodzone-chartsVerified publisher0.4.11 of 9See more

libretime podzone-charts 0.4.1

1 of the 9 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16.24aea012537ed
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

13,036
svc-postgrespostgres-fiap-lanches0.1.01 of 1See more

svc-postgres postgres-fiap-lanches 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:latest86c951e05bf5
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,753
pagesprasanthi1.0.01 of 3See more

pages prasanthi 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
prompt-dbprompt-dbVerified publisher1.0.71 of 3See more

prompt-db prompt-db 1.0.7

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,059
flaskDiaryptj-miniproject2.1.21 of 2See more

flaskDiary ptj-miniproject 2.1.2

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,654
powerdnspuckpuck2.0.01 of 4See more

powerdns puckpuck 2.0.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18-alpine77f585114c32
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,703
pumperlypumperlyVerified publisher0.2.01 of 3See more

pumperly pumperly 0.2.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
postgis/postgis:17-3.4-alpine5a1dbedac34e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,857
game-serverpvillaverdeVerified publisher1.0.61 of 1See more

game-server pvillaverde 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/itzg/minecraft-server:latest0c09bc50031e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,820
qantas-apiqantas-helm0.1.01 of 3See more

qantas-api qantas-helm 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:172d2b8998d310
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,636
unifiqaoruVerified publisher1.1.61 of 2See more

unifi qaoru 1.1.6

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:7.0-jammyf71f6d0913c9
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,976
qubivaqubiva0.3.21 of 3See more

qubiva qubiva 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:79854f7139445
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

8,053
buildkitquench-buildkitVerified publisher0.0.51 of 1See more

buildkit quench-buildkit 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/buildkitdigest-pinnedbf7f2eee87df
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

127
tykquench-tykVerified publisher0.0.231 of 2See more

tyk quench-tyk 0.0.23

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/tykdigest-pinned2d16b28a72f3
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

204
rad-pluginsradOfficialVerified publisher2.4.151 of 5See more

rad-plugins rad 2.4.15

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
public.ecr.aws/n8h5y2v5/rad-security/rad-sbom:v1.1.710f5aeaf1a77e
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

427
rancher-auto-registerrancher-auto-registerVerified publisher0.1.01 of 1See more

rancher-auto-register rancher-auto-register 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/ci-tools/tools:mainaa62b23f2b5e
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

2,399
pagesranjinigogga1.0.01 of 3See more

pages ranjinigogga 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
pagesrebecca-pages1.0.01 of 3See more

pages rebecca-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
gitops-operatorredhat-cop0.10.61 of 1See more

gitops-operator redhat-cop 0.10.6

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest486bf8e8f5b5
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

1,474
ploigosredhat-cop0.0.91 of 2See more

ploigos redhat-cop 0.0.9

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest486bf8e8f5b5
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

13,774
redminerestic-pvc-backupVerified publisher0.2.61 of 1See more

redmine restic-pvc-backup 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redmine:6.1.3-trixief474a901faec
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,471
retromretsamedocVerified publisher2026.2.51 of 1See more

retrom retsamedoc 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

8,297
olivetinrm3lVerified publisher0.2.01 of 1See more

olivetin rm3l 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/olivetin/olivetin:2025.2.19a89958921526
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

1,954
pagesroccohiggins-pages1.0.01 of 3See more

pages roccohiggins-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
matrix-stackrock8sVerified publisher0.8.11 of 7See more

matrix-stack rock8s 0.8.1

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17-alpineb0f9560a2de0
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

11,478
migration-incluster-cdromholdings0.10.01 of 1See more

migration-incluster-cd romholdings 0.10.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:122f2a8c2a7d10
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,908
rommromm-helm-chartVerified publisher1.5.51 of 3See more

romm romm-helm-chart 1.5.5

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:116422478cb8e1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,667
pagesronan-pages1.0.01 of 3See more

pages ronan-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
routehub-serverroutehub-helm1.0.11 of 3See more

routehub-server routehub-helm 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:latest74935e722416
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

8,032
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redis:7.2.4-alpinec8bb255c3559
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,900
spindlerubxkubeVerified publisher0.1.21 of 2See more

spindle rubxkube 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/docker:29.8.1-dind3f3c01aaaebf
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

1,683
tranquil-pdsrubxkubeVerified publisher0.2.01 of 2See more

tranquil-pds rubxkube 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18-alpine77f585114c32
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

616
rybbitrybbit-helm1.3.21 of 7See more

rybbit rybbit-helm 1.3.2

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15-alpinef7d23353e1b1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

8,545
housekeepersaashousekeeper1.0.01 of 14See more

housekeeper saashousekeeper 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,784
pagessamanvithkaranth1.0.01 of 3See more

pages samanvithkaranth 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
samplesample0.1.01 of 2See more

sample sample 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:noble61dd87ff554d
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,392
pagessarubits-pages1.0.01 of 3See more

pages sarubits-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
keycloaksb-helm-charts0.3.01 of 2See more

keycloak sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,957
mongodbsb-helm-charts0.4.01 of 1See more

mongodb sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:7.0.140032d2ca20db
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,120
mysqlsb-helm-charts0.4.01 of 1See more

mysql sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.4.3106d5197fd8e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,874

Container images carrying it

314 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
library/mariadb:12.2.2b1cb255a9939
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mariadb:12.3.3:latest:ltsdd9b303aed4f
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mariadb:11.7.2fcc7fcd7114a
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mongo:7.0.140032d2ca20db
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mongo:5.0.32-focal3b6c281e1c08
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mongo:8.04968f22d0c6c
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mongo:noble61dd87ff554d
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mongo:7.0.28-jammy88785f6f665a
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mongo:7.0.12ae1cf99fa7bf
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mongo:8d731d77bfd7a
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mongo:8.0.11dca8d11fe467
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mongo:8.2.12e0ce8c35124d
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mysql:8.4.3106d5197fd8e
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mysql:8:8.4:8.4.1185b9bf2e29cf
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mysql:8.4.108dbcf531a03a
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mysql:9.0.192dc86967801
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mysql:8.0-debian9382e4f6f7f0
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mysql:8.0.41bf577825b52a
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mysql:8.0.39ccb8f749bb5e
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mysql:8.0.40d58ac93387f6
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/mysql:9.7.2e2bde46db656
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:18.0073e7c8b84e2
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:14.232f439458ab6a
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:17.4304ab8135187
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:18.43a82e1f56c8f
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:143e7dd0bfd7bf
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:1642df6755a411
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:18.1-alpine3.2144d837eb4c2e
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:16.11468e1f126ca5
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:15.19-bookworm539ceaaae49b
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:16.6557fea37a744
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:17.5-alpine6567bca8d7bc
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:18.369e8582b781c
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:15.186eb0add3b77c
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:17.4-alpine7062a2109c4b
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:12-alpine7c8f48705831
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:157e2070cf6ad0
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:17.2-alpine7e5df973a748
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:18:18.6:18.6-trixie:latest86c951e05bf5
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:18.6-alpine3.23885cf05d376c
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:18.48ff36f3c6637
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:18.3a9abf4275f9e
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:14bdc3027c1610
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:15c67d80f67f76
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:15c961aa287d86
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:16ca0bd484cb98
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:14ceef4a62198b
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:17.10ebba4f4de37f
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:17.6-alpineef257d85f76e
github.com/moby/sys/user@v0.1.0
0.4.1
1
library/postgres:17.5-bookwormfbcea1bd13b6
github.com/moby/sys/user@v0.1.0
0.4.1
1

syft 1.42.1 · advisories as of 9 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.