StackRadar

CVE-2026-61801

Medium

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
Medium
worst across findings
CVSS
5.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
630
of 18,071 indexed, latest versions
Container images
314
deployed by those charts
Fix available
1 of 1
affected package

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

Carried by container images the latest versions of 630 of 18,071 indexed charts deploy, on 314 images.

Affected packageAffected versionsFixed inImages
github.com/moby/sys/usergolangv0.1.0, v0.2.0, v0.3.0, v0.4.00.4.1314
OSV records
GHSA-mjcv-p78q-w5fw
Trending
Rank 20 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

630 by stars
ChartLatestAffected imagesRadar Score
mariadbgroundhog2k4.44.01 of 1See more

mariadb groundhog2k 4.44.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:11.8.46b848cb24fbb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,488
mongodbgroundhog2k0.8.31 of 1See more

mongodb groundhog2k 0.8.3

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:8.3.115d7043a4ffe0
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,370
heimdallheimdallOfficialVerified publisher3.3.31 of 2See more

heimdall heimdall 3.3.3

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17d74eeac9a635
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,759
dolibarrhelmforgeVerified publisher1.2.191 of 3See more

dolibarr helmforge 1.2.19

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:26.7.0ade067ae2fb1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,955
postgresqlhelmforgeVerified publisher2.0.51 of 1See more

postgresql helmforge 2.0.5

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.6-trixie5a5a84b19854
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,753
umamihelmforgeVerified publisher2.3.41 of 3See more

umami helmforge 2.3.4

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.6-trixie5a5a84b19854
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,058
hertzbeathertzbeatOfficialVerified publisher1.8.11 of 4See more

hertzbeat hertzbeat 1.8.1

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15724292da1f2e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

16,634
librechatlibrechat-openshiftVerified publisher1.9.01 of 3See more

librechat librechat-openshift 1.9.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:8.0.20098862b1339f
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,669
open5gsopen5gsVerified publisher2.3.81 of 5See more

open5gs open5gs 2.3.8

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
gradiant/open5gs-dbctl:0.10.3332031245fce
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

12,515
boundaryboundaryVerified publisher0.1.01 of 1See more

boundary boundary 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
hashicorp/boundary:0.21.037bf86488b74
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

2,037
ghostcloudpirates-ghostVerified publisher0.20.293 of 3See more

ghost cloudpirates-ghost 0.20.29

3 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/ghost:6.69.055131b90d48c
github.com/moby/sys/user@v0.1.0
0.4.1
library/mariadb:12.0.25b6a1eac15b8
github.com/moby/sys/user@v0.1.0
0.4.1
library/mariadb:13.0.2f1bba652ba57
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

8,221
clowardenclowarden0.2.31 of 4See more

clowarden clowarden 0.2.3

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
artifacthub/postgres:latest4fd34fa635cc
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

7,065
convertigoconvertigoOfficialVerified publisher8.4.51 of 5See more

convertigo convertigo 8.4.5

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
timescale/timescaledb:latest-pg166f139d560429
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

17,462
crossviewcrossviewOfficialVerified publisher4.6.01 of 2See more

crossview crossview 4.6.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:latest5a5a84b19854
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,024
flyte-binaryflyte2.0.511 of 4See more

flyte-binary flyte 2.0.51

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15-alpinef7d23353e1b1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,032
flyte-coreflyte2.0.511 of 3See more

flyte-core flyte 2.0.51

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15-alpinef7d23353e1b1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

843
ghost-on-kubernetesghost-on-kubernetes-helmVerified publisher2.0.21 of 3See more

ghost-on-kubernetes ghost-on-kubernetes-helm 2.0.2

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.46ea90827b110
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,658
openbaogitlabVerified publisher0.19.01 of 1See more

openbao gitlab 0.19.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao:v2.6.2-gitlab13bc2e20d60d1
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

1,656
gitvotegitvoteVerified publisher1.5.01 of 6See more

gitvote gitvote 1.5.0

1 of the 6 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
artifacthub/postgres:latest4fd34fa635cc
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

7,078
netbirdhelmforgeVerified publisher1.0.112 of 4See more

netbird helmforge 1.0.11

2 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.6-trixie5a5a84b19854
github.com/moby/sys/user@v0.1.0
0.4.1
netbirdio/netbird-server:0.79.0d1da0c0179c9
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

3,173
coreinstill-aiOfficialVerified publisher0.1.751 of 15See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15-alpinef7d23353e1b1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

13,536
kubearmorkubearmor1.7.51 of 4See more

kubearmor kubearmor 1.7.5

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
kubearmor/kubearmor:stablea08141311045
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

1,856
mariadbmariadbVerified publisher0.4.01 of 1See more

mariadb mariadb 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:10.117db29378d4fd
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,744
observalobservalVerified publisher1.14.01 of 8See more

observal observal 1.14.0

1 of the 8 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:161a6ab3f5345e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,380
repoflowrepoflow-helm-public0.9.11 of 8See more

repoflow repoflow-helm-public 0.9.1

1 of the 8 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16.24aea012537ed
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

14,419
supabaserock8sVerified publisher0.0.61 of 1See more

supabase rock8s 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15-alpinef7d23353e1b1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

607
lldapself-hosters-by-nightVerified publisher0.5.22 of 2See more

lldap self-hosters-by-night 0.5.2

2 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.11090bc3a8ccf
github.com/moby/sys/user@v0.1.0
0.4.1
ghcr.io/lldap/lldap:2025-05-193de697c3ba57
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,787
pretixtechwolf12Verified publisher2026.7.01 of 3See more

pretix techwolf12 2026.7.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.4a02db8cac496
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

12,101
feedbacksystemthm-mni-iiVerified publisher0.48.21 of 14See more

feedbacksystem thm-mni-ii 0.48.2

1 of the 14 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/thm-mni-ii/fbs-runner:v2.0.78a9f30ef6aa8
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

28,436
crossplaneupbound-stable2.4.2-up.11 of 5See more

crossplane upbound-stable 2.4.2-up.1

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:14c2427de38f99
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,753
wgerwgerOfficialVerified publisher2.0.01 of 7See more

wger wger 2.0.0

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15.186eb0add3b77c
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

9,028
windmillwindmill4.0.2801 of 3See more

windmill windmill 4.0.280

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:1874935e722416
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,636
buildkitdwiremindVerified publisher0.33.11 of 1See more

buildkitd wiremind 0.33.1

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
moby/buildkit:v0.32.2-rootless504731e577c2
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

1,536
agentareaagentareaVerified publisher0.0.262 of 17See more

agentarea agentarea 0.0.26

2 of the 17 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1
library/postgres:alpine77f585114c32
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

17,180
anteonanteonVerified publisher2.6.41 of 13See more

anteon anteon 2.6.4

1 of the 13 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redis:7.2.4-alpinec8bb255c3559
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

27,363
aramid-indexerbiatec-repoVerified publisher3.9.01 of 5See more

aramid-indexer biatec-repo 3.9.0

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:14c2427de38f99
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

16,706
self-hostbitwarden2.5.19 of 11See more

self-host bitwarden 2.5.1

9 of the 11 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/bitwarden/admin:2026.9.2e82f37409cce
github.com/moby/sys/user@v0.1.0
0.4.1
ghcr.io/bitwarden/api:2026.9.272abdfb33c83
github.com/moby/sys/user@v0.1.0
0.4.1
ghcr.io/bitwarden/attachments:2026.9.2a3e09f120b64
github.com/moby/sys/user@v0.1.0
0.4.1
ghcr.io/bitwarden/events:2026.9.2818a1d907fc4
github.com/moby/sys/user@v0.1.0
0.4.1
ghcr.io/bitwarden/icons:2026.9.25e23eaab3976
github.com/moby/sys/user@v0.1.0
0.4.1
ghcr.io/bitwarden/identity:2026.9.263037d60f7d8
github.com/moby/sys/user@v0.1.0
0.4.1
ghcr.io/bitwarden/notifications:2026.9.2029f0d8a576f
github.com/moby/sys/user@v0.1.0
0.4.1
ghcr.io/bitwarden/sso:2026.9.23ef058df2039
github.com/moby/sys/user@v0.1.0
0.4.1
ghcr.io/bitwarden/web:2026.9.10d9b5f239cb8
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,299
buildkit-fleetbuildkit-fleetVerified publisher0.1.21 of 1See more

buildkit-fleet buildkit-fleet 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
moby/buildkit:v0.33.0-rootless80b15f0735e8
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

1,211
pgvectorcagriekinVerified publisher2.4.11 of 3See more

pgvector cagriekin 2.4.1

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
pgvector/pgvector:0.8.5-pg18-trixie9d2e61c7352b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,457
cert-vaultcert-vaultOfficialVerified publisher2.12.01 of 7See more

cert-vault cert-vault 2.12.0

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17d74eeac9a635
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

18,561
claude-code-hubclaude-code-hub0.1.01 of 4See more

claude-code-hub claude-code-hub 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18-alpine77f585114c32
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,136
clustereye-stackclustereyeVerified publisher0.1.11 of 5See more

clustereye-stack clustereye 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17-alpineb0f9560a2de0
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,407
cluster-setupcluster-setup1.5.01 of 8See more

cluster-setup cluster-setup 1.5.0

1 of the 8 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
public.ecr.aws/docker/library/redis:7.2.8-alpinec88ea2979a49
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

14,148
dagrondagron-workflowVerified publisher0.10.01 of 3See more

dagron dagron-workflow 0.10.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,517
data-fairdata354-helmVerified publisher1.1.21 of 12See more

data-fair data354-helm 1.1.2

1 of the 12 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

42,740
kubedashdevopstalesOfficialVerified publisher4.0.01 of 8See more

kubedash devopstales 4.0.0

1 of the 8 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.3a9abf4275f9e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

12,282
dockyarddockyardVerified publisher0.5.01 of 1See more

dockyard dockyard 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/kgma74/dockyard:0.5.015d1d5769e91
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

2,022
domain-lockerdomain-locker0.3.11 of 2See more

domain-locker domain-locker 0.3.1

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15-alpinef7d23353e1b1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,117
dominodominoVerified publisher0.1.111 of 3See more

domino domino 0.1.11

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:134689940c6838
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

9,934
glpieftechcombr-glpiVerified publisher2.11.71 of 5See more

glpi eftechcombr-glpi 2.11.7

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:12.3.2a02fe89cb597
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,599

Container images carrying it

314 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/codefresh/dind:3.0.250885ab519dac
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/fossa/postgres:17.2-15af45ac79f38
github.com/moby/sys/user@v0.1.0
0.4.1
1
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/kubescape/kubescape:v4.0.14418fa941ecc0
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/kubescape/node-agent:v0.3.2192044ed750f5e
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/nuclio/dashboard:1.17.9-amd64708fe10f099a
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/openshift/origin-cli:latest10fef10863a3
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/operator-framework/catalogd:v1.8.06ff40fa6257f
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/operator-framework/olm40d0363f4aa6
github.com/moby/sys/user@v0.1.0
0.4.1
1
quay.io/operator-framework/olm:v0.46.04404599eb7b7
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/operator-framework/operator-controller:v1.8.0bca5dfcc67ca
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/rhdh/rhdh-hub-rhel9:latest4f8c0f8a8ee0
github.com/moby/sys/user@v0.4.0
0.4.1
1
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao:v2.6.2-gitlab13bc2e20d60d1
github.com/moby/sys/user@v0.4.0
0.4.1
1
registry.gitlab.com/xrow-public/ci-tools/tools:mainaa62b23f2b5e
github.com/moby/sys/user@v0.4.0
0.4.1
1

syft 1.42.1 · advisories as of 9 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.