StackRadar

CVE-2026-61801

Medium

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
Medium
worst across findings
CVSS
5.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
630
of 18,071 indexed, latest versions
Container images
314
deployed by those charts
Fix available
1 of 1
affected package

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

Carried by container images the latest versions of 630 of 18,071 indexed charts deploy, on 314 images.

Affected packageAffected versionsFixed inImages
github.com/moby/sys/usergolangv0.1.0, v0.2.0, v0.3.0, v0.4.00.4.1314
OSV records
GHSA-mjcv-p78q-w5fw
Trending
Rank 20 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

630 by stars
ChartLatestAffected imagesRadar Score
postgresromanow-helm-chartsVerified publisher1.7.11 of 1See more

postgres romanow-helm-charts 1.7.1

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15724292da1f2e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,753
teamcityscalified-teamcityVerified publisher2026.2.01 of 3See more

teamcity scalified-teamcity 2026.2.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:14c2427de38f99
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,753
sceptresceptreai0.1.121 of 5See more

sceptre sceptreai 0.1.12

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
maponyacharles/sceptreai:postgresql-0.1.1258881351f309
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,551
securosecuroVerified publisher0.16.31 of 4See more

securo securo 0.16.3

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
pgvector/pgvector:pg167b822b0aac60
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,758
sentry-k8ssentry-k8sVerified publisher1.4.12 of 11See more

sentry-k8s sentry-k8s 1.4.1

2 of the 11 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:161a6ab3f5345e
github.com/moby/sys/user@v0.1.0
0.4.1
library/redis:6.2.20-alpine77697a75da9f
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

20,412
scaffoldsigstoreVerified publisher0.6.1171 of 15See more

scaffold sigstore 0.6.117

1 of the 15 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redisdigest-pinned148bb5411c18
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

10,691
postgresql-singlesinextraVerified publisher1.15.21 of 1See more

postgresql-single sinextra 1.15.2

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/sergelogvinov/postgresql:16.15fafb72e98f22
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,062
artifact-hubsoftonic1.19.02 of 8See more

artifact-hub softonic 1.19.0

2 of the 8 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
artifacthub/postgres:latest4fd34fa635cc
github.com/moby/sys/user@v0.1.0
0.4.1
artifacthub/scanner:v1.19.0323d026e78c3
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

17,986
stackradar-scannerstackradarVerified publisher0.4.01 of 1See more

stackradar-scanner stackradar 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/lockdep/stackradar-scanner:0.4.073cbeb990cf4
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

1,738
supabasesupabse0.8.02 of 11See more

supabase supabse 0.8.0

2 of the 11 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17-alpineb0f9560a2de0
github.com/moby/sys/user@v0.1.0
0.4.1
supabase/postgres:17.6.1.136f371b5f3f2ac
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,864
waldurwaldur-chartsVerified publisher8.1.21 of 3See more

waldur waldur-charts 8.1.2

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17d74eeac9a635
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,932
harborwener1.19.21 of 8See more

harbor wener 1.19.2

1 of the 8 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

2,723
wordpress-e2e-setupwoocommerce-e2e-setup0.1.11 of 2See more

wordpress-e2e-setup woocommerce-e2e-setup 0.1.1

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

9,273
wordpress-helmwordpress-helm0.2.91 of 4See more

wordpress-helm wordpress-helm 0.2.9

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:80744ee5ef89c
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

9,836
wraftwraft0.1.121 of 9See more

wraft wraft 0.1.12

1 of the 9 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:14-alpine4ea9e5ed0659
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,945
yugawareyugabyteVerified publisher2026.1.21 of 5See more

yugaware yugabyte 2026.1.2

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:14.232f439458ab6a
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,258
backendzymtraceOfficialVerified publisher26.10.01 of 6See more

backend zymtrace 26.10.0

1 of the 6 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17.4304ab8135187
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

10,907
airbyte-keycloakairbyteVerified publisher0.1.21 of 2See more

airbyte-keycloak airbyte 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17d74eeac9a635
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,753
airbyteairbyte-v2Verified publisher2.3.01 of 10See more

airbyte airbyte-v2 2.3.0

1 of the 10 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
airbyte/db:2.3.000cc017f0393
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

15,158
airports-postgresairports-postgres0.1.01 of 1See more

airports-postgres airports-postgres 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
postgis/postgis:latest01a6a70e41e6
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,803
akeyless-secrets-injectionakeyless-services-helmVerified publisher2.4.01 of 1See more

akeyless-secrets-injection akeyless-services-helm 2.4.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
akeyless/k8s-webhook-server:0.39.0996cd9afb3b4
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

608
pagesalstom-pages-app1.0.01 of 3See more

pages alstom-pages-app 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
buildkit-serviceandrcunsVerified publisher1.8.01 of 1See more

buildkit-service andrcuns 1.8.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
moby/buildkit:v0.31.0a095b3d11ce1
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

1,712
pagesandrei-pages1.0.01 of 3See more

pages andrei-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
games-on-whalesangelnu2.0.01 of 7See more

games-on-whales angelnu 2.0.0

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
andrewmackrodt/firefox-x11:142.0.1-r133f9080470c9
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

122,870
ddosifyanteonVerified publisher1.7.51 of 13See more

ddosify anteon 1.7.5

1 of the 13 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redis:7.2.4-alpinec8bb255c3559
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

30,964
antmediaantmediaVerified publisher3.1.01 of 4See more

antmedia antmedia 3.1.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:8.04968f22d0c6c
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,136
imagepullerapache-pulsar-helm-chart-repo1.0.11 of 2See more

imagepuller apache-pulsar-helm-chart-repo 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/docker:latest0b6d18a4a222
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

169
kesque-dashboardapache-pulsar-helm-chart-repo0.0.51 of 5See more

kesque-dashboard apache-pulsar-helm-chart-repo 0.0.5

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:latestd4fdec0510ad
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,570
persesappscodeVerified publisher2026.6.21 of 2See more

perses appscode 2026.6.2

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/appscode-images/postgres:18.3-bookworm8d320c6facbc
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,496
chart-app-vidapp-vid-chartVerified publisher0.0.71 of 2See more

chart-app-vid app-vid-chart 0.0.7

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:latestbac22ea7710d
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

8,953
appwriteappwrite-helmVerified publisher1.3.21 of 8See more

appwrite appwrite-helm 1.3.2

1 of the 8 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
appwrite/appwrite:1.9.01aaa70127114
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

12,920
arcadearcadeVerified publisher1.11.11 of 10See more

arcade arcade 1.11.1

1 of the 10 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17-alpineb0f9560a2de0
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

948
argocdargo-helm-charts1.0.01 of 3See more

argocd argo-helm-charts 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
public.ecr.aws/docker/library/redis:7.2.8-alpinec88ea2979a49
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

9,874
astrotrekastria0.0.22 of 4See more

astrotrek astria 0.0.2

2 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/astriaorg/astria-indexer:0.1.05cf1e5709820
github.com/moby/sys/user@v0.1.0
0.4.1
ghcr.io/astriaorg/astria-indexer-api:0.1.03490d9900af1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

36,695
graph-nodeastria0.2.21 of 3See more

graph-node astria 0.2.2

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:latestfc973eb97c9f
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,603
attestkeepattestkeepVerified publisher1.3.61 of 2See more

attestkeep attestkeep 1.3.6

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16.15-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,065
ragflowbaboulinet0.1.11 of 5See more

ragflow baboulinet 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.0.39ccb8f749bb5e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,943
helm-samplebehnambm-helm-chart1.0.11 of 3See more

helm-sample behnambm-helm-chart 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:86ea90827b110
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,966
pagesberrutig-pages1.0.01 of 3See more

pages berrutig-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
bdbablackduck2026.9.02 of 9See more

bdba blackduck 2026.9.0

2 of the 9 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
blackducksoftware/bdba-pgupgrader:2026.9.0b805c1f607e0
github.com/moby/sys/user@v0.1.0
0.4.1
library/postgres:15.19-bookworm539ceaaae49b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

9,870
blackduck-alertblackduck8.4.11 of 4See more

blackduck-alert blackduck 8.4.1

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
blackducksoftware/blackduck-alert-db:8.4.1ad33e84750f1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,038
boundary-softsciboundary-softsci0.2.41 of 1See more

boundary-softsci boundary-softsci 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
hashicorp/boundary:latest76a201954ca0
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

1,225
bitmagnetbrandan-schmitz-helm-chartsVerified publisher1.0.61 of 2See more

bitmagnet brandan-schmitz-helm-charts 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,472
pagesbrian-pages1.0.01 of 3See more

pages brian-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
pagesbrixton-mayuribhavsar23-pages1.0.01 of 3See more

pages brixton-mayuribhavsar23-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
pagesbrixton-pages1.0.01 of 3See more

pages brixton-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
postgresqlbuall-charts0.1.21 of 1See more

postgresql buall-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
buall/postgres-stack:18.6881a785642cb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,587
buildkitbuildkit0.1.01 of 1See more

buildkit buildkit 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
moby/buildkit:master-rootlessf3864381e463
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

601
buildkit-privilegedbuildkit-privileged0.1.01 of 1See more

buildkit-privileged buildkit-privileged 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
moby/buildkit:mastere7c131019aa9
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

601

Container images carrying it

314 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/codefresh/dind:3.0.250885ab519dac
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/fossa/postgres:17.2-15af45ac79f38
github.com/moby/sys/user@v0.1.0
0.4.1
1
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/kubescape/kubescape:v4.0.14418fa941ecc0
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/kubescape/node-agent:v0.3.2192044ed750f5e
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/nuclio/dashboard:1.17.9-amd64708fe10f099a
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/openshift/origin-cli:latest10fef10863a3
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/operator-framework/catalogd:v1.8.06ff40fa6257f
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/operator-framework/olm40d0363f4aa6
github.com/moby/sys/user@v0.1.0
0.4.1
1
quay.io/operator-framework/olm:v0.46.04404599eb7b7
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/operator-framework/operator-controller:v1.8.0bca5dfcc67ca
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/rhdh/rhdh-hub-rhel9:latest4f8c0f8a8ee0
github.com/moby/sys/user@v0.4.0
0.4.1
1
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao:v2.6.2-gitlab13bc2e20d60d1
github.com/moby/sys/user@v0.4.0
0.4.1
1
registry.gitlab.com/xrow-public/ci-tools/tools:mainaa62b23f2b5e
github.com/moby/sys/user@v0.4.0
0.4.1
1

syft 1.42.1 · advisories as of 9 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.