StackRadar

CVE-2026-61801

Medium

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
Medium
worst across findings
CVSS
5.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
630
of 18,071 indexed, latest versions
Container images
314
deployed by those charts
Fix available
1 of 1
affected package

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

Carried by container images the latest versions of 630 of 18,071 indexed charts deploy, on 314 images.

Affected packageAffected versionsFixed inImages
github.com/moby/sys/usergolangv0.1.0, v0.2.0, v0.3.0, v0.4.00.4.1314
OSV records
GHSA-mjcv-p78q-w5fw
Trending
Rank 20 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

630 by stars
ChartLatestAffected imagesRadar Score
category-microservicebusi-adsVerified publisher1.0.01 of 2See more

category-microservice busi-ads 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:latestbac22ea7710d
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

12,228
pages-microservicebusi-adsVerified publisher1.0.01 of 3See more

pages-microservice busi-ads 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
mariadbbysamioVerified publisher1.0.21 of 1See more

mariadb bysamio 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:12.0.2607835cd628b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,488
pagescamden-pages1.0.01 of 3See more

pages camden-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
geoservercamptocamp20.0.31 of 12See more

geoserver camptocamp2 0.0.3

1 of the 12 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:122f2a8c2a7d10
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

92,448
caninecanine0.1.101 of 7See more

canine canine 0.1.10

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/caninehq/canine:latest68b19aee1c64
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

17,581
ranchercarbide-charts2.15.22 of 2See more

rancher carbide-charts 2.15.2

2 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
rancher/rancher:v2.15.20c3d8e570255
github.com/moby/sys/user@v0.4.0
0.4.1
rancher/shell:v0.8.21eeed72d4eda
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

2,326
pagescarina-pages1.0.01 of 3See more

pages carina-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
pagescarmel-pages-dell1.0.01 of 3See more

pages carmel-pages-dell 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
castai-livecastaiVerified publisher0.140.21 of 1See more

castai-live castai 0.140.2

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/castai/images/clm:v0.140.2566f0c5ff554
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

860
catalyst-agentscatalyst-agents0.1.352 of 18See more

catalyst-agents catalyst-agents 0.1.35

2 of the 18 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/chaos-mesh/chaos-daemon:v2.8.369b1d3c09cfa
github.com/moby/sys/user@v0.4.0
0.4.1
ghcr.io/chaos-mesh/chaos-mesh:v2.8.3bdb31f3121a2
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

23,046
getoutlinecfi20171.2.01 of 4See more

getoutline cfi2017 1.2.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.06f3e42ad37de
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,287
opencvecfi20170.1.21 of 7See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.06f3e42ad37de
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

17,705
chart-appchart-app0.3.01 of 2See more

chart-app chart-app 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:86ea90827b110
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,826
chart-dnazarenochart-dnazareno0.1.01 of 3See more

chart-dnazareno chart-dnazareno 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:86ea90827b110
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,769
ghostchart-ghost0.1.61 of 2See more

ghost chart-ghost 0.1.6

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/ghost:6.65.0-alpine3.23fea3264f902e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,890
zksyncchronicleVerified publisher0.1.21 of 2See more

zksync chronicle 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:143e7dd0bfd7bf
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,974
vulnerability-operatorckotzbauerVerified publisher0.31.151 of 1See more

vulnerability-operator ckotzbauer 0.31.15

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/ckotzbauer/vulnerability-operator:0.28.167008df32715c
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

389
clairclair-helmVerified publisher0.12.01 of 3See more

clair clair-helm 0.12.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17-alpineb0f9560a2de0
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,246
ocs-operatorcloud-native-toolkit0.2.41 of 1See more

ocs-operator cloud-native-toolkit 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:lateste7965645fac6
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

452
refarch-infraconfigcloud-native-toolkit0.2.21 of 1See more

refarch-infraconfig cloud-native-toolkit 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:lateste7965645fac6
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

452
cloudvaultcloudvaultOfficialVerified publisher1.0.21 of 3See more

cloudvault cloudvault 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.3-alpine54451ecb8ab3
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,657
pulsarcloudve0.2.02 of 2See more

pulsar cloudve 0.2.0

2 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
galaxy/pulsar-kubernetes:0.15.7e50a890e24c9
github.com/moby/sys/user@v0.3.0
0.4.1
library/docker:dind0b6d18a4a222
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

7,030
clusterfactoryclusterfactory0.2.01 of 5See more

clusterfactory clusterfactory 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
gitea/act_runner:0.3.1c2a169c5e998
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

8,284
gitea-jenkinsclusterfactory0.1.11 of 5See more

gitea-jenkins clusterfactory 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
gitea/act_runner:latestb5c35d6bdbb9
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

8,026
door-agentcnoVerified publisher3.0.152 of 15See more

door-agent cno 3.0.15

2 of the 15 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/docker:27-cli851f91d24121
github.com/moby/sys/user@v0.3.0
0.4.1
library/docker:27-dindaa3df78ecf32
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

26,119
coderstudio-strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

coderstudio-strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:alpine77f585114c32
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,943
docker-composecoderstudio-strapi-devVerified publisher0.0.11 of 3See more

docker-compose coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:alpine77f585114c32
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,943
strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:alpine77f585114c32
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,943
mysqlcomet-mysql-helmVerified publisher1.0.81 of 1See more

mysql comet-mysql-helm 1.0.8

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.4.2ac80b6e09e5b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,832
dev-code-servercosmoVerified publisher0.0.71 of 2See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/docker:dind7dcdfc4a2024
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

16,666
cospacecospace0.0.341 of 3See more

cospace cospace 0.0.34

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:latestd4fdec0510ad
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,822
pagescrypticcode-helmchart1.0.01 of 3See more

pages crypticcode-helmchart 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
csghubcsghubVerified publisher2.5.02 of 34See more

csghub csghub 2.5.0

2 of the 34 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
opencsghq/csghub-server:v2.5.0-ee587046575c2c
github.com/moby/sys/user@v0.4.0
0.4.1
opencsghq/postgres:15.19b98600564e07
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

60,918
csgshipcsghubVerified publisher0.4.61 of 10See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
opencsghq/postgres:15.19b98600564e07
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

14,051
dataflowcsghubVerified publisher2.5.01 of 7See more

dataflow csghub 2.5.0

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
opencsghq/postgres:15.19b98600564e07
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

8,442
custom-rhcl-consolecustom-rhcl-consoleVerified publisher0.1.21 of 3See more

custom-rhcl-console custom-rhcl-console 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest10fef10863a3
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

2,297
pagesdalston-pages1.0.01 of 3See more

pages dalston-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
pagesdaman-dell-kuber1.0.01 of 3See more

pages daman-dell-kuber 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
damap-chartdamapVerified publisher0.3.11 of 5See more

damap-chart damap 0.3.1

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:161a6ab3f5345e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

18,812
dara-chartsdara-charts0.1.01 of 2See more

dara-charts dara-charts 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:1665b16a8b326e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,844
datacube-dashboarddatacube-charts0.5.101 of 2See more

datacube-dashboard datacube-charts 0.5.10

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:latestfc973eb97c9f
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,636
pagesdavid-pages1.0.01 of 3See more

pages david-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
pagesdebasish-pages1.0.01 of 3See more

pages debasish-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
airtraildefault-ghVerified publisher0.2.21 of 2See more

airtrail default-gh 0.2.2

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,019
challengedeneme0.1.01 of 2See more

challenge deneme 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:latestfc973eb97c9f
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,575
mysqldev-krishan-dhaka-charts1.0.11 of 1See more

mysql dev-krishan-dhaka-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.46ea90827b110
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

791
postgresdev-krishan-dhaka-charts1.0.21 of 1See more

postgres dev-krishan-dhaka-charts 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15-alpinef7d23353e1b1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

607
devops-diplomdevops-diplom-chartVerified publisher0.8.01 of 2See more

devops-diplom devops-diplom-chart 0.8.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:13-alpinefb9065b6e3e2
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,915
migration-incluster-cddevtron0.10.01 of 1See more

migration-incluster-cd devtron 0.10.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:122f2a8c2a7d10
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,908

Container images carrying it

314 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/codefresh/dind:3.0.250885ab519dac
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/fossa/postgres:17.2-15af45ac79f38
github.com/moby/sys/user@v0.1.0
0.4.1
1
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/kubescape/kubescape:v4.0.14418fa941ecc0
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/kubescape/node-agent:v0.3.2192044ed750f5e
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/nuclio/dashboard:1.17.9-amd64708fe10f099a
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/openshift/origin-cli:latest10fef10863a3
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/operator-framework/catalogd:v1.8.06ff40fa6257f
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/operator-framework/olm40d0363f4aa6
github.com/moby/sys/user@v0.1.0
0.4.1
1
quay.io/operator-framework/olm:v0.46.04404599eb7b7
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/operator-framework/operator-controller:v1.8.0bca5dfcc67ca
github.com/moby/sys/user@v0.4.0
0.4.1
1
quay.io/rhdh/rhdh-hub-rhel9:latest4f8c0f8a8ee0
github.com/moby/sys/user@v0.4.0
0.4.1
1
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao:v2.6.2-gitlab13bc2e20d60d1
github.com/moby/sys/user@v0.4.0
0.4.1
1
registry.gitlab.com/xrow-public/ci-tools/tools:mainaa62b23f2b5e
github.com/moby/sys/user@v0.4.0
0.4.1
1

syft 1.42.1 · advisories as of 9 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.