StackRadar

CVE-2026-61801

Medium

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
Medium
worst across findings
CVSS
5.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
630
of 18,071 indexed, latest versions
Container images
314
deployed by those charts
Fix available
1 of 1
affected package

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

Carried by container images the latest versions of 630 of 18,071 indexed charts deploy, on 314 images.

Affected packageAffected versionsFixed inImages
github.com/moby/sys/usergolangv0.1.0, v0.2.0, v0.3.0, v0.4.00.4.1314
OSV records
GHSA-mjcv-p78q-w5fw
Trending
Rank 20 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

630 by stars
ChartLatestAffected imagesRadar Score
pagespages-sushi1.0.01 of 3See more

pages pages-sushi 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
pagespages-vasanth58141.0.01 of 3See more

pages pages-vasanth5814 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
pagespages-vjp1.0.01 of 3See more

pages pages-vjp 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
paperclippaperclip-helmVerified publisher0.3.01 of 3See more

paperclip paperclip-helm 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17-alpineb0f9560a2de0
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

607
parcaparca-rr0.1.01 of 2See more

parca parca-rr 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/parca-dev/parca-agent:v0.42.0adc0eeb4dd05
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

3,239
minecraftpaul1365972-mc3.0.11 of 1See more

minecraft paul1365972-mc 3.0.1

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
itzg/minecraft-server:latest7b728e72b26b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

38,590
pagespawan-pages1.0.01 of 3See more

pages pawan-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
pet-battle-infrapetbattle1.0.321 of 2See more

pet-battle-infra petbattle 1.0.32

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest486bf8e8f5b5
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

17,616
pet-battle-tournamentpetbattle1.0.401 of 3See more

pet-battle-tournament petbattle 1.0.40

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest486bf8e8f5b5
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

17,616
pagespighosh-pages1.0.01 of 3See more

pages pighosh-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
planectlplanectlVerified publisher0.7.02 of 10See more

planectl planectl 0.7.0

2 of the 10 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
gitea/act_runner:0.2.11c57233403eff
github.com/moby/sys/user@v0.1.0
0.4.1
library/redis:7.4.2-alpine02419de7eddf
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

31,062
libretimepodzone-chartsVerified publisher0.4.11 of 9See more

libretime podzone-charts 0.4.1

1 of the 9 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16.24aea012537ed
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

13,036
svc-postgrespostgres-fiap-lanches0.1.01 of 1See more

svc-postgres postgres-fiap-lanches 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:latest86c951e05bf5
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,753
pagesprasanthi1.0.01 of 3See more

pages prasanthi 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
prompt-dbprompt-dbVerified publisher1.0.71 of 3See more

prompt-db prompt-db 1.0.7

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,059
flaskDiaryptj-miniproject2.1.21 of 2See more

flaskDiary ptj-miniproject 2.1.2

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,654
powerdnspuckpuck2.0.01 of 4See more

powerdns puckpuck 2.0.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18-alpine77f585114c32
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,703
pumperlypumperlyVerified publisher0.2.01 of 3See more

pumperly pumperly 0.2.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
postgis/postgis:17-3.4-alpine5a1dbedac34e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,857
game-serverpvillaverdeVerified publisher1.0.61 of 1See more

game-server pvillaverde 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/itzg/minecraft-server:latest0c09bc50031e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,820
qantas-apiqantas-helm0.1.01 of 3See more

qantas-api qantas-helm 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:172d2b8998d310
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,636
unifiqaoruVerified publisher1.1.61 of 2See more

unifi qaoru 1.1.6

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:7.0-jammyf71f6d0913c9
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,976
qubivaqubiva0.3.21 of 3See more

qubiva qubiva 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:79854f7139445
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

8,053
buildkitquench-buildkitVerified publisher0.0.51 of 1See more

buildkit quench-buildkit 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/buildkitdigest-pinnedbf7f2eee87df
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

127
tykquench-tykVerified publisher0.0.231 of 2See more

tyk quench-tyk 0.0.23

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/tykdigest-pinned2d16b28a72f3
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

204
rad-pluginsradOfficialVerified publisher2.4.151 of 5See more

rad-plugins rad 2.4.15

1 of the 5 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
public.ecr.aws/n8h5y2v5/rad-security/rad-sbom:v1.1.710f5aeaf1a77e
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

427
rancher-auto-registerrancher-auto-registerVerified publisher0.1.01 of 1See more

rancher-auto-register rancher-auto-register 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/ci-tools/tools:mainaa62b23f2b5e
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

2,399
pagesranjinigogga1.0.01 of 3See more

pages ranjinigogga 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
pagesrebecca-pages1.0.01 of 3See more

pages rebecca-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
gitops-operatorredhat-cop0.10.61 of 1See more

gitops-operator redhat-cop 0.10.6

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest486bf8e8f5b5
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

1,474
ploigosredhat-cop0.0.91 of 2See more

ploigos redhat-cop 0.0.9

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:latest486bf8e8f5b5
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

13,774
redminerestic-pvc-backupVerified publisher0.2.61 of 1See more

redmine restic-pvc-backup 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redmine:6.1.3-trixief474a901faec
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,471
retromretsamedocVerified publisher2026.2.51 of 1See more

retrom retsamedoc 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/jmberesford/retrom-service:retrom-v0.7.144d763d58f11d
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

8,297
olivetinrm3lVerified publisher0.2.01 of 1See more

olivetin rm3l 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/olivetin/olivetin:2025.2.19a89958921526
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

1,954
pagesroccohiggins-pages1.0.01 of 3See more

pages roccohiggins-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
matrix-stackrock8sVerified publisher0.8.11 of 7See more

matrix-stack rock8s 0.8.1

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17-alpineb0f9560a2de0
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

11,478
migration-incluster-cdromholdings0.10.01 of 1See more

migration-incluster-cd romholdings 0.10.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:122f2a8c2a7d10
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,908
rommromm-helm-chartVerified publisher1.5.51 of 3See more

romm romm-helm-chart 1.5.5

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:116422478cb8e1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,667
pagesronan-pages1.0.01 of 3See more

pages ronan-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
routehub-serverroutehub-helm1.0.11 of 3See more

routehub-server routehub-helm 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:latest74935e722416
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

8,032
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redis:7.2.4-alpinec8bb255c3559
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,900
spindlerubxkubeVerified publisher0.1.21 of 2See more

spindle rubxkube 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/docker:29.8.1-dind3f3c01aaaebf
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

1,683
tranquil-pdsrubxkubeVerified publisher0.2.01 of 2See more

tranquil-pds rubxkube 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18-alpine77f585114c32
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

616
rybbitrybbit-helm1.3.21 of 7See more

rybbit rybbit-helm 1.3.2

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15-alpinef7d23353e1b1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

8,545
housekeepersaashousekeeper1.0.01 of 14See more

housekeeper saashousekeeper 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

4,784
pagessamanvithkaranth1.0.01 of 3See more

pages samanvithkaranth 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
samplesample0.1.01 of 2See more

sample sample 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:noble61dd87ff554d
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,392
pagessarubits-pages1.0.01 of 3See more

pages sarubits-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
keycloaksb-helm-charts0.3.01 of 2See more

keycloak sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,957
mongodbsb-helm-charts0.4.01 of 1See more

mongodb sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:7.0.140032d2ca20db
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,120
mysqlsb-helm-charts0.4.01 of 1See more

mysql sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.4.3106d5197fd8e
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,874

Container images carrying it

314 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1
91
library/postgres:18:18.6:latest74935e722416
github.com/moby/sys/user@v0.1.0
0.4.1
26
library/postgres:18:18.6:18.6-trixie:latest5a5a84b19854
github.com/moby/sys/user@v0.1.0
0.4.1
21
library/postgres:16.15-alpine:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1
21
library/postgres:18:18.6-trixie:latestfc973eb97c9f
github.com/moby/sys/user@v0.1.0
0.4.1
19
library/postgres:18.6-alpine:18.6-alpine3.24:18-alpine:alpine77f585114c32
github.com/moby/sys/user@v0.1.0
0.4.1
18
library/mysql:8:8.4:8.4.116ea90827b110
github.com/moby/sys/user@v0.1.0
0.4.1
17
library/postgres:17-alpineb0f9560a2de0
github.com/moby/sys/user@v0.1.0
0.4.1
14
library/postgres:15-alpinef7d23353e1b1
github.com/moby/sys/user@v0.1.0
0.4.1
12
library/mongo:9.0.2:latestbac22ea7710d
github.com/moby/sys/user@v0.1.0
0.4.1
10
library/mariadb:13.0.2:latestf1bba652ba57
github.com/moby/sys/user@v0.1.0
0.4.1
9
library/mysql:26.7.0:latestade067ae2fb1
github.com/moby/sys/user@v0.1.0
0.4.1
9
library/postgres:161a6ab3f5345e
github.com/moby/sys/user@v0.1.0
0.4.1
9
library/mariadb:10:10.117db29378d4fd
github.com/moby/sys/user@v0.1.0
0.4.1
6
library/postgres:18.4a02db8cac496
github.com/moby/sys/user@v0.1.0
0.4.1
6
library/postgres:17d74eeac9a635
github.com/moby/sys/user@v0.1.0
0.4.1
6
postgis/postgis:17-3.5:latest01a6a70e41e6
github.com/moby/sys/user@v0.1.0
0.4.1
6
library/mariadb:13.0.2:latestd4fdec0510ad
github.com/moby/sys/user@v0.1.0
0.4.1
5
library/mongo:4.44be76f674fc4
github.com/moby/sys/user@v0.1.0
0.4.1
5
library/mysql:26.7.0:latest9d48c42f8341
github.com/moby/sys/user@v0.1.0
0.4.1
5
library/postgres:122f2a8c2a7d10
github.com/moby/sys/user@v0.1.0
0.4.1
5
library/redis:7.4.2-alpine:7.4.2-alpine3.2102419de7eddf
github.com/moby/sys/user@v0.1.0
0.4.1
5
rancher/rancher:v2.15.20c3d8e570255
github.com/moby/sys/user@v0.4.0
0.4.1
5
rancher/shell:v0.8.21eeed72d4eda
github.com/moby/sys/user@v0.4.0
0.4.1
5
artifacthub/postgres:latest4fd34fa635cc
github.com/moby/sys/user@v0.1.0
0.4.1
4
library/mongo:5.0-focal5e15a3f014ed
github.com/moby/sys/user@v0.1.0
0.4.1
4
library/postgres:172d2b8998d310
github.com/moby/sys/user@v0.1.0
0.4.1
4
library/postgres:134689940c6838
github.com/moby/sys/user@v0.1.0
0.4.1
4
library/postgres:14c2427de38f99
github.com/moby/sys/user@v0.1.0
0.4.1
4
library/redis:7.2.4-alpinec8bb255c3559
github.com/moby/sys/user@v0.1.0
0.4.1
4
quay.io/openshift/origin-cli:latest486bf8e8f5b5
github.com/moby/sys/user@v0.4.0
0.4.1
4
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
github.com/moby/sys/user@v0.4.0
0.4.1
3
library/mongo:8:8.3.11:latest5d7043a4ffe0
github.com/moby/sys/user@v0.1.0
0.4.1
3
library/mongo:7:7.09854f7139445
github.com/moby/sys/user@v0.1.0
0.4.1
3
library/postgres:15.7-alpine:15.7-alpine3.20468d34fefd63
github.com/moby/sys/user@v0.1.0
0.4.1
3
library/postgres:14-alpine4ea9e5ed0659
github.com/moby/sys/user@v0.1.0
0.4.1
3
library/postgres:1665b16a8b326e
github.com/moby/sys/user@v0.1.0
0.4.1
3
library/postgres:18:18.6-trixie6737476511d4
github.com/moby/sys/user@v0.1.0
0.4.1
3
library/postgres:15724292da1f2e
github.com/moby/sys/user@v0.1.0
0.4.1
3
meshery/meshery:stable-latest44b64ee128fb
github.com/moby/sys/user@v0.4.0
0.4.1
3
opencsghq/postgres:15.19b98600564e07
github.com/moby/sys/user@v0.1.0
0.4.1
3
public.ecr.aws/docker/library/redis:7.2.8-alpinec88ea2979a49
github.com/moby/sys/user@v0.1.0
0.4.1
3
grafana/alloy:v1.8.17790f6f7fbd8
github.com/moby/sys/user@v0.3.0
0.4.1
2
hashicorp/boundary-enterprise:1.0.2-ent3a8061968ee4
github.com/moby/sys/user@v0.4.0
0.4.1
2
inaccel/daemon:latest093e1ea90ab8
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/docker:dind:latest0b6d18a4a222
github.com/moby/sys/user@v0.4.0
0.4.1
2
library/ghost:6.69.055131b90d48c
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/mariadb:11.41292844148b3
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/mariadb:10.623616f0bd3af
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/mariadb:12.3.3:lts2bdff1534a7e
github.com/moby/sys/user@v0.1.0
0.4.1
2

syft 1.42.1 · advisories as of 9 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.