StackRadar

CVE-2026-61801

Medium

Advisory

Published 8 Oct 2026In the index since 9 Oct 2026
Severity
Medium
worst across findings
CVSS
5.5
base score, highest
EPSS
—
probability of exploitation
CISA KEV
Not listed
no confirmed exploitation
Charts affected
630
of 18,071 indexed, latest versions
Container images
314
deployed by those charts
Fix available
1 of 1
affected package

github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files

Carried by container images the latest versions of 630 of 18,071 indexed charts deploy, on 314 images.

Affected packageAffected versionsFixed inImages
github.com/moby/sys/usergolangv0.1.0, v0.2.0, v0.3.0, v0.4.00.4.1314
OSV records
GHSA-mjcv-p78q-w5fw
Trending
Rank 20 in indexed charts, since 9 Oct 2026. See the ranking →

Charts affected

630 by stars
ChartLatestAffected imagesRadar Score
nextcloudsb-helm-charts0.4.01 of 2See more

nextcloud sb-helm-charts 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

11,268
postgresqlsb-helm-charts0.4.01 of 1See more

postgresql sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16.11468e1f126ca5
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,003
redissb-helm-charts0.4.01 of 1See more

redis sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redis:7.4.1-alpinec1e88455c852
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,103
wordpresssb-helm-charts0.4.01 of 2See more

wordpress sb-helm-charts 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.0-debian9382e4f6f7f0
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

15,210
postgresscalified-postgresVerified publisher18.4.01 of 1See more

postgres scalified-postgres 18.4.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.4a02db8cac496
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,258
sonarqubescalified-sonarqubeVerified publisher26.9.01 of 2See more

sonarqube scalified-sonarqube 26.9.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

607
secret-managersecret-managerVerified publisher1.0.01 of 4See more

secret-manager secret-manager 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:9.0.192dc86967801
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

7,359
pagessekharpkube1.0.01 of 3See more

pages sekharpkube 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
postgresself-hosters-by-nightVerified publisher0.14.31 of 1See more

postgres self-hosters-by-night 0.14.3

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.11090bc3a8ccf
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,003
service-exampleservice-example-10.1.01 of 7See more

service-example service-example-1 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:latestbac22ea7710d
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

11,195
serviceexampleserviceexample-chart0.3.01 of 4See more

serviceexample serviceexample-chart 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:latestbac22ea7710d
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,821
serviceexampleservice-example-helm-chart0.1.01 of 4See more

serviceexample service-example-helm-chart 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:latestbac22ea7710d
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,891
first-chartshashkist-test0.1.01 of 3See more

first-chart shashkist-test 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:latest9d48c42f8341
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,680
pagesshrutiujlan-pages1.0.01 of 3See more

pages shrutiujlan-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
hedgedocsi-gitops0.12.31 of 2See more

hedgedoc si-gitops 0.12.3

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:18.43a82e1f56c8f
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,736
postgresqlsignoz0.0.21 of 1See more

postgresql signoz 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15c961aa287d86
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,636
olmsikalabs0.3.01 of 2See more

olm sikalabs 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
quay.io/operator-framework/olmdigest-pinned40d0363f4aa6
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,738
sikalabs-harbor-master-snapshotsikalabs2023.6.201 of 8See more

sikalabs-harbor-master-snapshot sikalabs 2023.6.20

1 of the 8 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:devd051158f1fd0
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

2,601
pgbouncersinextraVerified publisher0.17.01 of 1See more

pgbouncer sinextra 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/sergelogvinov/pgbouncer:16.1518f1121ba0a4
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,445
teamcitysinextraVerified publisher1.0.21 of 3See more

teamcity sinextra 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/docker:26.1-dinddd43b430341a
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

2,993
mariadbsitepilot1.0.31 of 1See more

mariadb sitepilot 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:10.623616f0bd3af
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,168
oi-slurm-cluster-chartslurm-cluster-chart0.25.11 of 4See more

oi-slurm-cluster-chart slurm-cluster-chart 0.25.1

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:10.10334b315c10e5
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,482
slurm-cluster-chartslurm-cluster-chart0.25.01 of 4See more

slurm-cluster-chart slurm-cluster-chart 0.25.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mariadb:10.10334b315c10e5
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,482
axonhubsnubisks0.1.01 of 3See more

axonhub snubisks 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

924
buildkitsomaz94Verified publisher0.1.41 of 1See more

buildkit somaz94 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
moby/buildkit:v0.33.06c2fa84a6b61
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

1,041
spacecapybara-chartspacecapy1.0.491 of 2See more

spacecapybara-chart spacecapy 1.0.49

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

13,224
pagessrinipages1.0.01 of 3See more

pages srinipages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
steadybit-agentsteadybit3.1.1792 of 6See more

steadybit-agent steadybit 3.1.179

2 of the 6 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/steadybit/extension-container:v1.8.2a1ce3f58f354
github.com/moby/sys/user@v0.4.0
0.4.1
ghcr.io/steadybit/extension-host:v1.8.332740e34b30a
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

4,957
pagesstephendillondell1.0.01 of 3See more

pages stephendillondell 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
orchestratorsubstraVerified publisher8.8.01 of 3See more

orchestrator substra 8.8.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17c6222b54873a
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,558
substra-backendsubstraVerified publisher26.15.31 of 7See more

substra-backend substra 26.15.3

1 of the 7 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:172d2b8998d310
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,158
pagessunilb2590-pages1.0.01 of 3See more

pages sunilb2590-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
icinga2svtech-public-helm-charts1.0.01 of 4See more

icinga2 svtech-public-helm-charts 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/redis:7.2.3a7cee7c8178f
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,965
stateful-data-generatortalhajuikar-helm-charts0.1.21 of 2See more

stateful-data-generator talhajuikar-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:4.44be76f674fc4
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

5,595
act-runnertektonops0.1.21 of 2See more

act-runner tektonops 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
gitea/act_runner:nightly7940221bcfc9
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

5,224
supabaseteochenglim0.1.21 of 13See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:15-alpinef7d23353e1b1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

10,917
terminusterminusVerified publisher1.1.01 of 1See more

terminus terminus 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
ghcr.io/terminus-io/enforcer:v1.1.0f21b905610d6
github.com/moby/sys/user@v0.4.0
0.4.1

Open the chart page →

979
pagestest43221.0.01 of 3See more

pages test4322 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
flask-contactstest-configmap1.0.11 of 3See more

flask-contacts test-configmap 1.0.1

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,392
the0the0Verified publisher0.11.12 of 9See more

the0 the0 0.11.1

2 of the 9 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mongo:7-jammyf71f6d0913c9
github.com/moby/sys/user@v0.1.0
0.4.1
library/postgres:15-alpinef7d23353e1b1
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,924
thingsboardthingsboardVerified publisher0.1.31 of 12See more

thingsboard thingsboard 0.1.3

1 of the 12 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:122f2a8c2a7d10
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

29,668
pagesthiru-pages1.0.01 of 3See more

pages thiru-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
pagesthuy-pages1.0.01 of 3See more

pages thuy-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

21,258
todolist-charttodolist-chart0.1.71 of 10See more

todolist-chart todolist-chart 0.1.7

1 of the 10 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

7,433
netbirdtotmicro1.8.21 of 4See more

netbird totmicro 1.8.2

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
netbirdio/management:0.60.252682e5f48f9
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

7,601
apptreenityVerified publisher0.1.531 of 2See more

app treenity 0.1.53

1 of the 2 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:17c6222b54873a
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

1,649
treenitytreenityVerified publisher0.1.31 of 4See more

treenity treenity 0.1.3

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:14ceef4a62198b
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,852
harbor-scanner-trivytrivy-operator0.31.21 of 1See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.31.26e790e233872
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

3,005
traceetrivy-operator0.24.11 of 1See more

tracee trivy-operator 0.24.1

1 of the 1 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
aquasec/tracee:0.24.1cfbbfee972e6
github.com/moby/sys/user@v0.3.0
0.4.1

Open the chart page →

1,660
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-61801.

Container imageDigestPackageFixed in
library/postgres:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1

Open the chart page →

6,641

Container images carrying it

314 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
library/mysql:8.07dcddc01f13b
github.com/moby/sys/user@v0.1.0
0.4.1
91
library/postgres:18:18.6:latest74935e722416
github.com/moby/sys/user@v0.1.0
0.4.1
26
library/postgres:18:18.6:18.6-trixie:latest5a5a84b19854
github.com/moby/sys/user@v0.1.0
0.4.1
21
library/postgres:16.15-alpine:16-alpine721873c34ceb
github.com/moby/sys/user@v0.1.0
0.4.1
21
library/postgres:18:18.6-trixie:latestfc973eb97c9f
github.com/moby/sys/user@v0.1.0
0.4.1
19
library/postgres:18.6-alpine:18.6-alpine3.24:18-alpine:alpine77f585114c32
github.com/moby/sys/user@v0.1.0
0.4.1
18
library/mysql:8:8.4:8.4.116ea90827b110
github.com/moby/sys/user@v0.1.0
0.4.1
17
library/postgres:17-alpineb0f9560a2de0
github.com/moby/sys/user@v0.1.0
0.4.1
14
library/postgres:15-alpinef7d23353e1b1
github.com/moby/sys/user@v0.1.0
0.4.1
12
library/mongo:9.0.2:latestbac22ea7710d
github.com/moby/sys/user@v0.1.0
0.4.1
10
library/mariadb:13.0.2:latestf1bba652ba57
github.com/moby/sys/user@v0.1.0
0.4.1
9
library/mysql:26.7.0:latestade067ae2fb1
github.com/moby/sys/user@v0.1.0
0.4.1
9
library/postgres:161a6ab3f5345e
github.com/moby/sys/user@v0.1.0
0.4.1
9
library/mariadb:10:10.117db29378d4fd
github.com/moby/sys/user@v0.1.0
0.4.1
6
library/postgres:18.4a02db8cac496
github.com/moby/sys/user@v0.1.0
0.4.1
6
library/postgres:17d74eeac9a635
github.com/moby/sys/user@v0.1.0
0.4.1
6
postgis/postgis:17-3.5:latest01a6a70e41e6
github.com/moby/sys/user@v0.1.0
0.4.1
6
library/mariadb:13.0.2:latestd4fdec0510ad
github.com/moby/sys/user@v0.1.0
0.4.1
5
library/mongo:4.44be76f674fc4
github.com/moby/sys/user@v0.1.0
0.4.1
5
library/mysql:26.7.0:latest9d48c42f8341
github.com/moby/sys/user@v0.1.0
0.4.1
5
library/postgres:122f2a8c2a7d10
github.com/moby/sys/user@v0.1.0
0.4.1
5
library/redis:7.4.2-alpine:7.4.2-alpine3.2102419de7eddf
github.com/moby/sys/user@v0.1.0
0.4.1
5
rancher/rancher:v2.15.20c3d8e570255
github.com/moby/sys/user@v0.4.0
0.4.1
5
rancher/shell:v0.8.21eeed72d4eda
github.com/moby/sys/user@v0.4.0
0.4.1
5
artifacthub/postgres:latest4fd34fa635cc
github.com/moby/sys/user@v0.1.0
0.4.1
4
library/mongo:5.0-focal5e15a3f014ed
github.com/moby/sys/user@v0.1.0
0.4.1
4
library/postgres:172d2b8998d310
github.com/moby/sys/user@v0.1.0
0.4.1
4
library/postgres:134689940c6838
github.com/moby/sys/user@v0.1.0
0.4.1
4
library/postgres:14c2427de38f99
github.com/moby/sys/user@v0.1.0
0.4.1
4
library/redis:7.2.4-alpinec8bb255c3559
github.com/moby/sys/user@v0.1.0
0.4.1
4
quay.io/openshift/origin-cli:latest486bf8e8f5b5
github.com/moby/sys/user@v0.4.0
0.4.1
4
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
github.com/moby/sys/user@v0.4.0
0.4.1
3
library/mongo:8:8.3.11:latest5d7043a4ffe0
github.com/moby/sys/user@v0.1.0
0.4.1
3
library/mongo:7:7.09854f7139445
github.com/moby/sys/user@v0.1.0
0.4.1
3
library/postgres:15.7-alpine:15.7-alpine3.20468d34fefd63
github.com/moby/sys/user@v0.1.0
0.4.1
3
library/postgres:14-alpine4ea9e5ed0659
github.com/moby/sys/user@v0.1.0
0.4.1
3
library/postgres:1665b16a8b326e
github.com/moby/sys/user@v0.1.0
0.4.1
3
library/postgres:18:18.6-trixie6737476511d4
github.com/moby/sys/user@v0.1.0
0.4.1
3
library/postgres:15724292da1f2e
github.com/moby/sys/user@v0.1.0
0.4.1
3
meshery/meshery:stable-latest44b64ee128fb
github.com/moby/sys/user@v0.4.0
0.4.1
3
opencsghq/postgres:15.19b98600564e07
github.com/moby/sys/user@v0.1.0
0.4.1
3
public.ecr.aws/docker/library/redis:7.2.8-alpinec88ea2979a49
github.com/moby/sys/user@v0.1.0
0.4.1
3
grafana/alloy:v1.8.17790f6f7fbd8
github.com/moby/sys/user@v0.3.0
0.4.1
2
hashicorp/boundary-enterprise:1.0.2-ent3a8061968ee4
github.com/moby/sys/user@v0.4.0
0.4.1
2
inaccel/daemon:latest093e1ea90ab8
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/docker:dind:latest0b6d18a4a222
github.com/moby/sys/user@v0.4.0
0.4.1
2
library/ghost:6.69.055131b90d48c
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/mariadb:11.41292844148b3
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/mariadb:10.623616f0bd3af
github.com/moby/sys/user@v0.1.0
0.4.1
2
library/mariadb:12.3.3:lts2bdff1534a7e
github.com/moby/sys/user@v0.1.0
0.4.1
2

syft 1.42.1 · advisories as of 9 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.