CVE-2026-6238

Medium

Advisory

Published 28 Apr 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.5; base score, highest
EPSS: 0.004; 30th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,504; of 17,821 indexed, latest versions
Container images: 2,538; deployed by those charts
Fix available: 1 of 3; affected packages

CVE-2026-6238 affecting package glibc 2.38-21

Carried by container images the latest versions of 2,504 of 17,821 indexed charts deploy, on 2,538 images.

Affected package	Affected versions	Fixed in	Images
glibcdeb	2.23-0ubuntu5, 2.23-0ubuntu7, 2.23-0ubuntu9, 2.23-0ubuntu10+61 more	2.35-0ubuntu3.14, 2.39-0ubuntu8.8, 2.41-12+deb13u2+e5, 2.43-2ubuntu2.3	2,517
eglibcdeb	2.19-0ubuntu6.3, 2.19-0ubuntu6.6, 2.19-0ubuntu6.13, 2.19-0ubuntu6.14+1 more	no fix listed	7
glibcrpm	2.38-16.azl3, 2.38-18.azl3, 2.38-20.azl3	no fix listed	14

OSV records: DEBIAN-CVE-2026-6238 UBUNTU-CVE-2026-6238 AZL-85004 ECHO-916f-8705-1b52
Also known as: USN-8611-1

Charts affected

2,504 by stars

Chart

Latest

Affected images

Radar Score

changedetection-iozekker6

1.102.0

1 of 1 See more

changedetection-io zekker6 1.102.0

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container image	Digest	Package	Fixed in
ghcr.io/dgtlmoon/changedetection.io :0.60.7	096dae27b5d6	glibc@2.36-9+deb12u14	no fix listed

Open the chart page →

2,710

endlessh-gozekker6

0.4.0

1 of 1 See more

endlessh-go zekker6 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container image	Digest	Package	Fixed in
ghcr.io/shizunge/endlessh-go :2026.0730.0	8826dad32623	glibc@2.41-12+deb13u3	no fix listed

Open the chart page →

411

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container image	Digest	Package	Fixed in
library/nginx :latest	abe47724e466	glibc@2.41-12+deb13u4	no fix listed

Open the chart page →

1,593

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-6238.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	glibc@2.27-3ubuntu1.4	no fix listed
yandex/clickhouse-server :21.3.20	4eccfffb01d7	glibc@2.31-0ubuntu9.2	no fix listed

Open the chart page →

9,297

Container images carrying it

2,538 by charts deploying them

A fixed version is listed for 1 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
blackducksoftware/bdba-frontend :2026.6.3	b10eaea94fd3	glibc@2.41-12+deb13u3	no fix listed	1
blakeblackshear/frigate :0.10.0-amd64	ae269270ad9e	glibc@2.31-0ubuntu9.2	no fix listed	1
blockstream/bitcoind :27.2	9472492530e3	glibc@2.36-9+deb12u9	no fix listed	1
bloxstaking/ssv-node :v2.2.0	bf6d7d2fdc93	glibc@2.36-9+deb12u9	no fix listed	1
bmeares/meerschaum :2.8.4	8e9c5bacaa82	glibc@2.36-9+deb12u9	no fix listed	1
bnjbvr/kresus :0.22.1	37e216b182c8	glibc@2.36-9+deb12u9	no fix listed	1
boky/postfix :5.1.0 :v5.1.0	aafc77238423	glibc@2.41-12	no fix listed	1
boky/postfix :4.4.0	f3f247fd4252	glibc@2.36-9+deb12u9	no fix listed	1
boxcutter/meshcmd :1.1.3	84e13f01bcab	glibc@2.35-0ubuntu3.1	2.35-0ubuntu3.14	1
browserless/chrome :1.48.0-chrome-stable	c81ae5585b47	glibc@2.31-0ubuntu9.2	no fix listed	1
btcpayserver/tor :0.4.8.10	e9585b68dc6b	glibc@2.36-9+deb12u3	no fix listed	1
budibase/database :2.1.0	d90f656261c9	glibc@2.36-9+deb12u13	no fix listed	1
budibase/proxy :3.41.3	8d780b6ee602	glibc@2.41-12+deb13u3	no fix listed	1
bugsink/bugsink :2	ecdd84587746	glibc@2.41-12+deb13u3	no fix listed	1
burakince/mlflow :3.16.0	ab4b566644b9	glibc@2.41-12+deb13u3	no fix listed	1
calltelemetry/web :0.8.1-rc72	05d13269e350	glibc@2.36-9+deb12u8	no fix listed	1
camunda/zeebe :8.4.5	ab5abc09e407	glibc@2.35-0ubuntu3.6	2.35-0ubuntu3.14	1
carbone/carbone-ee :full-5.11.0	518172cbad49	glibc@2.41-12+deb13u3	no fix listed	1
carlosmz87/test_helm_backend :latest	8ffa63aa995d	glibc@2.36-9+deb12u9	no fix listed	1
castai/hibernate :v0.14	da62858c8381	glibc@2.41-12+deb13u3	no fix listed	1
castlemock/castlemock :latest	b7f3f1527ba9	glibc@2.39-0ubuntu8.4	2.39-0ubuntu8.8	1
castopod/castopod :1.12.10	1fd37280cbb2	glibc@2.36-9+deb12u8	no fix listed	1
castopod/castopod :1.15.5	4e4f0440520f	glibc@2.41-12+deb13u1	no fix listed	1
cbioportal/cbioportal :6.4.1-web-shenandoah	08debbd2dbf9	glibc@2.39-0ubuntu8.6	2.39-0ubuntu8.8	1
cccs/assemblyline-core :4.7.4.stable20	098127270065	glibc@2.36-9+deb12u14	no fix listed	1
cccs/assemblyline-rust :4.7.4.stable20	2be5e6a57427	glibc@2.36-9+deb12u14	no fix listed	1
cccs/assemblyline-socketio :4.7.4.stable20	2b88493b62f7	glibc@2.36-9+deb12u14	no fix listed	1
cccs/assemblyline-ui :4.7.4.stable20	efa75509b854	glibc@2.36-9+deb12u14	no fix listed	1
ceresdb/ceresdb-server :v1.0.0	53b2d0dbba1f	glibc@2.31-0ubuntu9.9	no fix listed	1
chaerr/kridge :demo-operator-v0.1.2	66833deec017	glibc@2.31-0ubuntu9.9	no fix listed	1
chainsafe/lodestar :v1.27.0	7b9fe4aa8073	glibc@2.36-9+deb12u9	no fix listed	1
chainsafe/lodestar :latest	d717e4193699	glibc@2.36-9+deb12u14	no fix listed	1
checkmk/check-mk-community :2.5.0p6	c11b422210c4	glibc@2.35-0ubuntu3.13	2.35-0ubuntu3.14	1
chetangautamm/repo :Opensips_Build	b4b94155ff5a	eglibc@2.19-0ubuntu6.15	no fix listed	1
chetangautamm/repo :sipp.v3	e7f7049e1544	glibc@2.31-0ubuntu9.1	no fix listed	1
cheveo/azp-agent :1.0.2	82240f890884	glibc@2.35-0ubuntu3.9	2.35-0ubuntu3.14	1
cheyang/distributed-tf :1.6.0	46cc34755493	glibc@2.23-0ubuntu10	no fix listed	1
chiefonboarding/chiefonboarding :v2.5.0	d0964135ea82	glibc@2.41-12+deb13u3	no fix listed	1
chocobozzz/peertube :v8.1.5	052712130691	glibc@2.41-12+deb13u3	no fix listed	1
chriseaton/adventureworks :latest	54c3384ce701	glibc@2.35-0ubuntu3.9	2.35-0ubuntu3.14	1
chromadb/chroma :1.5.7	fc8dc8e11fb2	glibc@2.41-12+deb13u2	no fix listed	1
circleci/runner :launch-agent	9bdc62f02162	glibc@2.31-0ubuntu9.16	no fix listed	1
ciscolabs/msm-nc :07102023	36d02faad958	glibc@2.35-0ubuntu3.1	2.35-0ubuntu3.14	1
citizenstig/httpbin :latest	b81c818ccb86	glibc@2.23-0ubuntu5	no fix listed	1
ckan/ckan-base :2.12.0	87ecf3f27ad6	glibc@2.36-9+deb12u14	no fix listed	1
ckan/ckan-solr :2.11-solr9	ef8e5d3e6be1	glibc@2.35-0ubuntu3.13	2.35-0ubuntu3.14	1
ckulka/baikal :0.10.1-nginx	434bdd162247	glibc@2.36-9+deb12u10	no fix listed	1
clickhouse/clickhouse-server :24.8	1ffa82edee00	glibc@2.31-0ubuntu9.16	no fix listed	1
clickhouse/clickhouse-server :24.4.1	2e6587b81a26	glibc@2.31-0ubuntu9.15	no fix listed	1
clickhouse/clickhouse-server :23.8	512bb8a21483	glibc@2.31-0ubuntu9.16	no fix listed	1