StackRadar

CVE-2026-6238

Medium

Advisory

Published 28 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.004
30th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,516
of 17,828 indexed, latest versions
Container images
2,552
deployed by those charts
Fix available
1 of 3
affected packages

CVE-2026-6238 affecting package glibc 2.38-21

Carried by container images the latest versions of 2,516 of 17,828 indexed charts deploy, on 2,552 images.

Affected packageAffected versionsFixed inImages
glibcdeb2.23-0ubuntu5, 2.23-0ubuntu7, 2.23-0ubuntu9, 2.23-0ubuntu10+61 more2.35-0ubuntu3.14, 2.39-0ubuntu8.8, 2.41-12+deb13u2+e5, 2.43-2ubuntu2.32,532
eglibcdeb2.19-0ubuntu6.3, 2.19-0ubuntu6.6, 2.19-0ubuntu6.13, 2.19-0ubuntu6.14+1 moreno fix listed7
glibcrpm2.38-16.azl3, 2.38-18.azl3, 2.38-20.azl3no fix listed13
OSV records
DEBIAN-CVE-2026-6238UBUNTU-CVE-2026-6238AZL-85004ECHO-916f-8705-1b52
Also known as
USN-8611-1

Charts affected

2,516 by stars
ChartLatestAffected imagesRadar Score
helm-composenousefreakVerified publisher0.1.32 of 2See more

helm-compose nousefreak 0.1.3

2 of the 2 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
library/mariadb:10.8.2-focal490f01279be1
glibc@2.31-0ubuntu9.2
no fix listed
library/wordpress:latesta85a30d9e752
glibc@2.41-12+deb13u4
no fix listed

Open the chart page →

13,684
nvidia-gpu-exporternvidia-gpu-exporterVerified publisher2.15.11 of 1See more

nvidia-gpu-exporter nvidia-gpu-exporter 2.15.1

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
utkuozdemir/nvidia_gpu_exporter:1.15.17aee2d42836a
glibc@2.41-12+deb13u3
no fix listed

Open the chart page →

279
nginx-s3olopostVerified publisher0.2.11 of 1See more

nginx-s3 olopost 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
ghcr.io/nginxinc/nginx-s3-gateway/nginx-oss-s3-gateway:unprivileged-oss3db8145349a3
glibc@2.36-9+deb12u8
no fix listed

Open the chart page →

5,115
growthbookone-acre-fundVerified publisher0.3.01 of 3See more

growthbook one-acre-fund 0.3.0

1 of the 3 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
growthbook/growthbook:latestcbf1bc59e9a9
glibc@2.36-9+deb12u14
no fix listed

Open the chart page →

1,161
onechartonechart-slVerified publisher0.76.01 of 1See more

onechart onechart-sl 0.76.0

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
glibc@2.41-12+deb13u4
no fix listed

Open the chart page →

1,589
opencatalogiopencatalogi1.0.62 of 8See more

opencatalogi opencatalogi 1.0.6

2 of the 8 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/gateway-ui:stag6a5594b7b32c
glibc@2.36-9
no fix listed
ghcr.io/opencatalogi/web-app:deva1a7f507f6ae
glibc@2.36-9+deb12u8
no fix listed

Open the chart page →

14,990
dhcp-serveropencord1.0.21 of 1See more

dhcp-server opencord 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
networkboot/dhcpd:lateste99bbfbd6fb2
glibc@2.35-0ubuntu3.1
2.35-0ubuntu3.14

Open the chart page →

4,398
librechatopenshift1.9.02 of 3See more

librechat openshift 1.9.0

2 of the 3 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
library/mongo:8.0.20098862b1339f
glibc@2.39-0ubuntu8.7
2.39-0ubuntu8.8
ghcr.io/bat-bs/bitnami-pgvector:pg1619ebe07b4daf
glibc@2.36-9+deb12u9
no fix listed

Open the chart page →

5,943
opentelemetry-demoopentelemetry-helmOfficialVerified publisher0.42.011 of 34See more

opentelemetry-demo opentelemetry-helm 0.42.0

11 of the 34 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
library/postgres:18.4a02db8cac496
glibc@2.41-12+deb13u3
no fix listed
ghcr.io/open-telemetry/demo:3.1.0-payment10d6bd20d8a0
glibc@2.36-9+deb12u13
no fix listed
ghcr.io/open-telemetry/demo:3.1.0-frontend28358db46206
glibc@2.41-12+deb13u4
no fix listed
ghcr.io/open-telemetry/demo:3.1.0-chatbot604b1f493c92
glibc@2.41-12+deb13u4
no fix listed
ghcr.io/open-telemetry/demo:3.1.0-shipping7130dba0e77e
glibc@2.41-12+deb13u4
no fix listed
ghcr.io/open-telemetry/demo:3.1.0-mcp81db69cdd0b6
glibc@2.41-12+deb13u4
no fix listed
ghcr.io/open-telemetry/demo:3.1.0-flagd-ui97a3d37e709f
glibc@2.41-12+deb13u4
no fix listed
ghcr.io/open-telemetry/demo:3.1.0-fraud-detectiona07ee694304b
glibc@2.36-9+deb12u13
no fix listed
ghcr.io/open-telemetry/demo:3.1.0-load-generatorb130d6cee6cb
glibc@2.36-9+deb12u14
no fix listed
ghcr.io/open-telemetry/demo:3.1.0-agentd0f4ae0b32a8
glibc@2.41-12+deb13u4
no fix listed
ghcr.io/open-telemetry/demo:3.1.0-addfd7a4697116
glibc@2.39-0ubuntu8.5
2.39-0ubuntu8.8

Open the chart page →

20,236
openvaultopenvaultVerified publisher0.8.11 of 2See more

openvault openvault 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/ov-wag:v1.1.06df27f944fe8
glibc@2.36-9+deb12u10
no fix listed

Open the chart page →

7,011
rustfs-operatoroperatorVerified publisher0.7.01 of 1See more

rustfs-operator operator 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
rustfs/operator:0.07b96f986e5991
glibc@2.36-9+deb12u14
no fix listed

Open the chart page →

1,015
opikopikOfficialVerified publisher2.2.722 of 13See more

opik opik 2.2.72

2 of the 13 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
library/zookeeper:3.9.4dfa9ba46d14b
glibc@2.35-0ubuntu3.13
2.35-0ubuntu3.14
redis/redis-stack-server:7.2.0-v10e44b2b49d059
glibc@2.35-0ubuntu3.6
2.35-0ubuntu3.14

Open the chart page →

14,981
opsopsVerified publisher1.2.01 of 2See more

ops ops 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
shaowenchen/ops-server:latest6bac5cebd125
glibc@2.35-0ubuntu3.10
2.35-0ubuntu3.14

Open the chart page →

91,111
ouriosouriosVerified publisher0.4.81 of 1See more

ourios ourios 0.4.8

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
ghcr.io/jensholdgaard/ourios:latest3d87d932391d
glibc@2.36-9+deb12u14
no fix listed

Open the chart page →

360
palworldpalworld-server-chartVerified publisher2.7.11 of 1See more

palworld palworld-server-chart 2.7.1

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
thijsvanloef/palworld-server-docker:v2.7.1401d3eb5c053
glibc@2.41-12+deb13u1
no fix listed

Open the chart page →

3,780
paperless-ngxpaperlessVerified publisher0.4.03 of 3See more

paperless-ngx paperless 0.4.0

3 of the 3 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
bitnamilegacy/postgresqldigest-pinned926356130b77
glibc@2.36-9+deb12u10
no fix listed
valkey/valkey:9.0.54c64dfeae602
glibc@2.41-12+deb13u3
no fix listed
ghcr.io/paperless-ngx/paperless-ngxdigest-pinnedaa810a36942c
glibc@2.41-12+deb13u3
no fix listed

Open the chart page →

8,685
uptime-kumapascaliskeVerified publisher3.0.01 of 1See more

uptime-kuma pascaliske 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.0.2-slim-rootless9865163f92c1
glibc@2.36-9+deb12u13
no fix listed

Open the chart page →

6,976
fahclientpcktdmp2.6.01 of 2See more

fahclient pcktdmp 2.6.0

1 of the 2 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
foldingathome/fah-gpu:latest5ef7742d1eb4
glibc@2.27-3ubuntu1.4
no fix listed

Open the chart page →

4,629
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
glibc@2.41-12+deb13u3
no fix listed

Open the chart page →

7,122
periscopeperiscopeVerified publisher1.1.61 of 1See more

periscope periscope 1.1.6

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
ghcr.io/gnana997/periscope:1.1.621b284fb00f2
glibc@2.36-9+deb12u14
no fix listed

Open the chart page →

862
spring-boot-api-apppiominVerified publisher0.3.111 of 1See more

spring-boot-api-app piomin 0.3.11

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
piomin/sample-spring-kotlin-microservice:1.1871f784dd6bc
glibc@2.35-0ubuntu3.1
2.35-0ubuntu3.14

Open the chart page →

7,667
playgroundplayground0.1.11 of 1See more

playground playground 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
library/nginx:latestabe47724e466
glibc@2.41-12+deb13u4
no fix listed

Open the chart page →

1,589
matomopockostVerified publisher1.3.02 of 3See more

matomo pockost 1.3.0

2 of the 3 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
library/redis:8.10.1298e5b3bc566
glibc@2.41-12+deb13u3
no fix listed
pockost/matomo:5.13.07f5d293cbe4e
glibc@2.41-12+deb13u3
no fix listed

Open the chart page →

5,355
portraitportraitVerified publisher0.2.132 of 8See more

portrait portrait 0.2.13

2 of the 8 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
library/elasticsearch:7.17.0332c6d416808
glibc@2.31-0ubuntu9.2
no fix listed
treskon/portrait-web-setup:DEV-latesta475d80e4ecf
glibc@2.36-9+deb12u9
no fix listed

Open the chart page →

32,167
postgresqlpostgresql-helm0.1.21 of 1See more

postgresql postgresql-helm 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
library/postgres:16a3b7f434b2dc
glibc@2.41-12+deb13u4
no fix listed

Open the chart page →

1,268
JenkinsprasoonjenkinsVerified publisher0.1.01 of 1See more

Jenkins prasoonjenkins 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
glibc@2.41-12+deb13u3
no fix listed

Open the chart page →

2,545
privacyideaprivacyidea1.0.61 of 2See more

privacyidea privacyidea 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
library/mariadb:11.7.2fcc7fcd7114a
glibc@2.39-0ubuntu8.4
2.39-0ubuntu8.8

Open the chart page →

5,597
prowlerprowler-appVerified publisher0.0.92 of 5See more

prowler prowler-app 0.0.9

2 of the 5 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
library/neo4j:2026.02.25ab4ab0358cf
glibc@2.41-12+deb13u2
no fix listed
prowlercloud/prowler-api:5.31.14f252d579be2
glibc@2.36-9+deb12u14
no fix listed

Open the chart page →

8,493
pzserverpzserver0.1.171 of 2See more

pzserver pzserver 0.1.17

1 of the 2 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
lis314/project-zomboid-docker:latestaa2089c37920
glibc@2.36-9+deb12u9
no fix listed

Open the chart page →

3,270
phpqonstruktVerified publisher0.2.01 of 1See more

php qonstrukt 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
qonstrukt/php:8.4-v8-apache089af7925aa1
glibc@2.39-0ubuntu8.7
2.39-0ubuntu8.8

Open the chart page →

56,167
minecraft-serverqumine0.1.15001 of 1See more

minecraft-server qumine 0.1.1500

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
qumine/minecraft-server:v0.1.15c0b650d51132
glibc@2.35-0ubuntu3.1
2.35-0ubuntu3.14

Open the chart page →

6,967
rabbitmqrabbitmq-magefleet1.2.01 of 1See more

rabbitmq rabbitmq-magefleet 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
library/rabbitmq:4.1.0-management935b3f84c1e4
glibc@2.39-0ubuntu8.4
2.39-0ubuntu8.8

Open the chart page →

2,889
napcatredish101Verified publisher0.1.31 of 1See more

napcat redish101 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
mlikiowa/napcat-docker:latest2cc70b45244a
glibc@2.35-0ubuntu3.8
2.35-0ubuntu3.14

Open the chart page →

66,280
redis-sentinel-gatewayredis-sentinel-gatewayVerified publisher1.0.21 of 1See more

redis-sentinel-gateway redis-sentinel-gateway 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
promzeus/redis-sentinel-gateway:v182f6d56e280b
glibc@2.36-9+deb12u8
no fix listed

Open the chart page →

2,700
redmineredmine-helm-chartVerified publisher0.2.61 of 1See more

redmine redmine-helm-chart 0.2.6

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
library/redmine:6.1.3-trixief474a901faec
glibc@2.41-12+deb13u3
no fix listed

Open the chart page →

4,278
reportportalreportportal-ioOfficialVerified publisher26.8.123 of 15See more

reportportal reportportal-io 26.8.12

3 of the 15 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2025.7.23-debian-12-r08935e75fa5d1
glibc@2.36-9+deb12u10
no fix listed
library/postgres:18.4a02db8cac496
glibc@2.41-12+deb13u3
no fix listed
reportportal/service-auto-analyzer:5.15.5c449b93629a5
glibc@2.41-12+deb13u3
no fix listed

Open the chart page →

12,327
resurfaceresurfaceioVerified publisher3.9.01 of 3See more

resurface resurfaceio 3.9.0

1 of the 3 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
resurfaceio/resurface:3.7.84d5cda2f64109
glibc@2.35-0ubuntu3.9
2.35-0ubuntu3.14

Open the chart page →

7,283
retyc-csiretyc-csi0.2.01 of 3See more

retyc-csi retyc-csi 0.2.0

1 of the 3 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
ghcr.io/retyc/retyc-k8s-csi:v0.2.01521d4baeb85
glibc@2.41-12+deb13u3
no fix listed

Open the chart page →

1,416
atuinrm3lVerified publisher0.11.02 of 3See more

atuin rm3l 0.11.0

2 of the 3 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:16.2.0-debian-12-r890fda44bfa42
glibc@2.36-9+deb12u4
no fix listed
ghcr.io/atuinsh/atuin:18.12.0e953fa9e36ef
glibc@2.36-9+deb12u13
no fix listed

Open the chart page →

6,644
dev-feedrm3lVerified publisher3.1.21 of 3See more

dev-feed rm3l 3.1.2

1 of the 3 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
bitnamilegacy/mariadb:11.4.3-debian-12-r08b3778160e34
glibc@2.36-9+deb12u7
no fix listed

Open the chart page →

9,962
service-names-port-numbersrm3lVerified publisher0.26.11 of 1See more

service-names-port-numbers rm3l 0.26.1

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
rm3l/service-names-port-numbers:0.12.162d1cc4223e5
glibc@2.31-0ubuntu9.2
no fix listed

Open the chart page →

10,207
kimai2robjuz5.0.141 of 2See more

kimai2 robjuz 5.0.14

1 of the 2 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
kimai/kimai2:2.67.03084f1e5ecdc
glibc@2.36-9+deb12u14
no fix listed

Open the chart page →

4,775
rocketadminrocketadminOfficialVerified publisher1.0.421 of 1See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
rocketadmin/rocketadmin:1.17.710955ef540b9
glibc@2.36-9+deb12u13
no fix listed

Open the chart page →

5,705
elasticsearchromanow-helm-chartsVerified publisher1.7.11 of 2See more

elasticsearch romanow-helm-charts 1.7.1

1 of the 2 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
library/elasticsearch:7.17.8fdc73b3249c1
glibc@2.31-0ubuntu9.9
no fix listed

Open the chart page →

6,166
fluent-bitromanow-helm-chartsVerified publisher1.7.31 of 1See more

fluent-bit romanow-helm-charts 1.7.3

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
fluent/fluent-bit:4.0-debuge76397ef3983
glibc@2.36-9+deb12u13
no fix listed

Open the chart page →

8,022
kibanaromanow-helm-chartsVerified publisher1.7.11 of 1See more

kibana romanow-helm-charts 1.7.1

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
library/kibana:7.17.8c5781ba340ef
glibc@2.31-0ubuntu9.9
no fix listed

Open the chart page →

6,988
kube-state-metricsromanow-helm-chartsVerified publisher1.7.21 of 1See more

kube-state-metrics romanow-helm-charts 1.7.2

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
bitnamilegacy/kube-state-metrics:204a3044b384b
glibc@2.36-9+deb12u10
no fix listed

Open the chart page →

2,716
logstashromanow-helm-chartsVerified publisher1.5.01 of 1See more

logstash romanow-helm-charts 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
library/logstash:7.17.817a4f64e9cf5
glibc@2.31-0ubuntu9.9
no fix listed

Open the chart page →

7,627
postgresromanow-helm-chartsVerified publisher1.7.11 of 1See more

postgres romanow-helm-charts 1.7.1

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
library/postgres:15dfbbb0ad8cab
glibc@2.41-12+deb13u4
no fix listed

Open the chart page →

1,268
routehub-client-hubroutehub-helm1.0.01 of 3See more

routehub-client-hub routehub-helm 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-6238.

Container imageDigestPackageFixed in
eqalpha/keydb:latest6537505c4235
glibc@2.31-0ubuntu9.12
no fix listed

Open the chart page →

13,069

Container images carrying it

2,552 by charts deploying them

A fixed version is listed for 1 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/nfsplugin:v4.13.41eb5a85180a4
glibc@2.36-9+deb12u14
no fix listed
1
registry.k8s.io/sig-storage/nfsplugin:v4.11.0ce5b5ccd5eb0
glibc@2.36-9+deb12u10
no fix listed
1

syft 1.42.1 · advisories as of 22 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.