CVE-2026-6238

Medium

Advisory

Published 28 Apr 2026In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.5; base score, highest
EPSS: 0.004; 30th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,504; of 17,821 indexed, latest versions
Container images: 2,538; deployed by those charts
Fix available: 1 of 3; affected packages

CVE-2026-6238 affecting package glibc 2.38-21

Carried by container images the latest versions of 2,504 of 17,821 indexed charts deploy, on 2,538 images.

Affected package	Affected versions	Fixed in	Images
glibcdeb	2.23-0ubuntu5, 2.23-0ubuntu7, 2.23-0ubuntu9, 2.23-0ubuntu10+61 more	2.35-0ubuntu3.14, 2.39-0ubuntu8.8, 2.41-12+deb13u2+e5, 2.43-2ubuntu2.3	2,517
eglibcdeb	2.19-0ubuntu6.3, 2.19-0ubuntu6.6, 2.19-0ubuntu6.13, 2.19-0ubuntu6.14+1 more	no fix listed	7
glibcrpm	2.38-16.azl3, 2.38-18.azl3, 2.38-20.azl3	no fix listed	14

OSV records: DEBIAN-CVE-2026-6238 UBUNTU-CVE-2026-6238 AZL-85004 ECHO-916f-8705-1b52
Also known as: USN-8611-1

Charts affected

2,504 by stars

Chart

Latest

Affected images

Radar Score

changedetection-iozekker6

1.102.0

1 of 1 See more

changedetection-io zekker6 1.102.0

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container image	Digest	Package	Fixed in
ghcr.io/dgtlmoon/changedetection.io :0.60.7	096dae27b5d6	glibc@2.36-9+deb12u14	no fix listed

Open the chart page →

2,710

endlessh-gozekker6

0.4.0

1 of 1 See more

endlessh-go zekker6 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container image	Digest	Package	Fixed in
ghcr.io/shizunge/endlessh-go :2026.0730.0	8826dad32623	glibc@2.41-12+deb13u3	no fix listed

Open the chart page →

411

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2026-6238.

Container image	Digest	Package	Fixed in
library/nginx :latest	abe47724e466	glibc@2.41-12+deb13u4	no fix listed

Open the chart page →

1,593

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2026-6238.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	glibc@2.27-3ubuntu1.4	no fix listed
yandex/clickhouse-server :21.3.20	4eccfffb01d7	glibc@2.31-0ubuntu9.2	no fix listed

Open the chart page →

9,297

Container images carrying it

2,538 by charts deploying them

A fixed version is listed for 1 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
library/wordpress :7.1.0-apache	edeeae67330a	glibc@2.41-12+deb13u4	no fix listed	2
lightstep/collector :2021-01-26_23-02-36Z	11c5569aaf3b	glibc@2.23-0ubuntu11	no fix listed	2
linuxserver/cloud9 :latest :version-1.29.2	45c5fe102ff3	glibc@2.27-3ubuntu1.5	no fix listed	2
localstack/localstack :latest	4abc29e923e5	glibc@2.41-12+deb13u3	no fix listed	2
locustio/locust :2.32.2	a0d4b88e42c1	glibc@2.36-9+deb12u8	no fix listed	2
longhornio/longhorn-manager :v1.2.3	dca34321452c	glibc@2.31-0ubuntu9.2	no fix listed	2
louislam/uptime-kuma :2.5.4	917318f9d7be	glibc@2.36-9+deb12u14	no fix listed	2
louislam/uptime-kuma :2.3.2	9aeb4e51d038	glibc@2.36-9+deb12u13	no fix listed	2
louislam/uptime-kuma :2.5.0	a8610b3b4c38	glibc@2.36-9+deb12u14	no fix listed	2
mattermost/mattermost-team-edition :10.11.2	b8bd1246cb3a	glibc@2.36-9+deb12u10	no fix listed	2
mbentley/omada-controller :4.3	f4e682274bed	glibc@2.27-3ubuntu1.6	no fix listed	2
mesosphere/kubeaddons-catalog :v0.11.4	073db43d0b8b	glibc@2.31-0ubuntu9.1	no fix listed	2
moreillon/group-manager-front :v3.3.1	c9f85db3baa5	glibc@2.36-9+deb12u7	no fix listed	2
moreillon/user-manager :v5.0.2	e1c9bfab5c16	glibc@2.36-9+deb12u3	no fix listed	2
moreillon/user-manager-front :v5.0.3	b067dbbbb6af	glibc@2.36-9+deb12u3	no fix listed	2
ngick8stesting/c3po-mmeinit :latest	1e764eab77b4	glibc@2.27-3ubuntu1	no fix listed	2
nginxinc/nginx-unprivileged :stable	cb92301e719d	glibc@2.41-12+deb13u3	no fix listed	2
nutanix/nai-jobs :v2.8.0	9c373718e1b1	glibc@2.41-12+deb13u3	no fix listed	2
obolnetwork/charon :v1.10.0	278c7e2897b6	glibc@2.41-12+deb13u2	no fix listed	2
obsidiandynamics/kafdrop :3.30.0	5337c9e0e2de	glibc@2.31-0ubuntu9.7	no fix listed	2
omecproject/mcord-synchronizer :comac-1.0.0	cfdb566dd949	glibc@2.23-0ubuntu10	no fix listed	2
opea/embedding-tei :1.0	5c9639de61c1	glibc@2.36-9+deb12u8	no fix listed	2
opea/reranking-tei :1.0	e48613afb191	glibc@2.36-9+deb12u8	no fix listed	2
opea/retriever-redis :1.0	eb746b263705	glibc@2.36-9+deb12u8	no fix listed	2
opencloudeu/web-extensions :unzip-1.0.0	1691ad6612a3	glibc@2.36-9+deb12u9	no fix listed	2
opencloudeu/web-extensions :draw-io-1.0.0	27cb9b952f0d	glibc@2.36-9+deb12u9	no fix listed	2
opencloudeu/web-extensions :external-sites-1.0.0	5b176baa3694	glibc@2.36-9+deb12u9	no fix listed	2
opencloudeu/web-extensions :importer-1.0.0	6e8b2df6c5a4	glibc@2.36-9+deb12u9	no fix listed	2
opencloudeu/web-extensions :progress-bars-1.0.0	82f888a34440	glibc@2.36-9+deb12u9	no fix listed	2
opencloudeu/web-extensions :json-viewer-1.0.0	e0ac35a9576e	glibc@2.36-9+deb12u9	no fix listed	2
opencsghq/label-studio :v2.5.0	47e22aa71870	glibc@2.41-12+deb13u3	no fix listed	2
opendatacube/ows :latest	668cbb41473c	glibc@2.39-0ubuntu8.3	2.39-0ubuntu8.8	2
openebs/etcd :3.6.4-debian-12-r0	c86c06f1ce6a	glibc@2.36-9+deb12u10	no fix listed	2
patrikx3/p3x-redis-ui :latest	f19eb45b0694	glibc@2.36-9+deb12u14	no fix listed	2
pgvector/pgvector :0.8.5-pg18-trixie	9d2e61c7352b	glibc@2.41-12+deb13u3	no fix listed	2
pgvector/pgvector :0.8.6-pg16-bookworm :pg16	ccc6e83d6e35	glibc@2.36-9+deb12u14	no fix listed	2
piomin/sample-spring-kotlin-microservice :1.1	871f784dd6bc	glibc@2.35-0ubuntu3.1	2.35-0ubuntu3.14	2
polyaxon/polyaxon-agent :2.17.0	da877a2647fc	glibc@2.41-12+deb13u4	no fix listed	2
polyaxon/polyaxon-cli :2.17.0	297ed47ed63a	glibc@2.41-12+deb13u4	no fix listed	2
proxysql/proxysql :3.0.11	0e95d1b7cc32	glibc@2.41-12+deb13u3	no fix listed	2
qdrant/qdrant :v1.19.1	12364fe851b9	glibc@2.41-12+deb13u3	no fix listed	2
qichenxu4pd/pythonexample :1.0	f3a8502bc21b	glibc@2.36-9+deb12u7	no fix listed	2
quickwit/quickwit :v0.8.2	363ff56ce456	glibc@2.36-9+deb12u7	no fix listed	2
rajnandan1/kener :3.2.19	30407afca731	glibc@2.36-9+deb12u9	no fix listed	2
redis/redis-stack :7.2.0-v9	1c5f43fddcdd	glibc@2.35-0ubuntu3.6	2.35-0ubuntu3.14	2
redis/redis-stack-server :7.4.0 :7.4.0-v1	72035434f455	glibc@2.35-0ubuntu3.8	2.35-0ubuntu3.14	2
redis/redis-stack-server :7.2.0-v10	e44b2b49d059	glibc@2.35-0ubuntu3.6	2.35-0ubuntu3.14	2
rotationalio/quarterdeck :0.16.0	0e7ad3a031dc	glibc@2.36-9+deb12u14	no fix listed	2
safeglobal/safe-config-service :latest	09a5e495c219	glibc@2.41-12+deb13u3	no fix listed	2
safeglobal/safe-transaction-service :latest	80db836cc5d5	glibc@2.41-12+deb13u3	no fix listed	2