StackRadar

CVE-2025-11579

Medium

Advisory

Published 10 Oct 2025In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.004
31st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
47
of 17,781 indexed, latest versions
Container images
42
deployed by those charts
Fix available
1 of 2
affected packages

rardecode: DoS risk due to unrestricted RAR dictionary sizes

Carried by container images the latest versions of 47 of 17,781 indexed charts deploy, on 42 images.

Affected packageAffected versionsFixed inImages
github.com/nwaples/rardecodegolangv1.0.0, v1.1.0, v1.1.2, v1.1.3no fix listed34
github.com/nwaples/rardecode/v2golangv2.0.0-beta.2, v2.1.02.2.08
OSV records
GHSA-rwvp-r38j-9rgg
Also known as
GO-2025-4020

Charts affected

47 by stars
ChartLatestAffected imagesRadar Score
kubescape-operatorkubescape1.40.42 of 6See more

kubescape-operator kubescape 1.40.4

2 of the 6 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
quay.io/kubescape/kubevuln:v0.3.4309bed2f723ea0
github.com/nwaples/rardecode@v1.1.3
no fix listed
quay.io/kubescape/node-agent:v0.3.2192044ed750f5e
github.com/nwaples/rardecode@v1.1.3
no fix listed

Open the chart page →

920
ilumilumOfficialVerified publisher6.7.31 of 19See more

ilum ilum 6.7.3

1 of the 19 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
gitea/gitea:1.22.376f516a1a8c2
github.com/nwaples/rardecode@v1.1.3
no fix listed

Open the chart page →

23,228
filebrowserutkuozdemirVerified publisher1.0.01 of 1See more

filebrowser utkuozdemir 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.23.086e8449ff8ff
github.com/nwaples/rardecode@v1.1.0
no fix listed

Open the chart page →

3,073
lndfold0.3.151 of 4See more

lnd fold 0.3.15

1 of the 4 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
thesisrobot/lnd:v0.16.4-beta-c287129953689
github.com/nwaples/rardecode@v1.1.2
no fix listed

Open the chart page →

8,835
local-ailocalai3.4.21 of 1See more

local-ai localai 3.4.2

1 of the 1 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
quay.io/go-skynet/local-ai:latestd78cd113b2bc
github.com/nwaples/rardecode@v1.1.0
no fix listed

Open the chart page →

3,997
mattermostphntom3.24.01 of 2See more

mattermost phntom 3.24.0

1 of the 2 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
phntom/mattermost-team-edition:9.3.051cf9da4aa2e
github.com/nwaples/rardecode@v1.1.3
no fix listed

Open the chart page →

8,722
move2kubemove2kube0.3.151 of 1See more

move2kube move2kube 0.3.15

1 of the 1 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
github.com/nwaples/rardecode@v1.1.2
no fix listed

Open the chart page →

3,793
sn-platformstreamnative1.11.441 of 9See more

sn-platform streamnative 1.11.44

1 of the 9 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
streamnative/pulsar_vault_init:v1.0.731533fa9fab7
github.com/nwaples/rardecode@v1.1.2
no fix listed

Open the chart page →

15,477
datadogdatadog-test2.4.231 of 2See more

datadog datadog-test 2.4.23

1 of the 2 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
datadog/agent:7.22.08f20e56b5311
github.com/nwaples/rardecode@v1.1.0
no fix listed

Open the chart page →

4,568
fission-corefission-chartsVerified publisher1.14.11 of 3See more

fission-core fission-charts 1.14.1

1 of the 3 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
fission/fission-bundle:1.14.13fcfd8a0fa5d
github.com/nwaples/rardecode@v1.1.0
no fix listed

Open the chart page →

7,104
filebrowsergeek-cookbookVerified publisher1.4.21 of 1See more

filebrowser geek-cookbook 1.4.2

1 of the 1 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.18.04fcd47af573c
github.com/nwaples/rardecode@v1.0.0
no fix listed

Open the chart page →

3,474
gentrace-self-hostedgentrace-self-hostedVerified publisher0.1.31 of 9See more

gentrace-self-hosted gentrace-self-hosted 0.1.3

1 of the 9 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:23.8512bb8a21483
github.com/nwaples/rardecode/v2@v2.0.0-beta.2
2.2.0

Open the chart page →

15,562
operatoristio1.10.31 of 1See more

operator istio 1.10.3

1 of the 1 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
istio/operator:1.10.3655eefa11c84
github.com/nwaples/rardecode@v1.1.0
no fix listed

Open the chart page →

10,701
k8s-grafana-stackk8s-grafana-stackVerified publisher0.2.321 of 17See more

k8s-grafana-stack k8s-grafana-stack 0.2.32

1 of the 17 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
grafana/alloy:v1.14.0f50931848bd8
github.com/nwaples/rardecode/v2@v2.1.0
2.2.0

Open the chart page →

15,418
akeyless-gatewayakeyless-services-helmVerified publisher3.5.31 of 2See more

akeyless-gateway akeyless-services-helm 3.5.3

1 of the 2 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
akeyless/gateway:5.3.13d2e7dce5eb9
github.com/nwaples/rardecode@v1.1.3
no fix listed

Open the chart page →

1,522
akto-ai-guardrails-v2akto0.3.01 of 6See more

akto-ai-guardrails-v2 akto 0.3.0

1 of the 6 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
aktosecurity/guardrails-service:2.14.8a6218d07e84f
github.com/nwaples/rardecode/v2@v2.1.0
2.2.0

Open the chart page →

9,321
akto-regional-setupakto1.3.11 of 9See more

akto-regional-setup akto 1.3.1

1 of the 9 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
aktosecurity/guardrails-service:2.14.8a6218d07e84f
github.com/nwaples/rardecode/v2@v2.1.0
2.2.0

Open the chart page →

7,603
amorphieamorphie0.1.21 of 18See more

amorphie amorphie 0.1.2

1 of the 18 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.26b4e5dadf082
github.com/nwaples/rardecode@v1.1.2
no fix listed

Open the chart page →

28,131
persesappscodeVerified publisher2026.6.21 of 1See more

perses appscode 2026.6.2

1 of the 1 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
ghcr.io/opnpulse/perses:v2026.4.24b880da90aa1a
github.com/nwaples/rardecode/v2@v2.1.0
2.2.0

Open the chart page →

530
firehoseblip-firehoseVerified publisher0.0.181 of 11See more

firehose blip-firehose 0.0.18

1 of the 11 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.26b4e5dadf082
github.com/nwaples/rardecode@v1.1.2
no fix listed

Open the chart page →

13,459
cp4d-deployercloud-native-toolkit1.0.01 of 1See more

cp4d-deployer cloud-native-toolkit 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
github.com/nwaples/rardecode@v1.1.2
no fix listed

Open the chart page →

25,151
electric-mailcryptexlabsVerified publisher0.0.11 of 5See more

electric-mail cryptexlabs 0.0.1

1 of the 5 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
hashicorp/vault:1.8.34db614d40d0e
github.com/nwaples/rardecode@v1.1.0
no fix listed

Open the chart page →

5,973
purple-piecryptexlabsVerified publisher0.0.11 of 4See more

purple-pie cryptexlabs 0.0.1

1 of the 4 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
hashicorp/vault:1.8.34db614d40d0e
github.com/nwaples/rardecode@v1.1.0
no fix listed

Open the chart page →

5,973
gickupdamounVerified publisher1.11.01 of 1See more

gickup damoun 1.11.0

1 of the 1 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
buddyspencer/gickup:0.10.309e7dbf923c12
github.com/nwaples/rardecode@v1.1.3
no fix listed

Open the chart page →

1,028
ambassador-operatordatawire0.3.01 of 1See more

ambassador-operator datawire 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
datawire/ambassador-operator:v1.3.0f95ae710d75c
github.com/nwaples/rardecode@v1.0.0
no fix listed

Open the chart page →

7,486
furan2dollarshaveclubVerified publisher0.2.01 of 1See more

furan2 dollarshaveclub 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
dollarshaveclub/furan2:master14a257836529
github.com/nwaples/rardecode@v1.0.0
no fix listed

Open the chart page →

3,046
heliconehelicone0.1.421 of 14See more

helicone helicone 0.1.42

1 of the 14 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:23.4.2.11dc5658853ce1
github.com/nwaples/rardecode/v2@v2.0.0-beta.2
2.2.0

Open the chart page →

24,995
evi-vaultintelVerified publisher3.0.31 of 2See more

evi-vault intel 3.0.3

1 of the 2 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
hashicorp/vault:1.12.18de4d5f31b38
github.com/nwaples/rardecode@v1.1.2
no fix listed

Open the chart page →

4,478
vaultintelVerified publisher0.8.11 of 2See more

vault intel 0.8.1

1 of the 2 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
hashicorp/vault:1.12.18de4d5f31b38
github.com/nwaples/rardecode@v1.1.2
no fix listed

Open the chart page →

4,478
jx-app-datadogjenkins-x0.0.101 of 2See more

jx-app-datadog jenkins-x 0.0.10

1 of the 2 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
datadog/agent:6aad9994de6a7
github.com/nwaples/rardecode@v1.1.0
no fix listed

Open the chart page →

3,999
vaultjfrog0.25.01 of 2See more

vault jfrog 0.25.0

1 of the 2 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
hashicorp/vault:1.14.0b2177a8bfe85
github.com/nwaples/rardecode@v1.1.2
no fix listed

Open the chart page →

3,968
pipecdkrzwiatrzyk0.39.01 of 3See more

pipecd krzwiatrzyk 0.39.0

1 of the 3 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
ghcr.io/pipe-cd/pipecd:v0.39.00fae829caf29
github.com/nwaples/rardecode@v1.0.0
no fix listed

Open the chart page →

3,812
ksoc-pluginsksocOfficialVerified publisher1.9.101 of 5See more

ksoc-plugins ksoc 1.9.10

1 of the 5 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
public.ecr.aws/n8h5y2v5/rad-security/rad-sbom:v1.1.34e97e0e7a2088
github.com/nwaples/rardecode@v1.1.0
no fix listed

Open the chart page →

3,199
kubeclaritykubeclarity2.23.32 of 5See more

kubeclarity kubeclarity 2.23.3

2 of the 5 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
ghcr.io/openclarity/grype-server:v0.6.079412399f301
github.com/nwaples/rardecode@v1.1.0
no fix listed
ghcr.io/openclarity/kubeclarity:v2.23.314450f52a708
github.com/nwaples/rardecode@v1.1.0
no fix listed

Open the chart page →

5,496
deepflowkubesphere-stable6.2.6061 of 8See more

deepflow kubesphere-stable 6.2.606

1 of the 8 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
deepflowce/clickhouse-server:22.8.6.71bc1882f75c18
github.com/nwaples/rardecode/v2@v2.0.0-beta.2
2.2.0

Open the chart page →

18,316
mattermost-team-editionmattermost-team-edition6.6.831 of 4See more

mattermost-team-edition mattermost-team-edition 6.6.83

1 of the 4 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
mattermost/mattermost-team-edition:10.11.2b8bd1246cb3a
github.com/nwaples/rardecode/v2@v2.1.0
2.2.0

Open the chart page →

4,089
clickhousemyaVerified publisher0.2403.11 of 1See more

clickhouse mya 0.2403.1

1 of the 1 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:24.2ed9640bfff07
github.com/nwaples/rardecode/v2@v2.0.0-beta.2
2.2.0

Open the chart page →

3,558
cognativemyaVerified publisher0.2403.31 of 3See more

cognative mya 0.2403.3

1 of the 3 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:24.2ed9640bfff07
github.com/nwaples/rardecode/v2@v2.0.0-beta.2
2.2.0

Open the chart page →

7,309
giteamyaVerified publisher23.12.51 of 1See more

gitea mya 23.12.5

1 of the 1 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
gitea/gitea:1.21.6ac73e0da341f
github.com/nwaples/rardecode@v1.1.3
no fix listed

Open the chart page →

3,430
vault-helm-chartnotesprojectchart0.1.01 of 1See more

vault-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
library/vault:1.13.3f98ac9dd97b0
github.com/nwaples/rardecode@v1.1.2
no fix listed

Open the chart page →

2,246
giteanovum-rgi-charts2.1.31 of 3See more

gitea novum-rgi-charts 2.1.3

1 of the 3 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
gitea/gitea:1.13.0d5ab14cd29af
github.com/nwaples/rardecode@v1.0.0
no fix listed

Open the chart page →

4,861
mattermost-team-editionopenshift6.6.831 of 4See more

mattermost-team-edition openshift 6.6.83

1 of the 4 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
mattermost/mattermost-team-edition:10.11.2b8bd1246cb3a
github.com/nwaples/rardecode/v2@v2.1.0
2.2.0

Open the chart page →

4,089
rancher-auto-registerrancher-auto-registerVerified publisher0.1.01 of 1See more

rancher-auto-register rancher-auto-register 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
github.com/nwaples/rardecode@v1.1.0
no fix listed

Open the chart page →

1,837
prestashopstack-prestahop22.0.01 of 4See more

prestashop stack-prestahop 22.0.0

1 of the 4 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.23.086e8449ff8ff
github.com/nwaples/rardecode@v1.1.0
no fix listed

Open the chart page →

3,073
vaultstakaterVerified publisher0.8.41 of 2See more

vault stakater 0.8.4

1 of the 2 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
hashicorp/vault:1.8.4dfc3500beb0e
github.com/nwaples/rardecode@v1.1.0
no fix listed

Open the chart page →

5,864
filebrowserwenerme1.0.01 of 1See more

filebrowser wenerme 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.13.0c5d0a75a0041
github.com/nwaples/rardecode@v1.0.0
no fix listed

Open the chart page →

3,174
wexa-studiowexa-studio1.2.01 of 15See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2025-11579.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.40b01ed3924e6
github.com/nwaples/rardecode@v1.1.2
no fix listed

Open the chart page →

14,983

Container images carrying it

42 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
aktosecurity/guardrails-service:2.14.8a6218d07e84f
github.com/nwaples/rardecode/v2@v2.1.0
2.2.0
2
clickhouse/clickhouse-server:24.2ed9640bfff07
github.com/nwaples/rardecode/v2@v2.0.0-beta.2
2.2.0
2
filebrowser/filebrowser:v2.23.086e8449ff8ff
github.com/nwaples/rardecode@v1.1.0
no fix listed
2
hashicorp/vault:1.8.34db614d40d0e
github.com/nwaples/rardecode@v1.1.0
no fix listed
2
hashicorp/vault:1.15.26b4e5dadf082
github.com/nwaples/rardecode@v1.1.2
no fix listed
2
hashicorp/vault:1.12.18de4d5f31b38
github.com/nwaples/rardecode@v1.1.2
no fix listed
2
mattermost/mattermost-team-edition:10.11.2b8bd1246cb3a
github.com/nwaples/rardecode/v2@v2.1.0
2.2.0
2
akeyless/gateway:5.3.13d2e7dce5eb9
github.com/nwaples/rardecode@v1.1.3
no fix listed
1
buddyspencer/gickup:0.10.309e7dbf923c12
github.com/nwaples/rardecode@v1.1.3
no fix listed
1
clickhouse/clickhouse-server:23.8512bb8a21483
github.com/nwaples/rardecode/v2@v2.0.0-beta.2
2.2.0
1
clickhouse/clickhouse-server:23.4.2.11dc5658853ce1
github.com/nwaples/rardecode/v2@v2.0.0-beta.2
2.2.0
1
datadog/agent:7.22.08f20e56b5311
github.com/nwaples/rardecode@v1.1.0
no fix listed
1
datadog/agent:6aad9994de6a7
github.com/nwaples/rardecode@v1.1.0
no fix listed
1
datawire/ambassador-operator:v1.3.0f95ae710d75c
github.com/nwaples/rardecode@v1.0.0
no fix listed
1
deepflowce/clickhouse-server:22.8.6.71bc1882f75c18
github.com/nwaples/rardecode/v2@v2.0.0-beta.2
2.2.0
1
dollarshaveclub/furan2:master14a257836529
github.com/nwaples/rardecode@v1.0.0
no fix listed
1
filebrowser/filebrowser:v2.18.04fcd47af573c
github.com/nwaples/rardecode@v1.0.0
no fix listed
1
filebrowser/filebrowser:v2.13.0c5d0a75a0041
github.com/nwaples/rardecode@v1.0.0
no fix listed
1
fission/fission-bundle:1.14.13fcfd8a0fa5d
github.com/nwaples/rardecode@v1.1.0
no fix listed
1
gitea/gitea:1.22.376f516a1a8c2
github.com/nwaples/rardecode@v1.1.3
no fix listed
1
gitea/gitea:1.21.6ac73e0da341f
github.com/nwaples/rardecode@v1.1.3
no fix listed
1
gitea/gitea:1.13.0d5ab14cd29af
github.com/nwaples/rardecode@v1.0.0
no fix listed
1
grafana/alloy:v1.14.0f50931848bd8
github.com/nwaples/rardecode/v2@v2.1.0
2.2.0
1
hashicorp/vault:1.15.40b01ed3924e6
github.com/nwaples/rardecode@v1.1.2
no fix listed
1
hashicorp/vault:1.14.0b2177a8bfe85
github.com/nwaples/rardecode@v1.1.2
no fix listed
1
hashicorp/vault:1.8.4dfc3500beb0e
github.com/nwaples/rardecode@v1.1.0
no fix listed
1
istio/operator:1.10.3655eefa11c84
github.com/nwaples/rardecode@v1.1.0
no fix listed
1
library/vault:1.13.3f98ac9dd97b0
github.com/nwaples/rardecode@v1.1.2
no fix listed
1
phntom/mattermost-team-edition:9.3.051cf9da4aa2e
github.com/nwaples/rardecode@v1.1.3
no fix listed
1
streamnative/pulsar_vault_init:v1.0.731533fa9fab7
github.com/nwaples/rardecode@v1.1.2
no fix listed
1
thesisrobot/lnd:v0.16.4-beta-c287129953689
github.com/nwaples/rardecode@v1.1.2
no fix listed
1
ghcr.io/openclarity/grype-server:v0.6.079412399f301
github.com/nwaples/rardecode@v1.1.0
no fix listed
1
ghcr.io/openclarity/kubeclarity:v2.23.314450f52a708
github.com/nwaples/rardecode@v1.1.0
no fix listed
1
ghcr.io/opnpulse/perses:v2026.4.24b880da90aa1a
github.com/nwaples/rardecode/v2@v2.1.0
2.2.0
1
ghcr.io/pipe-cd/pipecd:v0.39.00fae829caf29
github.com/nwaples/rardecode@v1.0.0
no fix listed
1
public.ecr.aws/n8h5y2v5/rad-security/rad-sbom:v1.1.34e97e0e7a2088
github.com/nwaples/rardecode@v1.1.0
no fix listed
1
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
github.com/nwaples/rardecode@v1.1.2
no fix listed
1
quay.io/go-skynet/local-ai:latestd78cd113b2bc
github.com/nwaples/rardecode@v1.1.0
no fix listed
1
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
github.com/nwaples/rardecode@v1.1.2
no fix listed
1
quay.io/kubescape/kubevuln:v0.3.4309bed2f723ea0
github.com/nwaples/rardecode@v1.1.3
no fix listed
1
quay.io/kubescape/node-agent:v0.3.2192044ed750f5e
github.com/nwaples/rardecode@v1.1.3
no fix listed
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
github.com/nwaples/rardecode@v1.1.0
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.