StackRadar

CVE-2025-21614

High

Advisory

Published 6 Jan 2025In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.007
52nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
113
of 17,781 indexed, latest versions
Container images
110
deployed by those charts
Fix available
1 of 2
affected packages

go-git clients vulnerable to DoS via maliciously crafted Git server replies

Carried by container images the latest versions of 113 of 17,781 indexed charts deploy, on 110 images.

Affected packageAffected versionsFixed inImages
github.com/go-git/go-git/v5golangv5.0.0, v5.1.0, v5.2.0, v5.3.0+9 more5.13.097
gopkg.in/src-d/go-git.v4golangv4.10.0, v4.13.1no fix listed16
OSV records
GHSA-r9px-m959-cxf4
Also known as
GO-2025-3367

Charts affected

113 by stars
ChartLatestAffected imagesRadar Score
ambassadordatawire6.9.51 of 2See more

ambassador datawire 6.9.5

1 of the 2 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
gopkg.in/src-d/go-git.v4@v4.13.1
no fix listed

Open the chart page →

4,086
edge-stackdatawire7.1.8-ea1 of 2See more

edge-stack datawire 7.1.8-ea

1 of the 2 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
datawire/aes:2.0.3-ea07f8fe4f4f8e
gopkg.in/src-d/go-git.v4@v4.13.1
no fix listed

Open the chart page →

5,173
waypointhashicorpVerified publisher0.1.211 of 2See more

waypoint hashicorp 0.1.21

1 of the 2 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
hashicorp/waypoint:0.11.397d521a27498
github.com/go-git/go-git/v5@v5.2.0
gopkg.in/src-d/go-git.v4@v4.13.1
5.13.0
no fix listed

Open the chart page →

4,167
devtron-operatordevtron0.23.32 of 11See more

devtron-operator devtron 0.23.3

2 of the 11 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
quay.io/devtron/dex:v2.30.22e4c14d1b444
github.com/go-git/go-git/v5@v5.2.0
5.13.0
quay.io/devtron/kubectl:latest2ad610626658
github.com/go-git/go-git/v5@v5.4.2
5.13.0

Open the chart page →

32,902
ilumilumOfficialVerified publisher6.7.31 of 19See more

ilum ilum 6.7.3

1 of the 19 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
gitea/gitea:1.22.376f516a1a8c2
github.com/go-git/go-git/v5@v5.11.0
5.13.0

Open the chart page →

23,228
coder-observabilitycoder-observabilityVerified publisher0.7.31 of 21See more

coder-observability coder-observability 0.7.3

1 of the 21 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
grafana/agent:v0.40.3f6cbec9409be
github.com/go-git/go-git/v5@v5.11.0
5.13.0

Open the chart page →

24,700
kubecostmesosphere-stable0.37.51 of 9See more

kubecost mesosphere-stable 0.37.5

1 of the 9 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
grafana/grafana:9.4.71a359d92f40e
github.com/go-git/go-git/v5@v5.4.2
5.13.0

Open the chart page →

17,693
move2kubemove2kube0.3.151 of 1See more

move2kube move2kube 0.3.15

1 of the 1 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
github.com/go-git/go-git/v5@v5.11.0
5.13.0

Open the chart page →

3,793
sn-platformstreamnative1.11.441 of 9See more

sn-platform streamnative 1.11.44

1 of the 9 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
streamnative/apache-pulsar-grafana-dashboard-k8s:0.1.20e6d7aa3ef32
github.com/go-git/go-git/v5@v5.4.2
5.13.0

Open the chart page →

15,477
argocdtwomartensVerified publisher0.1.12 of 3See more

argocd twomartens 0.1.1

2 of the 3 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.37.0f579d00721b0
github.com/go-git/go-git/v5@v5.4.2
5.13.0
quay.io/argoproj/argocd:v2.8.6acaf37352569
github.com/go-git/go-git/v5@v5.7.0
5.13.0

Open the chart page →

10,315
clearml-servingallegroaiVerified publisher1.6.21 of 9See more

clearml-serving allegroai 1.6.2

1 of the 9 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
grafana/grafana:9.4.376dcf36e7d2a
github.com/go-git/go-git/v5@v5.4.2
5.13.0

Open the chart page →

17,877
soft-servealphani-helm-chartsVerified publisher0.4.01 of 1See more

soft-serve alphani-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
charmcli/soft-serve:v0.4.039523c1a6ba8
github.com/go-git/go-git/v5@v5.4.3-0.20210630082519-b4368b2a2ca4
5.13.0

Open the chart page →

3,119
argocd-backup-s3argocd-backup-s3Verified publisher0.9.51 of 1See more

argocd-backup-s3 argocd-backup-s3 0.9.5

1 of the 1 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
ghcr.io/oguzhan-yilmaz/argocd-backup-s3:latestb61c750ade19
github.com/go-git/go-git/v5@v5.2.0
5.13.0

Open the chart page →

5,222
dex-k8sav1o-chartsVerified publisher0.2.11 of 1See more

dex-k8s av1o-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.28.15e88f2205de1
github.com/go-git/go-git/v5@v5.2.0
5.13.0

Open the chart page →

3,391
helm-dashboardbeluga-cloudVerified publisher2.4.01 of 1See more

helm-dashboard beluga-cloud 2.4.0

1 of the 1 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
ghcr.io/beluga-cloud/helm-dashboard/dashboard:1.3.39ab9a675c405
github.com/go-git/go-git/v5@v5.7.0
5.13.0

Open the chart page →

2,898
finops-stackcert-managerVerified publisher0.0.51 of 12See more

finops-stack cert-manager 0.0.5

1 of the 12 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
ghcr.io/kyverno/kyverno-cli:v1.12.5832a32779e6d
github.com/go-git/go-git/v5@v5.11.0
5.13.0

Open the chart page →

12,562
trivy-operatordevopstalesVerified publisher2.5.01 of 1See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
devopstales/trivy-operator:2.575136aa7a26e
github.com/go-git/go-git/v5@v5.4.2
5.13.0

Open the chart page →

5,598
dex-serverdex-server1.19.11 of 3See more

dex-server dex-server 1.19.1

1 of the 3 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
dexidp/dex:v2.39.1-distroless43655afd1a8f
github.com/go-git/go-git/v5@v5.11.0
5.13.0

Open the chart page →

2,238
dockyarddockyardVerified publisher0.4.01 of 1See more

dockyard dockyard 0.4.0

1 of the 1 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
ghcr.io/kgma74/dockyard:0.4.0b40439329191
github.com/go-git/go-git/v5@v5.12.0
5.13.0

Open the chart page →

1,542
dexgabibbo974.0.41 of 1See more

dex gabibbo97 4.0.4

1 of the 1 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.28.15e88f2205de1
github.com/go-git/go-git/v5@v5.2.0
5.13.0

Open the chart page →

3,391
meta-monitoringgrafana1.3.01 of 2See more

meta-monitoring grafana 1.3.0

1 of the 2 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
grafana/alloy:v1.4.306bdcbb51fc2
github.com/go-git/go-git/v5@v5.11.0
5.13.0

Open the chart page →

3,518
carettagroundcover0.0.161 of 3See more

caretta groundcover 0.0.16

1 of the 3 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
quay.io/groundcover/grafana:9.3.18c65b333a3d3
github.com/go-git/go-git/v5@v5.4.2
5.13.0

Open the chart page →

6,799
giteakeyporttech0.2.101 of 4See more

gitea keyporttech 0.2.10

1 of the 4 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
gitea/gitea:1.12.485416d6f65fe
github.com/go-git/go-git/v5@v5.1.0
5.13.0

Open the chart page →

5,408
kubernetes-stateless-chartkubernetes-stateless-chart1.0.31 of 1See more

kubernetes-stateless-chart kubernetes-stateless-chart 1.0.3

1 of the 1 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
portainer/portainer-ce:2.18.4-alpine3e61aaee1341
github.com/go-git/go-git/v5@v5.3.0
5.13.0

Open the chart page →

3,274
mesherykubesphere-stable0.5.04 of 13See more

meshery kubesphere-stable 0.5.0

4 of the 13 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
layer5/meshery-consul:stable-latest25a4cc38abcd
github.com/go-git/go-git/v5@v5.9.0
5.13.0
layer5/meshery-linkerd:stable-latestb99c73bac1f5
github.com/go-git/go-git/v5@v5.11.0
5.13.0
layer5/meshery-osm:stable-latestec898e5786c6
github.com/go-git/go-git/v5@v5.4.2
5.13.0
layer5/meshery-traefik-mesh:stable-latest797fa7a03570
github.com/go-git/go-git/v5@v5.4.2
5.13.0

Open the chart page →

24,690
artifact-hubsoftonic1.19.04 of 8See more

artifact-hub softonic 1.19.0

4 of the 8 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
aquasec/trivy:0.43.1944a04445179
github.com/go-git/go-git/v5@v5.7.0
5.13.0
artifacthub/hub:v1.19.0111918d8c399
github.com/go-git/go-git/v5@v5.12.0
5.13.0
artifacthub/scanner:v1.19.0323d026e78c3
github.com/go-git/go-git/v5@v5.12.0
5.13.0
artifacthub/tracker:v1.19.06596c8c4d955
github.com/go-git/go-git/v5@v5.11.0
5.13.0

Open the chart page →

14,491
harbor-scanner-trivyaqua-helm0.17.01 of 1See more

harbor-scanner-trivy aqua-helm 0.17.0

1 of the 1 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.20.07ea4aa3d2eb6
github.com/go-git/go-git/v5@v5.0.0
5.13.0

Open the chart page →

5,202
performanceandusagediagnosisassist-iot-pud1.0.01 of 7See more

performanceandusagediagnosis assist-iot-pud 1.0.0

1 of the 7 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
grafana/grafana:9.1.19746858c20e6
github.com/go-git/go-git/v5@v5.4.2
5.13.0

Open the chart page →

8,556
ambassadorazureorkestra6.7.91 of 2See more

ambassador azureorkestra 6.7.9

1 of the 2 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
datawire/aes:1.13.62beb65062c8b
gopkg.in/src-d/go-git.v4@v4.13.1
no fix listed

Open the chart page →

5,521
helm-controllerazureorkestra0.1.11 of 2See more

helm-controller azureorkestra 0.1.1

1 of the 2 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
fluxcd/source-controller:v0.10.031a8c79a6803
github.com/go-git/go-git/v5@v5.2.0
5.13.0

Open the chart page →

7,705
pyroscopebook-k8sinfra-v21.10.01 of 3See more

pyroscope book-k8sinfra-v2 1.10.0

1 of the 3 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
grafana/alloy:v1.1.1c3dac4e26471
github.com/go-git/go-git/v5@v5.11.0
5.13.0

Open the chart page →

3,244
kubermatic-operatorbuttahtoastVerified publisher2.24.51 of 1See more

kubermatic-operator buttahtoast 2.24.5

1 of the 1 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
quay.io/kubermatic/kubermatic:v2.24.5ebba936046ab
github.com/go-git/go-git/v5@v5.11.0
5.13.0

Open the chart page →

2,770
clechaosnative0.2.71 of 6See more

cle chaosnative 0.2.7

1 of the 6 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
chaosnative/cle-server:2.7.0e7bcff4a20c0
github.com/go-git/go-git/v5@v5.3.0
5.13.0

Open the chart page →

16,389
cp4d-deployercloud-native-toolkit1.0.01 of 1See more

cp4d-deployer cloud-native-toolkit 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
github.com/go-git/go-git/v5@v5.3.0
gopkg.in/src-d/go-git.v4@v4.13.1
5.13.0
no fix listed

Open the chart page →

25,151
iteration-zerocloud-native-toolkit0.2.01 of 1See more

iteration-zero cloud-native-toolkit 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
quay.io/cloudnativetoolkit/cli-tools:v1.1-v1.8.2d6fd2a9e3273
github.com/go-git/go-git/v5@v5.3.0
5.13.0

Open the chart page →

6,921
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad1 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

1 of the 6 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
ghcr.io/formancehq/dex:v1.0.4b803fbe1cdb8
github.com/go-git/go-git/v5@v5.4.2
5.13.0

Open the chart page →

18,293
csghubcsghubVerified publisher2.4.32 of 34See more

csghub csghub 2.4.3

2 of the 34 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
opencsghq/gitlab-gitaly:v17.5.0bdd2c58b9744
github.com/go-git/go-git/v5@v5.11.0
5.13.0
opencsghq/gitlab-shell:v17.5.0f6d7e7d6be5d
github.com/go-git/go-git/v5@v5.11.0
5.13.0

Open the chart page →

58,897
gickupdamounVerified publisher1.11.01 of 1See more

gickup damoun 1.11.0

1 of the 1 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
buddyspencer/gickup:0.10.309e7dbf923c12
github.com/go-git/go-git/v5@v5.12.0
5.13.0

Open the chart page →

1,028
argocddevtron1.8.11 of 3See more

argocd devtron 1.8.1

1 of the 3 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
argoproj/argocd:v1.8.1830e86cacefd
gopkg.in/src-d/go-git.v4@v4.13.1
no fix listed

Open the chart page →

10,466
devtron-enterprisedevtron48.0.03 of 28See more

devtron-enterprise devtron 48.0.0

3 of the 28 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
quay.io/devtron/dex:v2.30.22e4c14d1b444
github.com/go-git/go-git/v5@v5.2.0
5.13.0
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/go-git/go-git/v5@v5.7.0
5.13.0
quay.io/devtron/kubectl:latest2ad610626658
github.com/go-git/go-git/v5@v5.4.2
5.13.0

Open the chart page →

68,240
devtron-in-clustercddevtron0.10.21 of 2See more

devtron-in-clustercd devtron 0.10.2

1 of the 2 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
quay.io/devtron/kubewatch:49f906a5-419-14814eec0305b594c
github.com/go-git/go-git/v5@v5.6.1
5.13.0

Open the chart page →

5,039
argocddevtron-labs1.8.11 of 3See more

argocd devtron-labs 1.8.1

1 of the 3 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
argoproj/argocd:v1.8.1830e86cacefd
gopkg.in/src-d/go-git.v4@v4.13.1
no fix listed

Open the chart page →

10,466
devtron-enterprisedevtron-labs48.0.03 of 28See more

devtron-enterprise devtron-labs 48.0.0

3 of the 28 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
quay.io/devtron/dex:v2.30.22e4c14d1b444
github.com/go-git/go-git/v5@v5.2.0
5.13.0
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/go-git/go-git/v5@v5.7.0
5.13.0
quay.io/devtron/kubectl:latest2ad610626658
github.com/go-git/go-git/v5@v5.4.2
5.13.0

Open the chart page →

68,240
devtron-in-clustercddevtron-labs0.10.21 of 2See more

devtron-in-clustercd devtron-labs 0.10.2

1 of the 2 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
quay.io/devtron/kubewatch:49f906a5-419-14814eec0305b594c
github.com/go-git/go-git/v5@v5.6.1
5.13.0

Open the chart page →

5,039
devtron-operatordevtron-labs0.23.32 of 11See more

devtron-operator devtron-labs 0.23.3

2 of the 11 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
quay.io/devtron/dex:v2.30.22e4c14d1b444
github.com/go-git/go-git/v5@v5.2.0
5.13.0
quay.io/devtron/kubectl:latest2ad610626658
github.com/go-git/go-git/v5@v5.4.2
5.13.0

Open the chart page →

32,902
drogue-cloud-examplesdrogue-iotVerified publisher0.7.111 of 6See more

drogue-cloud-examples drogue-iot 0.7.11

1 of the 6 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
grafana/grafana:9.2.4057896e23443
github.com/go-git/go-git/v5@v5.4.2
5.13.0

Open the chart page →

30,699
drogue-cloud-metricsdrogue-iotVerified publisher0.7.111 of 8See more

drogue-cloud-metrics drogue-iot 0.7.11

1 of the 8 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
grafana/grafana:9.2.4057896e23443
github.com/go-git/go-git/v5@v5.4.2
5.13.0

Open the chart page →

13,558
upgrade-responderepinioVerified publisher0.2.01 of 5See more

upgrade-responder epinio 0.2.0

1 of the 5 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
grafana/grafana:10.1.50679e877ba20
github.com/go-git/go-git/v5@v5.4.2
5.13.0

Open the chart page →

7,329
admin-console-operatorepmdedpVerified publisher2.14.01 of 2See more

admin-console-operator epmdedp 2.14.0

1 of the 2 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
epamedp/edp-admin-console:2.14.0616c678ba3e7
gopkg.in/src-d/go-git.v4@v4.10.0
no fix listed

Open the chart page →

4,308
reconcilerepmdedpVerified publisher2.12.01 of 1See more

reconciler epmdedp 2.12.0

1 of the 1 container images this version deploys carry CVE-2025-21614.

Container imageDigestPackageFixed in
epamedp/reconciler:2.12.0d33e938b6d59
github.com/go-git/go-git/v5@v5.4.3-0.20210630082519-b4368b2a2ca4
5.13.0

Open the chart page →

2,180

Container images carrying it

110 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/argoproj/argocd:v2.8.6acaf37352569
github.com/go-git/go-git/v5@v5.7.0
5.13.0
1
quay.io/argoproj/argocli:v3.5.591b9825f09a8
github.com/go-git/go-git/v5@v5.11.0
5.13.0
1
quay.io/cloudnativetoolkit/cli-tools:v1.1-v1.8.2d6fd2a9e3273
github.com/go-git/go-git/v5@v5.3.0
5.13.0
1
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
github.com/go-git/go-git/v5@v5.3.0
gopkg.in/src-d/go-git.v4@v4.13.1
5.13.0
no fix listed
1
quay.io/gkarthics/apid-helper:v0.2.3d7d93debf1f4
github.com/go-git/go-git/v5@v5.6.1
5.13.0
1
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
github.com/go-git/go-git/v5@v5.11.0
5.13.0
1
quay.io/kubermatic/kubermatic:v2.24.5ebba936046ab
github.com/go-git/go-git/v5@v5.11.0
5.13.0
1
quay.io/openshift/origin-jenkins-agent-base:latestc241c971aef8
github.com/go-git/go-git/v5@v5.11.0
5.13.0
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
github.com/go-git/go-git/v5@v5.3.0
5.13.0
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
gopkg.in/src-d/go-git.v4@v4.13.1
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.