StackRadar

CVE-2025-22872

Medium

Advisory

Published 16 Apr 2025In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.005
44th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,054
of 17,790 indexed, latest versions
Container images
2,544
deployed by those charts
Fix available
1 of 1
affected package

golang.org/x/net vulnerable to Cross-site Scripting

Carried by container images the latest versions of 2,054 of 17,790 indexed charts deploy, on 2,544 images.

Affected packageAffected versionsFixed inImages
golang.org/x/netgolangv0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+203 more0.38.02,544
OSV records
GHSA-vvgc-356p-c3xw
Also known as
GO-2025-3595

Charts affected

2,054 by stars
ChartLatestAffected imagesRadar Score
version-checkerymrs0.2.31 of 1See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2025-22872.

Container imageDigestPackageFixed in
quay.io/jetstack/version-checker:v0.2.15f6f8ba0b671
golang.org/x/net@v0.0.0-20200707034311-ab3426394381
0.38.0

Open the chart page →

3,024
zahori-consulzahoriVerified publisher1.0.12 of 2See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2025-22872.

Container imageDigestPackageFixed in
hashicorp/consul:1.15.3ddff34041c5c
golang.org/x/net@v0.8.0
0.38.0
hashicorp/consul-k8s-control-plane:1.1.262bed1bf8106
golang.org/x/net@v0.7.0
0.38.0

Open the chart page →

5,047
zahori-moonzahoriVerified publisher1.0.13 of 3See more

zahori-moon zahori 1.0.1

3 of the 3 container images this version deploys carry CVE-2025-22872.

Container imageDigestPackageFixed in
quay.io/aerokube/moon:2.5.1a8837b00ba1c
golang.org/x/net@v0.7.0
0.38.0
quay.io/aerokube/moon-conf:2.5.19ca307b30080
golang.org/x/net@v0.7.0
0.38.0
quay.io/aerokube/moon-ui:2.0.589990b146824
golang.org/x/net@v0.11.0
0.38.0

Open the chart page →

2,907
posthogzeet0.23.21 of 9See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2025-22872.

Container imageDigestPackageFixed in
altinity/clickhouse-operator:0.19.07a85f522c5bc
golang.org/x/net@v0.0.0-20210525063256-abc453219eb5
0.38.0

Open the chart page →

3,697

Container images carrying it

2,544 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
grafana/promtail:1.5.046e88d390cd6
golang.org/x/net@v0.0.0-20200226121028-0de0cce0169b
0.38.0
2
grafana/tempo:2.5.0f0200a9bff6d
golang.org/x/net@v0.24.0
0.38.0
2
hanchuanchuan/goinception:latestb3c0dd26fb50
golang.org/x/net@v0.23.0
0.38.0
2
hashicorp/consul:1.14.2e38576edcdfd
golang.org/x/net@v0.0.0-20220909164309-bea034e7d591
0.38.0
2
hashicorp/consul-k8s-control-plane:1.0.2538a3436398d
golang.org/x/net@v0.0.0-20211209124913-491a49abca63
0.38.0
2
hashicorp/vault:1.8.34db614d40d0e
golang.org/x/net@v0.0.0-20210510120150-4163338589ed
0.38.0
2
hashicorp/vault:1.15.26b4e5dadf082
golang.org/x/net@v0.17.0
0.38.0
2
hashicorp/vault:1.12.18de4d5f31b38
golang.org/x/net@v0.0.0-20220909164309-bea034e7d591
0.38.0
2
hashicorp/vault-k8s:1.3.15d74a885ae3e
golang.org/x/net@v0.17.0
0.38.0
2
hashicorp/vault-k8s:1.1.0844337076b72
golang.org/x/net@v0.0.0-20221004154528-8021a29435af
0.38.0
2
hashicorp/vault-k8s:0.13.1bebb03e8e800
golang.org/x/net@v0.0.0-20210428140749-89ef3d95e781
0.38.0
2
honestica/kube-iptables-tailer:master-91a393242fb939
golang.org/x/net@v0.0.0-20201202161906-c7110b5ffcbb
0.38.0
2
hoppscotch/hoppscotch:2024.8.2f1da831950b7
golang.org/x/net@v0.17.0
0.38.0
2
ilum/api:6.7.3624fd09528c8
golang.org/x/net@v0.37.0
0.38.0
2
ilum/mongodb:6.0.542b6d774c37d
golang.org/x/net@v0.8.0
0.38.0
2
inaccel/daemon:latest093e1ea90ab8
golang.org/x/net@v0.19.0
0.38.0
2
inaccel/reef:latestc967218739f3
golang.org/x/net@v0.19.0
0.38.0
2
iomesh/csi-node-driver-registrar:v2.5.086f58b0a2106
golang.org/x/net@v0.0.0-20210825183410-e898025ed96a
0.38.0
2
iomesh/csi-provisioner:v3.0.0f9508460b273
golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023
0.38.0
2
iomesh/csi-snapshotter:v6.2.2becc53e25b96
golang.org/x/net@v0.8.0
0.38.0
2
iomesh/hostpath-provisioner:v0.5.1f4878c8ae53a
golang.org/x/net@v0.0.0-20191112182307-2180aed22343
0.38.0
2
iomesh/livenessprobe:v2.8.0560f01510f99
golang.org/x/net@v0.0.0-20220921203646-d300de134e69
0.38.0
2
iomesh/localpv-manager:v0.2.0f13deacac3f4
golang.org/x/net@v0.3.1-0.20221206200815-1e63c2f08a10
0.38.0
2
iomesh/node-disk-exporter:1.8.0f03148764f38
golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b
0.38.0
2
iomesh/snapshot-controller:v6.2.2fb95b65bb88f
golang.org/x/net@v0.8.0
0.38.0
2
iomesh/zookeeper-operator:0.2.159b38b5c7a61d
golang.org/x/net@v0.7.0
0.38.0
2
ipfs/kubo:v0.33.21a30f5ed8579
golang.org/x/net@v0.34.0
0.38.0
2
istio/install-cni:1.24.2-distrolessaef4825e110f
golang.org/x/net@v0.29.0
0.38.0
2
istio/pilot:1.24.2-distroless137e44e3d1d2
golang.org/x/net@v0.29.0
0.38.0
2
istio/proxyv2:1.18.0757d28c24100
golang.org/x/net@v0.9.0
0.38.0
2
istio/proxyv2:1.10.3a78b7a165744
golang.org/x/net@v0.0.0-20210323141857-08027d57d8cf
0.38.0
2
jaegertracing/all-in-one:1.3104d224a9999b
golang.org/x/net@v0.0.0-20220105145211-5b0dc2dfae98
0.38.0
2
jenkins/jenkins:2.426.1-jdk11b470bcdc4ecd
golang.org/x/net@v0.7.0
0.38.0
2
jettech/kube-webhook-certgen:v1.2.1c42098c8d855
golang.org/x/net@v0.0.0-20190108225652-1e06a53dbb7e
0.38.0
2
jettech/kube-webhook-certgen:v1.5.0fb7c2cd46ccf
golang.org/x/net@v0.0.0-20200707034311-ab3426394381
0.38.0
2
jmalloc/echo-server:0.3.1e4eaee2c7998
golang.org/x/net@v0.0.0-20210813160813-60bc85c4be6d
0.38.0
2
k0sproject/k0s:v1.26.0-k0s.0f04635825d51
golang.org/x/net@v0.5.0
0.38.0
2
kubernetesui/dashboard:v2.2.0148991563e37
golang.org/x/net@v0.0.0-20201224014010-6772e930b67b
0.38.0
2
kubespheredev/kube-webhook-certgen:v1.1.123a03c9c381f
golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023
0.38.0
2
lachlanevenson/k8s-kubectl:v1.25.4af5cea3f2e40
golang.org/x/net@v0.0.0-20220722155237-a158d28d115b
0.38.0
2
langgenius/dify-sandbox:0.2.009b7e8705673
golang.org/x/net@v0.20.0
0.38.0
2
library/influxdb:2.6.1-alpine44a366dd7724
golang.org/x/net@v0.0.0-20220617184016-355a448f1bc9
0.38.0
2
library/influxdb:2.7b8d940ca9376
golang.org/x/net@v0.25.0
0.38.0
2
library/traefik:v2.57d5a6ae66572
golang.org/x/net@v0.0.0-20211209124913-491a49abca63
0.38.0
2
lightninglabs/lnd:v0.18.3-betaf86bbec4dfb3
golang.org/x/net@v0.24.0
0.38.0
2
listmonk/listmonk:v2.1.0d2eac77ddfad
golang.org/x/net@v0.0.0-20211209124913-491a49abca63
0.38.0
2
mesosphere/kubeaddons-catalog:v0.11.4073db43d0b8b
golang.org/x/net@v0.0.0-20200707034311-ab3426394381
0.38.0
2
minio/mc:RELEASE.2020-11-25T23-04-07Zbf85c57cdfcc
golang.org/x/net@v0.0.0-20201021035429-f5854403a974
0.38.0
2
minio/operator:v4.3.754393e03f3b2
golang.org/x/net@v0.0.0-20210421230115-4e50805a0758
0.38.0
2
natsio/nats-box:0.11.09fbf7bf684e4
golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2
0.38.0
2

syft 1.42.1 · advisories as of 16 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.