StackRadar

CVE-2025-22874

Unscored

Advisory

Published 11 Jun 2025In the index since 5 Sept 2026
Severity
Unscored
worst across findings
CVSS
—
base score, highest
EPSS
0.004
31st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
195
of 17,781 indexed, latest versions
Container images
184
deployed by those charts
Fix available
1 of 1
affected package

Usage of ExtKeyUsageAny disables policy validation in crypto/x509

Carried by container images the latest versions of 195 of 17,781 indexed charts deploy, on 184 images.

Affected packageAffected versionsFixed inImages
stdlibgolanggo1.24.0, go1.24.1, go1.24.2, go1.24.31.24.4184
OSV records
GO-2025-3749
Also known as
BIT-golang-2025-22874

Charts affected

195 by stars
ChartLatestAffected imagesRadar Score
argo-cdargoOfficialVerified publisher10.9.01 of 3See more

argo-cd argo 10.9.0

1 of the 3 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.5.2e2aadfae709d
stdlib@go1.24.0
1.24.4

Open the chart page →

3,218
argo-cdargo-cd-oci10.9.01 of 3See more

argo-cd argo-cd-oci 10.9.0

1 of the 3 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.5.2e2aadfae709d
stdlib@go1.24.0
1.24.4

Open the chart page →

3,218
chartmuseumchartmuseumVerified publisher3.10.41 of 1See more

chartmuseum chartmuseum 3.10.4

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
ghcr.io/helm/chartmuseum:v0.16.3c81f105c3682
stdlib@go1.24.1
1.24.4

Open the chart page →

1,360
openebsopenebsOfficialVerified publisher4.6.11 of 35See more

openebs openebs 4.6.1

1 of the 35 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
grafana/alloy:v1.8.17790f6f7fbd8
stdlib@go1.24.1
1.24.4

Open the chart page →

23,894
graylogkong-zVerified publisher3.0.321 of 5See more

graylog kong-z 3.0.32

1 of the 5 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
quay.io/mongodb/mongodb-kubernetes-operator:0.13.02dcc6393e6f7
stdlib@go1.24.2
1.24.4

Open the chart page →

2,699
community-operatormongodb-helm-charts0.13.01 of 1See more

community-operator mongodb-helm-charts 0.13.0

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
quay.io/mongodb/mongodb-kubernetes-operator:0.13.02dcc6393e6f7
stdlib@go1.24.2
1.24.4

Open the chart page →

1,127
prometheus-kafka-exporterprometheus-communityVerified publisher4.0.01 of 1See more

prometheus-kafka-exporter prometheus-community 4.0.0

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
danielqsj/kafka-exporter:v1.9.04150e46b2e96
stdlib@go1.24.0
1.24.4

Open the chart page →

716
pulsarapache4.7.01 of 10See more

pulsar apache 4.7.0

1 of the 10 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
alpine/k8s:1.32.12048f8d9c8cc7
stdlib@go1.24.0
1.24.4

Open the chart page →

9,864
operatorminio-operator7.1.11 of 1See more

operator minio-operator 7.1.1

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
quay.io/minio/operator:v7.1.1cd587f60c43d
stdlib@go1.24.2
1.24.4

Open the chart page →

874
oktetooktetoOfficialVerified publisher0.0.0-2026-08-031 of 10See more

okteto okteto 0.0.0-2026-08-03

1 of the 10 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
ghcr.io/okteto/okteto:3.22.0-beta.1e787b6bce27d
stdlib@go1.24.0
1.24.4

Open the chart page →

5,750
k8sgpt-operatork8sgptOfficialVerified publisher0.2.291 of 2See more

k8sgpt-operator k8sgpt 0.2.29

1 of the 2 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
quay.io/brancz/kube-rbac-proxy:v0.19.19f21034731c7
stdlib@go1.24.2
1.24.4

Open the chart page →

966
dgraphdgraph24.1.41 of 1See more

dgraph dgraph 24.1.4

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
dgraph/dgraph:v24.1.4b57fa31f9b7f
stdlib@go1.24.0
1.24.4

Open the chart page →

2,993
spirespiffeVerified publisher0.30.21 of 10See more

spire spiffe 0.30.2

1 of the 10 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
ghcr.io/spiffe/spiffe-csi-driver:0.2.79dfe4f0caff0
stdlib@go1.24.0
1.24.4

Open the chart page →

1,640
tailing-sidecar-operatortailing-sidecar-operatorOfficialVerified publisher0.111.01 of 2See more

tailing-sidecar-operator tailing-sidecar-operator 0.111.0

1 of the 2 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
quay.io/brancz/kube-rbac-proxy:v0.19.19f21034731c7
stdlib@go1.24.2
1.24.4

Open the chart page →

1,205
openstack-cinder-csicloud-provider-openstack2.36.52 of 7See more

openstack-cinder-csi cloud-provider-openstack 2.36.5

2 of the 7 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-provisioner:v5.3.0bb057f866177
stdlib@go1.24.2
1.24.4
registry.k8s.io/sig-storage/csi-resizer:v1.14.05e7cbb63fd49
stdlib@go1.24.2
1.24.4

Open the chart page →

3,604
ilumilumOfficialVerified publisher6.7.31 of 19See more

ilum ilum 6.7.3

1 of the 19 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
minio/mc:RELEASE.2025-04-16T18-13-26Zaead63c77f9d
stdlib@go1.24.2
1.24.4

Open the chart page →

23,228
cadvisorckotzbauerVerified publisher2.4.31 of 1See more

cadvisor ckotzbauer 2.4.3

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
gcr.io/cadvisor/cadvisor:v0.52.1f40e65878e25
stdlib@go1.24.1
1.24.4

Open the chart page →

961
whoamicowboysysopVerified publisher6.0.01 of 1See more

whoami cowboysysop 6.0.0

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
traefik/whoami:v1.11.0200689790a0a
stdlib@go1.24.1
1.24.4

Open the chart page →

353
meshery-operatormesheryOfficialVerified publisher1.0.691 of 2See more

meshery-operator meshery 1.0.69

1 of the 2 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
alpine/k8s:1.35.6b7a12c5ddf26
stdlib@go1.24.0
1.24.4

Open the chart page →

2,415
vsphere-csivsphere-tmm3.8.11 of 7See more

vsphere-csi vsphere-tmm 3.8.1

1 of the 7 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-resizer:v1.14.05e7cbb63fd49
stdlib@go1.24.2
1.24.4

Open the chart page →

3,911
dolibarrcowboysysopVerified publisher9.0.31 of 3See more

dolibarr cowboysysop 9.0.3

1 of the 3 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
wait4x/wait4x:3.3.14dcd86307de1
stdlib@go1.24.3
1.24.4

Open the chart page →

9,106
athens-proxyvolker-raschekVerified publisher2.0.31 of 1See more

athens-proxy volker-raschek 2.0.3

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
gomods/athens:v0.17.10f61d1e62359
stdlib@go1.24.1
1.24.4

Open the chart page →

2,039
pod-gatewayangelnu7.1.11 of 2See more

pod-gateway angelnu 7.1.1

1 of the 2 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
ghcr.io/angelnu/gateway-admision-controller:v3.12.06f6ab596afd5
stdlib@go1.24.2
1.24.4

Open the chart page →

1,133
athens-proxyathens-chartsOfficialVerified publisher0.17.11 of 1See more

athens-proxy athens-charts 0.17.1

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
gomods/athens:v0.18.197cc113b34b0
stdlib@go1.24.1
1.24.4

Open the chart page →

1,298
snapschedulerbackube-helm-chartsVerified publisher3.5.02 of 2See more

snapscheduler backube-helm-charts 3.5.0

2 of the 2 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
quay.io/backube/snapscheduler:3.5.035ac95c51780
stdlib@go1.24.3
1.24.4
quay.io/brancz/kube-rbac-proxy:v0.19.19f21034731c7
stdlib@go1.24.2
1.24.4

Open the chart page →

1,224
coder-observabilitycoder-observabilityVerified publisher0.7.31 of 21See more

coder-observability coder-observability 0.7.3

1 of the 21 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
grafana/grafana:10.4.19a9043254ba16
stdlib@go1.24.3
1.24.4

Open the chart page →

24,700
postgres-pgdump-backupeugen0.7.61 of 1See more

postgres-pgdump-backup eugen 0.7.6

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
traefik/whoami:v1.11.0200689790a0a
stdlib@go1.24.1
1.24.4

Open the chart page →

353
ascii-moviegabe565Verified publisher0.16.41 of 1See more

ascii-movie gabe565 0.16.4

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
ghcr.io/gabe565/ascii-movie:1.9.627f85bb98da3
stdlib@go1.24.0
1.24.4

Open the chart page →

986
domain-watchgabe565Verified publisher1.1.01 of 1See more

domain-watch gabe565 1.1.0

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
ghcr.io/gabe565/domain-watch:latest34c5a1e351d6
stdlib@go1.24.1
1.24.4

Open the chart page →

789
whoamiharrytangVerified publisher0.2.01 of 1See more

whoami harrytang 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
traefik/whoami:v1.11.0200689790a0a
stdlib@go1.24.1
1.24.4

Open the chart page →

353
headscaleheadscaleVerified publisher1.0.191 of 3See more

headscale headscale 1.0.19

1 of the 3 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
alpine/k8s:1.36.244ef4942e171
stdlib@go1.24.0
1.24.4

Open the chart page →

3,383
coreinstill-aiOfficialVerified publisher0.1.751 of 15See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
openfga/openfga:v1.9.25e94966c11df
stdlib@go1.24.2
1.24.4

Open the chart page →

30,816
lxcfs-on-kuberneteslxcfs-on-kubernetes0.2.71 of 2See more

lxcfs-on-kubernetes lxcfs-on-kubernetes 0.2.7

1 of the 2 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
ghcr.io/cndoit18/lxcfs-agent:latest9853bb613cd0
stdlib@go1.24.1
1.24.4

Open the chart page →

2,085
permifypermifyVerified publisher0.5.01 of 1See more

permify permify 0.5.0

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
ghcr.io/permify/permify:v1.3.5f0c6f7d7daa6
stdlib@go1.24.1
1.24.4

Open the chart page →

997
platzioplatz-ioVerified publisher0.6.51 of 2See more

platzio platz-io 0.6.5

1 of the 2 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
platzio/backend:v0.6.5d5e5972f344b
stdlib@go1.24.3
1.24.4

Open the chart page →

2,866
plecopleco0.24.01 of 1See more

pleco pleco 0.24.0

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
public.ecr.aws/r3m4q3r9/pleco:0.24.0651739583336
stdlib@go1.24.2
1.24.4

Open the chart page →

1,346
prometheus-systemd-exporterprometheus-communityVerified publisher0.5.21 of 1See more

prometheus-systemd-exporter prometheus-community 0.5.2

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
quay.io/prometheuscommunity/systemd-exporter:v0.7.078c03f875dfb
stdlib@go1.24.1
1.24.4

Open the chart page →

725
qgis-serverqgis-serverVerified publisher0.1.101 of 3See more

qgis-server qgis-server 0.1.10

1 of the 3 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
ghcr.io/cloudnative-pg/cloudnative-pg:1.25.1b5210df46c05
stdlib@go1.24.0
1.24.4

Open the chart page →

5,435
topaztopaz0.2.51 of 1See more

topaz topaz 0.2.5

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
ghcr.io/aserto-dev/topaz:0.32.594c708ecf7dc4
stdlib@go1.24.2
1.24.4

Open the chart page →

1,494
k8s-ttl-controllertwin0.4.01 of 1See more

k8s-ttl-controller twin 0.4.0

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
ghcr.io/twin/k8s-ttl-controller:v1.4.00525a7def93d
stdlib@go1.24.1
1.24.4

Open the chart page →

471
vaultvaultVerified publisher1.22.01 of 4See more

vault vault 1.22.0

1 of the 4 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
alpine/k8s:1.35.5d870622d0040
stdlib@go1.24.0
1.24.4

Open the chart page →

4,243
argo-cdwenerme10.9.01 of 3See more

argo-cd wenerme 10.9.0

1 of the 3 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
quay.io/argoproj/argocd:v3.5.2e2aadfae709d
stdlib@go1.24.0
1.24.4

Open the chart page →

3,218
kubernetes-etcd-backupadfinisVerified publisher1.6.21 of 1See more

kubernetes-etcd-backup adfinis 1.6.2

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
ghcr.io/adfinis/kubernetes-etcd-backup:v1.4.68ec6c4812a7e
stdlib@go1.24.2
1.24.4

Open the chart page →

1,819
upcloud-csiankra-chartsVerified publisher0.4.01 of 8See more

upcloud-csi ankra-charts 0.4.0

1 of the 8 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
alpine/k8s:1.31.137a319b15cfc9
stdlib@go1.24.2
1.24.4

Open the chart page →

14,917
kubebrowseravistoOfficialVerified publisher1.4.01 of 1See more

kubebrowser avisto 1.4.0

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
ghcr.io/avistotelecom/kubebrowser:0.10.0a354b8dc7e6a
stdlib@go1.24.1
1.24.4

Open the chart page →

677
btrfs-nfs-csibtrfs-nfs-csi0.4.01 of 7See more

btrfs-nfs-csi btrfs-nfs-csi 0.4.0

1 of the 7 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-provisioner:v5.3.0bb057f866177
stdlib@go1.24.2
1.24.4

Open the chart page →

3,183
argocd-source-trackercableship0.0.91 of 1See more

argocd-source-tracker cableship 0.0.9

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
ghcr.io/cableship/argocd-source-tracker:0.0.6ff7dd45aa774
stdlib@go1.24.2
1.24.4

Open the chart page →

1,483
chart-sentinelcableship0.0.121 of 1See more

chart-sentinel cableship 0.0.12

1 of the 1 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
ghcr.io/cableship/chart-sentinel:0.1.0a037f1042b28
stdlib@go1.24.2
1.24.4

Open the chart page →

1,483
openstack-manila-csicloud-provider-openstack2.36.32 of 5See more

openstack-manila-csi cloud-provider-openstack 2.36.3

2 of the 5 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/csi-provisioner:v5.3.0bb057f866177
stdlib@go1.24.2
1.24.4
registry.k8s.io/sig-storage/csi-resizer:v1.14.05e7cbb63fd49
stdlib@go1.24.2
1.24.4

Open the chart page →

3,749
cluster-setupcluster-setup1.5.02 of 8See more

cluster-setup cluster-setup 1.5.0

2 of the 8 container images this version deploys carry CVE-2025-22874.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.43.10881d3c9359b
stdlib@go1.24.3
1.24.4
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
stdlib@go1.24.1
1.24.4

Open the chart page →

10,037

Container images carrying it

184 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/loft-sh/vnode-runtime:0.3.3b065ec5a5239
stdlib@go1.24.2
1.24.4
1
ghcr.io/loxilb-io/loxilb:latestc7ede1bab641
stdlib@go1.24.0
1.24.4
1
ghcr.io/media-streaming-mesh/msm-admission-webhook:latest3e811d67189c
stdlib@go1.24.0
1.24.4
1
ghcr.io/media-streaming-mesh/msm-cni:latestfe0b89b818a6
stdlib@go1.24.0
1.24.4
1
ghcr.io/middleware-labs/mw-lang-aggregator:0.1.0ae6e13970ec2
stdlib@go1.24.0
1.24.4
1
ghcr.io/miniflux/miniflux:2.2.83a11ac10969e
stdlib@go1.24.2
1.24.4
1
ghcr.io/okteto/okteto:3.22.0-beta.1e787b6bce27d
stdlib@go1.24.0
1.24.4
1
ghcr.io/permify/permify:v1.3.5f0c6f7d7daa6
stdlib@go1.24.1
1.24.4
1
ghcr.io/sergelogvinov/mongodb:8.0.101eee8e20a87f
stdlib@go1.24.3
1.24.4
1
ghcr.io/streamingfast/firehose-ethereum:v2.12.489969b78fb07
stdlib@go1.24.2
1.24.4
1
ghcr.io/streamingfast/firehose-ethereum:v2.14.3bf816072380e
stdlib@go1.24.2
1.24.4
1
ghcr.io/streamingfast/firehose-ethereum:v2.12.4-gethd7bdfa7b41da
stdlib@go1.24.2
1.24.4
1
ghcr.io/tjm/vault-gcp-secrets:v1.19.59f157fe035f1
stdlib@go1.24.3
1.24.4
1
ghcr.io/twin/k8s-ttl-controller:v1.4.00525a7def93d
stdlib@go1.24.1
1.24.4
1
ghcr.io/zeiss/typhoon/controller:0.2.34fdf4edfda45
stdlib@go1.24.0
1.24.4
1
ghcr.io/zeiss/typhoon/typhoon-webhook:0.2.378f9b82050bc
stdlib@go1.24.0
1.24.4
1
public.ecr.aws/aws-observability/aws-otel-collector:v0.43.38aa9ea5f67b8
stdlib@go1.24.3
1.24.4
1
public.ecr.aws/eks-distro/kubernetes/kube-scheduler:v1.29.14-eks-1-29-lateste7e1db003e6a
stdlib@go1.24.2
1.24.4
1
public.ecr.aws/r3m4q3r9/pleco:0.24.0651739583336
stdlib@go1.24.2
1.24.4
1
quay.io/argoproj/argocd:v3.5.10deb1a1c9176
stdlib@go1.24.0
1.24.4
1
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
stdlib@go1.24.1
1.24.4
1
quay.io/backube/snapscheduler:3.5.035ac95c51780
stdlib@go1.24.3
1.24.4
1
quay.io/cilium/cilium:v1.18.2858f807ea4e2
stdlib@go1.24.2
1.24.4
1
quay.io/enix/zfs-exporter:2.3.1223b053f1cbd0
stdlib@go1.24.2
1.24.4
1
quay.io/minio/operator:v7.1.1cd587f60c43d
stdlib@go1.24.2
1.24.4
1
quay.io/mittwald/kubernetes-replicator:v2.11.13185496b3af3
stdlib@go1.24.1
1.24.4
1
quay.io/mongodb/mongodb-enterprise-operator-ubi:1.33.0b05101723412
stdlib@go1.24.2
1.24.4
1
quay.io/prometheuscommunity/systemd-exporter:v0.7.078c03f875dfb
stdlib@go1.24.1
1.24.4
1
quay.io/prometheus-operator/prometheus-config-reloader:v0.83.078aec597d87a
stdlib@go1.24.3
1.24.4
1
quay.io/prometheus/prometheus:v3.4.19abc6cf6aea7
stdlib@go1.24.3
1.24.4
1
quay.io/prometheus/pushgateway:v1.11.103738d278e08
stdlib@go1.24.1
1.24.4
1
registry.k8s.io/autoscaling/vpa-admission-controller:1.4.171d817780aa9
stdlib@go1.24.3
1.24.4
1
registry.k8s.io/autoscaling/vpa-recommender:1.4.140b6d76e8526
stdlib@go1.24.3
1.24.4
1
registry.k8s.io/autoscaling/vpa-updater:1.4.18ebf269779c1
stdlib@go1.24.3
1.24.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.