CVE-2025-31115

High

Advisory

Published 3 Apr 2025In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.7; base score, highest
EPSS: 0.007; 49th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 657; of 17,787 indexed, latest versions
Container images: 732; deployed by those charts
Fix available: 3 of 3; affected packages

liblzma5-32bit-5.8.1-1.1 on GA media

Carried by container images the latest versions of 657 of 17,787 indexed charts deploy, on 732 images.

Affected package	Affected versions	Fixed in	Images
xz-utilsdeb	5.4.1-0.2, 5.6.1+really5.4.5-1, 5.6.1+really5.4.5-1build0.1	5.4.1-1, 5.6.1+really5.4.5-1ubuntu0.2	487
xzapk	5.4.3-r0, 5.4.3-r1, 5.4.5-r0, 5.6.1-r3+2 more	5.4.3-r1, 5.4.5-r1, 5.6.2-r1, 5.6.3-r1+1 more	243
xzrpm	5.2.3-lp151.4.3.1	5.8.1-1.1	2

OSV records: ALPINE-CVE-2025-31115 DEBIAN-CVE-2025-31115 UBUNTU-CVE-2025-31115 openSUSE-SU-2025:14984-1
Also known as: DSA-5895-1, USN-7414-1

Charts affected

657 by stars

Chart

Latest

Affected images

Radar Score

tabbyxd

1.0.6

1 of 2 See more

7,685

xkopsxkops

0.1.0

4 of 5 See more

xkops xkops 0.1.0

4 of the 5 container images this version deploys carry CVE-2025-31115.

Container image	Digest	Package	Fixed in
hamzaarshad10/querybackend :1.6.2	2c1c3b86a8e7	xz-utils@5.4.1-0.2	5.4.1-1
hamzaarshad10/queryfrontend :1.1.5.14	cd359d9a78c3	xz@5.6.2-r0	5.6.2-r1
hamzaarshad10/querypodpy :1.7	154f38e8668e	xz-utils@5.4.1-0.2	5.4.1-1
murtazashah46/helmfile :latest	4d11726cf803	xz-utils@5.4.1-0.2	5.4.1-1

Open the chart page →

13,197

xlinexline

0.0.1

1 of 1 See more

xline xline 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-31115.

Container image	Digest	Package	Fixed in
ghcr.io/liangyuanpeng/xline :latest	3d2eceb44a3b	xz-utils@5.6.1+really5.4.5-1	5.6.1+really5.4.5-1ubuntu0.2

Open the chart page →

2,136

api-snapyoukadev

0.1.1

1 of 1 See more

api-snap youkadev 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-31115.

Container image	Digest	Package	Fixed in
youkadev/api-snap :0.1.1	4db0f9428e67	xz-utils@5.4.1-0.2	5.4.1-1

Open the chart page →

2,674

zahori-postgresqlzahori

1.0.1

1 of 1 See more

zahori-postgresql zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-31115.

Container image	Digest	Package	Fixed in
library/postgres :12.15-alpine	73ea9cdd4a9d	xz@5.4.3-r0	5.4.3-r1

Open the chart page →

448

sockpuppetbrowserzekker6

0.1.0

1 of 1 See more

sockpuppetbrowser zekker6 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-31115.

Container image	Digest	Package	Fixed in
dgtlmoon/sockpuppetbrowser :latest	f166a963b550	xz@5.4.3-r0	5.4.3-r1

Open the chart page →

1,588

zerossl-cert-managerzerossl-cert-manager

0.1.0

1 of 2 See more

zerossl-cert-manager zerossl-cert-manager 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-31115.

Container image	Digest	Package	Fixed in
andreymileshin/zerossl-issuer :v1.0.0	e0825acc9e48	xz@5.4.5-r0	5.4.5-r1

Open the chart page →

569

Container images carrying it

732 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/drewburr-labs/evobot :3.0.0	4ddbb244c82f	xz-utils@5.4.1-0.2	5.4.1-1	1
ghcr.io/drewburr-labs/mum-discord-bot :3.1.2	6e82914e1051	xz-utils@5.4.1-0.2	5.4.1-1	1
ghcr.io/element-hq/hydrogen-web :v0.5.1	2d15d14b201a	xz@5.6.2-r0	5.6.2-r1	1
ghcr.io/element-hq/synapse :v1.111.0	22ae556e0de4	xz-utils@5.4.1-0.2	5.4.1-1	1
ghcr.io/ellite/wallos :2.46.0	9ce55520e7bd	xz@5.6.3-r0	5.6.3-r1	1
ghcr.io/ferama/rospo :v0.12.0	ab40c1745534	xz-utils@5.4.1-0.2	5.4.1-1	1
ghcr.io/formancehq/console :console-on.v1.1.1	a4d32c2f68b3	xz-utils@5.4.1-0.2	5.4.1-1	1
ghcr.io/fpetr/readium-lcp-server-docker-helm/lcpserver :1.9.0	324f9b7b689c	xz@5.4.5-r0	5.4.5-r1	1
ghcr.io/fpetr/readium-lcp-server-docker-helm/lsdserver :1.9.0	cdba39e3f3d0	xz@5.4.5-r0	5.4.5-r1	1
ghcr.io/gabe565/mnemonic-ninja :latest	1fd90a9e4d04	xz@5.4.5-r0	5.4.5-r1	1
ghcr.io/gabe565/obico/web :latest	a5c1daef46c0	xz@5.4.3-r0	5.4.3-r1	1
ghcr.io/getsentry/sentry :26.7.2	7c5052aa4e3c	xz-utils@5.4.1-0.2	5.4.1-1	1
ghcr.io/graphprotocol/availability-oracle :sha-28312fd	472a25038957	xz-utils@5.4.1-0.2	5.4.1-1	1
ghcr.io/hemslo/chat-search :latest	39d48995a5bd	xz-utils@5.4.1-0.2	5.4.1-1	1
ghcr.io/home-assistant/home-assistant :2025.3.0	26c51e44d932	xz@5.6.3-r0	5.6.3-r1	1
ghcr.io/home-assistant/home-assistant :2023.11.3	feffc0b8227d	xz@5.4.3-r0	5.4.3-r1	1
ghcr.io/huggingface/text-embeddings-inference :cpu-1.6	66db77d7856c	xz-utils@5.4.1-0.2	5.4.1-1	1
ghcr.io/hypolia/kanri :0.1.2-rc4	fa7d5cc7fb7d	xz-utils@5.4.1-0.2	5.4.1-1	1
ghcr.io/ideamixes/object-cloner :2.0.0	31030fd2f192	xz@5.4.3-r0	5.4.3-r1	1
ghcr.io/jespernohr/dayz-dedicated-server :0.1.1	ec01d3ac7887	xz-utils@5.6.1+really5.4.5-1build0.1	5.6.1+really5.4.5-1ubuntu0.2	1
ghcr.io/jfwenisch/steamcmd-manager :v0.4.5	dab685e668d9	xz-utils@5.6.1+really5.4.5-1build0.1	5.6.1+really5.4.5-1ubuntu0.2	1
ghcr.io/jfwenisch/webtools :v0.1.4	4569cae83c70	xz-utils@5.6.1+really5.4.5-1build0.1	5.6.1+really5.4.5-1ubuntu0.2	1
ghcr.io/jmberesford/retrom-service :retrom-v0.7.14	4d763d58f11d	xz-utils@5.4.1-0.2	5.4.1-1	1
ghcr.io/juicerescue/juicepassproxy :0.5.1	984dc4f19162	xz-utils@5.4.1-0.2	5.4.1-1	1
ghcr.io/kubiyabot/kubernetes :1.32.0	b5ade0d9cc6b	xz-utils@5.4.1-0.2	5.4.1-1	1
ghcr.io/leprechaun/owntracks-exporter :0.1.11-de545066	099e1abd6d08	xz-utils@5.4.1-0.2	5.4.1-1	1
ghcr.io/liangyuanpeng/xline :latest	3d2eceb44a3b	xz-utils@5.6.1+really5.4.5-1	5.6.1+really5.4.5-1ubuntu0.2	1
ghcr.io/libreconnect/ferriscompany :0.1.0-rc6	ed86db9f0efe	xz-utils@5.4.1-0.2	5.4.1-1	1
ghcr.io/linuxoid69/webdav :1.26.2-r0	65bacf19caa7	xz@5.6.2-r0	5.6.2-r1	1
ghcr.io/linuxserver/bookstack :version-v24.12.1	cc795b254b73	xz@5.6.3-r0	5.6.3-r1	1
ghcr.io/linuxserver/plex :version-1.41.4.9463-630c9f557	e6d2775e77ec	xz-utils@5.6.1+really5.4.5-1build0.1	5.6.1+really5.4.5-1ubuntu0.2	1
ghcr.io/loft-sh/devpod-pro :0.0.0-ci.4-do-not-use	5dfa86b6451f	xz@5.4.3-r0	5.4.3-r1	1
ghcr.io/loft-sh/vcluster-control-plane :0.0.0-ci.4-do-not-use	45e744fc623f	xz@5.4.3-r0	5.4.3-r1	1
ghcr.io/luzilla/unbound :v0.7.0-rc3	252613692e5e	xz@5.4.5-r0	5.4.5-r1	1
ghcr.io/m0nsterrr/hyperglass :v2.0.4	f7b5d20c5e42	xz@5.6.1-r3	5.6.2-r1	1
ghcr.io/m9sweeper/trawler :1.6.0	df917c5a7e54	xz-utils@5.4.1-0.2	5.4.1-1	1
ghcr.io/maybe-finance/maybe :0.5.0	c6ab95ca9130	xz-utils@5.4.1-0.2	5.4.1-1	1
ghcr.io/mealie-recipes/mealie :v1.4.0	b56da41cf178	xz-utils@5.4.1-0.2	5.4.1-1	1
ghcr.io/media-streaming-mesh/msm-admission-webhook :latest	3e811d67189c	xz-utils@5.6.1+really5.4.5-1build0.1	5.6.1+really5.4.5-1ubuntu0.2	1
ghcr.io/media-streaming-mesh/msm-cni :latest	fe0b89b818a6	xz-utils@5.6.1+really5.4.5-1build0.1	5.6.1+really5.4.5-1ubuntu0.2	1
ghcr.io/media-streaming-mesh/msm-cp :latest	8cb08fc7010b	xz-utils@5.6.1+really5.4.5-1	5.6.1+really5.4.5-1ubuntu0.2	1
ghcr.io/media-streaming-mesh/msm-dp :latest	7ffcb25b4cfc	xz-utils@5.6.1+really5.4.5-1	5.6.1+really5.4.5-1ubuntu0.2	1
ghcr.io/media-streaming-mesh/msm-nc :latest	296fe4970e38	xz-utils@5.6.1+really5.4.5-1	5.6.1+really5.4.5-1ubuntu0.2	1
ghcr.io/mglants/kea-dhcp :2.5.8	e1b6eb9e37f9	xz@5.4.5-r0	5.4.5-r1	1
ghcr.io/middleware-labs/mw-kube-agent :1.12.0	9c7bc0f9bb35	xz-utils@5.6.1+really5.4.5-1build0.1	5.6.1+really5.4.5-1ubuntu0.2	1
ghcr.io/mirio/verbacap :v1.5.0	84928e2fc4f2	xz@5.4.5-r0	5.4.5-r1	1
ghcr.io/mollyim/mollysocket :1.1.1	2a687393f8c8	xz-utils@5.4.1-0.2	5.4.1-1	1
ghcr.io/mshade/kronic :v0.1.4	66e3043851cd	xz@5.4.5-r0	5.4.5-r1	1
ghcr.io/nefelim4ag/k8s-ssh-bastion :0.5.0	4d337e14c80b	xz-utils@5.6.1+really5.4.5-1	5.6.1+really5.4.5-1ubuntu0.2	1
ghcr.io/nefelim4ag/pingdom-operator :0.0.15	f8c7afdcf439	xz-utils@5.4.1-0.2	5.4.1-1	1