CVE-2025-31115

High

Advisory

Published 3 Apr 2025In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.7; base score, highest
EPSS: 0.007; 49th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 654; of 17,781 indexed, latest versions
Container images: 729; deployed by those charts
Fix available: 3 of 3; affected packages

liblzma5-32bit-5.8.1-1.1 on GA media

Carried by container images the latest versions of 654 of 17,781 indexed charts deploy, on 729 images.

Affected package	Affected versions	Fixed in	Images
xz-utilsdeb	5.4.1-0.2, 5.6.1+really5.4.5-1, 5.6.1+really5.4.5-1build0.1	5.4.1-1, 5.6.1+really5.4.5-1ubuntu0.2	485
xzapk	5.4.3-r0, 5.4.3-r1, 5.4.5-r0, 5.6.1-r3+2 more	5.4.3-r1, 5.4.5-r1, 5.6.2-r1, 5.6.3-r1+1 more	242
xzrpm	5.2.3-lp151.4.3.1	5.8.1-1.1	2

OSV records: ALPINE-CVE-2025-31115 DEBIAN-CVE-2025-31115 UBUNTU-CVE-2025-31115 openSUSE-SU-2025:14984-1
Also known as: DSA-5895-1, USN-7414-1

Charts affected

654 by stars

Chart

Latest

Affected images

Radar Score

api-snapyoukadev

0.1.1

1 of 1 See more

api-snap youkadev 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-31115.

Container image	Digest	Package	Fixed in
youkadev/api-snap :0.1.1	4db0f9428e67	xz-utils@5.4.1-0.2	5.4.1-1

Open the chart page →

2,661

zahori-postgresqlzahori

1.0.1

1 of 1 See more

zahori-postgresql zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-31115.

Container image	Digest	Package	Fixed in
library/postgres :12.15-alpine	73ea9cdd4a9d	xz@5.4.3-r0	5.4.3-r1

Open the chart page →

448

sockpuppetbrowserzekker6

0.1.0

1 of 1 See more

sockpuppetbrowser zekker6 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-31115.

Container image	Digest	Package	Fixed in
dgtlmoon/sockpuppetbrowser :latest	f166a963b550	xz@5.4.3-r0	5.4.3-r1

Open the chart page →

1,589

zerossl-cert-managerzerossl-cert-manager

0.1.0

1 of 2 See more

zerossl-cert-manager zerossl-cert-manager 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-31115.

Container image	Digest	Package	Fixed in
andreymileshin/zerossl-issuer :v1.0.0	e0825acc9e48	xz@5.4.5-r0	5.4.5-r1

Open the chart page →

570

Container images carrying it

729 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
library/python :3.7-alpine	f3d31c8677d0	xz@5.4.3-r0	5.4.3-r1	2
library/rabbitmq :3.13.6-management-alpine	611107e29cce	xz@5.6.2-r0	5.6.2-r1	2
library/redis :7.2.3	a7cee7c8178f	xz-utils@5.4.1-0.2	5.4.1-1	2
locustio/locust :2.32.2	a0d4b88e42c1	xz-utils@5.4.1-0.2	5.4.1-1	2
moreillon/group-manager-front :v3.3.1	c9f85db3baa5	xz-utils@5.4.1-0.2	5.4.1-1	2
moreillon/user-manager :v5.0.2	e1c9bfab5c16	xz-utils@5.4.1-0.2	5.4.1-1	2
moreillon/user-manager-front :v5.0.3	b067dbbbb6af	xz-utils@5.4.1-0.2	5.4.1-1	2
opea/chatqna-conversation-ui :1.0	02d5674ca863	xz@5.6.2-r0	5.6.2-r1	2
opea/embedding-tei :1.0	5c9639de61c1	xz-utils@5.4.1-0.2	5.4.1-1	2
opea/reranking-tei :1.0	e48613afb191	xz-utils@5.4.1-0.2	5.4.1-1	2
opea/retriever-redis :1.0	eb746b263705	xz-utils@5.4.1-0.2	5.4.1-1	2
opencloudeu/web-extensions :unzip-1.0.0	1691ad6612a3	xz-utils@5.4.1-0.2	5.4.1-1	2
opencloudeu/web-extensions :draw-io-1.0.0	27cb9b952f0d	xz-utils@5.4.1-0.2	5.4.1-1	2
opencloudeu/web-extensions :external-sites-1.0.0	5b176baa3694	xz-utils@5.4.1-0.2	5.4.1-1	2
opencloudeu/web-extensions :importer-1.0.0	6e8b2df6c5a4	xz-utils@5.4.1-0.2	5.4.1-1	2
opencloudeu/web-extensions :progress-bars-1.0.0	82f888a34440	xz-utils@5.4.1-0.2	5.4.1-1	2
opencloudeu/web-extensions :json-viewer-1.0.0	e0ac35a9576e	xz-utils@5.4.1-0.2	5.4.1-1	2
opendatacube/ows :latest	668cbb41473c	xz-utils@5.6.1+really5.4.5-1build0.1	5.6.1+really5.4.5-1ubuntu0.2	2
organizr/organizr :latest	1ce319d73cdf	xz@5.4.3-r0	5.4.3-r1	2
qichenxu4pd/pythonexample :1.0	f3a8502bc21b	xz-utils@5.4.1-0.2	5.4.1-1	2
quickwit/quickwit :v0.8.2	363ff56ce456	xz-utils@5.4.1-0.2	5.4.1-1	2
rajnandan1/kener :3.2.19	30407afca731	xz-utils@5.4.1-0.2	5.4.1-1	2
speckle/speckle-preview-service :2.18.11-branch.testing2.88634-335d469 :2.18.12-branch.testing3.88744-f55b341	4bd113093583	xz-utils@5.4.1-0.2	5.4.1-1	2
uffizzi/controller :latest	0344805f267b	xz-utils@5.4.1-0.2	5.4.1-1	2
vdiogov/glpi-conteiner :latest	6945f84f0058	xz-utils@5.4.1-0.2	5.4.1-1	2
zabbix/zabbix-agent :ubuntu-6.4-latest	349b924472a7	xz-utils@5.6.1+really5.4.5-1build0.1	5.6.1+really5.4.5-1ubuntu0.2	2
ghcr.io/airflow-helm/pgbouncer :1.22.1-patch.0	c181abe1093d	xz@5.4.5-r0	5.4.5-r1	2
ghcr.io/airflow-helm/postgresql-bitnami :11.22-patch.0	df576862b7c0	xz@5.4.5-r0	5.4.5-r1	2
ghcr.io/eosc-lot-1/s3cmd :2-alpine	49bce0dd876d	xz@5.4.5-r0	5.4.5-r1	2
ghcr.io/google/fleetspeak :v0.1.17	cd264d33efd4	xz-utils@5.4.1-0.2	5.4.1-1	2
ghcr.io/kiwigrid/k8s-sidecar :1.29.1	42002d66ddb3	xz@5.6.3-r0	5.6.3-r1	2
ghcr.io/nginxinc/nginx-s3-gateway/nginx-oss-s3-gateway :unprivileged-oss :unprivileged-oss-20250331	3db8145349a3	xz-utils@5.4.1-0.2	5.4.1-1	2
ghcr.io/postgresml/pgcat :main	245f9d2f5f5b	xz-utils@5.4.1-0.2	5.4.1-1	2
ghcr.io/rss3-network/agentdata :0.1.0	fd8d3e6e4cdf	xz-utils@5.4.1-0.2	5.4.1-1	2
quay.io/kiwigrid/k8s-sidecar :1.26.1	b8d5067137fe	xz@5.4.5-r0	5.4.5-r1	2
quay.io/kiwigrid/k8s-sidecar :1.27.4	f6ed71d0f9f1	xz@5.6.1-r3	5.6.2-r1	2
registry.k8s.io/ingress-nginx/controller :v1.9.4	5b161f051d01	xz@5.4.3-r0	5.4.3-r1	2
registry.k8s.io/ingress-nginx/controller :v1.9.5	b3aba22b1da8	xz@5.4.5-r0	5.4.5-r1	2
registry.k8s.io/ingress-nginx/controller :v1.12.1	d2fbc4ec70d8	xz@5.6.3-r0	5.6.3-r1	2
48n6e/camellia-redis-proxy :1.4.0-jdk-21-0.0.1	a6ed886fddfc	xz-utils@5.4.1-0.2	5.4.1-1	1
abdullahkhawer/simple-elasticsearch-cleaner :2.1.0	28a6c3f7e0a9	xz@5.6.3-r0	5.6.3-r1	1
abhinavsingh/proxy.py :latest	51adc989fd03	xz@5.6.3-r0	5.6.3-r1	1
aboogie/login_test_backend :new	9c41a4483ac8	xz-utils@5.4.1-0.2	5.4.1-1	1
actualbudget/actual-server :25.3.1	58fecd9088b7	xz-utils@5.4.1-0.2	5.4.1-1	1
adorsys/keycloak-config-cli :6.3.0-26.1.0	85be7a45a94c	xz-utils@5.6.1+really5.4.5-1build0.1	5.6.1+really5.4.5-1ubuntu0.2	1
adorsys/keycloak-config-cli :6.1.6-25.0.1	eb49a2dcbbb8	xz-utils@5.6.1+really5.4.5-1	5.6.1+really5.4.5-1ubuntu0.2	1
ahmetgrbzz/result_server :1.0	08e10f9c0f53	xz@5.4.5-r0	5.4.5-r1	1
ahmetgrbzz/result_server :2.0	35c37ae2bafd	xz@5.4.5-r0	5.4.5-r1	1
ahmetgrbzz/web_server :1.0	2e7fef69c29f	xz@5.4.5-r0	5.4.5-r1	1
ahmetgrbzz/web_server :2.0	f018bafd2b0c	xz@5.4.5-r0	5.4.5-r1	1