CVE-2025-3576

Medium

Advisory

Published 15 Apr 2025In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.9; base score, highest
EPSS: 0.003; 28th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,559; of 17,790 indexed, latest versions
Container images: 1,691; deployed by those charts
Fix available: 2 of 2; affected packages

Red Hat Security Advisory: krb5 security update

Carried by container images the latest versions of 1,559 of 17,790 indexed charts deploy, on 1,691 images.

Affected package	Affected versions	Fixed in	Images
krb5deb	1.12+dfsg-2ubuntu5, 1.12+dfsg-2ubuntu5.1, 1.12+dfsg-2ubuntu5.3, 1.12+dfsg-2ubuntu5.4+40 more	1.12+dfsg-2ubuntu5.4+esm7, 1.13.2+dfsg-5ubuntu2.2+esm7, 1.16-2ubuntu0.4+esm5, 1.17-6ubuntu4.11+4 more	1,447
krb5rpm	1.16.1-22.el8, 1.17-9.el8, 1.17-18.el8, 1.17-19.el8_2+25 more	0:1.17-19.el8_2.3, 0:1.18.2-9.el8_4.3, 0:1.18.2-16.el8_6.4, 0:1.18.2-26.el8_8.5+5 more	244

OSV records: DEBIAN-CVE-2025-3576 RHSA-2025:13664 RHSA-2025:13777 RHSA-2025:15001 RHSA-2025:15002 RHSA-2025:15003 RHSA-2025:15004 RHSA-2025:8411 RHSA-2025:9430 RLSA-2025:8411 RLSA-2025:9430 UBUNTU-CVE-2025-3576 DLA-4195-1 SUSE-SU-2025:3699-1
Also known as: USN-7542-1

Charts affected

1,559 by stars

Chart

Latest

Affected images

Radar Score

wp-gats-helmwordpress-gatsby

0.0.1

1 of 3 See more

wp-gats-helm wordpress-gatsby 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-3576.

Container image	Digest	Package	Fixed in
library/wordpress :6.0.0-php8.0-apache	277c6c25980f	krb5@1.18.3-6+deb11u1	1.18.3-6+deb11u7

Open the chart page →

2,021

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-3576.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	krb5@1.19.2-2ubuntu0.3	1.19.2-2ubuntu0.7

Open the chart page →

14,172

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2025-3576.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	krb5@1.18.2-14.el8	0:1.18.2-32.el8_10

Open the chart page →

11,592

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2025-3576.

Container image	Digest	Package	Fixed in
library/nginx :1.25	a484819eb602	krb5@1.20.1-2+deb12u1	1.20.1-2+deb12u4

Open the chart page →

7,685

xkopsxkops

0.1.0

3 of 5 See more

xkops xkops 0.1.0

3 of the 5 container images this version deploys carry CVE-2025-3576.

Container image	Digest	Package	Fixed in
hamzaarshad10/querybackend :1.6.2	2c1c3b86a8e7	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4
hamzaarshad10/querypodpy :1.7	154f38e8668e	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4
murtazashah46/helmfile :latest	4d11726cf803	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4

Open the chart page →

13,197

xlinexline

0.0.1

1 of 1 See more

xline xline 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-3576.

Container image	Digest	Package	Fixed in
ghcr.io/liangyuanpeng/xline :latest	3d2eceb44a3b	krb5@1.20.1-6ubuntu2	1.20.1-6ubuntu2.6

Open the chart page →

2,136

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2025-3576.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	krb5@1.18.2-22.el8_7	0:1.18.2-32.el8_10

Open the chart page →

6,016

enterprise-gatewayzeet

3.2.2

1 of 2 See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2025-3576.

Container image	Digest	Package	Fixed in
elyra/kernel-image-puller :3.2.2	c922f1f1646a	krb5@1.18.3-6+deb11u3	1.18.3-6+deb11u7

Open the chart page →

1,838

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2025-3576.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	krb5@1.18.2-22.el8_7	0:1.18.2-32.el8_10

Open the chart page →

3,697

Container images carrying it

1,691 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
gotson/komga :0.99.4	9b15ea6bfc30	krb5@1.16-2ubuntu0.1	1.16-2ubuntu0.4+esm5	1
gradiant/hdfs :3.2.2	e3bf364fe713	krb5@1.18.3-6	1.18.3-6+deb11u7	1
gradiant/open5gs-dbctl :0.10.3	332031245fce	krb5@1.20.1-6ubuntu2.5	1.20.1-6ubuntu2.6	1
grafana/promtail :2.6.1	072527b12cdf	krb5@1.18.3-6+deb11u1	1.18.3-6+deb11u7	1
grafana/promtail :2.9.10	63a2e57a5b14	krb5@1.18.3-6+deb11u5	1.18.3-6+deb11u7	1
grafana/promtail :2.7.0	c16c710f7333	krb5@1.18.3-6+deb11u2	1.18.3-6+deb11u7	1
grafana/promtail :3.0.0	d3de3da9431c	krb5@1.18.3-6+deb11u4	1.18.3-6+deb11u7	1
graphprotocol/graph-node :v0.37.0	f4452cdedd68	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4	1
graylog/graylog :6.1.10	19de1aff48c2	krb5@1.19.2-2ubuntu0.6	1.19.2-2ubuntu0.7	1
gresearchdev/siembol-config-editor-rest :latest	91863a50afb7	krb5@1.18.3-6+deb11u1	1.18.3-6+deb11u7	1
gresearchdev/siembol-storm-topology-manager :latest	8dad36a05ebf	krb5@1.18.3-6+deb11u1	1.18.3-6+deb11u7	1
grpl/grapple-cli :0.2.127	c00aafee6629	krb5@1.20.1-6ubuntu2	1.20.1-6ubuntu2.6	1
guacamole/guacamole :1.5.5	0f62f6d17ab3	krb5@1.19.2-2ubuntu0.3	1.19.2-2ubuntu0.7	1
guillh/web3-prometheus-exporter :0.3.0	4fb99dbc32b2	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4	1
gulacedia/web-dvwa-new :v3	67b467d961ca	krb5@1.20.1-2	1.20.1-2+deb12u4	1
gurolakman/oam :4.0.0	ed8fd2062548	krb5@1.18.2-29.el8_10	0:1.18.2-32.el8_10	1
gurolakman/smsf-configuration :1.0.4	9abb3882bcbd	krb5@1.18.2-26.el8_9	0:1.18.2-32.el8_10	1
gurolakman/smsf-dispatcher :1.0.4	6537e8ed8de8	krb5@1.18.2-26.el8_9	0:1.18.2-32.el8_10	1
gurolakman/smsf-momt :1.0.4	ce23b20a8a17	krb5@1.18.2-26.el8_9	0:1.18.2-32.el8_10	1
gurolakman/smsf-registration :1.0.4	b22e746edd5d	krb5@1.18.2-26.el8_9	0:1.18.2-32.el8_10	1
gurolakman/ussigw-configuration :1.0.4	bf18525c5ad9	krb5@1.18.2-26.el8_9	0:1.18.2-32.el8_10	1
gurolakman/ussigw-core :1.0.4	8739565c3ea2	krb5@1.18.2-26.el8_9	0:1.18.2-32.el8_10	1
gustavostingelin/floresta :0.8.0	82dcb2fbef58	krb5@1.18.3-6+deb11u3	1.18.3-6+deb11u7	1
ha33ona/python :test	6affdfc644d0	krb5@1.18.3-6+deb11u1	1.18.3-6+deb11u7	1
hamidyousefi93/saam-test :latest	c34f071f6ed0	krb5@1.20.1-2+deb12u1	1.20.1-2+deb12u4	1
hamzaarshad10/querybackend :1.6.2	2c1c3b86a8e7	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4	1
hamzaarshad10/querypodpy :1.7	154f38e8668e	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4	1
hansehe/locust :1.1.0	bc8e45262bc4	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4	1
hasura/graphql-engine :v2.34.0-ce	0111b0204136	krb5@1.19.2-2ubuntu0.2	1.19.2-2ubuntu0.7	1
haugene/transmission-openvpn :4.0	059216cfae4b	krb5@1.17-6ubuntu4.1	1.17-6ubuntu4.11	1
haveagitgat/tdarr :2.00.18	1256348872ce	krb5@1.17-6ubuntu4.1	1.17-6ubuntu4.11	1
haveagitgat/tdarr_node :2.00.10	1e3f9328327d	krb5@1.17-6ubuntu4.1	1.17-6ubuntu4.11	1
haveagitgat/tdarr_node :2.17.01	3ff0913202dd	krb5@1.17-6ubuntu4.3	1.17-6ubuntu4.11	1
hazegoodlife/haaze :veggiesite	50f02d2d5d4d	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4	1
hazegoodlife/haaze :milksite	8d4c63169e14	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4	1
hazelcast/hazelcast-jet :4.5.3	a825ecbe9fda	krb5@1.18.3-6+deb11u1	1.18.3-6+deb11u7	1
hazelcast/management-center :5.3.2	f9d34300d330	krb5@1.18.2-25.el8_8	0:1.18.2-26.el8_8.5	1
healthchecks/healthchecks :v2.8.1	e82bb0836e30	krb5@1.18.3-6+deb11u3	1.18.3-6+deb11u7	1
hecrom/myweatherangularclient :1.3.11	bb0372939c19	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4	1
hecrom/myweathergatewayservice :1.3.11	92e5588d55f3	krb5@1.18.3-6+deb11u5	1.18.3-6+deb11u7	1
hecrom/myweatherprocessingservice :1.3.11	203ee6853a27	krb5@1.18.3-6+deb11u5	1.18.3-6+deb11u7	1
hecrom/myweatherservice :1.3.11	c502a4b758f0	krb5@1.18.3-6+deb11u5	1.18.3-6+deb11u7	1
helga09/php_shoes_ukr :v1.1.1	e283539bcb8c	krb5@1.18.3-6+deb11u3	1.18.3-6+deb11u7	1
helga09/shoes_ukr :v1.1.1	7999bc8b77c0	krb5@1.18.3-6+deb11u3	1.18.3-6+deb11u7	1
helicone/clickhouse-migration-runner :v2025.03.05-1	4c69b971a7e4	krb5@1.17-6ubuntu4.7	1.17-6ubuntu4.11	1
helicone/supabase-migration-runner :v2025.03.05-1	4a913936c97b	krb5@1.20.1-2	1.20.1-2+deb12u4	1
heywood8/redisinsight :2.28.0	0bc9ab313d37	krb5@1.18.3-6+deb11u3	1.18.3-6+deb11u7	1
hiboxsystems/marge-bot :0.11.0	7235809b43b3	krb5@1.18.3-6+deb11u3	1.18.3-6+deb11u7	1
hiboxsystems/marge-bot :0.12.1	a96c10b61a59	krb5@1.18.3-6+deb11u3	1.18.3-6+deb11u7	1
hiboxsystems/marge-bot :0.14.0	dcffb926e563	krb5@1.20.1-2+deb12u1	1.20.1-2+deb12u4	1