CVE-2025-3576

Medium

Advisory

Published 15 Apr 2025In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.9; base score, highest
EPSS: 0.003; 28th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 1,559; of 17,797 indexed, latest versions
Container images: 1,689; deployed by those charts
Fix available: 2 of 2; affected packages

Red Hat Security Advisory: krb5 security update

Carried by container images the latest versions of 1,559 of 17,797 indexed charts deploy, on 1,689 images.

Affected package	Affected versions	Fixed in	Images
krb5deb	1.12+dfsg-2ubuntu5, 1.12+dfsg-2ubuntu5.1, 1.12+dfsg-2ubuntu5.3, 1.12+dfsg-2ubuntu5.4+40 more	1.12+dfsg-2ubuntu5.4+esm7, 1.13.2+dfsg-5ubuntu2.2+esm7, 1.16-2ubuntu0.4+esm5, 1.17-6ubuntu4.11+4 more	1,445
krb5rpm	1.16.1-22.el8, 1.17-9.el8, 1.17-18.el8, 1.17-19.el8_2+25 more	0:1.17-19.el8_2.3, 0:1.18.2-9.el8_4.3, 0:1.18.2-16.el8_6.4, 0:1.18.2-26.el8_8.5+5 more	244

OSV records: DEBIAN-CVE-2025-3576 RHSA-2025:13664 RHSA-2025:13777 RHSA-2025:15001 RHSA-2025:15002 RHSA-2025:15003 RHSA-2025:15004 RHSA-2025:8411 RHSA-2025:9430 RLSA-2025:8411 RLSA-2025:9430 UBUNTU-CVE-2025-3576 DLA-4195-1 SUSE-SU-2025:3699-1
Also known as: USN-7542-1

Charts affected

1,559 by stars

Chart

Latest

Affected images

Radar Score

wp-gats-helmwordpress-gatsby

0.0.1

1 of 3 See more

wp-gats-helm wordpress-gatsby 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-3576.

Container image	Digest	Package	Fixed in
library/wordpress :6.0.0-php8.0-apache	277c6c25980f	krb5@1.18.3-6+deb11u1	1.18.3-6+deb11u7

Open the chart page →

2,022

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-3576.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	krb5@1.19.2-2ubuntu0.3	1.19.2-2ubuntu0.7

Open the chart page →

14,218

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2025-3576.

Container image	Digest	Package	Fixed in
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	krb5@1.18.2-14.el8	0:1.18.2-32.el8_10

Open the chart page →

11,622

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2025-3576.

Container image	Digest	Package	Fixed in
library/nginx :1.25	a484819eb602	krb5@1.20.1-2+deb12u1	1.20.1-2+deb12u4

Open the chart page →

7,714

xkopsxkops

0.1.0

3 of 5 See more

xkops xkops 0.1.0

3 of the 5 container images this version deploys carry CVE-2025-3576.

Container image	Digest	Package	Fixed in
hamzaarshad10/querybackend :1.6.2	2c1c3b86a8e7	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4
hamzaarshad10/querypodpy :1.7	154f38e8668e	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4
murtazashah46/helmfile :latest	4d11726cf803	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4

Open the chart page →

13,813

xlinexline

0.0.1

1 of 1 See more

xline xline 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-3576.

Container image	Digest	Package	Fixed in
ghcr.io/liangyuanpeng/xline :latest	3d2eceb44a3b	krb5@1.20.1-6ubuntu2	1.20.1-6ubuntu2.6

Open the chart page →

2,152

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2025-3576.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	krb5@1.18.2-22.el8_7	0:1.18.2-32.el8_10

Open the chart page →

6,017

enterprise-gatewayzeet

3.2.2

1 of 2 See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2025-3576.

Container image	Digest	Package	Fixed in
elyra/kernel-image-puller :3.2.2	c922f1f1646a	krb5@1.18.3-6+deb11u3	1.18.3-6+deb11u7

Open the chart page →

1,838

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2025-3576.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	krb5@1.18.2-22.el8_7	0:1.18.2-32.el8_10

Open the chart page →

3,697

Container images carrying it

1,689 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/vshn/haproxy-with-mysql :1.0.0	a3c27ee3fb2f	krb5@1.20.1-2	1.20.1-2+deb12u4	1
ghcr.io/wbstack/api :8x.9.11	eee94f9f7a53	krb5@1.18.3-6+deb11u2	1.18.3-6+deb11u7	1
ghcr.io/wbstack/mediawiki :1.37-7.4-20220621-fp-beta-0	c3012c8a34b4	krb5@1.18.3-6+deb11u1	1.18.3-6+deb11u7	1
ghcr.io/wgbh-mla/ov-wag :v1.1.0	6df27f944fe8	krb5@1.20.1-2+deb12u3	1.20.1-2+deb12u4	1
ghcr.io/wiremind/grafana-pdf-exporter :v1.7	dbaa8527bf4c	krb5@1.20.1-2+deb12u1	1.20.1-2+deb12u4	1
ghcr.io/wizarrrr/wizarr :4.2.0-beta.3	d19d886d5090	krb5@1.20.1-2+deb12u1	1.20.1-2+deb12u4	1
ghcr.io/wmde/wbaas-backup :v0.1.7	8e6a9516eac0	krb5@1.16-2ubuntu0.2	1.16-2ubuntu0.4+esm5	1
ghcr.io/wundergraph/cosmo/otelcollector :0.18.1	5a6fe78d4d15	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4	1
ghcr.io/zcube/bitnami-compat/redis :7.0-debian-11-r55	118a403046f7	krb5@1.18.3-6+deb11u3	1.18.3-6+deb11u7	1
ghcr.io/zoriya/kyoo_autosync :4.7.1	fbba58ddb1a6	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4	1
ghcr.io/zoriya/kyoo_back :4.7.1	416e980f76a6	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4	1
ghcr.io/zoriya/kyoo_scanner :4.7.1	7dc0ee57b628	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4	1
mcr.microsoft.com/mssql/server :2017-latest	13221ac5f673	krb5@1.16-2ubuntu0.4	1.16-2ubuntu0.4+esm5	1
mcr.microsoft.com/mssql/server :2019-CU16-ubuntu-20.04	49a57dc220b1	krb5@1.17-6ubuntu4.1	1.17-6ubuntu4.11	1
mcr.microsoft.com/mssql/server :2017-latest	fbf79e0fea59	krb5@1.16-2ubuntu0.4	1.16-2ubuntu0.4+esm5	1
mcr.microsoft.com/oss/azure/aad-pod-identity/nmi :v1.8.17	77788bf38938	krb5@1.18.3-6+deb11u3	1.18.3-6+deb11u7	1
public.ecr.aws/groundcovercom/grafana-groundcover :v0.0.54-grafana11.3.7	ee9d973e3952	krb5@1.19.2-2ubuntu0.6	1.19.2-2ubuntu0.7	1
public.ecr.aws/jtekt-corporation/annotation-tool :ef974ad9	abd817eb6845	krb5@1.18.3-6+deb11u3	1.18.3-6+deb11u7	1
public.ecr.aws/jtekt-corporation/image-storage-service :v1.16.17	b1493760c716	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4	1
public.ecr.aws/jtekt-corporation/image-storage-service-gui :v1.9.4	34823c8abe00	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4	1
public.ecr.aws/jtekt-corporation/polygonal-annotation-tool :a3fa9360	56efd38500d6	krb5@1.18.3-6+deb11u3	1.18.3-6+deb11u7	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	krb5@1.20.1-2+deb12u1	1.20.1-2+deb12u4	1
public.ecr.aws/jtekt-corporation/shinsei-manager-front :v1.5.5	f8fb4eea4071	krb5@1.20.1-2+deb12u1	1.20.1-2+deb12u4	1
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	krb5@1.20.1-2+deb12u1	1.20.1-2+deb12u4	1
public.ecr.aws/k6v9y5g3/cluster-agent :master.575	36d051110158	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4	1
public.ecr.aws/k6v9y5g3/cluster-agent :cost_k8s_process.576	9e14a72b066d	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4	1
public.ecr.aws/outerbounds/metaflow_metadata_service :v2.4.13	f7567ce3419d	krb5@1.20.1-2+deb12u1	1.20.1-2+deb12u4	1
public.ecr.aws/perfectscale-io/kube-state-metrics :4.1.14-redhat	849e235e2d3e	krb5@1.18.2-30.el8_10	0:1.18.2-32.el8_10	1
public.ecr.aws/perfectscale-io/psc-exporter :v1.0.45-redhat	9083e60c38bc	krb5@1.21.1-4.el9_5	0:1.21.1-8.el9_6	1
public.ecr.aws/perfectscale-io/ubi9/ubi :9.5	d7c3def9252b	krb5@1.21.1-4.el9_5	0:1.21.1-8.el9_6	1
public.ecr.aws/spotinst/spot-network-client :1.0.0-8-lb_endpoint-d0ec127	efcecf98b912	krb5@1.16-2ubuntu0.2	1.16-2ubuntu0.4+esm5	1
public.ecr.aws/supportpal/helpdesk-monolithic :4.0.4	573779e57fae	krb5@1.17-6ubuntu4.1	1.17-6ubuntu4.11	1
public.ecr.aws/t0u0d5o5/ecr_authenticator :latest	077e4e57e41c	krb5@1.18.3-6+deb11u4	1.18.3-6+deb11u7	1
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	krb5@1.20.1-2+deb12u1	1.20.1-2+deb12u4	1
public.ecr.aws/v0r6c2e2/hive-metastore :latest	794b3bff9510	krb5@1.21.1-2.el9_4	0:1.21.1-2.el9_4.2	1
public.ecr.aws/v0r6c2e2/trino :latest	c265156b00d1	krb5@1.21.1-4.el9_5	0:1.21.1-8.el9_6	1
quay.io/aerokube/jumphost :1.0.1	70fd7c00418d	krb5@1.19.2-2ubuntu0.3	1.19.2-2ubuntu0.7	1
quay.io/aerokube/keygen :1.0.1	578934444f04	krb5@1.19.2-2ubuntu0.3	1.19.2-2ubuntu0.7	1
quay.io/ai-lab/llamacpp_python :latest	70d138997acd	krb5@1.21.1-2.el9_4	0:1.21.1-2.el9_4.2	1
quay.io/ansible/awx-operator :2.19.1	7302e0c8e5a7	krb5@1.18.2-26.el8_9	0:1.18.2-32.el8_10	1
quay.io/apicurio/apicurio-registry-mem :2.5.8.Final	3b036692d546	krb5@1.18.2-26.el8_9	0:1.18.2-32.el8_10	1
quay.io/argoproj/argocd :v2.4.11	5b6701d8fb31	krb5@1.19.2-2	1.19.2-2ubuntu0.7	1
quay.io/argoproj/argocd :v3.0.3	95b5cf7ba6fe	krb5@1.20.1-6ubuntu2.5	1.20.1-6ubuntu2.6	1
quay.io/argoproj/argocd :v2.8.6	acaf37352569	krb5@1.19.2-2ubuntu0.2	1.19.2-2ubuntu0.7	1
quay.io/backube/scribe :0.2.0	cdefc81c6b2e	krb5@1.18.2-8.el8	0:1.18.2-9.el8_4.3	1
quay.io/bentoml/yatai :0.4.6	14b482c1f1b8	krb5@1.18.3-6+deb11u1	1.18.3-6+deb11u7	1
quay.io/cilium/cilium :v1.15.1	351d6685dc6f	krb5@1.19.2-2ubuntu0.3	1.19.2-2ubuntu0.7	1
quay.io/cloudnativetoolkit/cloud-pak-deployer :latest	13aaae779248	krb5@1.18.2-25.el8_8	0:1.18.2-26.el8_8.5	1
quay.io/clustersecret/clustersecret :0.0.14	a9f835d1b241	krb5@1.20.1-2+deb12u2	1.20.1-2+deb12u4	1
quay.io/ctrontesting/iofog-controller :latest	10df27bc5560	krb5@1.18.2-8.el8	0:1.18.2-9.el8_4.3	1