CVE-2025-4207
MediumAdvisory
Published 8 May 2025In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.9
- base score, highest
- EPSS
- 0.007
- 52nd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 252
- of 17,781 indexed, latest versions
- Container images
- 254
- deployed by those charts
- Fix available
- 10 of 13
- affected packages
PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation
Carried by container images the latest versions of 252 of 17,781 indexed charts deploy, on 254 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| postgresql-15deb | 15.3-0+deb12u1, 15.3-1.pgdg120+1, 15.4-2.pgdg120+1, 15.5-0+deb12u1+6 more | 15.13-0+deb12u1 | 76 |
| postgresqlbitnami | 11.8.0-10, 11.12.0-7, 14.4.0-0, 14.4.0-11+23 more | 13.21.0 | 28 |
| postgresql-12deb | 12.7-0ubuntu0.20.04.1, 12.8-0ubuntu0.20.04.1, 12.9-0ubuntu0.20.04.1, 12.11-0ubuntu0.20.04.1+2 more | 12.22-0ubuntu0.20.04.4 | 17 |
| postgresql16apk | 16.1-r0, 16.2-r0, 16.2-r1, 16.3-r0+2 more | 16.9-r0 | 13 |
| PostgreSQLbitnami | 15.3.0, 15.4.0, 15.5.0-42, 16.0.0+6 more | 13.21.0 | 11 |
| postgresql-14deb | 14.3-1.pgdg22.04+1, 14.4-0ubuntu0.22.04.1, 14.5-0ubuntu0.22.04.1, 14.6-1.pgdg22.04+1+4 more | 14.18-0ubuntu0.22.04.1 | 11 |
| postgresql15apk | 15.3-r0, 15.4-r0, 15.5-r0, 15.6-r0+1 more | 15.13-r0 | 8 |
| postgresql-10deb | 10.6-0ubuntu0.18.04.1, 10.10-0ubuntu0.18.04.1, 10.12-0ubuntu0.18.04.1, 10.14-0ubuntu0.18.04.1+1 more | no fix listed | 6 |
| postgresql17apk | 17.2-r0, 17.4-r0 | 17.5-r0 | 3 |
| postgresql-9.5deb | 9.5.10-0ubuntu0.16.04, 9.5.14-0ubuntu0.16.04 | no fix listed | 3 |
| postgresql-16deb | 16.2-1ubuntu4, 16.6-0ubuntu0.24.04.1 | 16.9-0ubuntu0.24.04.1 | 2 |
| postgresql-9.3deb | 9.3.22-0ubuntu0.14.04 | no fix listed | 1 |
| postgresql-13deb | 13.3-1, 13.4-0+deb11u1, 13.5-0+deb11u1, 13.6-1.pgdg110+1+13 more | 13.21-0+deb11u1 | 85 |
- OSV records
- ALPINE-CVE-2025-4207BIT-postgresql-2025-4207DEBIAN-CVE-2025-4207UBUNTU-CVE-2025-4207DLA-4159-1
- Also known as
- USN-7520-1
Charts affected
252 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| airflowapache-airflowOfficialVerified publisher | 1.22.0 | 1 of 4See more | 3,195 |
| airflowairflow-helmVerified publisher | 8.9.0 | 2 of 4See more | 11,367 |
| netboxbootcVerified publisher | 4.1.1 | 1 of 4See more | 9,145 |
| weblateweblateOfficialVerified publisher | 0.5.36 | 1 of 3See more | 6,699 |
| difydoubanVerified publisher | 0.10.0 | 1 of 6See more | 19,391 |
| difydify-helmVerified publisher | 0.38.0 | 1 of 11See more | 22,002 |
| openprojectopenproject-helm-chartsOfficialVerified publisher | 13.11.0 | 1 of 5See more | 19,926 |
| zabbixcetic | 3.1.3 | 2 of 5See more | 33,725 |
| chatwootchatwootVerified publisher | 2.0.24 | 1 of 3See more | 9,203 |
| synapsehalkeye | 0.40.0 | 1 of 2See more | 6,543 |
| stacks-blockchain-apihirosystemsVerified publisher | 6.5.1 | 1 of 5See more | 8,364 |
| litellm-helmlitellm | 1.100.1 | 1 of 2See more | 5,003 |
| flagsmithflagsmithOfficialVerified publisher | 0.83.0 | 1 of 4See more | 2,110 |
| prefect-serverprefectVerified publisher | 2026.9.3212605 | 1 of 2See more | 5,786 |
| adminercetic | 0.2.1 | 1 of 1See more | 461 |
| mauticone-acre-fundVerified publisher | 0.1.7 | 1 of 3See more | 2,667 |
| ilumilumOfficialVerified publisher | 6.7.3 | 2 of 19See more | 23,228 |
| tbmq-clustertbmq-helm-chartOfficialVerified publisher | 2.1.0 | 1 of 3See more | 3,534 |
| barmanadfinisVerified publisher | 0.10.0 | 1 of 1See more | 1,552 |
| zabbix-serveraekondratievVerified publisher | 1.0.6 | 2 of 4See more | 30,668 |
| baserowbaserow-chartVerified publisher | 1.0.56 | 1 of 6See more | 17,263 |
| fadicetic | 0.3.1 | 1 of 25See more | 52,919 |
| daskhubdask | 2024.1.1 | 1 of 9See more | 14,094 |
| infrahubinfrahubVerified publisher | 4.33.2 | 1 of 5See more | 10,428 |
| kubeflowkubeflow | 1.6.2 | 2 of 45See more | 96,941 |
| kubernetes-loggingkubernetes-logging | 4.8.0 | 1 of 6See more | 10,530 |
| librechatlibrechat-openshiftVerified publisher | 1.9.0 | 1 of 3See more | 5,779 |
| k8s-telegram-sendertelegram-senderVerified publisher | 0.0.1 | 1 of 1See more | 3,048 |
| uffizzi-appuffizzi-app | 1.3.0 | 1 of 14See more | 19,337 |
| alerta-webalerta-webVerified publisher | 0.1.12 | 1 of 2See more | 3,569 |
| convertigoconvertigoOfficialVerified publisher | 8.4.3 | 1 of 5See more | 17,404 |
| cosmocosmo-platformOfficialVerified publisher | 0.20.0 | 1 of 10See more | 28,839 |
| healthchecksgabe565Verified publisher | 0.17.0 | 1 of 1See more | 2,286 |
| infrahub-enterpriseinfrahub-enterpriseVerified publisher | 4.19.2 | 1 of 5See more | 10,530 |
| kea-dhcpmglants | 0.7.1 | 1 of 1See more | 1,133 |
| nebraskanebraska | 3.0.0 | 1 of 2See more | 4,060 |
| kobotoolboxone-acre-fundVerified publisher | 0.7.4 | 2 of 9See more | 18,517 |
| open-zaakopen-zaak | 0.8.0 | 1 of 3See more | 4,045 |
| nominatimrobjuz | 6.4.1 | 1 of 4See more | 8,690 |
| thingsboard-clusterthingsboard-cluster-bettaVerified publisher | 0.2.26 | 1 of 6See more | 14,566 |
| feedbacksystemthm-mni-iiVerified publisher | 0.47.1 | 1 of 10See more | 28,534 |
| huginnutkuozdemirVerified publisher | 2.2.1 | 1 of 4See more | 18,137 |
| roundcubevolker-raschekVerified publisher | 0.3.1 | 1 of 1See more | 1,797 |
| wombatwombatOfficialVerified publisher | 4.1.28 | 1 of 1See more | 3,697 |
| icat-k8salba-helm-chartsVerified publisher | 1.1.0 | 1 of 4See more | 3,697 |
| clearml-servingallegroaiVerified publisher | 1.6.2 | 2 of 9See more | 17,877 |
| psonoankra-chartsVerified publisher | 1.2.0 | 1 of 2See more | 2,388 |
| open-elevationbeeinventor | 0.1.0 | 1 of 2See more | 13,145 |
| cert-vaultcert-vaultOfficialVerified publisher | 2.12.0 | 1 of 7See more | 15,863 |
| paperless-ngxcrystalnetVerified publisher | 0.2.22 | 1 of 3See more | 13,761 |
Container images carrying it
254 by charts deploying them
A fixed version is listed for 10 of the 13 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| bitnamilegacy/ | 42a8200d3597 | postgresql | 13.21.0 | 5 |
| bitnamilegacy/ | 233f361c5819 | postgresql | 13.21.0 | 4 |
| bitnamilegacy/ | 5dba7e6a514d | postgresql PostgreSQL | 13.21.0 13.21.0 | 4 |
| bitnamilegacy/ | cc301eef7436 | postgresql PostgreSQL | 13.21.0 13.21.0 | 3 |
| bitnamilegacy/ | df6ec02e2b9a | postgresql | 13.21.0 | 3 |
| opencsghq/ | 57def8e77d0f | postgresql17 | 17.5-r0 | 3 |
| ghcr.io/ | 19ebe07b4daf | postgresql | 13.21.0 | 3 |
| apache/ | ae0b86d3c4d0 | postgresql-16 | 16.9-0ubuntu0.24.04.1 | 2 |
| bitnamilegacy/ | 7e7ebb082031 | postgresql | 13.21.0 | 2 |
| bitnamilegacy/ | 94bc968141e7 | postgresql | 13.21.0 | 2 |
| chatwoot/ | d530ab8c1753 | postgresql15 | 15.13-r0 | 2 |
| freeradius/ | 21c8bfa904d8 | postgresql-10 | no fix listed | 2 |
| gjeanmart/ | 926264c8f2d1 | postgresql-15 | 15.13-0+deb12u1 | 2 |
| library/ | 34d37131366c | postgresql-13 | 13.21-0+deb11u1 | 2 |
| library/ | eedf63967cdb | postgresql-15 | 15.13-0+deb12u1 | 2 |
| moreillon/ | e1c9bfab5c16 | postgresql-15 | 15.13-0+deb12u1 | 2 |
| omecproject/ | cfdb566dd949 | postgresql-9.5 | no fix listed | 2 |
| opendatacube/ | 668cbb41473c | postgresql-16 | 16.9-0ubuntu0.24.04.1 | 2 |
| pecan/ | f825d480cd62 | postgresql-13 | 13.21-0+deb11u1 | 2 |
| qichenxu4pd/ | f3a8502bc21b | postgresql-15 | 15.13-0+deb12u1 | 2 |
| vaultwarden/ | 39f34c5159a2 | postgresql-13 | 13.21-0+deb11u1 | 2 |
| yzhou442/ | a3f7ca69e28d | postgresql-13 | 13.21-0+deb11u1 | 2 |
| ghcr.io/ | c181abe1093d | postgresql16 | 16.9-r0 | 2 |
| ghcr.io/ | df576862b7c0 | postgresql16 | 16.9-r0 | 2 |
| ghcr.io/ | 5be52524664c | postgresql-14 | 14.18-0ubuntu0.22.04.1 | 2 |
| ghcr.io/ | 5f545698e907 | postgresql-14 | 14.18-0ubuntu0.22.04.1 | 2 |
| ghcr.io/ | 245f9d2f5f5b | postgresql-15 | 15.13-0+deb12u1 | 2 |
| akaunting/ | 52811b36ec3a | postgresql-15 | 15.13-0+deb12u1 | 1 |
| allegroai/ | fca885e8cfc6 | postgresql-13 | 13.21-0+deb11u1 | 1 |
| allegroai/ | c58d9da7bdf8 | postgresql-13 | 13.21-0+deb11u1 | 1 |
| ankane/ | d3a9d8ac27bb | postgresql-15 | 15.13-0+deb12u1 | 1 |
| apache/ | 975ab033580d | postgresql-13 | 13.21-0+deb11u1 | 1 |
| apache/ | ab9467fd712c | postgresql-15 | 15.13-0+deb12u1 | 1 |
| archish27/ | 6610071a2101 | postgresql-13 | 13.21-0+deb11u1 | 1 |
| aristidetm/ | ccb516cb8474 | postgresql-13 | 13.21-0+deb11u1 | 1 |
| arthurjguerra18/ | f540af20b307 | postgresql-15 | 15.13-0+deb12u1 | 1 |
| assistiot/ | 8b5d118bdf0e | postgresql-13 | 13.21-0+deb11u1 | 1 |
| assistiot/ | b1dbe4d62a03 | postgresql-15 | 15.13-0+deb12u1 | 1 |
| avinash263/ | aa2b8727f1a6 | postgresql-15 | 15.13-0+deb12u1 | 1 |
| azhar008/ | a1e827b0adea | postgresql-13 | 13.21-0+deb11u1 | 1 |
| baserow/ | e0b3c8130b91 | postgresql-15 | 15.13-0+deb12u1 | 1 |
| baserow/ | df0c42eb67e8 | postgresql-15 | 15.13-0+deb12u1 | 1 |
| bitnamilegacy/ | 02e2f47a405e | postgresql | 13.21.0 | 1 |
| bitnamilegacy/ | 04f3b0dfdb15 | postgresql PostgreSQL | 13.21.0 13.21.0 | 1 |
| bitnamilegacy/ | 29e3dd0e7e7a | postgresql PostgreSQL | 13.21.0 13.21.0 | 1 |
| bitnamilegacy/ | 3332e81afb4f | postgresql PostgreSQL | 13.21.0 13.21.0 | 1 |
| bitnamilegacy/ | 3ba6e6f11388 | postgresql | 13.21.0 | 1 |
| bitnamilegacy/ | 3e65a6b89e38 | postgresql | 13.21.0 | 1 |
| bitnamilegacy/ | 5f4cf61668e5 | postgresql PostgreSQL | 13.21.0 13.21.0 | 1 |
| bitnamilegacy/ | 687034f33da6 | postgresql | 13.21.0 | 1 |