CVE-2025-4207

Medium

Advisory

Published 8 May 2025In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.9; base score, highest
EPSS: 0.007; 52nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 252; of 17,781 indexed, latest versions
Container images: 254; deployed by those charts
Fix available: 10 of 13; affected packages

PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation

Carried by container images the latest versions of 252 of 17,781 indexed charts deploy, on 254 images.

Affected package	Affected versions	Fixed in	Images
postgresql-15deb	15.3-0+deb12u1, 15.3-1.pgdg120+1, 15.4-2.pgdg120+1, 15.5-0+deb12u1+6 more	15.13-0+deb12u1	76
postgresqlbitnami	11.8.0-10, 11.12.0-7, 14.4.0-0, 14.4.0-11+23 more	13.21.0	28
postgresql-12deb	12.7-0ubuntu0.20.04.1, 12.8-0ubuntu0.20.04.1, 12.9-0ubuntu0.20.04.1, 12.11-0ubuntu0.20.04.1+2 more	12.22-0ubuntu0.20.04.4	17
postgresql16apk	16.1-r0, 16.2-r0, 16.2-r1, 16.3-r0+2 more	16.9-r0	13
PostgreSQLbitnami	15.3.0, 15.4.0, 15.5.0-42, 16.0.0+6 more	13.21.0	11
postgresql-14deb	14.3-1.pgdg22.04+1, 14.4-0ubuntu0.22.04.1, 14.5-0ubuntu0.22.04.1, 14.6-1.pgdg22.04+1+4 more	14.18-0ubuntu0.22.04.1	11
postgresql15apk	15.3-r0, 15.4-r0, 15.5-r0, 15.6-r0+1 more	15.13-r0	8
postgresql-10deb	10.6-0ubuntu0.18.04.1, 10.10-0ubuntu0.18.04.1, 10.12-0ubuntu0.18.04.1, 10.14-0ubuntu0.18.04.1+1 more	no fix listed	6
postgresql17apk	17.2-r0, 17.4-r0	17.5-r0	3
postgresql-9.5deb	9.5.10-0ubuntu0.16.04, 9.5.14-0ubuntu0.16.04	no fix listed	3
postgresql-16deb	16.2-1ubuntu4, 16.6-0ubuntu0.24.04.1	16.9-0ubuntu0.24.04.1	2
postgresql-9.3deb	9.3.22-0ubuntu0.14.04	no fix listed	1
postgresql-13deb	13.3-1, 13.4-0+deb11u1, 13.5-0+deb11u1, 13.6-1.pgdg110+1+13 more	13.21-0+deb11u1	85

OSV records: ALPINE-CVE-2025-4207 BIT-postgresql-2025-4207 DEBIAN-CVE-2025-4207 UBUNTU-CVE-2025-4207 DLA-4159-1
Also known as: USN-7520-1

Charts affected

252 by stars

Chart

Latest

Affected images

Radar Score

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2025-4207.

Container image	Digest	Package	Fixed in
ghcr.io/bat-bs/bitnami-pgvector :pg16	19ebe07b4daf	postgresql@16.6.0-1	13.21.0

Open the chart page →

11,577

enterprise-gatewayzeet

3.2.2

1 of 2 See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2025-4207.

Container image	Digest	Package	Fixed in
elyra/kernel-image-puller :3.2.2	c922f1f1646a	postgresql-13@13.9-0+deb11u1	13.21-0+deb11u1

Open the chart page →

1,838

Container images carrying it

254 by charts deploying them

A fixed version is listed for 10 of the 13 affected packages.

Container image	Digest	Package	Fixed in	Used by
bitnamilegacy/postgresql :15.5.0	6887635cc793	postgresql@15.5.0-42 PostgreSQL@15.5.0-42	13.21.0 13.21.0	1
bitnamilegacy/postgresql :17.5.0-debian-12-r12	85198aae0aed	postgresql@17.5.0-9	13.21.0	1
bitnamilegacy/postgresql :16.2.0-debian-12-r8	90fda44bfa42	postgresql@16.2.0-4 PostgreSQL@16.2.0-4	13.21.0 13.21.0	1
bitnamilegacy/postgresql :16.0.0-debian-11-r3	b8a21df9b747	PostgreSQL@16.0.0	13.21.0	1
bitnamilegacy/postgresql :11.8.0	c3f10b41989f	postgresql@11.8.0-10	13.21.0	1
bitnamilegacy/postgresql :16.3.0-debian-12-r14	cc55da2fa366	postgresql@16.3.0-11 PostgreSQL@16.3.0-11	13.21.0 13.21.0	1
bitnamilegacy/postgresql :17.2.0-debian-12-r5	cf63048c9209	postgresql@17.2.0-4	13.21.0	1
bitnamilegacy/postgresql :17.2.0-debian-12-r2	e6fa49bb0347	postgresql@17.2.0-1	13.21.0	1
bitnamilegacy/postgresql :16.2.0-debian-12-r6	ea55532b6f75	postgresql@16.2.0-2 PostgreSQL@16.2.0-2	13.21.0 13.21.0	1
bitnamilegacy/postgresql :17.4.0-debian-12-r11	fb3806e823c2	postgresql@17.4.0-9	13.21.0	1
bitnamilegacy/postgresql :16.3.0-debian-12-r15	fdc6979dbc53	postgresql@16.3.0-12	13.21.0	1
bmeares/meerschaum :2.8.4	8e9c5bacaa82	postgresql-15@15.10-0+deb12u1	15.13-0+deb12u1	1
bnjbvr/kresus :0.22.1	37e216b182c8	postgresql-15@15.10-0+deb12u1	15.13-0+deb12u1	1
buntha/mlflow :2.1.1	154542cc3083	postgresql-13@13.9-0+deb11u1	13.21-0+deb11u1	1
calltelemetry/web :0.8.1-rc72	05d13269e350	postgresql-15@15.8-0+deb12u1	15.13-0+deb12u1	1
calltelemetry/web :0.6.7	457a7e353542	postgresql-13@13.7-0+deb11u1	13.21-0+deb11u1	1
camerahub/camerahub :0.36.23	a5af37dd6e1b	postgresql-13@13.9-0+deb11u1	13.21-0+deb11u1	1
carlosmz87/test_helm_backend :latest	8ffa63aa995d	postgresql-15@15.8-0+deb12u1	15.13-0+deb12u1	1
chandanteekinavar/findery-market-product-service :1.0	c49ff7c141c0	postgresql-13@13.18-0+deb11u1	13.21-0+deb11u1	1
codecov/self-hosted-api :24.4.1	0475cb1c3136	postgresql15@15.6-r0	15.13-r0	1
codecov/self-hosted-worker :24.4.1	837f546b479b	postgresql15@15.6-r0	15.13-r0	1
danuk/telegram-sender :0.0.1	026560388070	postgresql-13@13.8-0+deb11u1	13.21-0+deb11u1	1
djjudas21/dbdump :0.0.9	17fc245e29bd	postgresql16@16.2-r0	16.9-r0	1
douz/helpdesk :latest	4384103d0219	postgresql-13@13.7-0+deb11u1	13.21-0+deb11u1	1
elyra/kernel-image-puller :3.2.2	c922f1f1646a	postgresql-13@13.9-0+deb11u1	13.21-0+deb11u1	1
erlangsolutions/wombatoam :4.1.28	4680c990147a	postgresql-13@13.8-0+deb11u1	13.21-0+deb11u1	1
factly/hunting :0.2.0-stagv1.2	ca5bc71d1d5c	postgresql-13@13.9-0+deb11u1	13.21-0+deb11u1	1
fanzynoodle/smeejas :0.0.1	5f9916c1a287	postgresql-13@13.5-0+deb11u1	13.21-0+deb11u1	1
felipecs8/app-db-connection-test :v1	29e06c9c6385	postgresql-15@15.10-0+deb12u1	15.13-0+deb12u1	1
firefart/requesttracker :5.0.4	0d6249906d8c	postgresql-15@15.3-0+deb12u1	15.13-0+deb12u1	1
fluent/fluent-bit :2.2.0	0fa18c71d821	postgresql-13@13.11-0+deb11u1	13.21-0+deb11u1	1
fluent/fluent-bit :2.1	5766d881ddb1	postgresql-13@13.11-0+deb11u1	13.21-0+deb11u1	1
fluent/fluent-bit :2.1.9	6a1d0c693dfa	postgresql-13@13.11-0+deb11u1	13.21-0+deb11u1	1
fonoster/routr-pgdata-migrations :2.13.6	c7b1dba81eb3	postgresql16@16.4-r0	16.9-r0	1
galaxy/galaxy-stable :v18.01	8e577a626dfd	postgresql-9.3@9.3.22-0ubuntu0.14.04	no fix listed	1
geoscienceaustralia/dea-k8s-data :latest	f4039b45572a	postgresql-10@10.14-0ubuntu0.18.04.1	no fix listed	1
golenski/db-init :1.0.0	86ca17cd3063	postgresql-13@13.16-0+deb11u1	13.21-0+deb11u1	1
graphprotocol/graph-node :v0.37.0	f4452cdedd68	postgresql-15@15.10-0+deb12u1	15.13-0+deb12u1	1
ha33ona/python :test	6affdfc644d0	postgresql-13@13.5-0+deb11u1	13.21-0+deb11u1	1
healthchecks/healthchecks :v2.8.1	e82bb0836e30	postgresql-13@13.9-0+deb11u1	13.21-0+deb11u1	1
helga09/shoes_ukr :v1.1.1	7999bc8b77c0	postgresql-13@13.10-0+deb11u1	13.21-0+deb11u1	1
helicone/supabase-migration-runner :v2025.03.05-1	4a913936c97b	postgresql-15@15.3-0+deb12u1	15.13-0+deb12u1	1
huginn/huginn-single-process :4d17829cf6b15b004ad3f4be196303dca4944810	c794eddc7b47	postgresql-10@10.15-0ubuntu0.18.04.1	no fix listed	1
intelowlproject/intelowl :v6.6.1	0b22e547ea6b	postgresql-15@15.5-0+deb12u1	15.13-0+deb12u1	1
jupyterhub/k8s-hub :3.0.1-0.dev.git.6287.hbfb05cd6	5a0ceed1300a	postgresql-13@13.11-0+deb11u1	13.21-0+deb11u1	1
knspar/phronetis-operator :0.1.6	0c4f0543ee58	postgresql-15@15.6-0+deb12u1	15.13-0+deb12u1	1
kobotoolbox/kobocat :2.022.24a	b15679454415	postgresql-13@13.7-0+deb11u1	13.21-0+deb11u1	1
kobotoolbox/kpi :2.022.24d	bcacc01bccd4	postgresql-13@13.7-0+deb11u1	13.21-0+deb11u1	1
kporwit/vinyl_lib_app :v0.1.1	217de0302218	postgresql-13@13.7-0+deb11u1	13.21-0+deb11u1	1
library/postgres :13.7	03652c675ae1	postgresql-13@13.7-1.pgdg110+1	13.21-0+deb11u1	1