CVE-2025-4207

Medium

Advisory

Published 8 May 2025In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.9; base score, highest
EPSS: 0.007; 52nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 252; of 17,781 indexed, latest versions
Container images: 254; deployed by those charts
Fix available: 10 of 13; affected packages

PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation

Carried by container images the latest versions of 252 of 17,781 indexed charts deploy, on 254 images.

Affected package	Affected versions	Fixed in	Images
postgresql-15deb	15.3-0+deb12u1, 15.3-1.pgdg120+1, 15.4-2.pgdg120+1, 15.5-0+deb12u1+6 more	15.13-0+deb12u1	76
postgresqlbitnami	11.8.0-10, 11.12.0-7, 14.4.0-0, 14.4.0-11+23 more	13.21.0	28
postgresql-12deb	12.7-0ubuntu0.20.04.1, 12.8-0ubuntu0.20.04.1, 12.9-0ubuntu0.20.04.1, 12.11-0ubuntu0.20.04.1+2 more	12.22-0ubuntu0.20.04.4	17
postgresql16apk	16.1-r0, 16.2-r0, 16.2-r1, 16.3-r0+2 more	16.9-r0	13
PostgreSQLbitnami	15.3.0, 15.4.0, 15.5.0-42, 16.0.0+6 more	13.21.0	11
postgresql-14deb	14.3-1.pgdg22.04+1, 14.4-0ubuntu0.22.04.1, 14.5-0ubuntu0.22.04.1, 14.6-1.pgdg22.04+1+4 more	14.18-0ubuntu0.22.04.1	11
postgresql15apk	15.3-r0, 15.4-r0, 15.5-r0, 15.6-r0+1 more	15.13-r0	8
postgresql-10deb	10.6-0ubuntu0.18.04.1, 10.10-0ubuntu0.18.04.1, 10.12-0ubuntu0.18.04.1, 10.14-0ubuntu0.18.04.1+1 more	no fix listed	6
postgresql17apk	17.2-r0, 17.4-r0	17.5-r0	3
postgresql-9.5deb	9.5.10-0ubuntu0.16.04, 9.5.14-0ubuntu0.16.04	no fix listed	3
postgresql-16deb	16.2-1ubuntu4, 16.6-0ubuntu0.24.04.1	16.9-0ubuntu0.24.04.1	2
postgresql-9.3deb	9.3.22-0ubuntu0.14.04	no fix listed	1
postgresql-13deb	13.3-1, 13.4-0+deb11u1, 13.5-0+deb11u1, 13.6-1.pgdg110+1+13 more	13.21-0+deb11u1	85

OSV records: ALPINE-CVE-2025-4207 BIT-postgresql-2025-4207 DEBIAN-CVE-2025-4207 UBUNTU-CVE-2025-4207 DLA-4159-1
Also known as: USN-7520-1

Charts affected

252 by stars

Chart

Latest

Affected images

Radar Score

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2025-4207.

Container image	Digest	Package	Fixed in
ghcr.io/bat-bs/bitnami-pgvector :pg16	19ebe07b4daf	postgresql@16.6.0-1	13.21.0

Open the chart page →

11,577

enterprise-gatewayzeet

3.2.2

1 of 2 See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2025-4207.

Container image	Digest	Package	Fixed in
elyra/kernel-image-puller :3.2.2	c922f1f1646a	postgresql-13@13.9-0+deb11u1	13.21-0+deb11u1

Open the chart page →

1,838

Container images carrying it

254 by charts deploying them

A fixed version is listed for 10 of the 13 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/0xemma/reddark :main	2a115e991894	postgresql-13@13.11-0+deb11u1	13.21-0+deb11u1	1
ghcr.io/astriaorg/astrotrek :0.1.0	5889bea38e56	postgresql-15@15.8-0+deb12u1	15.13-0+deb12u1	1
ghcr.io/axoflow/axosyslog :4.5.0	aa7831e207cd	postgresql15@15.5-r0	15.13-r0	1
ghcr.io/borgmatic-collective/borgmatic :1.9.9	835b72878606	postgresql17@17.2-r0	17.5-r0	1
ghcr.io/camptocamp/tetragon-policy-builder :master	0e99f12bb040	postgresql-15@15.10-0+deb12u1	15.13-0+deb12u1	1
ghcr.io/chatwoot/pgvector :14.4.0-debian-11-r0	f759f1510d09	postgresql@14.4.0-0	13.21.0	1
ghcr.io/cosmo-workspace/dev-code-server :v0.0.3	16fda01ae58a	postgresql-15@15.12-0+deb12u2	15.13-0+deb12u1	1
ghcr.io/drewburr-labs/mum-discord-bot :3.1.2	6e82914e1051	postgresql-15@15.5-0+deb12u1	15.13-0+deb12u1	1
ghcr.io/ducksify/pgdump-to-s3 :latest	c42c0946bd0f	postgresql-13@13.7-0+deb11u1	13.21-0+deb11u1	1
ghcr.io/element-hq/synapse :v1.111.0	22ae556e0de4	postgresql-15@15.7-0+deb12u1	15.13-0+deb12u1	1
ghcr.io/estaid-app/pgbouncer-docker :1.22.0	7e5630757299	postgresql16@16.1-r0	16.9-r0	1
ghcr.io/facebook/threatexchange/hma :1.0.17	84d09c6b75a7	postgresql-13@13.20-0+deb11u1	13.21-0+deb11u1	1
ghcr.io/g0dscookie/icinga2 :2.13.5	da81246ccfc9	postgresql-13@13.8-0+deb11u1	13.21-0+deb11u1	1
ghcr.io/gabe565/obico/web :latest	a5c1daef46c0	postgresql15@15.10-r0	15.13-r0	1
ghcr.io/graphprotocol/availability-oracle :sha-28312fd	472a25038957	postgresql-15@15.7-0+deb12u1	15.13-0+deb12u1	1
ghcr.io/jmberesford/retrom-service :retrom-v0.7.14	4d763d58f11d	postgresql-15@15.10-0+deb12u1	15.13-0+deb12u1	1
ghcr.io/kvaps/opennebula :v5.12.0.4-1	e28e0e7de11b	postgresql-12@12.7-0ubuntu0.20.04.1	12.22-0ubuntu0.20.04.4	1
ghcr.io/kvaps/opennebula-exporter :v5.12.0.4	01563adc95fd	postgresql-12@12.7-0ubuntu0.20.04.1	12.22-0ubuntu0.20.04.4	1
ghcr.io/kvaps/opennebula-exporter :v5.12.0.4-1	2b92df1143b9	postgresql-12@12.7-0ubuntu0.20.04.1	12.22-0ubuntu0.20.04.4	1
ghcr.io/kvaps/opennebula-flow :v5.12.0.4-1	600221f0f43f	postgresql-12@12.7-0ubuntu0.20.04.1	12.22-0ubuntu0.20.04.4	1
ghcr.io/kvaps/opennebula-gate :v5.12.0.4-1	a85e03d8bc1d	postgresql-12@12.7-0ubuntu0.20.04.1	12.22-0ubuntu0.20.04.4	1
ghcr.io/leoquote/tinyproxy_exporter :master	6b4103d88dbb	postgresql-13@13.3-1	13.21-0+deb11u1	1
ghcr.io/libreconnect/ferriscompany :0.1.0-rc6	ed86db9f0efe	postgresql-15@15.8-0+deb12u1	15.13-0+deb12u1	1
ghcr.io/linuxoid69/motion :4.7.0-0.1.0	f0f000c3fc47	postgresql-13@13.18-0+deb11u1	13.21-0+deb11u1	1
ghcr.io/linuxserver/healthchecks :version-v3.9	b5c6bfb00b03	postgresql17@17.4-r0	17.5-r0	1
ghcr.io/mastodon/mastodon :v4.1.2	6b18e6d0eda4	postgresql-13@13.9-0+deb11u1	13.21-0+deb11u1	1
ghcr.io/maybe-finance/maybe :0.5.0	c6ab95ca9130	postgresql-15@15.10-0+deb12u1	15.13-0+deb12u1	1
ghcr.io/mglants/kea-dhcp :2.5.8	e1b6eb9e37f9	postgresql16@16.3-r0	16.9-r0	1
ghcr.io/nathanvaughn/webtrees :2.0.19	69423a100fab	postgresql-13@13.5-0+deb11u1	13.21-0+deb11u1	1
ghcr.io/nefelim4ag/pingdom-operator :0.0.15	f8c7afdcf439	postgresql-15@15.7-0+deb12u1	15.13-0+deb12u1	1
ghcr.io/opencost/opencost-parquet-exporter :v0.2.1	ce85ef0ce665	postgresql-15@15.10-0+deb12u1	15.13-0+deb12u1	1
ghcr.io/paperless-ngx/paperless-ngx :2.13.1	0642357c5dbd	postgresql-15@15.8-0+deb12u1	15.13-0+deb12u1	1
ghcr.io/paperless-ngx/paperless-ngx :1.8.0	9bbc9a90641e	postgresql-13@13.7-0+deb11u1	13.21-0+deb11u1	1
ghcr.io/paperless-ngx/paperless-ngx :2.0.1	ab255bea133e	postgresql-15@15.5-0+deb12u1	15.13-0+deb12u1	1
ghcr.io/postgresml/pgcat :v1.2.0	627761f6dcbc	postgresql-15@15.8-0+deb12u1	15.13-0+deb12u1	1
ghcr.io/remla23-team17/app :1.0.0	5816dbddf47d	postgresql-13@13.11-0+deb11u1	13.21-0+deb11u1	1
ghcr.io/remla23-team17/model-service :1.0.0	aa59fe2c4f6a	postgresql-13@13.11-0+deb11u1	13.21-0+deb11u1	1
ghcr.io/rivals-space/rivals-mastodon :1.6.1	43b23d55e4be	postgresql-13@13.9-0+deb11u1	13.21-0+deb11u1	1
ghcr.io/rodg/nodecg-base :latest	31be4bf87070	postgresql-13@13.11-0+deb11u1	13.21-0+deb11u1	1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui :0.2.1-5d668c1	ed07e7ca098d	postgresql-15@15.10-0+deb12u1	15.13-0+deb12u1	1
ghcr.io/tandoorrecipes/recipes :1.5.31	063eb446e298	postgresql16@16.6-r0	16.9-r0	1
ghcr.io/wizarrrr/wizarr :4.2.0-beta.3	d19d886d5090	postgresql-15@15.5-0+deb12u1	15.13-0+deb12u1	1
ghcr.io/wyrihaximusnet/redirect :random	bf5983d754d7	postgresql16@16.3-r0	16.9-r0	1
ghcr.io/zoriya/kyoo_autosync :4.7.1	fbba58ddb1a6	postgresql-15@15.10-0+deb12u1	15.13-0+deb12u1	1
ghcr.io/zoriya/kyoo_scanner :4.7.1	7dc0ee57b628	postgresql-15@15.10-0+deb12u1	15.13-0+deb12u1	1
public.ecr.aws/jtekt-corporation/image-storage-service :v1.16.17	b1493760c716	postgresql-15@15.8-0+deb12u1	15.13-0+deb12u1	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	postgresql-15@15.6-0+deb12u1	15.13-0+deb12u1	1
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	postgresql-15@15.3-0+deb12u1	15.13-0+deb12u1	1
public.ecr.aws/outerbounds/metaflow_metadata_service :v2.4.13	f7567ce3419d	postgresql-15@15.8-0+deb12u1	15.13-0+deb12u1	1
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	postgresql-15@15.5-0+deb12u1	15.13-0+deb12u1	1