StackRadar

CVE-2025-4207

Medium

Advisory

Published 8 May 2025In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.9
base score, highest
EPSS
0.007
52nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
252
of 17,781 indexed, latest versions
Container images
254
deployed by those charts
Fix available
10 of 13
affected packages

PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation

Carried by container images the latest versions of 252 of 17,781 indexed charts deploy, on 254 images.

Affected packageAffected versionsFixed inImages
postgresql-15deb15.3-0+deb12u1, 15.3-1.pgdg120+1, 15.4-2.pgdg120+1, 15.5-0+deb12u1+6 more15.13-0+deb12u176
postgresqlbitnami11.8.0-10, 11.12.0-7, 14.4.0-0, 14.4.0-11+23 more13.21.028
postgresql-12deb12.7-0ubuntu0.20.04.1, 12.8-0ubuntu0.20.04.1, 12.9-0ubuntu0.20.04.1, 12.11-0ubuntu0.20.04.1+2 more12.22-0ubuntu0.20.04.417
postgresql16apk16.1-r0, 16.2-r0, 16.2-r1, 16.3-r0+2 more16.9-r013
PostgreSQLbitnami15.3.0, 15.4.0, 15.5.0-42, 16.0.0+6 more13.21.011
postgresql-14deb14.3-1.pgdg22.04+1, 14.4-0ubuntu0.22.04.1, 14.5-0ubuntu0.22.04.1, 14.6-1.pgdg22.04+1+4 more14.18-0ubuntu0.22.04.111
postgresql15apk15.3-r0, 15.4-r0, 15.5-r0, 15.6-r0+1 more15.13-r08
postgresql-10deb10.6-0ubuntu0.18.04.1, 10.10-0ubuntu0.18.04.1, 10.12-0ubuntu0.18.04.1, 10.14-0ubuntu0.18.04.1+1 moreno fix listed6
postgresql17apk17.2-r0, 17.4-r017.5-r03
postgresql-9.5deb9.5.10-0ubuntu0.16.04, 9.5.14-0ubuntu0.16.04no fix listed3
postgresql-16deb16.2-1ubuntu4, 16.6-0ubuntu0.24.04.116.9-0ubuntu0.24.04.12
postgresql-9.3deb9.3.22-0ubuntu0.14.04no fix listed1
postgresql-13deb13.3-1, 13.4-0+deb11u1, 13.5-0+deb11u1, 13.6-1.pgdg110+1+13 more13.21-0+deb11u185
OSV records
ALPINE-CVE-2025-4207BIT-postgresql-2025-4207DEBIAN-CVE-2025-4207UBUNTU-CVE-2025-4207DLA-4159-1
Also known as
USN-7520-1

Charts affected

252 by stars
ChartLatestAffected imagesRadar Score
mastodondefault-ghVerified publisher0.3.11 of 3See more

mastodon default-gh 0.3.1

1 of the 3 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
ghcr.io/mastodon/mastodon:v4.1.26b18e6d0eda4
postgresql-13@13.9-0+deb11u1
13.21-0+deb11u1

Open the chart page →

5,056
frontenddemo-application0.1.01 of 1See more

frontend demo-application 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
azhar008/flaskapplication:latesta1e827b0adea
postgresql-13@13.5-0+deb11u1
13.21-0+deb11u1

Open the chart page →

3,558
pgbouncerestaidVerified publisher1.0.71 of 1See more

pgbouncer estaid 1.0.7

1 of the 1 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
ghcr.io/estaid-app/pgbouncer-docker:1.22.07e5630757299
postgresql16@16.1-r0
16.9-r0

Open the chart page →

544
obicogabe565Verified publisher0.6.01 of 3See more

obico gabe565 0.6.0

1 of the 3 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
ghcr.io/gabe565/obico/web:latesta5c1daef46c0
postgresql15@15.10-r0
15.13-r0

Open the chart page →

1,965
deepstackgeek-cookbookVerified publisher1.5.21 of 2See more

deepstack geek-cookbook 1.5.2

1 of the 2 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
robmarkcole/deepstack-ui:latest410275726459
postgresql-13@13.3-1
13.21-0+deb11u1

Open the chart page →

5,305
paperlessgeek-cookbookVerified publisher9.2.01 of 1See more

paperless geek-cookbook 9.2.0

1 of the 1 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
ghcr.io/paperless-ngx/paperless-ngx:1.8.09bbc9a90641e
postgresql-13@13.7-0+deb11u1
13.21-0+deb11u1

Open the chart page →

3,924
vaultwardengeek-cookbookVerified publisher5.4.01 of 1See more

vaultwarden geek-cookbook 5.4.0

1 of the 1 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
vaultwarden/server:1.25.239f34c5159a2
postgresql-13@13.7-0+deb11u1
13.21-0+deb11u1

Open the chart page →

1,585
webtreesgeek-cookbookVerified publisher2.2.01 of 1See more

webtrees geek-cookbook 2.2.0

1 of the 1 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
ghcr.io/nathanvaughn/webtrees:2.0.1969423a100fab
postgresql-13@13.5-0+deb11u1
13.21-0+deb11u1

Open the chart page →

3,646
gentrace-self-hostedgentrace-self-hostedVerified publisher0.1.31 of 9See more

gentrace-self-hosted gentrace-self-hosted 0.1.3

1 of the 9 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
library/postgres:15.38775adb39f0d
postgresql-15@15.3-1.pgdg120+1
15.13-0+deb12u1

Open the chart page →

15,562
temporalglasskubeVerified publisher0.45.2-gk.11 of 14See more

temporal glasskube 0.45.2-gk.1

1 of the 14 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.25.0-tctl-1.18.1-cli-1.0.0cda4901bab53
postgresql16@16.3-r0
16.9-r0

Open the chart page →

16,346
hasher-matcher-actionerhasher-matcher-actioner1.0.01 of 1See more

hasher-matcher-actioner hasher-matcher-actioner 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
ghcr.io/facebook/threatexchange/hma:1.0.1784d09c6b75a7
postgresql-13@13.20-0+deb11u1
13.21-0+deb11u1

Open the chart page →

910
supersetinseefrlab1.4.01 of 4See more

superset inseefrlab 1.4.0

1 of the 4 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
apache/superset:9cdaa280429ec297db16d56c94fd77b5d2aff107975ab033580d
postgresql-13@13.7-0+deb11u1
13.21-0+deb11u1

Open the chart page →

7,129
opennebulakvaps2.1.15 of 9See more

opennebula kvaps 2.1.1

5 of the 9 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
ghcr.io/kvaps/opennebula:v5.12.0.4-1e28e0e7de11b
postgresql-12@12.7-0ubuntu0.20.04.1
12.22-0ubuntu0.20.04.4
ghcr.io/kvaps/opennebula-exporter:v5.12.0.401563adc95fd
postgresql-12@12.7-0ubuntu0.20.04.1
12.22-0ubuntu0.20.04.4
ghcr.io/kvaps/opennebula-exporter:v5.12.0.4-12b92df1143b9
postgresql-12@12.7-0ubuntu0.20.04.1
12.22-0ubuntu0.20.04.4
ghcr.io/kvaps/opennebula-flow:v5.12.0.4-1600221f0f43f
postgresql-12@12.7-0ubuntu0.20.04.1
12.22-0ubuntu0.20.04.4
ghcr.io/kvaps/opennebula-gate:v5.12.0.4-1a85e03d8bc1d
postgresql-12@12.7-0ubuntu0.20.04.1
12.22-0ubuntu0.20.04.4

Open the chart page →

113,791
chatwootmaxcrm-chartsVerified publisher1.1.2011 of 4See more

chatwoot maxcrm-charts 1.1.201

1 of the 4 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v3.1.0d530ab8c1753
postgresql15@15.4-r0
15.13-r0

Open the chart page →

5,940
mlflow-servermlflowserver0.1.91 of 3See more

mlflow-server mlflowserver 0.1.9

1 of the 3 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
buntha/mlflow:2.1.1154542cc3083
postgresql-13@13.9-0+deb11u1
13.21-0+deb11u1

Open the chart page →

5,804
clowder2ncsaVerified publisher1.9.71 of 12See more

clowder2 ncsa 1.9.7

1 of the 12 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:15.5.06887635cc793
postgresql@15.5.0-42
PostgreSQL@15.5.0-42
13.21.0
13.21.0

Open the chart page →

37,373
librechatopenshift1.9.01 of 3See more

librechat openshift 1.9.0

1 of the 3 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
ghcr.io/bat-bs/bitnami-pgvector:pg1619ebe07b4daf
postgresql@16.6.0-1
13.21.0

Open the chart page →

5,779
open-notificatiesopen-zaak0.7.01 of 4See more

open-notificaties open-zaak 0.7.0

1 of the 4 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
openzaak/open-notificaties:1.3.02e65313b9b10
postgresql-13@13.5-0+deb11u1
13.21-0+deb11u1

Open the chart page →

2,850
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
treskon/portrait-web-setup:DEV-latesta475d80e4ecf
postgresql-15@15.10-0+deb12u1
15.13-0+deb12u1

Open the chart page →

31,844
pritunl-slack-apppritunl-slack-appVerified publisher0.1.71 of 1See more

pritunl-slack-app pritunl-slack-app 0.1.7

1 of the 1 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
nathanielvarona/pritunl-slack-app:0.1.10b746a34e5597
postgresql-13@13.8-0+deb11u1
13.21-0+deb11u1

Open the chart page →

2,871
resurfaceresurfaceioVerified publisher3.9.01 of 3See more

resurface resurfaceio 3.9.0

1 of the 3 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
resurfaceio/resurface:3.7.84d5cda2f64109
postgresql-14@14.17-0ubuntu0.22.04.1
14.18-0ubuntu0.22.04.1

Open the chart page →

7,432
atuinrm3lVerified publisher0.11.01 of 3See more

atuin rm3l 0.11.0

1 of the 3 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:16.2.0-debian-12-r890fda44bfa42
postgresql@16.2.0-4
PostgreSQL@16.2.0-4
13.21.0
13.21.0

Open the chart page →

6,521
kyoorubxkubeVerified publisher0.1.102 of 9See more

kyoo rubxkube 0.1.10

2 of the 9 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
ghcr.io/zoriya/kyoo_autosync:4.7.1fbba58ddb1a6
postgresql-15@15.10-0+deb12u1
15.13-0+deb12u1
ghcr.io/zoriya/kyoo_scanner:4.7.17dc0ee57b628
postgresql-15@15.10-0+deb12u1
15.13-0+deb12u1

Open the chart page →

30,234
healthchecksstackhelmVerified publisher0.1.01 of 2See more

healthchecks stackhelm 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
healthchecks/healthchecks:v2.8.1e82bb0836e30
postgresql-13@13.9-0+deb11u1
13.21-0+deb11u1

Open the chart page →

2,236
graph-nodestakewise3.1.01 of 3See more

graph-node stakewise 3.1.0

1 of the 3 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
graphprotocol/graph-node:v0.37.0f4452cdedd68
postgresql-15@15.10-0+deb12u1
15.13-0+deb12u1

Open the chart page →

4,661
ckanstatcan0.0.351 of 8See more

ckan statcan 0.0.35

1 of the 8 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
statcan/ckan:2.93921305425b8
postgresql-12@12.7-0ubuntu0.20.04.1
12.22-0ubuntu0.20.04.4

Open the chart page →

24,930
synapsesudermanjr1.1.51 of 1See more

synapse sudermanjr 1.1.5

1 of the 1 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
matrixdotorg/synapse:v1.53.0cb89c0f17ba1
postgresql-13@13.5-0+deb11u1
13.21-0+deb11u1

Open the chart page →

3,332
unitycatalogunitycatalogVerified publisher0.0.21 of 4See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui:0.2.1-5d668c1ed07e7ca098d
postgresql-15@15.10-0+deb12u1
15.13-0+deb12u1

Open the chart page →

12,581
postfixadminvolker-raschekVerified publisher0.3.11 of 1See more

postfixadmin volker-raschek 0.3.1

1 of the 1 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
volkerraschek/postfixadmin:3.3.13c4f10aebf87b
postgresql-13@13.9-0+deb11u1
13.21-0+deb11u1

Open the chart page →

1,083
redirectwyrihaximusnetVerified publisher1.1.01 of 1See more

redirect wyrihaximusnet 1.1.0

1 of the 1 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
ghcr.io/wyrihaximusnet/redirect:randombf5983d754d7
postgresql16@16.3-r0
16.9-r0

Open the chart page →

1,581
abstract-nodeabstract-nodeVerified publisher0.1.491 of 2See more

abstract-node abstract-node 0.1.49

1 of the 2 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
matterlabs/external-node:9734bf2-17870579939295dadc06bdf3b
postgresql-15@15.8-0+deb12u1
15.13-0+deb12u1

Open the chart page →

4,554
resource-provisioningassist-iot-resource-provisioning1.0.01 of 7See more

resource-provisioning assist-iot-resource-provisioning 1.0.0

1 of the 7 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
assistiot/resource-provisioning_prc:1.0.08b5d118bdf0e
postgresql-13@13.11-0+deb11u1
13.21-0+deb11u1

Open the chart page →

8,032
smartorchestratorassist-iot-smart-orchestrator4.0.01 of 14See more

smartorchestrator assist-iot-smart-orchestrator 4.0.0

1 of the 14 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
assistiot/smart-orchestrator_scheduler_mc:latestb1dbe4d62a03
postgresql-15@15.3-0+deb12u1
15.13-0+deb12u1

Open the chart page →

45,363
astrotrekastria0.0.22 of 4See more

astrotrek astria 0.0.2

2 of the 4 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
timescale/timescaledb-ha:pg15-latesta8e3322e1cf9
postgresql-14@14.7-1.pgdg22.04+1
14.18-0ubuntu0.22.04.1
ghcr.io/astriaorg/astrotrek:0.1.05889bea38e56
postgresql-15@15.8-0+deb12u1
15.13-0+deb12u1

Open the chart page →

32,501
axelor-open-suiteaxelor-open-suiteVerified publisher7.2.581 of 2See more

axelor-open-suite axelor-open-suite 7.2.58

1 of the 2 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:15.3.0-debian-11-r775f4cf61668e5
postgresql@15.3.0-9
PostgreSQL@15.3.0
13.21.0
13.21.0

Open the chart page →

9,722
axosyslog-collectoraxosyslogVerified publisher0.8.11 of 1See more

axosyslog-collector axosyslog 0.8.1

1 of the 1 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
ghcr.io/axoflow/axosyslog:4.5.0aa7831e207cd
postgresql15@15.5-r0
15.13-r0

Open the chart page →

1,516
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
postgresql-15@15.10-0+deb12u1
15.13-0+deb12u1

Open the chart page →

10,145
ct-singlecalltelemetry0.8.41 of 7See more

ct-single calltelemetry 0.8.4

1 of the 7 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
calltelemetry/web:0.8.1-rc7205d13269e350
postgresql-15@15.8-0+deb12u1
15.13-0+deb12u1

Open the chart page →

10,629
stablecalltelemetry0.7.11 of 9See more

stable calltelemetry 0.7.1

1 of the 9 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
calltelemetry/web:0.6.7457a7e353542
postgresql-13@13.7-0+deb11u1
13.21-0+deb11u1

Open the chart page →

7,702
camerahubcamerahub0.10.211 of 2See more

camerahub camerahub 0.10.21

1 of the 2 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
camerahub/camerahub:0.36.23a5af37dd6e1b
postgresql-13@13.9-0+deb11u1
13.21-0+deb11u1

Open the chart page →

2,507
tetragon-policy-buildercamptocamp30.1.11 of 1See more

tetragon-policy-builder camptocamp3 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
ghcr.io/camptocamp/tetragon-policy-builder:master0e99f12bb040
postgresql-15@15.10-0+deb12u1
15.13-0+deb12u1

Open the chart page →

10,776
temporalcastaiVerified publisher0.54.21 of 14See more

temporal castai 0.54.2

1 of the 14 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
temporalio/admin-tools:1.26.237e2e33dbd7b
postgresql16@16.3-r0
16.9-r0

Open the chart page →

16,198
zksyncchronicleVerified publisher0.1.01 of 2See more

zksync chronicle 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
matterlabs/external-node:v24.0.06cbfea4c694a
postgresql-15@15.6-0+deb12u1
15.13-0+deb12u1

Open the chart page →

5,982
robot-shopcloud-native-toolkit1.1.11 of 12See more

robot-shop cloud-native-toolkit 1.1.1

1 of the 12 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
robotshop/rs-payment:latest774b52c6180d
postgresql-13@13.3-1
13.21-0+deb11u1

Open the chart page →

29,555
galaxy-stablecloudve2.0.01 of 5See more

galaxy-stable cloudve 2.0.0

1 of the 5 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
galaxy/galaxy-stable:v18.018e577a626dfd
postgresql-9.3@9.3.22-0ubuntu0.14.04
no fix listed

Open the chart page →

70,895
metaflowcluster-deploy0.2.21 of 1See more

metaflow cluster-deploy 0.2.2

1 of the 1 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
public.ecr.aws/outerbounds/metaflow_metadata_service:v2.4.13f7567ce3419d
postgresql-15@15.8-0+deb12u1
15.13-0+deb12u1

Open the chart page →

8,009
codehubcodehubVerified publisher6.2.181 of 5See more

codehub codehub 6.2.18

1 of the 5 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:latest42a8200d3597
postgresql@17.5.0-14
13.21.0

Open the chart page →

13,220
dev-code-servercosmoVerified publisher0.0.71 of 2See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
postgresql-15@15.12-0+deb12u2
15.13-0+deb12u1

Open the chart page →

14,559
postgresqlcowboysysopVerified publisher15.5.71 of 1See more

postgresql cowboysysop 15.5.7

1 of the 1 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:16.3.0-debian-12-r14cc55da2fa366
postgresql@16.3.0-11
PostgreSQL@16.3.0-11
13.21.0
13.21.0

Open the chart page →

4,770
csghubcsghubVerified publisher2.4.31 of 34See more

csghub csghub 2.4.3

1 of the 34 container images this version deploys carry CVE-2025-4207.

Container imageDigestPackageFixed in
opencsghq/psql:latest57def8e77d0f
postgresql17@17.2-r0
17.5-r0

Open the chart page →

58,897

Container images carrying it

254 by charts deploying them

A fixed version is listed for 10 of the 13 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/jupyterhub/k8s-hub:3.2.12528c6e57587
postgresql-13@13.13-0+deb11u1
13.21-0+deb11u1
1
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
postgresql-15@15.3-0+deb12u1
15.13-0+deb12u1
1
registry.gitlab.com/open-forms/forms-catalogue:latest4eaf9c911f33
postgresql-13@13.3-1
13.21-0+deb11u1
1
registry.gitlab.com/open-forms/request-registry:latest0886cbbc5f95
postgresql-13@13.3-1
13.21-0+deb11u1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.