CVE-2025-49794

Critical

Advisory

Published 16 Jun 2025In the index since 5 Sept 2026

Severity: Critical; worst across findings
CVSS: 9.1; base score, highest
EPSS: 0.008; 54th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 555; of 17,781 indexed, latest versions
Container images: 549; deployed by those charts
Fix available: 2 of 2; affected packages

The matching OSV records carry no description.

Carried by container images the latest versions of 555 of 17,781 indexed charts deploy, on 549 images.

Affected package	Affected versions	Fixed in	Images
libxml2deb	2.9.1+dfsg1-3ubuntu4.3, 2.9.1+dfsg1-3ubuntu4.4, 2.9.1+dfsg1-3ubuntu4.12, 2.9.3+dfsg1-1ubuntu0.2+35 more	2.9.1+dfsg1-3ubuntu4.13+esm8, 2.9.3+dfsg1-1ubuntu0.7+esm9, 2.9.4+dfsg1-6.1ubuntu1.9+esm4, 2.9.10+dfsg-5ubuntu0.20.04.10+esm1+3 more	485
libxml2apk	2.13.4-r3, 2.13.4-r5, 2.13.4-r6, 2.13.8-r0	2.13.9-r0	64

OSV records: ALPINE-CVE-2025-49794 DEBIAN-CVE-2025-49794 UBUNTU-CVE-2025-49794
Also known as: USN-7694-1

Charts affected

555 by stars

Chart

Latest

Affected images

Radar Score

longhornwenerme

1.2.3

1 of 2 See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2025-49794.

Container image	Digest	Package	Fixed in
longhornio/longhorn-manager :v1.2.3	dca34321452c	libxml2@2.9.10+dfsg-5ubuntu0.20.04.1	2.9.10+dfsg-5ubuntu0.20.04.10+esm1

Open the chart page →

15,230

keycloakwiremind

25.3.1

1 of 2 See more

keycloak wiremind 25.3.1

1 of the 2 container images this version deploys carry CVE-2025-49794.

Container image	Digest	Package	Fixed in
bitnamilegacy/postgresql :17.6.0-debian-12-r4	926356130b77	libxml2@2.9.14+dfsg-1.3~deb12u2	2.9.14+dfsg-1.3~deb12u3

Open the chart page →

7,624

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-49794.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	libxml2@2.9.13+dfsg-1ubuntu0.4	2.9.13+dfsg-1ubuntu0.8

Open the chart page →

14,100

workshop-pipelinesworkshop-pipelines

0.1.6

1 of 2 See more

workshop-pipelines workshop-pipelines 0.1.6

1 of the 2 container images this version deploys carry CVE-2025-49794.

Container image	Digest	Package	Fixed in
ghcr.io/bat-bs/bitnami-pgvector :pg16	19ebe07b4daf	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3

Open the chart page →

11,577

tabbyxd

1.0.6

1 of 2 See more

tabby xd 1.0.6

1 of the 2 container images this version deploys carry CVE-2025-49794.

Container image	Digest	Package	Fixed in
library/nginx :1.25	a484819eb602	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3

Open the chart page →

7,673

Container images carrying it

549 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
opea/retriever-redis :1.0	eb746b263705	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	2
opencloudeu/web-extensions :unzip-1.0.0	1691ad6612a3	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	2
opencloudeu/web-extensions :draw-io-1.0.0	27cb9b952f0d	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	2
opencloudeu/web-extensions :external-sites-1.0.0	5b176baa3694	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	2
opencloudeu/web-extensions :importer-1.0.0	6e8b2df6c5a4	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	2
opencloudeu/web-extensions :progress-bars-1.0.0	82f888a34440	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	2
opencloudeu/web-extensions :json-viewer-1.0.0	e0ac35a9576e	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	2
opendatacube/ows :latest	668cbb41473c	libxml2@2.9.14+dfsg-1.3ubuntu3	2.9.14+dfsg-1.3ubuntu3.4	2
qichenxu4pd/pythonexample :1.0	f3a8502bc21b	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	2
redis/redis-stack :7.2.0-v9	1c5f43fddcdd	libxml2@2.9.13+dfsg-1ubuntu0.4	2.9.13+dfsg-1ubuntu0.8	2
smartedge/generic-multi-access-network-virtualization :1.0	4cd63c22ce36	libxml2@2.9.10+dfsg-5ubuntu0.20.04.4	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	2
svtechnmaa/svtech_debuger :v1.0.0	b2987abe57d3	libxml2@2.9.13+dfsg-1ubuntu0.1	2.9.13+dfsg-1ubuntu0.8	2
vdiogov/glpi-conteiner :latest	6945f84f0058	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	2
wurstmeister/zookeeper :latest	7a7fd44a7210	libxml2@2.9.1+dfsg1-3ubuntu4.3	2.9.1+dfsg1-3ubuntu4.13+esm8	2
ghcr.io/bryopsida/k8s-dev-pod :main	82d0b161161d	libxml2@2.9.14+dfsg-1.3ubuntu3.3	2.9.14+dfsg-1.3ubuntu3.4	2
ghcr.io/danbooru/danbooru :9cab67c0ac72a8c52289302c519715ceec2372d9	5f545698e907	libxml2@2.9.13+dfsg-1ubuntu0.1	2.9.13+dfsg-1ubuntu0.8	2
ghcr.io/games-on-whales/pulseaudio :1.0.0	f34f98405c10	libxml2@2.9.10+dfsg-5ubuntu0.20.04.1	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	2
ghcr.io/games-on-whales/retroarch :1.0.0	103fbcec2314	libxml2@2.9.10+dfsg-5ubuntu0.20.04.1	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	2
ghcr.io/games-on-whales/steam :1.0.0	9b6105be7ad0	libxml2@2.9.10+dfsg-5ubuntu0.20.04.1	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	2
ghcr.io/grafana/helm-chart-toolbox-kubectl :0.1.1	c137478627cc	libxml2@2.13.8-r0	2.13.9-r0	2
ghcr.io/nginxinc/nginx-s3-gateway/nginx-oss-s3-gateway :unprivileged-oss :unprivileged-oss-20250331	3db8145349a3	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	2
mcr.microsoft.com/azure-sql-edge :latest	902628a8be89	libxml2@2.9.10+dfsg-5ubuntu0.20.04.6	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	2
registry.k8s.io/ingress-nginx/controller :v1.11.8	695d79381ee6	libxml2@2.13.8-r0	2.13.9-r0	2
registry.k8s.io/ingress-nginx/controller :v1.12.1	d2fbc4ec70d8	libxml2@2.13.4-r5	2.13.9-r0	2
1dev/server :11.9.0	cd5b12fe5471	libxml2@2.9.14+dfsg-1.3ubuntu3.3	2.9.14+dfsg-1.3ubuntu3.4	1
5200710/hadoop :3.2.3-java8	092d3088a5fb	libxml2@2.9.10+dfsg-5ubuntu0.20.04.6	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
a10networks/acos-prometheus-exporter :latest	8dc58d434d71	libxml2@2.9.4+dfsg1-6.1ubuntu1.3	2.9.4+dfsg1-6.1ubuntu1.9+esm4	1
adwerx/github-actions-runner :2.276.1-20.04-1	840d2b078682	libxml2@2.9.10+dfsg-5	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
airbyte/pod-sweeper :1.5.1	98d2c39d512e	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
airsonicadvanced/airsonic-advanced :latest	f7cbafac2806	libxml2@2.9.10+dfsg-5ubuntu0.20.04.1	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
akaunting/akaunting :3.0.15	52811b36ec3a	libxml2@2.9.14+dfsg-1.2	2.9.14+dfsg-1.3~deb12u3	1
aktosecurity/akto-puppeteer-replay :doom_latest	853e37321e6e	libxml2@2.13.8-r0	2.13.9-r0	1
allegroai/clearml :2.0.0-613	713ae38f7daf	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
allegroai/clearml-agent-k8s-base :1.24-21	772827a01bb5	libxml2@2.9.4+dfsg1-6.1ubuntu1.6	2.9.4+dfsg1-6.1ubuntu1.9+esm4	1
alpine/k8s :1.31.10	6dbe6f391eda	libxml2@2.13.8-r0	2.13.9-r0	1
alpine/k8s :1.31.13	7a319b15cfc9	libxml2@2.13.8-r0	2.13.9-r0	1
alpine/k8s :1.32.4	7e1e7d5b7a96	libxml2@2.13.4-r5	2.13.9-r0	1
alpine/k8s :1.31.4	9c4976d47656	libxml2@2.13.4-r3	2.13.9-r0	1
alpine/k8s :1.32.3	eec354133193	libxml2@2.13.4-r5	2.13.9-r0	1
andrewmackrodt/firefox-x11 :142.0.1-r1	33f9080470c9	libxml2@2.9.13+dfsg-1ubuntu0.7	2.9.13+dfsg-1ubuntu0.8	1
anguda/ant-media :2.5	c435285fc241	libxml2@2.9.10+dfsg-5ubuntu0.20.04.5	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
ankane/pgvector :v0.5.1	d3a9d8ac27bb	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
anujdatar/cups :25.07.01	685df04a643b	libxml2@2.9.14+dfsg-1.3~deb12u2	2.9.14+dfsg-1.3~deb12u3	1
apache/airflow :2.8.4-python3.9	64e58748b6b9	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
apache/airflow :2.10.2-python3.9	ce90bdc3d2af	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
apache/airflow :2.8.1	e5560ad0b86e	libxml2@2.9.14+dfsg-1.3~deb12u1	2.9.14+dfsg-1.3~deb12u3	1
apache/nifi-registry :1.27.0	63b8e3e40742	libxml2@2.9.13+dfsg-1ubuntu0.4	2.9.13+dfsg-1ubuntu0.8	1
apachepulsar/pulsar :3.1.0	16f9fdab3fa6	libxml2@2.9.13+dfsg-1ubuntu0.3	2.9.13+dfsg-1ubuntu0.8	1
apachepulsar/pulsar :2.10.0	3b262ab7a7d9	libxml2@2.9.10+dfsg-5ubuntu0.20.04.1	2.9.10+dfsg-5ubuntu0.20.04.10+esm1	1
apachepulsar/pulsar :3.0.7	9c9947de139d	libxml2@2.9.13+dfsg-1ubuntu0.4	2.9.13+dfsg-1ubuntu0.8	1