StackRadar

CVE-2025-52565

High

Advisory

Published 5 Nov 2025In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
289
of 17,781 indexed, latest versions
Container images
224
deployed by those charts
Fix available
1 of 2
affected packages

runc container escape with malicious config due to /dev/console mount and related races

Carried by container images the latest versions of 289 of 17,781 indexed charts deploy, on 224 images.

Affected packageAffected versionsFixed inImages
runcdeb1.1.5+ds1-1+deb12u1no fix listed9
github.com/opencontainers/runcgolangv1.0.0-rc6.0.20190115182101-c1e454b2a1bf, v1.0.0-rc8, v1.0.0-rc8.0.20190926150303-84373aaa560b, v1.0.0-rc9+29 more1.2.8215
OSV records
DEBIAN-CVE-2025-52565GHSA-qw9x-cqr3-wc7r
Also known as
GO-2025-4097

Charts affected

289 by stars
ChartLatestAffected imagesRadar Score
fireflylsst-sqre0.3.71 of 2See more

firefly lsst-sqre 0.3.7

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/redis:5fc5ecd863862
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

1,731
m9sweeperm9sweeperVerified publisher1.6.01 of 6See more

m9sweeper m9sweeper 1.6.0

1 of the 6 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
ghcr.io/m9sweeper/trawler:1.6.0df917c5a7e54
github.com/opencontainers/runc@v1.1.5
1.2.8

Open the chart page →

9,774
magistralamagistrala-devopsVerified publisher0.16.21 of 42See more

magistrala magistrala-devops 0.16.2

1 of the 42 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
jaegertracing/jaeger-cassandra-schema:1.53.0d48d6dab2c65
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

24,400
novosgamarcusrepo0.1.11 of 2See more

novosga marcusrepo 0.1.1

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

3,706
kruisematrixone-operatorVerified publisher1.8.31 of 2See more

kruise matrixone-operator 1.8.3

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
openkruise/kruise-manager:v1.8.30482722b4e56
github.com/opencontainers/runc@v1.2.0-rc.3
1.2.8

Open the chart page →

1,767
mayastormayastorVerified publisher2.12.11 of 31See more

mayastor mayastor 2.12.1

1 of the 31 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
grafana/alloy:v1.8.17790f6f7fbd8
github.com/opencontainers/runc@v1.2.1
1.2.8

Open the chart page →

21,064
eoloplantmca-eoloplaner0.1.01 of 7See more

eoloplant mca-eoloplaner 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mysql:8.0.28fc77d54cacef
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

29,588
ingressmedia-streaming-meshVerified publisher0.1.81 of 2See more

ingress media-streaming-mesh 0.1.8

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.7.07612338342a1
github.com/opencontainers/runc@v1.1.4
1.2.8

Open the chart page →

3,301
memgptmemgptVerified publisher0.3.191 of 2See more

memgpt memgpt 0.3.19

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
ankane/pgvector:v0.5.1d3a9d8ac27bb
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

5,866
kommandermesosphere-stable0.39.21 of 29See more

kommander mesosphere-stable 0.39.2

1 of the 29 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
mesosphere/kommander-federation-utility-apiserver:v0.21.2f9b769c65e24
github.com/opencontainers/runc@v1.0.0-rc92
1.2.8

Open the chart page →

68,284
istio-operatormetakube1.12.01 of 1See more

istio-operator metakube 1.12.0

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
istio/operator:1.12.06cfce8a071b9
github.com/opencontainers/runc@v1.0.2
1.2.8

Open the chart page →

8,902
aws-api-gateway-operatormintel0.1.21 of 11See more

aws-api-gateway-operator mintel 0.1.2

1 of the 11 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/docker:20.10-dindaf96c680a7e1
github.com/opencontainers/runc@v1.1.5
1.2.8

Open the chart page →

10,603
standard-application-stackmintel11.4.01 of 12See more

standard-application-stack mintel 11.4.0

1 of the 12 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/docker:20.10-dindaf96c680a7e1
github.com/opencontainers/runc@v1.1.5
1.2.8

Open the chart page →

10,603
mariadbmmontesVerified publisher0.3.01 of 1See more

mariadb mmontes 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mariadb:10.7.307e06f2e7ae9
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

10,065
backendmojaloop0.1.01 of 6See more

backend mojaloop 0.1.0

1 of the 6 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
bitnamilegacy/kafka:2.8.1-debian-11-r7b6e381ffd6ae
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

16,198
camera-viewermoreillonVerified publisher0.2.11 of 4See more

camera-viewer moreillon 0.2.1

1 of the 4 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:6.0.4-debian-11-r10016dce036593
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

11,643
face-recognitionmoreillonVerified publisher0.2.41 of 3See more

face-recognition moreillon 0.2.4

1 of the 3 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
bitnamilegacy/mongodb:6.0.4-debian-11-r10016dce036593
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

8,556
mqtt-loggermoreillonVerified publisher0.3.12 of 5See more

mqtt-logger moreillon 0.3.1

2 of the 5 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
bitnamilegacy/influxdb:2.6.1-debian-11-r18d17df1f9d745
github.com/opencontainers/runc@v1.1.0
1.2.8
bitnamilegacy/mongodb:6.0.4-debian-11-r10016dce036593
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

10,959
cognativemyaVerified publisher0.2403.31 of 3See more

cognative mya 0.2403.3

1 of the 3 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
github.com/opencontainers/runc@v1.1.12
1.2.8

Open the chart page →

7,309
Practica_4_helmmy-heml-appVerified publisher0.1.01 of 7See more

Practica_4_helm my-heml-app 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mysql:8.0.28fc77d54cacef
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

27,721
influxdbmy-personal-influxdb20.1.01 of 1See more

influxdb my-personal-influxdb2 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/influxdb:2.7b8d940ca9376
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

3,867
phonebook-chartmy-phonebook-chart0.1.01 of 3See more

phonebook-chart my-phonebook-chart 0.1.0

1 of the 3 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

3,034
nominatimnominatim-chart1.3.01 of 3See more

nominatim nominatim-chart 1.3.0

1 of the 3 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
robjuz/postgresql-nominatim:latest805c7bab76df
github.com/opencontainers/runc@v1.0.0-rc95
1.2.8

Open the chart page →

22,658
ingress-helm-chartnotesprojectchart0.1.01 of 2See more

ingress-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.8.1e5c4824e7375
github.com/opencontainers/runc@v1.1.7
1.2.8

Open the chart page →

2,956
kafka-helm-chartnotesprojectchart0.1.01 of 1See more

kafka-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

4,547
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
linuxserver/cloud9:latest45c5fe102ff3
github.com/opencontainers/runc@v1.1.2
1.2.8

Open the chart page →

27,465
apicurioone-acre-fundVerified publisher2.3.01 of 5See more

apicurio one-acre-fund 2.3.0

1 of the 5 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
bitnamilegacy/postgresql:14.4.0-debian-11-r237e7ebb082031
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

18,667
anchore-engineopencloudcx1.13.01 of 2See more

anchore-engine opencloudcx 1.13.0

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
anchore/anchore-engine:v0.10.0bde9eedf639d
github.com/opencontainers/runc@v1.0.0-rc92
1.2.8

Open the chart page →

18,023
probuilderopenfaas0.2.01 of 2See more

probuilder openfaas 0.2.0

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
moby/buildkit:v0.10.0c2aeafaed434
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

4,751
open-pdcopen-pdc0.1.01 of 3See more

open-pdc open-pdc 0.1.0

1 of the 3 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

3,423
open-pubopen-pub0.1.01 of 3See more

open-pub open-pub 0.1.0

1 of the 3 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

3,423
redhat-trusted-application-pipelineopenshift1.0.21 of 2See more

redhat-trusted-application-pipeline openshift 1.0.2

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

8,599
openvscode-serveropenvscode-server-helmVerified publisher2.7.371 of 2See more

openvscode-server openvscode-server-helm 2.7.37

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/docker:23.0.1-dindd9a0fd8bdd15
github.com/opencontainers/runc@v1.1.3
1.2.8

Open the chart page →

4,237
open-webconceptopen-webconcept0.1.01 of 3See more

open-webconcept open-webconcept 0.1.0

1 of the 3 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

3,423
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.01 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

1 of the 40 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/arangodb:3.11.81e75d74954a4
github.com/opencontainers/runc@v1.1.12
1.2.8

Open the chart page →

71,208
yetiosdfir-infrastructureVerified publisher1.0.51 of 4See more

yeti osdfir-infrastructure 1.0.5

1 of the 4 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/arangodb:3.11.81e75d74954a4
github.com/opencontainers/runc@v1.1.12
1.2.8

Open the chart page →

6,583
adotowan-charts0.1.01 of 1See more

adot owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
public.ecr.aws/aws-observability/aws-otel-collector:v0.43.38aa9ea5f67b8
github.com/opencontainers/runc@v1.1.14
1.2.8

Open the chart page →

1,016
arpap2p-avs0.1.31 of 2See more

arpa p2p-avs 0.1.3

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
ghcr.io/arpa-network/node-client:latest657a2c9f6e6d
github.com/opencontainers/runc@v1.1.12
1.2.8

Open the chart page →

1,980
pet-battle-infrapetbattle1.0.321 of 2See more

pet-battle-infra petbattle 1.0.32

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:4.8bb5e052770e5
github.com/opencontainers/runc@v1.0.0-rc91
1.2.8

Open the chart page →

15,466
pet-battle-tournamentpetbattle1.0.401 of 3See more

pet-battle-tournament petbattle 1.0.40

1 of the 3 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:4.8bb5e052770e5
github.com/opencontainers/runc@v1.0.0-rc91
1.2.8

Open the chart page →

15,466
npre-essentialsphntom0.1.601 of 22See more

npre-essentials phntom 0.1.60

1 of the 22 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.5.14ba73c697770
github.com/opencontainers/runc@v1.1.4
1.2.8

Open the chart page →

26,840
pixie-operator-chartpixie0.1.71 of 3See more

pixie-operator-chart pixie 0.1.7

1 of the 3 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
quay.io/operator-framework/olmdigest-pinned1b6002156f56
github.com/opencontainers/runc@v1.1.12
1.2.8

Open the chart page →

1,899
tenant-namespacepnnl-miscscripts0.6.231 of 1See more

tenant-namespace pnnl-miscscripts 0.6.23

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.3.0d1707ca76d3b
github.com/opencontainers/runc@v1.1.3
1.2.8

Open the chart page →

2,578
postgrespostgresVerified publisher0.1.11 of 1See more

postgres postgres 0.1.1

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/postgres:13.12ced3ba927f4c
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

4,916
Practica_4_helmpr04helm0.1.01 of 7See more

Practica_4_helm pr04helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mysql:8.0.28fc77d54cacef
github.com/opencontainers/runc@v1.0.1
1.2.8

Open the chart page →

27,558
practica-helmpractica-helm0.1.01 of 7See more

practica-helm practica-helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

28,484
wp-chartprojet-devops0.1.01 of 2See more

wp-chart projet-devops 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

5,203
cdmswebapppyalive-cdmswebappVerified publisher0.1.01 of 3See more

cdmswebapp pyalive-cdmswebapp 0.1.0

1 of the 3 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

6,668
kratosradar-baseVerified publisher0.43.11 of 1See more

kratos radar-base 0.43.1

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
oryd/kratos:v1.1.08f15006a080d
github.com/opencontainers/runc@v1.1.12
1.2.8

Open the chart page →

1,776
radar-kratosradar-baseVerified publisher0.1.51 of 1See more

radar-kratos radar-base 0.1.5

1 of the 1 container images this version deploys carry CVE-2025-52565.

Container imageDigestPackageFixed in
oryd/kratos:v1.3.1fe2428f103a6
github.com/opencontainers/runc@v1.1.14
1.2.8

Open the chart page →

1,561

Container images carrying it

224 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/eformat/jenkins-agent-graalvm:latesta3b9a07648b6
github.com/opencontainers/runc@v1.0.0-rc91
1.2.8
1
quay.io/geored/spmm-collector-contrib:1.0.063baf86a49ac
github.com/opencontainers/runc@v1.1.5
1.2.8
1
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
github.com/opencontainers/runc@v1.0.0-rc9
1.2.8
1
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
github.com/opencontainers/runc@v1.1.5
1.2.8
1
quay.io/openshift/origin-cli:4.66722d5041b47
github.com/opencontainers/runc@v1.0.0-rc91.0.20200707015106-819fcc687efb
1.2.8
1
quay.io/openshift/origin-console:4.10.00bbe8b451fa3
github.com/opencontainers/runc@v1.0.0-rc8.0.20190926150303-84373aaa560b
1.2.8
1
quay.io/openshift/origin-jenkins-agent-base:latestc241c971aef8
github.com/opencontainers/runc@v1.1.10
1.2.8
1
quay.io/operator-framework/olm1b6002156f56
github.com/opencontainers/runc@v1.1.12
1.2.8
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
github.com/opencontainers/runc@v1.0.1
1.2.8
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
github.com/opencontainers/runc@v1.0.0-rc9
1.2.8
1
quay.io/skopeo/stable:v1.134853591bd1d2
github.com/opencontainers/runc@v1.1.7
1.2.8
1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator:0.5.136b19b72120e
github.com/opencontainers/runc@v1.0.2
1.2.8
1
registry.k8s.io/csi-vsphere/driver:v3.4.0f5349a8ae3f3
github.com/opencontainers/runc@v1.1.13
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.6.415be4666c530
github.com/opencontainers/runc@v1.1.4
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.10.042b3f0e5d084
github.com/opencontainers/runc@v1.1.12
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.3.154f7fe2c6c5a
github.com/opencontainers/runc@v1.1.4
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.2.15516d103a9c2
github.com/opencontainers/runc@v1.1.2
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.8.0744ae2afd433
github.com/opencontainers/runc@v1.1.7
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.7.07612338342a1
github.com/opencontainers/runc@v1.1.4
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.3.0d1707ca76d3b
github.com/opencontainers/runc@v1.1.3
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.11.3d56f135b6462
github.com/opencontainers/runc@v1.1.14
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.10.1e24f39d3eed6
github.com/opencontainers/runc@v1.1.12
1.2.8
1
registry.k8s.io/ingress-nginx/controller:v1.12.0e6b8de175acd
github.com/opencontainers/runc@v1.2.3
1.2.8
1
registry.k8s.io/nfd/node-feature-discovery:v0.16.619ebca8b3804
github.com/opencontainers/runc@v1.1.14
1.2.8
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.