CVE-2025-5278

Medium

Advisory

Published 27 May 2025In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 4.4; base score, highest
EPSS: 0.003; 22nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,554; of 17,821 indexed, latest versions
Container images: 2,613; deployed by those charts
Fix available: 3 of 3; affected packages

Red Hat Security Advisory: coreutils security update

Carried by container images the latest versions of 2,554 of 17,821 indexed charts deploy, on 2,613 images.

Affected package	Affected versions	Fixed in	Images
coreutilsdeb	8.21-1ubuntu5, 8.21-1ubuntu5.1, 8.21-1ubuntu5.4, 8.25-2ubuntu2+17 more	8.32-4.1ubuntu1.4, 9.4-3ubuntu6.3, 9.7-3ubuntu2.1	2,440
coreutilsrpm	8.29-lp151.3.3, 8.29-lp152.4.7, 8.32-32.el9, 8.32-34.el9+7 more	0:8.32-41.el9_8, 0:9.5-8.el10_2, 8.32-150400.9.9.1, 9.4-7+1 more	155
coreutils-fromdeb	9.5-1ubuntu2+0.0.0~ubuntu24, 9.5-1ubuntu2+0.0.0~ubuntu25	9.7-3ubuntu2.1	77

OSV records: DEBIAN-CVE-2025-5278 RHSA-2026:28911 RHSA-2026:33124 RLSA-2026:28911 UBUNTU-CVE-2025-5278 AZL-93060 openSUSE-SU-2025:15327-1 SUSE-SU-2025:02362-1
Also known as: USN-8697-1

Charts affected

2,554 by stars

Chart

Latest

Affected images

Radar Score

changedetection-iozekker6

1.102.0

1 of 1 See more

changedetection-io zekker6 1.102.0

1 of the 1 container images this version deploys carry CVE-2025-5278.

Container image	Digest	Package	Fixed in
ghcr.io/dgtlmoon/changedetection.io :0.60.7	096dae27b5d6	coreutils@9.1-1	no fix listed

Open the chart page →

2,710

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2025-5278.

Container image	Digest	Package	Fixed in
library/nginx :latest	abe47724e466	coreutils@9.7-3	no fix listed

Open the chart page →

1,593

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2025-5278.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	coreutils@8.28-1ubuntu1	no fix listed
yandex/clickhouse-server :21.3.20	4eccfffb01d7	coreutils@8.30-3ubuntu2	no fix listed

Open the chart page →

9,297

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2025-5278.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	coreutils@8.32-4.1ubuntu1.3	8.32-4.1ubuntu1.4

Open the chart page →

7,966

Container images carrying it

2,613 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor :1.66.9	138c8b82c398	coreutils@9.4-3ubuntu6.2	9.4-3ubuntu6.3	1
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor :latest	f669a6eacf8c	coreutils@9.4-3ubuntu6.2	9.4-3ubuntu6.3	1
public.ecr.aws/aktosecurity/akto-api-security-mini-runtime :latest	5d55a742a2bc	coreutils-from@9.5-1ubuntu2+0.0.0~ubuntu25	9.7-3ubuntu2.1	1
public.ecr.aws/aktosecurity/akto-api-security-mini-runtime :1.74.6_local	8b9208c09d76	coreutils-from@9.5-1ubuntu2+0.0.0~ubuntu25	9.7-3ubuntu2.1	1
public.ecr.aws/aktosecurity/akto-api-security-mini-runtime :latest	8be3ed26f746	coreutils-from@9.5-1ubuntu2+0.0.0~ubuntu25	9.7-3ubuntu2.1	1
public.ecr.aws/aktosecurity/akto-api-security-mini-testing :1.72.6_local	43316f900242	coreutils@9.7-3ubuntu2 coreutils-from@9.5-1ubuntu2+0.0.0~ubuntu25	9.7-3ubuntu2.1 9.7-3ubuntu2.1	1
public.ecr.aws/aktosecurity/akto-api-security-mini-testing :1.74.4_local	5bda14f66e8e	coreutils-from@9.5-1ubuntu2+0.0.0~ubuntu25	9.7-3ubuntu2.1	1
public.ecr.aws/aktosecurity/akto-api-security-testing-db-layer :1.74.4_local	1ed844ecab29	coreutils@9.4-3ubuntu6.1	9.4-3ubuntu6.3	1
public.ecr.aws/aktosecurity/akto-api-testing :latest	97d830d5538a	coreutils@9.4-3ubuntu6.2	9.4-3ubuntu6.3	1
public.ecr.aws/aktosecurity/akto-threat-detection :latest	3f103ce347ce	coreutils-from@9.5-1ubuntu2+0.0.0~ubuntu25	9.7-3ubuntu2.1	1
public.ecr.aws/aktosecurity/akto-threat-detection :1.16.2	a47eb6cc17ea	coreutils@9.7-3ubuntu2 coreutils-from@9.5-1ubuntu2+0.0.0~ubuntu25	9.7-3ubuntu2.1 9.7-3ubuntu2.1	1
public.ecr.aws/aktosecurity/confluentinc-cp-kafka :8.1.0-1-ubi9	9026dbbf280d	coreutils@8.32-39.el9	0:8.32-41.el9_8	1
public.ecr.aws/aktosecurity/redis	47200b041382	coreutils@9.1-1	no fix listed	1
public.ecr.aws/aktosecurity/redis :latestV8.6.2	832d7785830f	coreutils@9.7-3	no fix listed	1
public.ecr.aws/datadog/agent :7.73.0	f4925b15ce94	coreutils@9.4-3ubuntu6.1	9.4-3ubuntu6.3	1
public.ecr.aws/datadog/cloudprem :v0.1.33	bda08753668d	coreutils@9.4-3ubuntu6.2	9.4-3ubuntu6.3	1
public.ecr.aws/decisiveai/valkey :9.0.1	59c7e728fb3a	coreutils@9.7-3	no fix listed	1
public.ecr.aws/dynatrace/dynatrace-operator :v1.3.0	f68901a54664	coreutils@8.32-35.el9	0:8.32-41.el9_8	1
public.ecr.aws/flanksource/incident-manager-ui :v1.4.317	fea799d4fb2f	coreutils@9.1-1	no fix listed	1
public.ecr.aws/g4a0y2u8/unifie-store :staging-19925	a2057fabc948	coreutils@9.1-1	no fix listed	1
public.ecr.aws/groundcovercom/grafana-groundcover :v0.0.54-grafana11.3.7	ee9d973e3952	coreutils@8.32-4.1ubuntu1.2	8.32-4.1ubuntu1.4	1
public.ecr.aws/jtekt-corporation/image-storage-service :v1.16.17	b1493760c716	coreutils@9.1-1	no fix listed	1
public.ecr.aws/jtekt-corporation/image-storage-service-gui :v1.9.4	34823c8abe00	coreutils@9.1-1	no fix listed	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	coreutils@9.1-1	no fix listed	1
public.ecr.aws/jtekt-corporation/shinsei-manager-front :v1.5.5	f8fb4eea4071	coreutils@9.1-1	no fix listed	1
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	coreutils@9.1-1	no fix listed	1
public.ecr.aws/k2x0t8t6/kubeadapt/app/kubeadapt-k8s-pulse :v3.0.1	dc5a516c2333	coreutils@9.1-1	no fix listed	1
public.ecr.aws/k6v9y5g3/cluster-agent :master.575	36d051110158	coreutils@9.1-1	no fix listed	1
public.ecr.aws/k6v9y5g3/cluster-agent :cost_k8s_process.576	9e14a72b066d	coreutils@9.1-1	no fix listed	1
public.ecr.aws/outerbounds/metaflow_metadata_service :v2.4.13	f7567ce3419d	coreutils@9.1-1	no fix listed	1
public.ecr.aws/perfectscale-io/psc-exporter :v1.0.45-redhat	9083e60c38bc	coreutils@8.32-36.el9	0:8.32-41.el9_8	1
public.ecr.aws/perfectscale-io/ubi9/ubi :9.5	d7c3def9252b	coreutils@8.32-36.el9	0:8.32-41.el9_8	1
public.ecr.aws/spotinst/spot-network-client :1.0.14	86380a01587d	coreutils@9.4-3ubuntu6.1	9.4-3ubuntu6.3	1
public.ecr.aws/spotinst/spot-network-client :1.0.0-8-lb_endpoint-d0ec127	efcecf98b912	coreutils@8.28-1ubuntu1	no fix listed	1
public.ecr.aws/supportpal/helpdesk-monolithic :4.0.4	573779e57fae	coreutils@8.30-3ubuntu2	no fix listed	1
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	coreutils@9.1-1	no fix listed	1
public.ecr.aws/v0r6c2e2/hive-metastore :latest	794b3bff9510	coreutils@8.32-35.el9	0:8.32-41.el9_8	1
public.ecr.aws/v0r6c2e2/minio :latest	08c90bd040bf	coreutils@8.32-36.el9	0:8.32-41.el9_8	1
public.ecr.aws/v0r6c2e2/trino :latest	c265156b00d1	coreutils@8.32-36.el9	0:8.32-41.el9_8	1
quay.io/aerokube/jumphost :1.0.1	70fd7c00418d	coreutils@8.32-4.1ubuntu1.2	8.32-4.1ubuntu1.4	1
quay.io/aerokube/keygen :1.0.1	578934444f04	coreutils@8.32-4.1ubuntu1.2	8.32-4.1ubuntu1.4	1
quay.io/ai-lab/llamacpp_python :latest	70d138997acd	coreutils@8.32-35.el9	0:8.32-41.el9_8	1
quay.io/argoproj/argocd :v3.5.1	0deb1a1c9176	coreutils@9.7-3ubuntu2 coreutils-from@9.5-1ubuntu2+0.0.0~ubuntu25	9.7-3ubuntu2.1 9.7-3ubuntu2.1	1
quay.io/argoproj/argocd :v2.4.11	5b6701d8fb31	coreutils@8.32-4.1ubuntu1	8.32-4.1ubuntu1.4	1
quay.io/argoproj/argocd :v2.10.7	83c86003b781	coreutils@8.32-4.1ubuntu1.2	8.32-4.1ubuntu1.4	1
quay.io/argoproj/argocd :v3.0.3	95b5cf7ba6fe	coreutils@9.4-3ubuntu6	9.4-3ubuntu6.3	1
quay.io/argoproj/argocd :v3.1.1	a36ab0c0860c	coreutils@9.4-3ubuntu6	9.4-3ubuntu6.3	1
quay.io/argoproj/argocd :v2.8.6	acaf37352569	coreutils@8.32-4.1ubuntu1	8.32-4.1ubuntu1.4	1
quay.io/argoprojlabs/gitops-promoter :v0.40.1	daf2e7650d61	coreutils@9.7-3	no fix listed	1
quay.io/backube/volsync :0.16.0	0d03a6aad575	coreutils@8.32-40.el9	0:8.32-41.el9_8	1