CVE-2025-5278

Medium

Advisory

Published 27 May 2025In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 4.4; base score, highest
EPSS: 0.003; 22nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,554; of 17,821 indexed, latest versions
Container images: 2,613; deployed by those charts
Fix available: 3 of 3; affected packages

Red Hat Security Advisory: coreutils security update

Carried by container images the latest versions of 2,554 of 17,821 indexed charts deploy, on 2,613 images.

Affected package	Affected versions	Fixed in	Images
coreutilsdeb	8.21-1ubuntu5, 8.21-1ubuntu5.1, 8.21-1ubuntu5.4, 8.25-2ubuntu2+17 more	8.32-4.1ubuntu1.4, 9.4-3ubuntu6.3, 9.7-3ubuntu2.1	2,440
coreutilsrpm	8.29-lp151.3.3, 8.29-lp152.4.7, 8.32-32.el9, 8.32-34.el9+7 more	0:8.32-41.el9_8, 0:9.5-8.el10_2, 8.32-150400.9.9.1, 9.4-7+1 more	155
coreutils-fromdeb	9.5-1ubuntu2+0.0.0~ubuntu24, 9.5-1ubuntu2+0.0.0~ubuntu25	9.7-3ubuntu2.1	77

OSV records: DEBIAN-CVE-2025-5278 RHSA-2026:28911 RHSA-2026:33124 RLSA-2026:28911 UBUNTU-CVE-2025-5278 AZL-93060 openSUSE-SU-2025:15327-1 SUSE-SU-2025:02362-1
Also known as: USN-8697-1

Charts affected

2,554 by stars

Chart

Latest

Affected images

Radar Score

changedetection-iozekker6

1.102.0

1 of 1 See more

changedetection-io zekker6 1.102.0

1 of the 1 container images this version deploys carry CVE-2025-5278.

Container image	Digest	Package	Fixed in
ghcr.io/dgtlmoon/changedetection.io :0.60.7	096dae27b5d6	coreutils@9.1-1	no fix listed

Open the chart page →

2,710

NEW_APPzekker6

0.0.0

1 of 1 See more

NEW_APP zekker6 0.0.0

1 of the 1 container images this version deploys carry CVE-2025-5278.

Container image	Digest	Package	Fixed in
library/nginx :latest	abe47724e466	coreutils@9.7-3	no fix listed

Open the chart page →

1,593

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2025-5278.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	coreutils@8.28-1ubuntu1	no fix listed
yandex/clickhouse-server :21.3.20	4eccfffb01d7	coreutils@8.30-3ubuntu2	no fix listed

Open the chart page →

9,297

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2025-5278.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	coreutils@8.32-4.1ubuntu1.3	8.32-4.1ubuntu1.4

Open the chart page →

7,966

Container images carrying it

2,613 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
dellcloud/pages :monitor	6ba7b22caacd	coreutils@8.30-3ubuntu2	no fix listed	79
flyway/flyway :6.4.4	22d97ceb0c47	coreutils@8.28-1ubuntu1	no fix listed	79
library/nginx :1.31 :1.31.5 :latest :trixie	05b8cb60c354	coreutils@9.7-3	no fix listed	72
library/postgres :18 :18.6 :18.6-trixie :latest	4ef4dbc939d6	coreutils@9.7-3	no fix listed	48
library/nginx :1.31 :latest	abe47724e466	coreutils@9.7-3	no fix listed	33
library/redis :8.10.1 :latest	298e5b3bc566	coreutils@9.7-3	no fix listed	29
library/nginx :stable	d5792f71a949	coreutils@9.7-3	no fix listed	20
library/postgres :18 :18.6 :18.6-trixie :latest	86c951e05bf5	coreutils@9.7-3	no fix listed	19
jenkins/jenkins :2.568.3-jdk21 :2.568.3-lts-jdk21 :lts	c1e4c349365f	coreutils@9.7-3	no fix listed	17
codeurjc/toposervice :v1.0 :v1.23	9fb4c11e6a49	coreutils@8.28-1ubuntu1	no fix listed	13
bitnamilegacy/postgresql :17.6.0-debian-12-r4	926356130b77	coreutils@9.1-1	no fix listed	11
library/redis :8.10.1 :latest	8a1efc5f4795	coreutils@9.7-3	no fix listed	11
oomk8s/readiness-check :2.0.2	875814cc853d	coreutils@8.25-2ubuntu3~16.04	no fix listed	11
library/mongo :5.0.6-focal	8e70544b6c76	coreutils@8.30-3ubuntu2	no fix listed	10
library/rabbitmq :3.9-management	8a279e9396a8	coreutils@8.32-4.1ubuntu1.1	8.32-4.1ubuntu1.4	10
minio/minio :latest :RELEASE.2025-09-07T16-13-09Z	14cea493d9a3	coreutils@8.32-39.el9	0:8.32-41.el9_8	9
library/kong :3.6	a42d2b4503e7	coreutils@8.32-4.1ubuntu1.2	8.32-4.1ubuntu1.4	8
library/mongo :8 :8.3.8 :latest	5211c51171f5	coreutils@9.4-3ubuntu6.2	9.4-3ubuntu6.3	8
library/rabbitmq :3.13-management :3-management	e582c0bc7766	coreutils@9.4-3ubuntu6.1	9.4-3ubuntu6.3	8
valkey/valkey :9.1.2 :latest	c123e3715db6	coreutils@9.7-3	no fix listed	8
library/mariadb :12.3.3 :latest :lts	dd9b303aed4f	coreutils@9.4-3ubuntu6.2	9.4-3ubuntu6.3	7
library/postgres :16	f1c3376c26f2	coreutils@9.7-3	no fix listed	7
library/postgres :17	f4c66b820c6f	coreutils@9.7-3	no fix listed	7
ghcr.io/paperless-ngx/paperless-ngx :3.1.3	aa810a36942c	coreutils@9.7-3	no fix listed	7
public.ecr.aws/aktosecurity/confluentinc-cp-kafka :8.2.2 :8.2.2-1-ubi9	8e01c0305844	coreutils@8.32-40.el9	0:8.32-41.el9_8	7
quay.io/minio/minio :RELEASE.2024-12-18T13-15-44Z	1dce27c494a1	coreutils@8.32-36.el9	0:8.32-41.el9_8	7
bitnamilegacy/postgresql :17.5.0 :latest	42a8200d3597	coreutils@9.1-1	no fix listed	6
bitnamilegacy/rabbitmq :4.1.3 :4.1.3-debian-12-r1	9e635efba431	coreutils@9.1-1	no fix listed	6
bitnamilegacy/redis :8.2.1-debian-12-r0	25bf63f3caf7	coreutils@9.1-1	no fix listed	6
jellyfin/jellyfin :10.11 :10.11.11 :latest	aefb67e6a7ff	coreutils@9.7-3	no fix listed	6
library/postgres :18.4	a02db8cac496	coreutils@9.7-3	no fix listed	6
oomk8s/readiness-check :2.0.0	7daa08b81954	coreutils@8.25-2ubuntu3~16.04	no fix listed	6
ghcr.io/appscode/b3 :v2026.9.11	76d28575b71c	coreutils@9.1-1	no fix listed	6
quay.io/devtron/devtron-utils :dup-chart-repo-v1.1.0	95d6f0e05636	coreutils@9.1-1	no fix listed	6
quay.io/devtron/postgres :14.9	1b594392f7cb	coreutils@9.1-1	no fix listed	6
quay.io/minio/mc :RELEASE.2024-11-21T17-21-54Z	993e8c454a7e	coreutils@8.32-36.el9	0:8.32-41.el9_8	6
bitnamilegacy/kubectl :1.29.2	c74b703deed2	coreutils@9.1-1	no fix listed	5
flaresolverr/flaresolverr :latest :v3.5.0	139dfee1c6f8	coreutils@9.1-1	no fix listed	5
library/mariadb :13.0.2 :latest	d4fdec0510ad	coreutils-from@9.5-1ubuntu2+0.0.0~ubuntu25	9.7-3ubuntu2.1	5
library/mongo :4.4	4be76f674fc4	coreutils@8.30-3ubuntu2	no fix listed	5
library/phpmyadmin :5.2.3-apache :latest	3a8a8d6b5289	coreutils@9.7-3	no fix listed	5
library/postgres :12	2f2a8c2a7d10	coreutils@9.1-1	no fix listed	5
library/postgres :16	a3b7f434b2dc	coreutils@9.7-3	no fix listed	5
library/ubuntu :latest	2260313b31c8	coreutils@9.7-3ubuntu2 coreutils-from@9.5-1ubuntu2+0.0.0~ubuntu25	9.7-3ubuntu2.1 9.7-3ubuntu2.1	5
solsson/kafka :latest	41e5d8f6f290	coreutils@8.30-3ubuntu2	no fix listed	5
valkey/valkey :9.1.1 :9.1.1-trixie	64e361b630ec	coreutils@9.7-3	no fix listed	5
vaultwarden/server :1.37.2 :latest	094b5689ed81	coreutils@9.7-3	no fix listed	5
artifacthub/postgres :latest	4fd34fa635cc	coreutils@9.7-3	no fix listed	4
bitnamilegacy/mariadb :12.0.2-debian-12-r0	888cdaae3cb9	coreutils@9.1-1	no fix listed	4
bitnamilegacy/mysql :9.4.0-debian-12-r1	ec13e229247a	coreutils@9.1-1	no fix listed	4