StackRadar

CVE-2025-52881

High

Advisory

Published 5 Nov 2025In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
427
of 17,781 indexed, latest versions
Container images
344
deployed by those charts
Fix available
9 of 10
affected packages

Red Hat Security Advisory: container-tools:rhel8 security update

Carried by container images the latest versions of 427 of 17,781 indexed charts deploy, on 344 images.

Affected packageAffected versionsFixed inImages
containers-commonrpm2:1-64.module+el8.8.0+18571+eed59fc42:1-82.module+el8.10.0+23820+ae6deecc1
criurpm3.15-4.module+el8.8.0+19044+f9982fd80:3.18-5.module+el8.10.0+23820+ae6deecc1
fuse-overlayfsrpm1.11-1.module+el8.8.0+18634+9a2682920:1.13-1.module+el8.10.0+23820+ae6deecc1
libslirprpm4.4.0-1.module+el8.8.0+18060+3f21f2cc0:4.4.0-2.module+el8.10.0+23820+ae6deecc1
runcrpm1:1.1.4-1.module+el8.8.0+18060+3f21f2cc4:1.2.9-2.module+el8.10.0+23820+ae6deecc1
skopeorpm2:1.11.2-0.2.module+el8.8.0+18251+ad5b274c2:1.14.5-5.module+el8.10.0+23820+ae6deecc1
slirp4netnsrpm1.2.0-2.module+el8.8.0+18060+3f21f2cc0:1.2.3-1.module+el8.10.0+23820+ae6deecc1
runcdeb1.1.5+ds1-1+deb12u1no fix listed9
github.com/opencontainers/runcgolangv0.0.0-20161107232042-8779fa57eb4a, v0.0.0-20230719051532-82f18fe0e44a, v0.1.1, v1.0.0-rc2.0.20190611121236-6cc515888830+33 more1.2.8277
github.com/opencontainers/selinuxgolangv1.3.3, v1.8.0, v1.8.2, v1.10.0+5 more1.13.0122
OSV records
DEBIAN-CVE-2025-52881GHSA-cgrx-mc8f-2prmRHSA-2025:23543
Also known as
GO-2025-4098

Charts affected

427 by stars
ChartLatestAffected imagesRadar Score
ingress-nginx-external-lbsuminhong1.0.01 of 2See more

ingress-nginx-external-lb suminhong 1.0.0

1 of the 2 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.10.042b3f0e5d084
github.com/opencontainers/runc@v1.1.12
1.2.8

Open the chart page →

2,094
freeradiussvtech-public-helm-charts0.1.51 of 4See more

freeradius svtech-public-helm-charts 0.1.5

1 of the 4 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
library/mysql:8.2.0212fe73edca5
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

12,655
ingress-nginxsvtech-public-helm-charts1.0.01 of 1See more

ingress-nginx svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.9.45b161f051d01
github.com/opencontainers/runc@v1.1.9
1.2.8

Open the chart page →

1,480
maxscalesvtech-public-helm-charts1.0.01 of 2See more

maxscale svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
library/mysql:8.2.0212fe73edca5
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

5,841
explorersynapse0.2.162 of 6See more

explorer synapse 0.2.16

2 of the 6 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
yandex/clickhouse-server:latest1cbf75aabe1e
github.com/opencontainers/runc@v1.0.1
1.2.8
ghcr.io/synapsecns/sanguine/explorer:latest00131e3d1eaf
github.com/opencontainers/runc@v1.1.5
1.2.8

Open the chart page →

8,518
taalhuizen-servicetaalhuizen-service1.0.01 of 3See more

taalhuizen-service taalhuizen-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/taalhuizen-service-php:latest04f1b7f0d573
github.com/opencontainers/runc@v0.1.1
1.2.8

Open the chart page →

7,480
act-runnertektonops0.1.21 of 2See more

act-runner tektonops 0.1.2

1 of the 2 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
library/docker:23.0.6-dindafa5d5134900
github.com/opencontainers/runc@v1.1.7
1.2.8

Open the chart page →

4,212
tensor_apptensor-app0.2.21 of 3See more

tensor_app tensor-app 0.2.2

1 of the 3 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

17,461
vehicle-dashboardtest-vehi-dash0.1.01 of 7See more

vehicle-dashboard test-vehi-dash 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
library/mongo:5.0.217c81758cb295
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

20,270
thanhvt27-lab-k8sthanh-vtVerified publisher0.1.41 of 5See more

thanhvt27-lab-k8s thanh-vt 0.1.4

1 of the 5 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
pysga1996/redis:latest3af6d0c7db19
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

4,661
steamcmdthetredevVerified publisher1.0.91 of 1See more

steamcmd thetredev 1.0.9

1 of the 1 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
ghcr.io/thetredev/steamcmd:srcds-20240309dbb0f042cb31
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

1,075
harbor-scanner-trivytrivy-operator0.31.21 of 1See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.31.26e790e233872
github.com/opencontainers/selinux@v1.11.0
1.13.0

Open the chart page →

2,477
trouw-servicetrouw-service1.0.01 of 3See more

trouw-service trouw-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/trouw-service-php:latestf745e2870692
github.com/opencontainers/runc@v0.1.1
1.2.8

Open the chart page →

7,510
tfy-inferentia-operatortruefoundryVerified publisher0.2.81 of 3See more

tfy-inferentia-operator truefoundry 0.2.8

1 of the 3 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
public.ecr.aws/eks-distro/kubernetes/kube-scheduler:v1.29.14-eks-1-29-lateste7e1db003e6a
github.com/opencontainers/selinux@v1.11.0
1.13.0

Open the chart page →

2,902
phonebook-chartusuladams2Verified publisher0.2.11 of 3See more

phonebook-chart usuladams2 0.2.1

1 of the 3 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

3,176
devportalveecode-platform-nextVerified publisher0.1.211 of 1See more

devportal veecode-platform-next 0.1.21

1 of the 1 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinnedc443520aebf7
github.com/opencontainers/selinux@v1.12.0
1.13.0

Open the chart page →

1,787
verhuis-serviceverhuis-service1.0.01 of 3See more

verhuis-service verhuis-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/verhuis-service-php:latest66bbaf95a123
github.com/opencontainers/runc@v0.1.1
1.2.8

Open the chart page →

7,510
verzoekconversieserviceverzoekconversieservice1.0.01 of 3See more

verzoekconversieservice verzoekconversieservice 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/verzoekconversieservice-php:lateste918014fb8d3
github.com/opencontainers/runc@v0.1.1
1.2.8

Open the chart page →

7,528
verzoekregistratiecomponentverzoekregistratiecomponent1.1.01 of 4See more

verzoekregistratiecomponent verzoekregistratiecomponent 1.1.0

1 of the 4 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/verzoekregistratiecomponent-php:latestc4f6c03af5d3
github.com/opencontainers/runc@v0.1.1
1.2.8

Open the chart page →

7,429
verzoektypecatalogusverzoektypecatalogus1.1.01 of 4See more

verzoektypecatalogus verzoektypecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/verzoektypecatalogus-php:latest64f5eb7a398b
github.com/opencontainers/runc@v0.1.1
1.2.8

Open the chart page →

7,429
wallarm-ingress-rcwallarmVerified publisher4.8.41 of 2See more

wallarm-ingress-rc wallarm 4.8.4

1 of the 2 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
wallarm/ingress-controller:4.8.0-1a591b9c91570
github.com/opencontainers/runc@v1.1.7
1.2.8

Open the chart page →

2,635
webresourcecataloguswebresourcecatalogus1.1.01 of 4See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/webresourcecatalogus-php:latest8f1bbd5cda85
github.com/opencontainers/runc@v0.1.1
1.2.8

Open the chart page →

7,552
ceph-csi-cephfswikimedia0.1.81 of 5See more

ceph-csi-cephfs wikimedia 0.1.8

1 of the 5 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.7.2f7f8228f17cc
github.com/opencontainers/selinux@v1.10.0
1.13.0

Open the chart page →

10,285
ceph-csi-rbdwikimedia0.1.131 of 6See more

ceph-csi-rbd wikimedia 0.1.13

1 of the 6 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.7.2f7f8228f17cc
github.com/opencontainers/selinux@v1.10.0
1.13.0

Open the chart page →

11,784
jaegerwikimedia3.1.21 of 4See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
jaegertracing/jaeger-cassandra-schema:1.53.0d48d6dab2c65
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

9,248
opentelemetry-collectorwikimedia0.62.71 of 1See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
github.com/opencontainers/runc@v1.1.5
github.com/opencontainers/selinux@v1.10.0
1.2.8
1.13.0

Open the chart page →

2,022
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
quay.io/prometheus/node-exporter:v1.8.24032c6d5bfd7
github.com/opencontainers/selinux@v1.11.0
1.13.0

Open the chart page →

9,381

Container images carrying it

344 by charts deploying them

A fixed version is listed for 9 of the 10 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/openshift/origin-cli:4.8bb5e052770e5
github.com/opencontainers/runc@v1.0.0-rc91
1.2.8
2
registry.k8s.io/ingress-nginx/controller:v1.9.45b161f051d01
github.com/opencontainers/runc@v1.1.9
1.2.8
2
registry.k8s.io/ingress-nginx/controller:v1.9.5b3aba22b1da8
github.com/opencontainers/runc@v1.1.10
1.2.8
2
registry.k8s.io/ingress-nginx/controller:v1.12.1d2fbc4ec70d8
github.com/opencontainers/runc@v1.2.6
1.2.8
2
registry.k8s.io/kube-apiserver:v1.26.199e1ed9fbc8a
github.com/opencontainers/selinux@v1.10.0
1.13.0
2
registry.k8s.io/kube-controller-manager:v1.26.140adecbe3a40
github.com/opencontainers/selinux@v1.10.0
1.13.0
2
registry.k8s.io/kube-scheduler:v1.30.1474a5cf9cfa9f
github.com/opencontainers/selinux@v1.11.0
1.13.0
2
alpine/k8s:1.22.600ac10bcb759
github.com/opencontainers/runc@v1.0.2
1.2.8
1
alpine/k8s:1.18.16a41efe02a041
github.com/opencontainers/runc@v0.1.1
1.2.8
1
amazon/aws-otel-collector:v0.27.0d8ab0eef5074
github.com/opencontainers/runc@v1.1.4
github.com/opencontainers/selinux@v1.10.0
1.2.8
1.13.0
1
amazon/cloudwatch-agent:1.300032.2b36173b79b02f03a
github.com/opencontainers/runc@v1.1.5
github.com/opencontainers/selinux@v1.10.1
1.2.8
1.13.0
1
amazon/cloudwatch-agent:1.247350.0b251780e745d1783c93
github.com/opencontainers/runc@v1.0.0-rc10
github.com/opencontainers/selinux@v1.3.3
1.2.8
1.13.0
1
amd64/mysql:5.7e20a653e0f51
github.com/opencontainers/runc@v1.1.0
1.2.8
1
anchore/anchore-engine:v0.10.0bde9eedf639d
github.com/opencontainers/runc@v1.0.0-rc92
github.com/opencontainers/selinux@v1.8.0
1.2.8
1.13.0
1
ankane/pgvector:v0.5.1d3a9d8ac27bb
github.com/opencontainers/runc@v1.1.0
1.2.8
1
anonaddy/anonaddy:0.12.3957a95565166
github.com/opencontainers/runc@v1.1.3
1.2.8
1
apache/camel-k:1.10.43bb13d14f64a
github.com/opencontainers/runc@v1.0.2
1.2.8
1
apecloud/gemini-scheduler:0.1.15832d1a9097a
github.com/opencontainers/selinux@v1.11.0
1.13.0
1
apecloud/kubeblocks-csi-driver:0.1.3c93655ccb2d7
github.com/opencontainers/selinux@v1.8.2
1.13.0
1
aquasec/harbor-scanner-trivy:0.31.26e790e233872
github.com/opencontainers/selinux@v1.11.0
1.13.0
1
aquasec/trivy:0.43.1944a04445179
github.com/opencontainers/runc@v1.1.5
github.com/opencontainers/selinux@v1.11.0
1.2.8
1.13.0
1
aquasec/trivy:0.32.0973d0df16189
github.com/opencontainers/runc@v1.1.3
github.com/opencontainers/selinux@v1.10.1
1.2.8
1.13.0
1
artifacthub/scanner:v1.19.0323d026e78c3
github.com/opencontainers/selinux@v1.11.0
1.13.0
1
artifacthub/tracker:v1.19.06596c8c4d955
github.com/opencontainers/runc@v1.1.12
1.2.8
1
assistiot/authorization_db:latestc3adbab6a3e7
github.com/opencontainers/runc@v1.1.0
1.2.8
1
assistiot/cybersecurity-monitoring_id-wzh:latest0aacefac9677
github.com/opencontainers/runc@v0.0.0-20161107232042-8779fa57eb4a
1.2.8
1
assistiot/cybersecurity-monitoring_ir-cas:latest6a107f224c34
github.com/opencontainers/runc@v1.1.0
1.2.8
1
assistiot/identity-manager_db:latest0d3e6d35f168
github.com/opencontainers/runc@v1.1.0
1.2.8
1
bitnamilegacy/kafka:3.4.0-debian-11-r6ac64829e45b3
github.com/opencontainers/runc@v1.1.0
1.2.8
1
bitnamilegacy/kafka:2.8.1-debian-11-r7b6e381ffd6ae
github.com/opencontainers/runc@v1.0.1
1.2.8
1
bitnamilegacy/keycloak:20.0.5cb04e49e6eb1
github.com/opencontainers/runc@v1.1.0
1.2.8
1
bitnamilegacy/mariadb:10.6.12-debian-11-r1315edb5643b73
github.com/opencontainers/runc@v1.1.0
1.2.8
1
bitnamilegacy/mariadb:10.6.12-debian-11-r1678847062532a
github.com/opencontainers/runc@v1.1.0
1.2.8
1
bitnamilegacy/mariadb-galera:10.6.12-debian-11-r1643a70df0e7c6
github.com/opencontainers/runc@v1.1.0
1.2.8
1
bitnamilegacy/minio:2022.12.12-debian-11-r90f7c8ac484ac
github.com/opencontainers/runc@v1.1.0
1.2.8
1
bitnamilegacy/mongodb:5.0.103bb1deeaf9d0
github.com/opencontainers/runc@v1.0.1
1.2.8
1
bitnamilegacy/postgresql:15.2.0-debian-11-r113e65a6b89e38
github.com/opencontainers/runc@v1.1.0
1.2.8
1
bitnamilegacy/rabbitmq:3.10.88f7161d8ce19
github.com/opencontainers/runc@v1.0.1
1.2.8
1
bitnamilegacy/rabbitmq:3.10.7-debian-11-r4cf93e2772250
github.com/opencontainers/runc@v1.0.1
1.2.8
1
bitnamilegacy/redis:7.0.10-debian-11-r059293f5206b7
github.com/opencontainers/runc@v1.1.0
1.2.8
1
bitnamilegacy/redis:6.2.7-debian-11-r37788b908dd0d
github.com/opencontainers/runc@v1.0.1
1.2.8
1
bitnamilegacy/redis:7.0.8-debian-11-r0bf01d031ba8c
github.com/opencontainers/runc@v1.1.0
1.2.8
1
bitnamilegacy/zookeeper:3.8.1-debian-11-r6dba59d740e13
github.com/opencontainers/runc@v1.1.0
1.2.8
1
breton/cool:dev41b1bb483aa2
github.com/opencontainers/selinux@v1.10.0
1.13.0
1
btcpayserver/tor:0.4.8.10e9585b68dc6b
github.com/opencontainers/runc@v1.0.0-rc95
1.2.8
1
conduction/agendaservice-php:latest9cfeeb6c7c20
github.com/opencontainers/runc@v0.1.1
1.2.8
1
conduction/balance-registration-php:devc36094a41369
github.com/opencontainers/runc@v0.1.1
1.2.8
1
conduction/betaalservice-php:latestece1ab544c57
github.com/opencontainers/runc@v0.1.1
1.2.8
1
conduction/cgrc-php:dev25415534d245
github.com/opencontainers/runc@v0.1.1
1.2.8
1
conduction/checkin-component-php:dev3423845692c1
github.com/opencontainers/runc@v0.1.1
1.2.8
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.