StackRadar

CVE-2025-52881

High

Advisory

Published 5 Nov 2025In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
427
of 17,781 indexed, latest versions
Container images
344
deployed by those charts
Fix available
9 of 10
affected packages

Red Hat Security Advisory: container-tools:rhel8 security update

Carried by container images the latest versions of 427 of 17,781 indexed charts deploy, on 344 images.

Affected packageAffected versionsFixed inImages
containers-commonrpm2:1-64.module+el8.8.0+18571+eed59fc42:1-82.module+el8.10.0+23820+ae6deecc1
criurpm3.15-4.module+el8.8.0+19044+f9982fd80:3.18-5.module+el8.10.0+23820+ae6deecc1
fuse-overlayfsrpm1.11-1.module+el8.8.0+18634+9a2682920:1.13-1.module+el8.10.0+23820+ae6deecc1
libslirprpm4.4.0-1.module+el8.8.0+18060+3f21f2cc0:4.4.0-2.module+el8.10.0+23820+ae6deecc1
runcrpm1:1.1.4-1.module+el8.8.0+18060+3f21f2cc4:1.2.9-2.module+el8.10.0+23820+ae6deecc1
skopeorpm2:1.11.2-0.2.module+el8.8.0+18251+ad5b274c2:1.14.5-5.module+el8.10.0+23820+ae6deecc1
slirp4netnsrpm1.2.0-2.module+el8.8.0+18060+3f21f2cc0:1.2.3-1.module+el8.10.0+23820+ae6deecc1
runcdeb1.1.5+ds1-1+deb12u1no fix listed9
github.com/opencontainers/runcgolangv0.0.0-20161107232042-8779fa57eb4a, v0.0.0-20230719051532-82f18fe0e44a, v0.1.1, v1.0.0-rc2.0.20190611121236-6cc515888830+33 more1.2.8277
github.com/opencontainers/selinuxgolangv1.3.3, v1.8.0, v1.8.2, v1.10.0+5 more1.13.0122
OSV records
DEBIAN-CVE-2025-52881GHSA-cgrx-mc8f-2prmRHSA-2025:23543
Also known as
GO-2025-4098

Charts affected

427 by stars
ChartLatestAffected imagesRadar Score
ingress-nginx-external-lbsuminhong1.0.01 of 2See more

ingress-nginx-external-lb suminhong 1.0.0

1 of the 2 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.10.042b3f0e5d084
github.com/opencontainers/runc@v1.1.12
1.2.8

Open the chart page →

2,094
freeradiussvtech-public-helm-charts0.1.51 of 4See more

freeradius svtech-public-helm-charts 0.1.5

1 of the 4 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
library/mysql:8.2.0212fe73edca5
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

12,655
ingress-nginxsvtech-public-helm-charts1.0.01 of 1See more

ingress-nginx svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
registry.k8s.io/ingress-nginx/controller:v1.9.45b161f051d01
github.com/opencontainers/runc@v1.1.9
1.2.8

Open the chart page →

1,480
maxscalesvtech-public-helm-charts1.0.01 of 2See more

maxscale svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
library/mysql:8.2.0212fe73edca5
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

5,841
explorersynapse0.2.162 of 6See more

explorer synapse 0.2.16

2 of the 6 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
yandex/clickhouse-server:latest1cbf75aabe1e
github.com/opencontainers/runc@v1.0.1
1.2.8
ghcr.io/synapsecns/sanguine/explorer:latest00131e3d1eaf
github.com/opencontainers/runc@v1.1.5
1.2.8

Open the chart page →

8,518
taalhuizen-servicetaalhuizen-service1.0.01 of 3See more

taalhuizen-service taalhuizen-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/taalhuizen-service-php:latest04f1b7f0d573
github.com/opencontainers/runc@v0.1.1
1.2.8

Open the chart page →

7,480
act-runnertektonops0.1.21 of 2See more

act-runner tektonops 0.1.2

1 of the 2 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
library/docker:23.0.6-dindafa5d5134900
github.com/opencontainers/runc@v1.1.7
1.2.8

Open the chart page →

4,212
tensor_apptensor-app0.2.21 of 3See more

tensor_app tensor-app 0.2.2

1 of the 3 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

17,461
vehicle-dashboardtest-vehi-dash0.1.01 of 7See more

vehicle-dashboard test-vehi-dash 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
library/mongo:5.0.217c81758cb295
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

20,270
thanhvt27-lab-k8sthanh-vtVerified publisher0.1.41 of 5See more

thanhvt27-lab-k8s thanh-vt 0.1.4

1 of the 5 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
pysga1996/redis:latest3af6d0c7db19
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

4,661
steamcmdthetredevVerified publisher1.0.91 of 1See more

steamcmd thetredev 1.0.9

1 of the 1 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
ghcr.io/thetredev/steamcmd:srcds-20240309dbb0f042cb31
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

1,075
harbor-scanner-trivytrivy-operator0.31.21 of 1See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.31.26e790e233872
github.com/opencontainers/selinux@v1.11.0
1.13.0

Open the chart page →

2,477
trouw-servicetrouw-service1.0.01 of 3See more

trouw-service trouw-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/trouw-service-php:latestf745e2870692
github.com/opencontainers/runc@v0.1.1
1.2.8

Open the chart page →

7,510
tfy-inferentia-operatortruefoundryVerified publisher0.2.81 of 3See more

tfy-inferentia-operator truefoundry 0.2.8

1 of the 3 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
public.ecr.aws/eks-distro/kubernetes/kube-scheduler:v1.29.14-eks-1-29-lateste7e1db003e6a
github.com/opencontainers/selinux@v1.11.0
1.13.0

Open the chart page →

2,902
phonebook-chartusuladams2Verified publisher0.2.11 of 3See more

phonebook-chart usuladams2 0.2.1

1 of the 3 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
library/mysql:5.74bc6bc963e6d
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

3,176
devportalveecode-platform-nextVerified publisher0.1.211 of 1See more

devportal veecode-platform-next 0.1.21

1 of the 1 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinnedc443520aebf7
github.com/opencontainers/selinux@v1.12.0
1.13.0

Open the chart page →

1,787
verhuis-serviceverhuis-service1.0.01 of 3See more

verhuis-service verhuis-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/verhuis-service-php:latest66bbaf95a123
github.com/opencontainers/runc@v0.1.1
1.2.8

Open the chart page →

7,510
verzoekconversieserviceverzoekconversieservice1.0.01 of 3See more

verzoekconversieservice verzoekconversieservice 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/verzoekconversieservice-php:lateste918014fb8d3
github.com/opencontainers/runc@v0.1.1
1.2.8

Open the chart page →

7,528
verzoekregistratiecomponentverzoekregistratiecomponent1.1.01 of 4See more

verzoekregistratiecomponent verzoekregistratiecomponent 1.1.0

1 of the 4 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/verzoekregistratiecomponent-php:latestc4f6c03af5d3
github.com/opencontainers/runc@v0.1.1
1.2.8

Open the chart page →

7,429
verzoektypecatalogusverzoektypecatalogus1.1.01 of 4See more

verzoektypecatalogus verzoektypecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/verzoektypecatalogus-php:latest64f5eb7a398b
github.com/opencontainers/runc@v0.1.1
1.2.8

Open the chart page →

7,429
wallarm-ingress-rcwallarmVerified publisher4.8.41 of 2See more

wallarm-ingress-rc wallarm 4.8.4

1 of the 2 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
wallarm/ingress-controller:4.8.0-1a591b9c91570
github.com/opencontainers/runc@v1.1.7
1.2.8

Open the chart page →

2,635
webresourcecataloguswebresourcecatalogus1.1.01 of 4See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/webresourcecatalogus-php:latest8f1bbd5cda85
github.com/opencontainers/runc@v0.1.1
1.2.8

Open the chart page →

7,552
ceph-csi-cephfswikimedia0.1.81 of 5See more

ceph-csi-cephfs wikimedia 0.1.8

1 of the 5 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.7.2f7f8228f17cc
github.com/opencontainers/selinux@v1.10.0
1.13.0

Open the chart page →

10,285
ceph-csi-rbdwikimedia0.1.131 of 6See more

ceph-csi-rbd wikimedia 0.1.13

1 of the 6 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.7.2f7f8228f17cc
github.com/opencontainers/selinux@v1.10.0
1.13.0

Open the chart page →

11,784
jaegerwikimedia3.1.21 of 4See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
jaegertracing/jaeger-cassandra-schema:1.53.0d48d6dab2c65
github.com/opencontainers/runc@v1.1.0
1.2.8

Open the chart page →

9,248
opentelemetry-collectorwikimedia0.62.71 of 1See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
github.com/opencontainers/runc@v1.1.5
github.com/opencontainers/selinux@v1.10.0
1.2.8
1.13.0

Open the chart page →

2,022
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2025-52881.

Container imageDigestPackageFixed in
quay.io/prometheus/node-exporter:v1.8.24032c6d5bfd7
github.com/opencontainers/selinux@v1.11.0
1.13.0

Open the chart page →

9,381

Container images carrying it

344 by charts deploying them

A fixed version is listed for 9 of the 10 affected packages.

Container imageDigestPackageFixed inUsed by
otel/opentelemetry-collector-contrib:0.83.071fcef33ae71
github.com/opencontainers/runc@v1.1.5
github.com/opencontainers/selinux@v1.10.0
1.2.8
1.13.0
1
otel/opentelemetry-collector-contrib:0.108.0923eb1cfae32
github.com/opencontainers/runc@v1.1.13
github.com/opencontainers/selinux@v1.10.0
1.2.8
1.13.0
1
otel/opentelemetry-collector-contrib:0.89.0995f17004231
github.com/opencontainers/runc@v1.1.9
github.com/opencontainers/selinux@v1.10.0
1.2.8
1.13.0
1
otel/opentelemetry-collector-contrib:0.46.0ba173aa85f3f
github.com/opencontainers/runc@v1.1.0
github.com/opencontainers/selinux@v1.10.0
1.2.8
1.13.0
1
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
github.com/opencontainers/runc@v1.1.5
github.com/opencontainers/selinux@v1.10.0
1.2.8
1.13.0
1
otel/opentelemetry-collector-contrib:0.63.1dfb3a55ea8c9
github.com/opencontainers/runc@v1.1.3
github.com/opencontainers/selinux@v1.10.0
1.2.8
1.13.0
1
photoprism/photoprism:220629-jammy2954334adbda
github.com/opencontainers/runc@v1.1.2
1.2.8
1
pnnlmiscscripts/gitlab-runner-operator:0.1.3-1155131891741
github.com/opencontainers/runc@v0.1.1
1.2.8
1
portainer/portainer-ce:2.18.4-alpine3e61aaee1341
github.com/opencontainers/runc@v1.1.5
1.2.8
1
postgis/postgis:11-2.5f479f6c3435e
github.com/opencontainers/runc@v1.0.1
1.2.8
1
prom/node-exporter:v1.6.0d2e48098c364
github.com/opencontainers/selinux@v1.11.0
1.13.0
1
pysga1996/redis:latest3af6d0c7db19
github.com/opencontainers/runc@v1.1.0
1.2.8
1
rancher/k3s:v1.28.2-k3s18c2599ecfca8
github.com/opencontainers/runc@v0.0.0-20230719051532-82f18fe0e44a
github.com/opencontainers/selinux@v1.10.1
1.2.8
1.13.0
1
rancher/k3s:v1.25.3-k3s1eaa270df79cc
github.com/opencontainers/runc@v1.1.2
github.com/opencontainers/selinux@v1.10.0
1.2.8
1.13.0
1
redislabs/redisearch:2.4.1433561794c5c8
github.com/opencontainers/runc@v1.0.1
1.2.8
1
rezachalak/bzen-mongo:1.0.034f694325191
github.com/opencontainers/runc@v1.1.0
1.2.8
1
robjuz/postgresql-nominatim:latest805c7bab76df
github.com/opencontainers/runc@v1.0.0-rc95
1.2.8
1
sstarcher/helm-exporter:0.5.011769d01ba35
github.com/opencontainers/runc@v0.1.1
1.2.8
1
thmmniii/fbs-runner:v1.27.186105349c1a3
github.com/opencontainers/runc@v1.1.5
github.com/opencontainers/selinux@v1.11.0
1.2.8
1.13.0
1
veecode/devportalc443520aebf7
github.com/opencontainers/selinux@v1.12.0
1.13.0
1
wallarm/ingress-controller:5.3.10.1a1fecfdf987e
github.com/opencontainers/runc@v1.2.2
1.2.8
1
wallarm/ingress-controller:4.8.0-1a591b9c91570
github.com/opencontainers/runc@v1.1.7
1.2.8
1
yandex/clickhouse-server:latest1cbf75aabe1e
github.com/opencontainers/runc@v1.0.1
1.2.8
1
ygqygq2/mysql-exec-sql:latest54f30def1558
github.com/opencontainers/runc@v1.1.0
1.2.8
1
gcr.io/cadvisor/cadvisor:v0.40.0135327c978de
github.com/opencontainers/runc@v1.0.0-rc95
github.com/opencontainers/selinux@v1.8.0
1.2.8
1.13.0
1
gcr.io/cadvisor/cadvisor:v0.47.2e6c562b5e983
github.com/opencontainers/runc@v1.1.9
github.com/opencontainers/selinux@v1.10.0
1.2.8
1.13.0
1
gcr.io/cadvisor/cadvisor:v0.52.1f40e65878e25
github.com/opencontainers/runc@v1.2.5
1.2.8
1
gcr.io/kaniko-project/executor:latest4e7a52dd1f14
github.com/opencontainers/selinux@v1.12.0
1.13.0
1
gcr.io/knative-releases/knative.dev/serving/cmd/controller30ce73388ae5
github.com/opencontainers/runc@v0.1.1
1.2.8
1
gcr.io/knative-releases/knative.dev/serving/cmd/controllerb2cd45b8a8a4
github.com/opencontainers/runc@v0.1.1
1.2.8
1
gcr.io/ml-pipeline/mysql:5.7-debiandf28187b5455
github.com/opencontainers/runc@v1.0.1
1.2.8
1
ghcr.io/arpa-network/node-client:latest657a2c9f6e6d
github.com/opencontainers/runc@v1.1.12
github.com/opencontainers/selinux@v1.11.0
1.2.8
1.13.0
1
ghcr.io/beluga-cloud/helm-dashboard/dashboard:1.3.39ab9a675c405
github.com/opencontainers/runc@v1.1.5
github.com/opencontainers/selinux@v1.11.0
1.2.8
1.13.0
1
ghcr.io/caninehq/canine:latesta058034ca006
github.com/opencontainers/selinux@v1.12.0
1.13.0
1
ghcr.io/chaos-mesh/chaos-daemon:v2.7.29608d9b51452
github.com/opencontainers/runc@v1.1.12
github.com/opencontainers/selinux@v1.11.0
1.2.8
1.13.0
1
ghcr.io/chaos-mesh/chaos-daemon:v2.5.1cf78fdf7403a
github.com/opencontainers/runc@v1.1.2
github.com/opencontainers/selinux@v1.10.1
1.2.8
1.13.0
1
ghcr.io/chaos-mesh/chaos-daemon:v2.8.0fb609bc264d9
github.com/opencontainers/selinux@v1.11.1
1.13.0
1
ghcr.io/chaos-mesh/chaos-dashboard:v2.7.211cdbbc479b3
github.com/opencontainers/runc@v1.1.12
github.com/opencontainers/selinux@v1.11.0
1.2.8
1.13.0
1
ghcr.io/chaos-mesh/chaos-dashboard:v2.5.1448cb346b12c
github.com/opencontainers/runc@v1.1.2
github.com/opencontainers/selinux@v1.10.1
1.2.8
1.13.0
1
ghcr.io/chaos-mesh/chaos-dashboard:v2.8.0e7f9e8f1d565
github.com/opencontainers/selinux@v1.11.1
1.13.0
1
ghcr.io/chaos-mesh/chaos-mesh:v2.8.0091b906a0b13
github.com/opencontainers/selinux@v1.11.1
1.13.0
1
ghcr.io/chaos-mesh/chaos-mesh:v2.5.1700bb42ac21d
github.com/opencontainers/runc@v1.1.2
github.com/opencontainers/selinux@v1.10.1
1.2.8
1.13.0
1
ghcr.io/chaos-mesh/chaos-mesh:v2.7.28bc853c7414c
github.com/opencontainers/runc@v1.1.12
github.com/opencontainers/selinux@v1.11.0
1.2.8
1.13.0
1
ghcr.io/chatwoot/pgvector:14.4.0-debian-11-r0f759f1510d09
github.com/opencontainers/runc@v1.0.1
1.2.8
1
ghcr.io/cloudnative-pg/postgresql:14.5b3b30d04b362
github.com/opencontainers/runc@v1.0.1
1.2.8
1
ghcr.io/conductionnl/adresservice-php:latestc5075f0320cd
github.com/opencontainers/runc@v0.1.1
1.2.8
1
ghcr.io/conductionnl/authorization-component-php:latest94a749392fcf
github.com/opencontainers/runc@v0.1.1
1.2.8
1
ghcr.io/conductionnl/berichtservice-php:latestee6a21e66ff0
github.com/opencontainers/runc@v0.1.1
1.2.8
1
ghcr.io/conductionnl/brpservice-php:latestc17f1ba17d36
github.com/opencontainers/runc@v0.1.1
1.2.8
1
ghcr.io/conductionnl/contactcatalogus-php:latesteeb625bd660c
github.com/opencontainers/runc@v0.1.1
1.2.8
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.