StackRadar

CVE-2025-58058

Medium

Advisory

Published 28 Aug 2025In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.004
35th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
146
of 17,781 indexed, latest versions
Container images
127
deployed by those charts
Fix available
1 of 1
affected package

github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives

Carried by container images the latest versions of 146 of 17,781 indexed charts deploy, on 127 images.

Affected packageAffected versionsFixed inImages
github.com/ulikunitz/xzgolangv0.5.5, v0.5.6, v0.5.7, v0.5.8+5 more0.5.15127
OSV records
GHSA-jc7w-c686-c4v9
Also known as
GO-2025-3922

Charts affected

146 by stars
ChartLatestAffected imagesRadar Score
vcluster-pro-k8sloftVerified publisher0.0.0-ci-run.101 of 4See more

vcluster-pro-k8s loft 0.0.0-ci-run.10

1 of the 4 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
github.com/ulikunitz/xz@v0.5.9
0.5.15

Open the chart page →

8,202
m9sweeperm9sweeperVerified publisher1.6.01 of 6See more

m9sweeper m9sweeper 1.6.0

1 of the 6 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
ghcr.io/m9sweeper/trawler:1.6.0df917c5a7e54
github.com/ulikunitz/xz@v0.5.11
0.5.15

Open the chart page →

9,774
magistralamagistrala-devopsVerified publisher0.16.21 of 42See more

magistrala magistrala-devops 0.16.2

1 of the 42 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
natsio/nats-box:0.14.31cc420186664
github.com/ulikunitz/xz@v0.5.11
0.5.15

Open the chart page →

24,400
mattermost-team-editionmattermost-team-edition6.6.831 of 4See more

mattermost-team-edition mattermost-team-edition 6.6.83

1 of the 4 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
mattermost/mattermost-team-edition:10.11.2b8bd1246cb3a
github.com/ulikunitz/xz@v0.5.12
0.5.15

Open the chart page →

4,089
mayastormayastorVerified publisher2.12.11 of 31See more

mayastor mayastor 2.12.1

1 of the 31 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
grafana/alloy:v1.8.17790f6f7fbd8
github.com/ulikunitz/xz@v0.5.12
0.5.15

Open the chart page →

21,064
registry-syncermesosphere0.1.01 of 1See more

registry-syncer mesosphere 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
regclient/regsync:v0.8.33d8d8e40afb7
github.com/ulikunitz/xz@v0.5.12
0.5.15

Open the chart page →

370
clickhousemyaVerified publisher0.2403.11 of 1See more

clickhouse mya 0.2403.1

1 of the 1 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:24.2ed9640bfff07
github.com/ulikunitz/xz@v0.5.10
0.5.15

Open the chart page →

3,558
cognativemyaVerified publisher0.2403.31 of 3See more

cognative mya 0.2403.3

1 of the 3 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
clickhouse/clickhouse-server:24.2ed9640bfff07
github.com/ulikunitz/xz@v0.5.10
0.5.15

Open the chart page →

7,309
giteamyaVerified publisher23.12.51 of 1See more

gitea mya 23.12.5

1 of the 1 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
gitea/gitea:1.21.6ac73e0da341f
github.com/ulikunitz/xz@v0.5.11
0.5.15

Open the chart page →

3,430
cosmoshub-rpcnodeifyVerified publisher1.0.71 of 2See more

cosmoshub-rpc nodeify 1.0.7

1 of the 2 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
ghcr.io/cosmos/gaia:v25.1.0f115777d1112
github.com/ulikunitz/xz@v0.5.11
0.5.15

Open the chart page →

2,006
cosmos-nodenodeifyVerified publisher2.6.01 of 2See more

cosmos-node nodeify 2.6.0

1 of the 2 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
ghcr.io/cosmos/gaia:v25.1.0f115777d1112
github.com/ulikunitz/xz@v0.5.11
0.5.15

Open the chart page →

2,006
vault-helm-chartnotesprojectchart0.1.01 of 1See more

vault-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
library/vault:1.13.3f98ac9dd97b0
github.com/ulikunitz/xz@v0.5.10
0.5.15

Open the chart page →

2,246
giteanovum-rgi-charts2.1.31 of 3See more

gitea novum-rgi-charts 2.1.3

1 of the 3 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
gitea/gitea:1.13.0d5ab14cd29af
github.com/ulikunitz/xz@v0.5.6
0.5.15

Open the chart page →

4,861
nutanix-flow-cninutanix-helm-releasesVerified publisher1.1.01 of 7See more

nutanix-flow-cni nutanix-helm-releases 1.1.0

1 of the 7 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
natsio/nats-box:0.14.1a67913df95f1
github.com/ulikunitz/xz@v0.5.11
0.5.15

Open the chart page →

4,988
anchore-engineopencloudcx1.13.01 of 2See more

anchore-engine opencloudcx 1.13.0

1 of the 2 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
anchore/anchore-engine:v0.10.0bde9eedf639d
github.com/ulikunitz/xz@v0.5.8
0.5.15

Open the chart page →

18,023
harikubeopenshift0.16.31 of 3See more

harikube openshift 0.16.3

1 of the 3 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
github.com/ulikunitz/xz@v0.5.14
0.5.15

Open the chart page →

2,525
kb-cloud-installeropenshift2.1.351 of 1See more

kb-cloud-installer openshift 2.1.35

1 of the 1 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
apecloud/kb-cloud-installer:v2.1.42-certified98abc64aa985
github.com/ulikunitz/xz@v0.5.12
0.5.15

Open the chart page →

4,127
mattermost-team-editionopenshift6.6.831 of 4See more

mattermost-team-edition openshift 6.6.83

1 of the 4 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
mattermost/mattermost-team-edition:10.11.2b8bd1246cb3a
github.com/ulikunitz/xz@v0.5.12
0.5.15

Open the chart page →

4,089
redhat-trusted-application-pipelineopenshift1.0.21 of 2See more

redhat-trusted-application-pipeline openshift 1.0.2

1 of the 2 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
github.com/ulikunitz/xz@v0.5.8
0.5.15

Open the chart page →

8,599
pet-battle-infrapetbattle1.0.321 of 2See more

pet-battle-infra petbattle 1.0.32

1 of the 2 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:4.8bb5e052770e5
github.com/ulikunitz/xz@v0.5.9
0.5.15

Open the chart page →

15,466
pet-battle-tournamentpetbattle1.0.401 of 3See more

pet-battle-tournament petbattle 1.0.40

1 of the 3 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
quay.io/openshift/origin-cli:4.8bb5e052770e5
github.com/ulikunitz/xz@v0.5.9
0.5.15

Open the chart page →

15,466
pixie-operator-chartpixie0.1.71 of 3See more

pixie-operator-chart pixie 0.1.7

1 of the 3 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
quay.io/operator-framework/olmdigest-pinned1b6002156f56
github.com/ulikunitz/xz@v0.5.11
0.5.15

Open the chart page →

1,899
rancher-auto-registerrancher-auto-registerVerified publisher0.1.01 of 1See more

rancher-auto-register rancher-auto-register 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
github.com/ulikunitz/xz@v0.5.12
0.5.15

Open the chart page →

1,837
sonatype-nexusredhat-cop1.1.131 of 2See more

sonatype-nexus redhat-cop 1.1.13

1 of the 2 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
quay.io/openshift/origin-jenkins-agent-base:latestc241c971aef8
github.com/ulikunitz/xz@v0.5.11
0.5.15

Open the chart page →

16,047
stackrox-chartredhat-cop0.0.101 of 1See more

stackrox-chart redhat-cop 0.0.10

1 of the 1 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
github.com/ulikunitz/xz@v0.5.9
0.5.15

Open the chart page →

29,227
fleet-vendoredrock8sVerified publisher6.5.11 of 1See more

fleet-vendored rock8s 6.5.1

1 of the 1 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
fleetdm/fleet:v4.66.012e644b7f40e
github.com/ulikunitz/xz@v0.5.12
0.5.15

Open the chart page →

1,581
argocdromholdings1.8.11 of 3See more

argocd romholdings 1.8.1

1 of the 3 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
argoproj/argocd:v1.8.1830e86cacefd
github.com/ulikunitz/xz@v0.5.5
0.5.15

Open the chart page →

10,466
clairromholdings0.1.141 of 2See more

clair romholdings 0.1.14

1 of the 2 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
quay.io/devtron/clair:4.3.675fb847ac045
github.com/ulikunitz/xz@v0.5.8
0.5.15

Open the chart page →

6,237
devtron-enterpriseromholdings48.0.02 of 28See more

devtron-enterprise romholdings 48.0.0

2 of the 28 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/ulikunitz/xz@v0.5.11
0.5.15
quay.io/devtron/nats-box:latest48cdd3054b20
github.com/ulikunitz/xz@v0.5.8
0.5.15

Open the chart page →

68,240
hermitcrabseal-ioVerified publisher0.1.41 of 2See more

hermitcrab seal-io 0.1.4

1 of the 2 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
sealio/terraform-deployer:v1.5.7-seal.1b0389d9848a5
github.com/ulikunitz/xz@v0.5.10
0.5.15

Open the chart page →

4,881
semaphoresemaphore-light1.0.01 of 1See more

semaphore semaphore-light 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
semaphoreui/semaphore:latest3996804607eb
github.com/ulikunitz/xz@v0.5.10
0.5.15

Open the chart page →

1,674
serviceexampleserviceexample0.1.01 of 5See more

serviceexample serviceexample 0.1.0

1 of the 5 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
natsio/nats-box:0.13.559cf2e949181
github.com/ulikunitz/xz@v0.5.11
0.5.15

Open the chart page →

5,449
service-exampleservice-example-10.1.01 of 7See more

service-example service-example-1 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
natsio/nats-box:0.13.3c507bd7e3831
github.com/ulikunitz/xz@v0.5.11
0.5.15

Open the chart page →

9,022
keycloak-configuratorsikalabs0.2.01 of 1See more

keycloak-configurator sikalabs 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
hashicorp/terraform:1.44dcb45513699
github.com/ulikunitz/xz@v0.5.10
0.5.15

Open the chart page →

2,863
olmsikalabs0.3.01 of 2See more

olm sikalabs 0.3.0

1 of the 2 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
quay.io/operator-framework/olmdigest-pinned40d0363f4aa6
github.com/ulikunitz/xz@v0.5.11
0.5.15

Open the chart page →

1,146
keydbsinextraVerified publisher0.31.01 of 1See more

keydb sinextra 0.31.0

1 of the 1 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
ghcr.io/sergelogvinov/keydb:6.3.376a19ddc3626
github.com/ulikunitz/xz@v0.5.8
0.5.15

Open the chart page →

2,165
harborsoftonic1.13.01 of 8See more

harbor softonic 1.13.0

1 of the 8 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
github.com/ulikunitz/xz@v0.5.10
0.5.15

Open the chart page →

7,672
trivy-operatorsoftonic0.18.01 of 1See more

trivy-operator softonic 0.18.0

1 of the 1 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
ghcr.io/aquasecurity/trivy-operator:0.16.0a608b798fda5
github.com/ulikunitz/xz@v0.5.10
0.5.15

Open the chart page →

2,505
prestashopstack-prestahop22.0.01 of 4See more

prestashop stack-prestahop 22.0.0

1 of the 4 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.23.086e8449ff8ff
github.com/ulikunitz/xz@v0.5.9
0.5.15

Open the chart page →

3,073
allurestakaterVerified publisher1.0.11 of 1See more

allure stakater 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
quay.io/eformat/jenkins-agent-graalvm:latesta3b9a07648b6
github.com/ulikunitz/xz@v0.5.9
0.5.15

Open the chart page →

28,165
vaultstakaterVerified publisher0.8.41 of 2See more

vault stakater 0.8.4

1 of the 2 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
hashicorp/vault:1.8.4dfc3500beb0e
github.com/ulikunitz/xz@v0.5.7
0.5.15

Open the chart page →

5,864
synadia-serversynadiaVerified publisher1.1.101 of 2See more

synadia-server synadia 1.1.10

1 of the 2 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
natsio/nats-box:0.14.1a67913df95f1
github.com/ulikunitz/xz@v0.5.11
0.5.15

Open the chart page →

1,970
harbor-scanner-trivytrivy-operator0.31.21 of 1See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.31.26e790e233872
github.com/ulikunitz/xz@v0.5.11
0.5.15

Open the chart page →

2,477
twenty-crmvictorlane0.0.11 of 3See more

twenty-crm victorlane 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
twentycrm/twenty-postgres-spilo:latest2f78405a78be
github.com/ulikunitz/xz@v0.5.8
0.5.15

Open the chart page →

13,459
filebrowserwenerme1.0.01 of 1See more

filebrowser wenerme 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
filebrowser/filebrowser:v2.13.0c5d0a75a0041
github.com/ulikunitz/xz@v0.5.6
0.5.15

Open the chart page →

3,174
wexa-studiowexa-studio1.2.01 of 15See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2025-58058.

Container imageDigestPackageFixed in
hashicorp/vault:1.15.40b01ed3924e6
github.com/ulikunitz/xz@v0.5.10
0.5.15

Open the chart page →

14,983

Container images carrying it

127 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/m9sweeper/trawler:1.6.0df917c5a7e54
github.com/ulikunitz/xz@v0.5.11
0.5.15
1
ghcr.io/manzil-infinity180/deploydefender:ea3ab0bb646cdbeddd1aca483ecf650f9ac0d0847fbc6855c8b3
github.com/ulikunitz/xz@v0.5.11
0.5.15
1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.2035bc5ca66d55a
github.com/ulikunitz/xz@v0.5.14
0.5.15
1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.55d7f93d2182fe
github.com/ulikunitz/xz@v0.5.12
0.5.15
1
ghcr.io/openclarity/grype-server:v0.6.079412399f301
github.com/ulikunitz/xz@v0.5.10
0.5.15
1
ghcr.io/openclarity/kubeclarity:v2.23.314450f52a708
github.com/ulikunitz/xz@v0.5.10
0.5.15
1
ghcr.io/opnpulse/perses:v2026.4.24b880da90aa1a
github.com/ulikunitz/xz@v0.5.12
0.5.15
1
ghcr.io/pipe-cd/pipecd:v0.39.00fae829caf29
github.com/ulikunitz/xz@v0.5.6
0.5.15
1
ghcr.io/runatlantis/atlantis:v0.47.1511231955463
github.com/ulikunitz/xz@v0.5.10
0.5.15
1
ghcr.io/sergelogvinov/keydb:6.3.376a19ddc3626
github.com/ulikunitz/xz@v0.5.8
0.5.15
1
ghcr.io/sergelogvinov/mongodb:8.0.101eee8e20a87f
github.com/ulikunitz/xz@v0.5.11
0.5.15
1
ghcr.io/turbot/guardrails-agent-kubernetes:0.3.09d01bf9c9224
github.com/ulikunitz/xz@v0.5.12
0.5.15
1
public.ecr.aws/n8h5y2v5/rad-security/rad-sbom:v1.1.34e97e0e7a2088
github.com/ulikunitz/xz@v0.5.12
0.5.15
1
quay.io/cloudnativetoolkit/cli-tools:v1.1-v1.8.2d6fd2a9e3273
github.com/ulikunitz/xz@v0.5.10
0.5.15
1
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
github.com/ulikunitz/xz@v0.5.10
0.5.15
1
quay.io/eformat/jenkins-agent-graalvm:latesta3b9a07648b6
github.com/ulikunitz/xz@v0.5.9
0.5.15
1
quay.io/go-skynet/local-ai:latestd78cd113b2bc
github.com/ulikunitz/xz@v0.5.14
0.5.15
1
quay.io/harikube/vcluster-pro:0.32.1b741efae8d31
github.com/ulikunitz/xz@v0.5.14
0.5.15
1
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
github.com/ulikunitz/xz@v0.5.8
0.5.15
1
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
github.com/ulikunitz/xz@v0.5.10
0.5.15
1
quay.io/openshift/origin-jenkins-agent-base:latestc241c971aef8
github.com/ulikunitz/xz@v0.5.11
0.5.15
1
quay.io/operator-framework/olm1b6002156f56
github.com/ulikunitz/xz@v0.5.11
0.5.15
1
quay.io/operator-framework/olm40d0363f4aa6
github.com/ulikunitz/xz@v0.5.11
0.5.15
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
github.com/ulikunitz/xz@v0.5.8
0.5.15
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
github.com/ulikunitz/xz@v0.5.9
0.5.15
1
quay.io/skopeo/stable:v1.134853591bd1d2
github.com/ulikunitz/xz@v0.5.11
0.5.15
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
github.com/ulikunitz/xz@v0.5.12
0.5.15
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.