StackRadar

CVE-2025-58181

Medium

Advisory

Published 19 Nov 2025In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.006
45th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,054
of 17,790 indexed, latest versions
Container images
2,352
deployed by those charts
Fix available
1 of 1
affected package

golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption

Carried by container images the latest versions of 2,054 of 17,790 indexed charts deploy, on 2,352 images.

Affected packageAffected versionsFixed inImages
golang.org/x/cryptogolangv0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+146 more0.45.02,352
OSV records
GHSA-j5w8-q4qc-rx2x
Also known as
GO-2025-4134

Charts affected

2,054 by stars
ChartLatestAffected imagesRadar Score
rawfile-csiymatrixVerified publisher0.2.12 of 4See more

rawfile-csi ymatrix 0.2.1

2 of the 4 container images this version deploys carry CVE-2025-58181.

Container imageDigestPackageFixed in
matrixdb/custom-external-provisioner:4622a07d7-202204247e9ffe249a51
golang.org/x/crypto@v0.0.0-20210817164053-32db794688a5
0.45.0
matrixdb/rawfile-csi:v0.2.195b2e38e913d
golang.org/x/crypto@v0.0.0-20210817164053-32db794688a5
0.45.0

Open the chart page →

7,998
version-checkerymrs0.2.31 of 1See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2025-58181.

Container imageDigestPackageFixed in
quay.io/jetstack/version-checker:v0.2.15f6f8ba0b671
golang.org/x/crypto@v0.0.0-20200622213623-75b288015ac9
0.45.0

Open the chart page →

3,024
zahori-consulzahoriVerified publisher1.0.12 of 2See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2025-58181.

Container imageDigestPackageFixed in
hashicorp/consul:1.15.3ddff34041c5c
golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d
0.45.0
hashicorp/consul-k8s-control-plane:1.1.262bed1bf8106
golang.org/x/crypto@v0.0.0-20201002170205-7f63de1d35b0
0.45.0

Open the chart page →

5,047
zahori-moonzahoriVerified publisher1.0.11 of 3See more

zahori-moon zahori 1.0.1

1 of the 3 container images this version deploys carry CVE-2025-58181.

Container imageDigestPackageFixed in
quay.io/aerokube/moon-ui:2.0.589990b146824
golang.org/x/crypto@v0.10.0
0.45.0

Open the chart page →

2,907

Container images carrying it

2,352 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
bitnamilegacy/minio:2024.7.4-debian-12-r0952f86d1116c
golang.org/x/crypto@v0.23.0
0.45.0
1
bitnamilegacy/minio:2025.3.12-debian-12-r0ba9f3b4b0b00
golang.org/x/crypto@v0.36.0
0.45.0
1
bitnamilegacy/minio:2024.12.18-debian-12-r1c0ede65eb88e
golang.org/x/crypto@v0.27.0
0.45.0
1
bitnamilegacy/minio:2024.12.18-debian-12-r0cce234b4381a
golang.org/x/crypto@v0.27.0
0.45.0
1
bitnamilegacy/minio:2025.4.22-debian-12-r1d7cd0e172c4c
golang.org/x/crypto@v0.37.0
0.45.0
1
bitnamilegacy/mongodb:7.0.14-debian-12-r321e8f8baa432
golang.org/x/crypto@v0.25.0
0.45.0
1
bitnamilegacy/mongodb:8.0.13-debian-12-r02579e968033e
golang.org/x/crypto@v0.38.0
0.45.0
1
bitnamilegacy/mongodb:7.0.8-debian-12-r23163c3842bfd
golang.org/x/crypto@v0.14.0
0.45.0
1
bitnamilegacy/mongodb:5.0.103bb1deeaf9d0
golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d
0.45.0
1
bitnamilegacy/mongodb:7.0.5-debian-11-r66fe59ed5d79f
golang.org/x/crypto@v0.14.0
0.45.0
1
bitnamilegacy/mongodb:latestb0652af9c8d0
golang.org/x/crypto@v0.38.0
0.45.0
1
bitnamilegacy/mongodb:4.4.5e3c9d6b4bc92
golang.org/x/crypto@v0.0.0-20190530122614-20be4c3c3ed5
0.45.0
1
bitnamilegacy/mongodb-exporter:0.39.0-debian-11-r106de7256c7adcd
golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d
0.45.0
1
bitnamilegacy/mysqld-exporter:0.14.0-debian-11-r10304768b637c94
golang.org/x/crypto@v0.0.0-20210616213533-5ff15b29337e
0.45.0
1
bitnamilegacy/mysqld-exporter:0.15.1-debian-12-r2611a5f0b79e79
golang.org/x/crypto@v0.14.0
0.45.0
1
bitnamilegacy/mysqld-exporter:0.13.0a7e14cc919cb
golang.org/x/crypto@v0.0.0-20201208171446-5f87f3452ae9
0.45.0
1
bitnamilegacy/nats:2.11.8-debian-12-r0fa0cfba6034a
golang.org/x/crypto@v0.41.0
0.45.0
1
bitnamilegacy/postgres-exporter:0.17.1-debian-12-r20cca9d93a617
golang.org/x/crypto@v0.32.0
0.45.0
1
bitnamilegacy/postgres-exporter:0.15.0-debian-12-r44e7e1b3a90682
golang.org/x/crypto@v0.14.0
0.45.0
1
bitnamilegacy/prometheus:2.54.1-debian-12-r408b1b7cb6a5b
golang.org/x/crypto@v0.25.0
0.45.0
1
bitnamilegacy/rabbitmq-cluster-operator:1.14.0-scratch-r567ac64a9623a
golang.org/x/crypto@v0.0.0-20220214200702-86341886e292
0.45.0
1
bitnamilegacy/rmq-messaging-topology-operator:1.7.1-scratch-r33c26208691a1
golang.org/x/crypto@v0.0.0-20220525230936-793ad666bf5e
0.45.0
1
bitnamilegacy/seaweedfs:3.87.0-debian-12-r10cb31d0fc356
golang.org/x/crypto@v0.37.0
0.45.0
1
bitnamilegacy/thanos:0.37.1-debian-12-r05bf82b98c82c
golang.org/x/crypto@v0.28.0
0.45.0
1
bitnami/mongodb:8.0.8b3bd5b6be9a0
golang.org/x/crypto@v0.35.0
0.45.0
1
bitnami/sealed-secrets-controller:v0.18.50516f987fae2
golang.org/x/crypto@v0.0.0-20220829220503-c86fa9a7ed90
0.45.0
1
bitnami/sealed-secrets-controller:0.31.0-debian-12-r074eaff41382b
golang.org/x/crypto@v0.41.0
0.45.0
1
blipai/deckard:0.0.28737d5d19a312
golang.org/x/crypto@v0.17.0
0.45.0
1
bloxstaking/ssv-node:v2.2.0bf6d7d2fdc93
golang.org/x/crypto@v0.32.0
0.45.0
1
breton/cool:dev41b1bb483aa2
golang.org/x/crypto@v0.0.0-20220622213112-05595931fe9d
0.45.0
1
bsgrigorov/helm-operator:latest45ab095f09c8
golang.org/x/crypto@v0.0.0-20201012173705-84dcc777aaee
0.45.0
1
buddyspencer/gickup:0.10.386b656f19b0c1
golang.org/x/crypto@v0.36.0
0.45.0
1
buddyspencer/gickup:0.10.309e7dbf923c12
golang.org/x/crypto@v0.22.0
0.45.0
1
buildkite/agent:3.25.0aec38cfaae0e
golang.org/x/crypto@v0.0.0-20200302210943-78000ba7a073
0.45.0
1
bulich/domain-exporter:latest6d0b780f7c7b
golang.org/x/crypto@v0.9.0
0.45.0
1
burningalchemist/sql_exporter:0.16.0b8e4757c7def
golang.org/x/crypto@v0.28.0
0.45.0
1
bytesafe/bytesafe-ce:v1.0.4ee287384c005
golang.org/x/crypto@v0.9.0
0.45.0
1
caarlos0/domain_exporter:v1.23.0d11dec138900
golang.org/x/crypto@v0.18.0
0.45.0
1
calico/cni:v3.28.0cef0c907b8f4
golang.org/x/crypto@v0.22.0
0.45.0
1
calico/cni:v3.28.1e486870cfde8
golang.org/x/crypto@v0.22.0
0.45.0
1
calico/kube-controllers:v3.28.08f04e4772a2b
golang.org/x/crypto@v0.22.0
0.45.0
1
calico/kube-controllers:v3.28.1eadb3a25109a
golang.org/x/crypto@v0.22.0
0.45.0
1
calico/node:v3.28.0385bf6391fea
golang.org/x/crypto@v0.22.0
0.45.0
1
calico/node:v3.28.1d8c644a8a3ee
golang.org/x/crypto@v0.22.0
0.45.0
1
camptocamp/bucket-cloner:latestacfafc308d88
golang.org/x/crypto@v0.0.0-20210421170649-83a5a9bb288b
0.45.0
1
caroga/commentoplusplus:v1.8.7f3233882b3bd
golang.org/x/crypto@v0.0.0-20210220033148-5ea612d1eb83
0.45.0
1
casbin/casdoor:v1.224.066f836ef778b
golang.org/x/crypto@v0.0.0-20220214200702-86341886e292
0.45.0
1
casbin/casdoor:v1.753.0770ad9ec3190
golang.org/x/crypto@v0.21.0
0.45.0
1
cbeneke/hcloud-fip-controller:v0.4.1dc658078d7ba
golang.org/x/crypto@v0.0.0-20200220183623-bac4c82f6975
0.45.0
1
censedata/floating-server:v1.6.3ebfffb9dd4c0
golang.org/x/crypto@v0.38.0
0.45.0
1

syft 1.42.1 · advisories as of 16 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.